Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-126266: siyuan-note siyuan: SiYuan from 3.6.0 before 3.8.9 contains an information disclosure vulnerability that allows unauthenticated publish…7.5 High8.7 High0%Nov 13, 2026
CVE-2026-126265: siyuan-note siyuan: SiYuan 2.1.0 before 3.8.9 contains a flaw where the loginAuth CAPTCHA challenge lives in a signed client-side cookie,…7.4 High9.1 Critical0%Nov 13, 2026
CVE-2026-126264: siyuan-note siyuan: SiYuan before 3.8.9 contains an information disclosure vulnerability that allows authenticated Reader users to retrieve…7.7 High8.3 High0%Nov 13, 2026
WordPress Plugin: wpzoom-elementor-addons: CVE-2026-126029: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')6.4 MediumN/A0%Nov 13, 2026
WordPress Plugin: recipe-card-blocks-by-wpzoom: CVE-2026-125948: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')6.4 MediumN/A0%Nov 13, 2026
WordPress Plugin: content-protector: CVE-2026-125409: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')6.4 MediumN/A0%Nov 13, 2026
WordPress Plugin: chatterbug-forms: CVE-2026-125055: Unrestricted Upload of File with Dangerous Type9.8 CriticalN/A1%Nov 13, 2026
WordPress Plugin: drag-and-drop-file-upload-for-elementor-forms: CVE-2026-124218: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')8.2 HighN/A1%Nov 13, 2026
WordPress Plugin: suredash: CVE-2026-123769: Improper Privilege Management8.8 HighN/A0%Nov 13, 2026
WordPress Plugin: easy-property-listings: CVE-2026-122227: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')6.5 MediumN/A0%Nov 13, 2026
WordPress Plugin: newsletters-lite: CVE-2026-122063: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')6.5 MediumN/A0%Nov 13, 2026
WordPress Plugin: customer-reviews-woocommerce: CVE-2026-121518: Exposure of Sensitive Information to an Unauthorized Actor5.3 MediumN/A1%Nov 13, 2026
WordPress Plugin: elisqlreports: CVE-2026-120688: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')7.2 HighN/A0%Nov 13, 2026
WordPress Plugin: download-manager: CVE-2026-120658: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')6.4 MediumN/A0%Nov 13, 2026
WordPress Plugin: wpematico: CVE-2026-120573: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')6.4 MediumN/A0%Nov 13, 2026
WordPress Plugin: contact-form-7-honeypot: CVE-2026-120547: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')4.4 MediumN/A0%Nov 13, 2026
WordPress Plugin: elex-helpdesk-customer-support-ticket-system: CVE-2026-119077: Deserialization of Untrusted Data9.8 CriticalN/A1%Nov 13, 2026
WordPress Plugin: powerpress: CVE-2026-118587: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')5.4 MediumN/A0%Nov 13, 2026
WordPress Plugin: nextgen-gallery: CVE-2026-118191: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')8.1 HighN/A1%Nov 13, 2026
WordPress Plugin: widget-options: CVE-2026-116615: Improper Control of Generation of Code ('Code Injection')8.8 HighN/A1%Nov 13, 2026
WordPress Plugin: wp-product-feed-manager: CVE-2026-116614: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')4.9 MediumN/A0%Nov 13, 2026
WordPress Plugin: quiz-master-next: CVE-2026-116509: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')6.5 MediumN/A0%Nov 13, 2026
CVE-2026-116433: Dell PowerScale InsightIQ: Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains a Missing Authorization vulnerability4.3 MediumN/A0%Nov 13, 2026
CVE-2026-116418: Dell PowerScale InsightIQ: Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains an Incorrect Authorization vulnerability7.5 HighN/A0%Nov 13, 2026
WordPress Plugin: wp-staging: CVE-2026-115871: External Control of File Name or Path2.7 LowN/A0%Nov 13, 2026
701-725 of 561732