The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-114697: QuarkA QA Analytics: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuarkA QA…7.1 HighN/AN/AOct 24, 2026
CVE-2026-114178: Bold Grid W3 Total Cache: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Grid W3…7.1 HighN/AN/AOct 24, 2026
CVE-2026-114190: Hai Zheng / Lite Speed Cache LiteSpeed Cache: Insertion of Sensitive Information Into Sent Data vulnerability in Hai Zheng / Lite Speed Cache LiteSpeed Cache…5.9 MediumN/AN/AOct 24, 2026
CVE-2026-112866: WPFactory Product Filter by WBW: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product…9.3 CriticalN/AN/AOct 24, 2026
CVE-2026-94075: Tribulant Software Newsletters: Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object…9.8 CriticalN/AN/AOct 24, 2026
CVE-2026-112869: Noah Hearle We’re Open!: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Hearle We’re…7.1 HighN/AN/AOct 24, 2026
CVE-2026-111402: Tribulant Software Newsletters: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant…9.3 CriticalN/AN/AOct 24, 2026
CVE-2026-112844: Arraytics WP Event Solution: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics WP…7.1 HighN/AN/AOct 24, 2026
CVE-2026-114179: wordplus BP Better Messages: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordplus BP…7.1 HighN/AN/AOct 24, 2026
CVE-2026-115975: CervantesSec cervantes: Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or…7.1 HighN/AN/AOct 24, 2026
CVE-2026-115803: n/a Scada-LTS: A flaw has been found in Scada-LTS 2.8.04.3 Medium2.1 LowN/AOct 24, 2026
CVE-2026-115802: InternScience InternAgent: A weakness has been identified in InternScience InternAgent 1.5.04.3 Medium2.1 LowN/AOct 24, 2026
CVE-2026-108013: HCL Software BigFix Platform: BigFix Platform uses Mozilla CA certificate bundle (PEM)6.8 MediumN/AN/AOct 24, 2026
CVE-2026-97353: Unknown News Kit Addons For Elementor: The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before…N/AN/AN/AOct 24, 2026
CVE-2026-97352: Unknown News Kit Addons For Elementor: The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check on one of its AJAX…N/AN/AN/AOct 24, 2026
CVE-2026-87835: Unknown Front End Users: The Front End Users WordPress plugin through 3.2.35 does not restrict which account attributes a visitor may set when…N/AN/AN/AOct 24, 2026
CVE-2026-114429: Unknown WPVR: The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before…N/AN/AN/AOct 24, 2026
CVE-2026-113674: Unknown GeoDirectory: The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by…N/AN/AN/AOct 24, 2026
CVE-2026-113673: Unknown GeoDirectory: The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it…N/AN/AN/AOct 24, 2026
CVE-2026-113493: Unknown GeoDirectory: The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes…N/AN/AN/AOct 24, 2026
CVE-2026-113492: Unknown GeoDirectory: The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading…N/AN/AN/AOct 24, 2026
CVE-2026-113491: Unknown GeoDirectory: The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local…N/AN/AN/AOct 24, 2026
CVE-2026-113490: Unknown GeoDirectory: The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a…N/AN/AN/AOct 24, 2026
CVE-2026-113489: Unknown GeoDirectory: The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing…N/AN/AN/AOct 24, 2026
CVE-2026-112207: Unknown Download Monitor: The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site…N/AN/AN/AOct 24, 2026
26-50 of 413119
‹›