The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-109821: elixir-lang elixir: Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's URI module allows an…N/A6.3 MediumN/AOct 30, 2026
CVE-2026-82104: Teltonika Networks: In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9…N/A9.4 CriticalN/AOct 30, 2026
CVE-2026-115455: Red Hat: A flaw was found in GCC libstdc++6.5 MediumN/AN/AOct 30, 2026
CVE-2026-114691: Red Hat: A flaw was found in the libstdc++ component of GCC5.9 MediumN/AN/AOct 30, 2026
CVE-2026-114690: Red Hat: A flaw was found in GCC6.2 MediumN/AN/AOct 30, 2026
CVE-2026-97645: Gravity Forms: The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via List Field in all versions up…7.2 HighN/AN/AOct 30, 2026
CVE-2026-90437: Gravity Forms: The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Excerpt / Post Custom…7.2 HighN/AN/AOct 30, 2026
CVE-2026-89435: strategy11team: The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is…8.8 HighN/AN/AOct 30, 2026
CVE-2026-118952: Red Hat: A flaw was found in the Kroxylicious ACL authorizer6.5 MediumN/AN/AOct 30, 2026
CVE-2026-118593: Red Hat: A flaw was found in Red Hat Enterprise Linux 9 kernel builds5.9 MediumN/AN/AOct 30, 2026
CVE-2026-116622: wpscripts Food Store – Online Food Delivery & Pickup: The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…7.2 HighN/AN/AOct 30, 2026
CVE-2026-110732: tigroumeow: The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Missing…7.5 HighN/AN/AOct 30, 2026
CVE-2026-103039: Gravity Forms: The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including,…9.8 CriticalN/AN/AOct 30, 2026
CVE-2026-119087: keywordrush Content Egg – Affiliate Product Importer & Price Comparison: The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to authorization…4.3 MediumN/AN/AOct 30, 2026
CVE-2026-119059: keywordrush Content Egg – Affiliate Product Importer & Price Comparison: The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post…4.3 MediumN/AN/AOct 30, 2026
CVE-2026-118698: beardev: The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL…6.5 MediumN/AN/AOct 30, 2026
CVE-2026-118634: liedekef Events Made Easy: The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all…6.4 MediumN/AN/AOct 30, 2026
CVE-2026-118500: coolplugins Cool FormKit Lite – Advanced Form Builder for Elementor: The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based…6.4 MediumN/AN/AOct 30, 2026
CVE-2026-118194: cyberlord92 Page and Post Restriction: The Page and Post Restriction plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and…6.5 MediumN/AN/AOct 30, 2026
CVE-2026-118165: Unknown Firelight Lightbox: The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens in its Classic lightbox…6.8 MediumN/AN/AOct 30, 2026
CVE-2026-118101: Unknown BuddyForms: The BuddyForms WordPress plugin before 2.10.1 does not verify that a user editing an existing entry is the author of…5.3 MediumN/AN/AOct 30, 2026
CVE-2026-118100: Unknown BuddyForms: The BuddyForms WordPress plugin before 2.10.3 does not check that the requester is allowed to manage a form before…5.3 MediumN/AN/AOct 30, 2026
CVE-2026-118072: Unknown Fraud Prevention For WooCommerce and EDD: The Fraud Prevention For WooCommerce and EDD WordPress plugin before 2.3.6 does not check that a user is allowed to…5.4 MediumN/AN/AOct 30, 2026
CVE-2026-118071: Unknown Joinchat: The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an…6.8 MediumN/AN/AOct 30, 2026
CVE-2026-117572: Unknown WP Visitor Statistics (Real Time Traffic): The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape a parameter…4.1 MediumN/AN/AOct 30, 2026
501-525 of 418318