The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-118273: a2ui-project a2ui: A flaw has been found in a2ui-project a2ui up to 0.10.64.3 Medium2.1 LowN/AOct 28, 2026
CVE-2026-117610: libexpat: libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in…5.9 Medium8.2 HighN/AOct 28, 2026
CVE-2026-117608: assimp: Assimp through 6.0.5 contains an integer overflow vulnerability in MD2Importer::ValidateHeader() that allows attackers…6.1 Medium6.9 MediumN/AOct 28, 2026
CVE-2026-117607: thexerteproject xerteonlinetoolkits: Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users…7.2 High8.6 HighN/AOct 28, 2026
CVE-2026-117606: Blair2004 NexoPOS: NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate…5.4 Medium5.3 MediumN/AOct 28, 2026
CVE-2026-115624: GROWI, Inc. GROWI: GROWI contains a missing authorization check vulnerability in its collaborative editing feature5.3 Medium6.9 MediumN/AOct 28, 2026
CVE-2026-111314: cservit affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display: The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Stored…7.2 HighN/AN/AOct 28, 2026
CVE-2026-109974: plugins360: The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is…6.4 MediumN/AN/AOct 28, 2026
CVE-2026-109848: GROWI, Inc. GROWI: GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use…4.2 Medium2.3 LowN/AOct 28, 2026
CVE-2026-109209: plugins360: The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is…6.4 MediumN/AN/AOct 28, 2026
CVE-2026-107745: tigroumeow: The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file…4.2 MediumN/AN/AOct 28, 2026
CVE-2026-105272: GROWI, Inc. GROWI: GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper…4.2 Medium2.3 LowN/AOct 28, 2026
CVE-2015-20129: CrushFTP: CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform…8.8 High8.6 HighN/AOct 28, 2026
CVE-2014-125138: C97net: C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted…8.8 High8.7 HighN/AOct 28, 2026
CVE-2014-125137: C97net: C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file…6.5 Medium7.1 HighN/AOct 28, 2026
CVE-2013-20009: Linksys WAG200G: Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows authenticated…4.8 Medium4.8 MediumN/AOct 28, 2026
CVE-2013-20008: Linksys WAG200G: Linksys WAG200G through 1.01.06 contains a weak password change mechanism that allows attackers to change the…6.8 Medium7.0 HighN/AOct 28, 2026
CVE-2013-20007: Linksys WAG200G: Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to…7.2 High8.6 HighN/AOct 28, 2026
CVE-2026-109999: nalam-1: The AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media…7.2 HighN/AN/AOct 28, 2026
CVE-2026-107625: ultimatemember: The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin…6.4 MediumN/AN/AOct 28, 2026
CVE-2026-118271: a2ui-project a2ui: A security vulnerability has been detected in a2ui-project a2ui up to 0.10.64.3 Medium2.1 LowN/AOct 28, 2026
CVE-2026-106013: artbees Jupiter X Core: The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Social Login handler…9.8 CriticalN/AN/AOct 28, 2026
CVE-2026-118376: Tencent WeKnora: WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedIP() that misclassifies…5.3 Medium6.0 MediumN/AOct 28, 2026
CVE-2026-118372: OpenBSD LibreSSL: LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers…3.7 Low6.3 MediumN/AOct 28, 2026
CVE-2026-117609: merbanan rtl_433: rtl_433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2_mc() that allows nearby…7.1 High7.1 HighN/AOct 28, 2026
601-625 of 417096