The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-123670: Unknown Essential Real Estate: The Essential Real Estate WordPress plugin before 5.3.6 does not verify that the recipients it allows for its contact…4.3 MediumN/AN/ANov 13, 2026
CVE-2026-123124: Unknown WooCommerce Vindi Pagamento: The WooCommerce Vindi Pagamento WordPress plugin through 0.8.3 does not perform any authorisation check when updating…7.5 HighN/AN/ANov 13, 2026
CVE-2026-123097: Unknown WP Remote Users Sync: The WP Remote Users Sync WordPress plugin before 2.2.1 does not restrict which account fields a synchronised site may…7.5 HighN/AN/ANov 13, 2026
CVE-2026-123093: Unknown WP Remote Users Sync: The WP Remote Users Sync WordPress plugin before 2.2.1 does not have authorisation and CSRF checks in one of its AJAX…4.3 MediumN/AN/ANov 13, 2026
CVE-2026-121853: Unknown AppPresser: The AppPresser WordPress plugin before 5.0.0 does not restrict access to two of its REST API endpoints, allowing…5.3 MediumN/AN/ANov 13, 2026
CVE-2026-120407: Unknown Contact Form 7: The Contact Form 7 WordPress plugin before 6.2.5 does not restrict which user properties a form field's default value…4.5 MediumN/AN/ANov 13, 2026
CVE-2026-118065: Unknown Advance Guest Post: The Advance Guest Post WordPress plugin through 1.9 does not perform any authorization or ownership check when deleting…7.5 HighN/AN/ANov 13, 2026
CVE-2026-118064: Unknown Advance Guest Post: The Advance Guest Post WordPress plugin through 1.9 does not properly restrict or validate file uploads, authorizing an…9.8 CriticalN/AN/ANov 13, 2026
CVE-2026-118063: Unknown Advance Guest Post: The Advance Guest Post WordPress plugin through 1.9 does not properly validate uploaded files, relying on a…9.8 CriticalN/AN/ANov 13, 2026
CVE-2026-116059: Unknown LetsRecover: The LetsRecover WordPress plugin through 1.2.0 does not sanitize a user-supplied value that is used as a database…8.6 HighN/AN/ANov 13, 2026
CVE-2026-111342: Citrix: Memory overflow in LDAP authentication can lead to unpredictable or erroneous behavior or Denial of Service in Citrix…N/A8.7 HighN/ANov 13, 2026
CVE-2026-111341: Citrix: Memory overflow in client-certificate authentication can lead to unpredictable or erroneous behavior or Denial of…N/A8.7 HighN/ANov 13, 2026
CVE-2026-111340: Citrix: Memory overflow in KBA (knowledge-based authentication) can lead to unpredictable or erroneous behavior or Denial of…N/A8.7 HighN/ANov 13, 2026
CVE-2026-107415: Citrix: Memory overflow in Email OTP authentication can lead to unpredictable or erroneous behavior or Denial of Service in…N/A9.3 CriticalN/ANov 13, 2026
CVE-2026-74911: Imagination Technologies Graphics DDK: Software installed and run as a non-privileged user may conduct improper GPU system calls to the execution of an error…N/AN/AN/ANov 13, 2026
CVE-2026-49747: Imagination Technologies Graphics DDK: Software installed and run as a non-privileged user may conduct GPU system calls to trigger an integer overflow and…N/AN/AN/ANov 13, 2026
CVE-2026-127286: Zackriya-Solutions Meetily: A vulnerability was identified in Zackriya-Solutions Meetily up to 0.4.17.3 High5.5 MediumN/ANov 13, 2026
CVE-2026-127285: Cairo-dock Glx-Dock: A flaw has been found in Cairo-dock Glx-Dock 3.4.04.3 Medium2.1 LowN/ANov 13, 2026
CVE-2026-107414: Citrix: Memory overflow in WebAuth authentication can lead to unpredictable or erroneous behavior or Denial of Service in…N/A8.7 HighN/ANov 13, 2026
CVE-2026-107413: Citrix NetScaler: Memory overflow in SAML authentication can lead to unpredictable or erroneous behavior or Denial of Service in Citrix…N/A8.7 HighN/ANov 13, 2026
CVE-2026-107412: Citrix NetScaler: Multiple Memory overflow vulnerabilities can lead to unpredictable or erroneous behavior and Denial of Service in…N/A9.5 CriticalN/ANov 13, 2026
CVE-2026-107411: Citrix NetScaler: Memory overflow in RTSP ALG can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScalerN/A8.7 HighN/ANov 13, 2026
CVE-2026-16671: mcu-tools mcuboot: split_image_check() in boot/bootutil/src/loader.c declares a fixed uint8_t loader_hash[32] buffer and passes it as the…2.9 LowN/AN/ANov 13, 2026
CVE-2026-16664: mcu-tools mcuboot: MCUboot's Zephyr serial-recovery upload handler bs_upload() in boot/boot_serial/src/boot_serial.c decodes the…5.1 MediumN/AN/ANov 13, 2026
CVE-2026-16662: mcu-tools mcuboot: boot_save_boot_status() in boot/bootutil/src/boot_record.c reads the image's EXPECTED_HASH_TLV into a stack buffer…2.4 LowN/AN/ANov 13, 2026
676-700 of 532044