The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-113472: Unknown Depicter — Popup & Slider Builder: The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not properly validate uploaded files in its…5.4 MediumN/A0%Oct 23, 2026
CVE-2026-112230: Unknown Popup Builder: The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in…3.7 LowN/A0%Oct 23, 2026
CVE-2026-112219: Unknown Download Monitor: The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the list of filesystem…4.9 MediumN/A0%Oct 23, 2026
CVE-2026-111982: Unknown User Profile Builder: The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific…7.2 HighN/A0%Oct 23, 2026
CVE-2026-111966: Unknown User Profile Builder: The User Profile Builder WordPress plugin before 4.0.5 does not sanitise and escape one of its shortcode attributes…6.8 MediumN/A0%Oct 23, 2026
CVE-2026-111738: Unknown Speed Optimizer: The Speed Optimizer WordPress plugin before 7.8.5 does not verify network-level privilege before applying an option…5.5 MediumN/A0%Oct 23, 2026
CVE-2026-111737: Unknown Speed Optimizer: The Speed Optimizer WordPress plugin before 7.8.5 does not sanitise or escape some of its settings before outputting…3.5 LowN/A0%Oct 23, 2026
CVE-2026-110537: Unknown Essential Addons for Elementor: The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may manage the…3.8 LowN/A0%Oct 23, 2026
CVE-2026-110510: Unknown Essential Addons for Elementor: The Essential Addons for Elementor WordPress plugin before 6.8.7 does not validate the HTML tag setting of some of its…3.5 LowN/A0%Oct 23, 2026
CVE-2026-109936: Unknown Otter Blocks: The Otter Blocks WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its…7.5 HighN/A0%Oct 23, 2026
CVE-2026-109935: Unknown Otter Blocks: The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a published post…5.3 MediumN/A0%Oct 23, 2026
CVE-2026-109934: Unknown Otter Blocks: The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before…5.3 MediumN/A0%Oct 23, 2026
CVE-2026-109933: Unknown Otter Blocks: The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values…6.8 MediumN/A0%Oct 23, 2026
CVE-2026-107858: Google Agent Development Kit (ADK) for Java: Missing Origin Validation in WebSockets (CWE-1385) and Permissive Cross-domain Policy with Untrusted Domains (CWE-942)…N/A7.2 High0%Oct 23, 2026
CVE-2026-86055: Part-DB Part-DB-server: Part-DB is an open source inventory management system for electronic componentsN/A8.7 High0%Oct 23, 2026
CVE-2026-86020: Part-DB Part-DB-server: Part-DB is an open source inventory management system for electronic components4.6 MediumN/A0%Oct 23, 2026
CVE-2026-86019: Part-DB Part-DB-server: Part-DB is an open source inventory management system for electronic componentsN/A5.3 Medium0%Oct 23, 2026
CVE-2026-86018: Part-DB Part-DB-server: Part-DB is an open source inventory management system for electronic componentsN/A5.3 Medium0%Oct 23, 2026
CVE-2026-59188: Part-DB Part-DB-server: Part-DB is an open source inventory management system for electronic components5.4 MediumN/A0%Oct 23, 2026
CVE-2026-55835: lookyloo: Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call…N/A6.9 Medium0%Oct 23, 2026
CVE-2026-115497: codepeople Music Store – WordPress eCommerce: The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to,…7.5 HighN/A1%Oct 23, 2026
CVE-2026-109198: cleantalk CleanTalk Anti-Spam – Complete Spam Protection: The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site…7.2 HighN/A0%Oct 23, 2026
CVE-2026-90458: OpenStack Ironic: OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's…5.4 MediumN/A0%Oct 23, 2026
CVE-2026-89419: OpenStack Ironic: OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to…5.0 MediumN/A0%Oct 23, 2026
CVE-2026-55600: Part-DB Part-DB-server: Part-DB is an open source inventory management system for electronic componentsN/A5.7 Medium0%Oct 23, 2026
526-550 of 530113
‹›