The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-116613: bplugins Animated Text Block – Add Typing and Looping Text Effects: The Animated Text Block plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and…7.5 HighN/AN/AOct 28, 2026
CVE-2026-111727: codepeople Appointment Booking Calendar: The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…6.4 MediumN/AN/AOct 28, 2026
CVE-2026-111255: cservit affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display: The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to…7.5 HighN/AN/AOct 28, 2026
CVE-2026-118275: a2ui-project a2ui: A vulnerability was found in a2ui-project a2ui up to 0.10.65.3 Medium5.5 MediumN/AOct 28, 2026
CVE-2026-97019: mohammed_kaludi AMP for WP – Accelerated Mobile Pages: The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…7.2 HighN/AN/AOct 28, 2026
CVE-2026-84999: Pie Register Pie Register Premium: The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and…9.8 CriticalN/AN/AOct 28, 2026
CVE-2026-118384: GNU mtools: GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c.6.1 MediumN/AN/AOct 28, 2026
CVE-2026-118378: TabularisDB tabularis: Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute…7.8 High8.5 HighN/AOct 28, 2026
CVE-2026-118377: mewebstudio pos: mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows…7.5 High8.7 HighN/AOct 28, 2026
CVE-2026-118375: ggml-org llama.cpp: llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdma_recv()…8.1 High9.2 CriticalN/AOct 28, 2026
CVE-2026-118374: OpenBSD LibreSSL: LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to…5.9 Medium8.2 HighN/AOct 28, 2026
CVE-2026-118373: OpenBSD LibreSSL: LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host() discards the OCSP…3.7 Low6.3 MediumN/AOct 28, 2026
CVE-2026-118371: OpenBSD LibreSSL: LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url()…3.7 Low6.3 MediumN/AOct 28, 2026
CVE-2026-118370: libexpat: libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows…5.9 Medium8.2 HighN/AOct 28, 2026
CVE-2026-118274: a2ui-project a2ui: A vulnerability has been found in a2ui-project a2ui up to 0.10.64.3 Medium2.1 LowN/AOct 28, 2026
CVE-2026-118273: a2ui-project a2ui: A flaw has been found in a2ui-project a2ui up to 0.10.64.3 Medium2.1 LowN/AOct 28, 2026
CVE-2026-117610: libexpat: libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in…5.9 Medium8.2 HighN/AOct 28, 2026
CVE-2026-117608: assimp: Assimp through 6.0.5 contains an integer overflow vulnerability in MD2Importer::ValidateHeader() that allows attackers…6.1 Medium6.9 MediumN/AOct 28, 2026
CVE-2026-117607: thexerteproject xerteonlinetoolkits: Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users…7.2 High8.6 HighN/AOct 28, 2026
CVE-2026-117606: Blair2004 NexoPOS: NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate…5.4 Medium5.3 MediumN/AOct 28, 2026
CVE-2026-115624: GROWI, Inc. GROWI: GROWI contains a missing authorization check vulnerability in its collaborative editing feature5.3 Medium6.9 MediumN/AOct 28, 2026
CVE-2026-111314: cservit affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display: The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Stored…7.2 HighN/AN/AOct 28, 2026
CVE-2026-109974: plugins360: The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is…6.4 MediumN/AN/AOct 28, 2026
CVE-2026-109848: GROWI, Inc. GROWI: GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use…4.2 Medium2.3 LowN/AOct 28, 2026
CVE-2026-109209: plugins360: The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is…6.4 MediumN/AN/AOct 28, 2026
576-600 of 417096