Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-125449: Mamunur Rashid Testimonial Slider: Deserialization of Untrusted Data vulnerability in Mamunur Rashid Testimonial Slider testimonial-slider-and-showcase…8.8 HighN/AN/ANov 15, 2026
CVE-2026-125443: Denishua WPJAM Basic: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Denishua WPJAM…7.1 HighN/AN/ANov 15, 2026
CVE-2026-124995: Michal Jaworski: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michal Jaworski…7.1 HighN/AN/ANov 15, 2026
CVE-2026-124755: Justin Kruit Advanced Custom Fields: Font Awesome Field: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Kruit…6.5 MediumN/AN/ANov 15, 2026
CVE-2026-124270: Basix NEX-Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms…7.1 HighN/AN/ANov 15, 2026
CVE-2026-124259: Franky Events Made Easy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Franky Events…7.1 HighN/AN/ANov 15, 2026
CVE-2026-124254: Exactly WWW LLC EWWW Image Optimizer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Exactly WWW LLC…7.1 HighN/AN/ANov 15, 2026
CVE-2026-122662: Barn2 Plugins Document Library Pro: Deserialization of Untrusted Data vulnerability in Barn2 Plugins Document Library Pro document-library-pro allows…9.8 CriticalN/AN/ANov 15, 2026
CVE-2026-129469: xiaochong0302 course-tencent-cloud: Course-tencent-cloud before 2.0.2 contains an insecure direct object reference vulnerability that allows…5.3 Medium6.9 MediumN/ANov 15, 2026
CVE-2026-129468: netcccyun dnsmgr: Netcccyun dnsmgr 2.18 before 2.22 contains a missing authorization vulnerability in POST…4.3 Medium5.3 MediumN/ANov 15, 2026
CVE-2026-129467: tess1o GeoPulse: GeoPulse 1.5.0 through 2.3.0 contains an insecure direct object reference vulnerability in GET…4.3 Medium5.3 MediumN/ANov 15, 2026
CVE-2026-129452: DrayTek Vigor2960: A vulnerability has been found in DrayTek Vigor2960 1.5.1.69.1 Critical8.5 HighN/ANov 15, 2026
CVE-2026-129451: DrayTek Vigor2960: A flaw has been found in DrayTek Vigor2960 up to 1.5.1.69.9 Critical8.6 HighN/ANov 15, 2026
CVE-2026-129450: DrayTek Vigor2960: A vulnerability was detected in DrayTek Vigor2960 1.5.1.69.9 Critical8.6 HighN/ANov 15, 2026
CVE-2026-129449: DrayTek Vigor2960: A security vulnerability has been detected in DrayTek Vigor2960 up to 1.5.1.69.9 Critical8.6 HighN/ANov 15, 2026
CVE-2026-82663: GiveWP Give - Peer-to-Peer: The Give - Peer-to-Peer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and…7.5 HighN/A1%Nov 15, 2026
CVE-2026-82568: GiveWP Give - Peer-to-Peer: The Give - Peer-to-Peer plugin for WordPress is vulnerable to time-based SQL Injection via the 'sort' parameter in all…7.5 HighN/A1%Nov 15, 2026
CVE-2026-129445: D-Link DIR-850L: A security flaw has been discovered in D-Link DIR-850L FW1.20WWb038.2 High8.4 HighN/ANov 15, 2026
CVE-2026-129349: Apache Software Foundation Apache Shiro: When authentication caching is enabled on DefaultLdapRealm, after a user logs in successfully once, subsequent logins…N/A9.1 Critical1%Nov 15, 2026
CVE-2026-129444: D-Link DSL-6740C: A vulnerability was identified in D-Link DSL-6740C 2013112610.0 Critical9.3 Critical1%Nov 15, 2026
CVE-2026-129443: itsourcecode Airline Reservation System: A vulnerability was determined in itsourcecode Airline Reservation System 1.06.3 Medium2.1 Low0%Nov 15, 2026
CVE-2026-127048: Unknown Custom Block Builder: The Custom Block Builder WordPress plugin before 3.0.0 does not properly deny unauthorised requests to its REST routes,…N/AN/A0%Nov 15, 2026
CVE-2026-124673: Unknown Burst Statistics: The Burst Statistics WordPress plugin before 3.7.5 does not check that a reported page view belongs to published…N/AN/A0%Nov 15, 2026
CVE-2026-124671: Unknown Burst Statistics: The Burst Statistics WordPress plugin before 3.7.5 does not enforce a shared report's date range on the analytics it…N/AN/A0%Nov 15, 2026
CVE-2026-123707: Unknown WPGraphQL: The WPGraphQL WordPress plugin before 2.27.1 does not restrict access to posts in custom non-public post statuses,…N/AN/A0%Nov 15, 2026
26-50 of 420572