The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-128037: gittuf: In gittuf 0.10.0 through 0.15.0, when a minimum threshold global rule and a policy rule protect the same namespace,…6.5 MediumN/AN/ANov 13, 2026
CVE-2026-128036: gittuf: In gittuf 0.4.0 through 0.16.0, when a policy update appears within the range of reference state log entries being…2.3 LowN/AN/ANov 13, 2026
CVE-2026-128035: gittuf: In gittuf 0.10.0 through 0.17.0, the verification workflow does not load policy updates that are propagated from an…5.5 MediumN/AN/ANov 13, 2026
CVE-2026-128034: gittuf: In gittuf before 0.18.0, verification of file protection rules uses the quoted, escaped pathnames that Git prints by…5.5 MediumN/AN/ANov 13, 2026
CVE-2026-109091: X.Org: A buffer overflow in handling EDID Display-Range descriptors in X.Org xwayland before 24.1.15 and X Server before…7.8 HighN/AN/ANov 13, 2026
CVE-2026-129094: universal-tool-calling-protocol @utcp/http: @utcp/http before 1.1.14 contains a server-side request forgery vulnerability that allows remote manuals to reach…4.7 Medium2.3 LowN/ANov 13, 2026
CVE-2026-63079: RBH Access Technologies Integra32 Security Management System: RBH Access Technologies Integra32 Security Management System 5.1.11 R5.0 contains an unauthenticated deserialization…9.8 Critical9.3 CriticalN/ANov 13, 2026
CVE-2026-111545: Dell: Dell PowerStore contains a SQL Injection vulnerability8.8 HighN/AN/ANov 13, 2026
CVE-2026-129092: CCC-Attestation attested-tls-poc: CCC Attestation SIG attested-tls-poc through commit 731ca82 contains a time-of-check time-of-use vulnerability because…5.7 Medium7.0 HighN/ANov 13, 2026
CVE-2026-125432: RelyWP reCAPTCHA for WooCommerce: Weak Password Recovery Mechanism for Forgotten Password vulnerability in RelyWP reCAPTCHA for WooCommerce recaptcha-woo…5.3 MediumN/AN/ANov 13, 2026
CVE-2026-119517: VillaTheme Catna – Woo Name Your Price and Offers: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Catna…7.1 HighN/AN/ANov 13, 2026
CVE-2026-124415: Alejandro Alex Reservations: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alejandro Alex…9.3 CriticalN/AN/ANov 13, 2026
CVE-2026-124410: wpLingua Translation Service Translate and boost SEO – Automatic AI translation – wpLingua: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpLingua…7.1 HighN/AN/ANov 13, 2026
CVE-2026-124965: rtCamp Inc.: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rtCamp Inc6.5 MediumN/AN/ANov 13, 2026
CVE-2026-124265: Tribulant Software Newsletters: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant…8.5 HighN/AN/ANov 13, 2026
CVE-2026-124414: VideoWhisper.com Broadcast Live Video: Weak Authentication vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration…5.3 MediumN/AN/ANov 13, 2026
CVE-2026-124418: Ahmad WP Job Portal: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ahmad WP Job…6.5 MediumN/AN/ANov 13, 2026
CVE-2026-124267: Noor Alam Gmail SMTP: Missing Authorization vulnerability in Noor Alam Gmail SMTP gmail-smtp allows Exploiting Incorrectly Configured Access…7.5 HighN/AN/ANov 13, 2026
CVE-2026-124272: Dimitri Grassi Salon booking system: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dimitri Grassi…7.1 HighN/AN/ANov 13, 2026
CVE-2026-121776: WP Chill Passster: Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured…6.5 MediumN/AN/ANov 13, 2026
CVE-2026-124260: Jacob N. Breetvelt WP Photo Album Plus: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacob N7.1 HighN/AN/ANov 13, 2026
CVE-2026-124420: Themeisle Woody ad snippets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Woody…7.1 HighN/AN/ANov 13, 2026
CVE-2026-119512: Tribulant Software Newsletters: Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object…8.8 HighN/AN/ANov 13, 2026
CVE-2026-125783: madalin.ungureanu Custom Post Types and Custom Fields creator – WCK: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in madalin.ungureanu…7.1 HighN/AN/ANov 13, 2026
CVE-2026-120835: VillaTheme AFFI – Affiliate Marketing for WooCommerce: Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce…8.8 HighN/AN/ANov 13, 2026
26-50 of 532044