The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-115953: Dylan Kuhn Geo Mashup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo…6.5 MediumN/AN/AOct 26, 2026
CVE-2026-115951: Kevin Weber Lazy Load for Videos: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Weber Lazy…6.5 MediumN/AN/AOct 26, 2026
CVE-2026-115950: WP Smart Widgets Better Post & Filter Widgets for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Smart Widgets…6.5 MediumN/AN/AOct 26, 2026
CVE-2026-115948: David Lingren Media LIbrary Assistant: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren…8.5 HighN/AN/AOct 26, 2026
CVE-2026-115608: Crocoblock JetEngine: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock…8.5 HighN/AN/AOct 26, 2026
CVE-2026-115595: Supsystic Contact Form by Supsystic: Missing Authorization vulnerability in Supsystic Contact Form by Supsystic contact-form-by-supsystic allows Exploiting…5.3 MediumN/AN/AOct 26, 2026
CVE-2026-115594: David Lingren Media LIbrary Assistant: Insertion of Sensitive Information Into Sent Data vulnerability in David Lingren Media LIbrary Assistant…6.5 MediumN/AN/AOct 26, 2026
CVE-2026-114708: Crocoblock JetSmartFilters: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock…6.5 MediumN/AN/AOct 26, 2026
CVE-2026-114707: Crocoblock JetElements For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock…6.5 MediumN/AN/AOct 26, 2026
CVE-2026-97295: Cross-Site Request Forgery (CSRF)4.3 MediumN/AN/AOct 26, 2026
CVE-2026-97255: Authorization Bypass Through User-Controlled Key5.3 MediumN/AN/AOct 26, 2026
CVE-2026-97254: Cross-site Scripting (XSS)6.5 MediumN/AN/AOct 26, 2026
CVE-2026-4316: Zuinq Studio IsMyGym: Reflected Cross-Site Scripting (XSS) in Gym Management Software IsMyGym by Zuinq Studio affecting the reservation…N/A5.1 MediumN/AOct 26, 2026
CVE-2026-116255: Path Traversal5.3 Medium5.5 MediumN/AOct 26, 2026
CVE-2026-116254: Insufficient Verification of Data Authenticity6.5 Medium5.5 MediumN/AOct 26, 2026
CVE-2026-116253: n/a DedeCMS: A vulnerability was determined in DedeCMS 5.7.1187.3 High6.9 MediumN/AOct 26, 2026
CVE-2026-116237: A vulnerability was found in Oray Pugongying X5 Pro 7.6.18.4 High8.5 HighN/AOct 26, 2026
CVE-2026-115958: Missing Authorization5.3 MediumN/AN/AOct 26, 2026
CVE-2026-115949: Missing Authorization6.5 MediumN/AN/AOct 26, 2026
CVE-2026-115614: Missing Authorization vulnerability in Magepeople inc5.3 MediumN/AN/AOct 26, 2026
CVE-2026-115613: Cross-site Scripting (XSS)6.5 MediumN/AN/AOct 26, 2026
CVE-2026-115602: Cross-site Scripting (XSS)6.5 MediumN/AN/AOct 26, 2026
CVE-2026-114709: Cross-site Scripting (XSS)6.5 MediumN/AN/AOct 26, 2026
CVE-2026-112865: Cross-site Scripting (XSS)6.5 MediumN/AN/AOct 26, 2026
CVE-2026-112250: Bizerba SE & Co. KG BRAIN2: A vulnerability has been identified in BRAIN2 versions up to and including version 3.094.4 MediumN/AN/AOct 26, 2026
651-675 of 416032