The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-116044: prasathmani TinyFileManager: A security vulnerability has been detected in prasathmani TinyFileManager up to 2.66.3 Medium2.1 Low0%Oct 25, 2026
CVE-2026-115251: Unknown Duplicator: The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to…7.2 HighN/A0%Oct 25, 2026
CVE-2026-115214: Unknown Datawiza Proxy Auth Plugin: The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP…9.8 CriticalN/A0%Oct 25, 2026
CVE-2026-115183: Unknown Qi Addons For Elementor: The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after…2.4 LowN/A0%Oct 25, 2026
CVE-2026-114743: Unknown InstaWP Connect: The InstaWP Connect WordPress plugin before 0.1.4.2 does not perform a capability check on its InstaWP Connect…3.1 LowN/A0%Oct 25, 2026
CVE-2026-114742: Unknown WPVR: The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours,…2.7 LowN/A0%Oct 25, 2026
CVE-2026-114741: Unknown WPVR: The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating…3.8 LowN/A0%Oct 25, 2026
CVE-2026-114740: Unknown WPVR: The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its…4.9 MediumN/A0%Oct 25, 2026
CVE-2026-111981: Unknown GiveWP: The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes,…2.7 LowN/A0%Oct 25, 2026
CVE-2026-111980: Unknown GiveWP: The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capability request applies…5.5 MediumN/A0%Oct 25, 2026
CVE-2026-111979: Unknown GiveWP: The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form template…6.8 MediumN/A0%Oct 25, 2026
CVE-2026-111978: Unknown GiveWP: The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-supplied filename before reading it from…6.0 MediumN/A0%Oct 25, 2026
CVE-2026-111976: Unknown GiveWP: The GiveWP WordPress plugin before 4.19.0.1 does not perform any status or capability check when rendering a donation…5.3 MediumN/A0%Oct 25, 2026
CVE-2026-110285: Unknown WP Stripe Checkout: The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the Stripe webhook signature when no signing…5.3 MediumN/A0%Oct 25, 2026
CVE-2025-15705: Unknown Contact Form by Supsystic: The Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise and escape a form name, allowing users…3.5 LowN/A0%Oct 25, 2026
CVE-2026-116007: YunaiV, zhijiantianya ruoyi-vue-pro: A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.093.7 Low2.9 Low0%Oct 25, 2026
CVE-2026-116006: YunaiV, zhijiantianya ruoyi-vue-pro: A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.097.3 High5.5 Medium0%Oct 25, 2026
CVE-2026-116004: onyx-dot-app Onyx: A security vulnerability has been detected in onyx-dot-app Onyx up to 5.0.03.5 Low2.0 Low0%Oct 25, 2026
CVE-2026-116000: Zylon PrivateGPT: A security flaw has been discovered in Zylon PrivateGPT 1.0.0/1.0.17.3 High5.5 Medium0%Oct 25, 2026
CVE-2026-115999: mansi-k Restaurant_IMS: A vulnerability has been found in mansi-k Restaurant_IMS d7ad49f61ab7cc1ec6eb359ac2b5378bdbde06947.3 High6.9 Medium0%Oct 25, 2026
CVE-2026-115997: pig-mesh pig: A flaw has been found in pig-mesh pig up to 4.1.06.3 Medium2.1 Low0%Oct 25, 2026
CVE-2026-89284: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.N/AN/AN/AOct 24, 2026
CVE-2026-115996: Unitree Robotics Unitree Go2: A vulnerability was detected in Unitree Robotics Unitree Go2 up to 1.1.13/1.1.14.1/1.1.15.13.7 Low6.3 Medium0%Oct 24, 2026
CVE-2026-115995: Unitree Robotics Unitree Go2: A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.49.6 Critical9.4 Critical1%Oct 24, 2026
CVE-2026-111326: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.N/AN/AN/AOct 24, 2026
476-500 of 416032