The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-106468: Unknown Code Snippets: The Code Snippets WordPress plugin before 4.1.0 does not verify network-level capabilities before honouring a…3.8 LowN/AN/ANov 11, 2026
CVE-2026-104718: Unknown Elementor Website Builder: The Elementor Website Builder WordPress plugin before 4.3.6 does not validate or escape an element identifier before…6.8 MediumN/AN/ANov 11, 2026
CVE-2025-15714: Unknown Live Composer: The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its Button module settings before…3.5 LowN/AN/ANov 11, 2026
CVE-2025-15713: Unknown Live Composer: The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its page-builder module settings…3.5 LowN/AN/ANov 11, 2026
CVE-2025-15712: Unknown Live Composer: The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its staff member settings before…3.5 LowN/AN/ANov 11, 2026
CVE-2025-15711: Unknown Live Composer: The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its module settings before…3.5 LowN/AN/ANov 11, 2026
CVE-2026-97054: Go standard library net/http: For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without…N/AN/AN/ANov 11, 2026
CVE-2026-97043: Go toolchain: Building a malicious package that uses cgo could bypass "#cgo LDFLAGS" validation and cause unexpected code execution…N/AN/AN/ANov 11, 2026
CVE-2026-97042: Go toolchain: Building a malicious package that uses "//go:cgo_import_dynamic" or links against a crafted PE object on Windows could…N/AN/AN/ANov 11, 2026
CVE-2026-97041: Go toolchain: Building a malicious package containing "//go:cgo_*" compiler directives could inject arbitrary flags into the external…N/AN/AN/ANov 11, 2026
CVE-2026-97040: Go toolchain: Building a package containing a crafted ".syso" file could bypass cgo flag validation and inject arbitrary linker flags…N/AN/AN/ANov 11, 2026
CVE-2026-97039: Go toolchain cmd/go: Building a malicious package that uses "#cgo pkg-config:" directives could load untrusted pkg-config ".pc" files or…N/AN/AN/ANov 11, 2026
CVE-2026-97038: Go toolchain cmd/go: Building a malicious package containing ".syso" files or cgo linker inputs could inject arbitrary linker flags or…N/AN/AN/ANov 11, 2026
CVE-2026-97037: Go toolchain cmd/go: Building a malicious package that uses cgo could cause arbitrary code execution at link time by passing linker script…N/AN/AN/ANov 11, 2026
CVE-2026-97036: Go toolchain cmd/go: On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker…N/AN/AN/ANov 11, 2026
CVE-2026-97035: Go toolchain cmd/go: When using Clang or GCC, building a malicious package that uses cgo could cause unexpected code execution at build time…N/AN/AN/ANov 11, 2026
CVE-2026-97034: Go toolchain cmd/go: When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via…N/AN/AN/ANov 11, 2026
CVE-2026-97033: Go toolchain cmd/go: Building a malicious package that uses cgo could cause arbitrary code execution at build time through several compiler…N/AN/AN/ANov 11, 2026
CVE-2026-64686: opensearch-project OpenSearch-Dashboards: OpenSearch Dashboards is an open-source data visualization tool designed to work with OpenSearch5.0 MediumN/AN/ANov 11, 2026
CVE-2026-64682: NauelG astro-blocks: AstroBlocks is a block-first CMS for Astro projects9.8 CriticalN/AN/ANov 11, 2026
CVE-2026-64678: nitrite nitrite-java: NOsql Object (NO2 a.k.a Nitrite) database is an open source nosql embedded document store9.8 CriticalN/AN/ANov 11, 2026
CVE-2026-64671: walinejs waline: Waline is a comment system with backend support7.2 HighN/AN/ANov 11, 2026
CVE-2026-64670: walinejs waline: Waline is a comment system with backend support9.3 CriticalN/AN/ANov 11, 2026
CVE-2026-64669: mcdope pam_usb: pam_usb provides hardware authentication for Linux using removable media7.4 HighN/AN/ANov 11, 2026
CVE-2026-64668: mcdope pam_usb: pam_usb provides hardware authentication for Linux using removable media7.4 HighN/AN/ANov 11, 2026
476-500 of 511254