The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-110452: NixOS Nix: The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user (who invoked the…4.0 MediumN/AN/AOct 14, 2026
CVE-2026-110451: NixOS Nix: Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox escape (for an unconfined build) because a…4.3 MediumN/AN/AOct 14, 2026
CVE-2026-110450: NixOS Nix: Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and…8.0 HighN/AN/AOct 14, 2026
CVE-2026-110449: NixOS Nix: Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating…7.5 HighN/AN/AOct 14, 2026
CVE-2026-97668: Tyche Softwares Abandoned Cart Pro for WooCommerce: The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart…9.8 CriticalN/AN/AOct 14, 2026
CVE-2026-97657: Tyche Softwares Abandoned Cart Pro for WooCommerce: The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via Malleable…9.8 CriticalN/AN/AOct 14, 2026
CVE-2026-14765: Epic Games Unreal Engine: Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default configuration for the…7.7 HighN/AN/AOct 14, 2026
CVE-2026-110447: Collabora Collabora Online - Built-in CODE Server: Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code…N/A9.2 CriticalN/AOct 14, 2026
CVE-2026-110445: TEAMPLUS TECHNOLOGY TeamPlus Messenger: TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability8.8 High8.6 HighN/AOct 14, 2026
CVE-2026-110444: TEAMPLUS TECHNOLOGY TeamPlus Messenger: TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability8.8 High8.6 HighN/AOct 14, 2026
CVE-2026-110002: snazzyplugins Snazzy Social Media Feed: The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and…9.8 CriticalN/AN/AOct 14, 2026
CVE-2026-103422: ateshabaev AnyComment: The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions…7.2 HighN/AN/AOct 14, 2026
CVE-2026-102251: Tyche Softwares Abandoned Cart Pro for WooCommerce: The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'validate'…7.5 HighN/AN/AOct 14, 2026
CVE-2026-93388: printcart Printcart Store – Web to Print Product Designer for WooCommerce: The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file…9.8 CriticalN/AN/AOct 14, 2026
CVE-2026-92097: holithemes Click to Chat – HoliThemes: The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to,…9.1 CriticalN/AN/AOct 14, 2026
CVE-2026-86607: Hitachi Hitachi Ops Center Administrator: Internal Application Information Exposure Vulnerability in Hitachi Ops Center Administrator4.3 MediumN/AN/AOct 14, 2026
CVE-2026-86573: Hitachi: Out-of-bounds write vulnerability in Hitachi Disk Array Driver for AIX and Hitachi Disk Array Driver for Virtual I/O…5.1 MediumN/AN/AOct 14, 2026
CVE-2026-82715: Hitachi: Insecure Temporary File vulnerability in Hitachi Disk Array Driver for AIX and Hitachi Disk Array Driver for Virtual…7.9 HighN/AN/AOct 14, 2026
CVE-2026-17092: wpwax: The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to…8.1 HighN/AN/AOct 14, 2026
CVE-2026-110392: Samsung Open Source QA-Board: Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Samsung…9.8 CriticalN/AN/AOct 14, 2026
CVE-2026-107652: arshidkv12 Database Addon for Contact Form 7 – CFDB7: The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions…5.3 MediumN/AN/AOct 14, 2026
CVE-2026-104995: dontdream BP Profile Search: The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9…8.1 HighN/AN/AOct 14, 2026
CVE-2026-104767: davefx Membership & User Roles for WooCommerce (Automatic Role Changer): The Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for WordPress is vulnerable to Privilege…7.5 HighN/AN/AOct 14, 2026
CVE-2026-104749: bitpressadmin: The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is…7.5 HighN/AN/AOct 14, 2026
CVE-2026-103425: masaakitanaka Booking Package: The Booking Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all…6.4 MediumN/AN/AOct 14, 2026
26-50 of 657253
‹›