The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-107237: Unknown Backup and Staging by WP Time Capsule: The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks…8.2 HighN/A0%Oct 21, 2026
CVE-2026-107128: Unknown Uncanny Toolkit for LearnDash: The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to…5.0 MediumN/A0%Oct 21, 2026
CVE-2026-107127: Unknown Uncanny Toolkit for LearnDash: The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset…7.5 HighN/A0%Oct 21, 2026
CVE-2026-106932: Unknown Moloni: The Moloni WordPress plugin before 5.0.14 does not perform capability or nonce checks on several of its authenticated…6.5 MediumN/A0%Oct 21, 2026
CVE-2026-105999: Unknown Booking Package: The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning…5.3 MediumN/A0%Oct 21, 2026
CVE-2026-105998: Unknown Booking Package: The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before…5.3 MediumN/A0%Oct 21, 2026
CVE-2026-105996: Unknown Booking Package: The Booking Package WordPress plugin before 1.7.31 does not generate booking cancellation tokens using a secure source…4.8 MediumN/A0%Oct 21, 2026
CVE-2026-105992: Unknown Ettrick Escape Room Booking: The Ettrick Escape Room Booking WordPress plugin before 1.3.1 does not verify a booking's payment status against the…5.3 MediumN/A0%Oct 21, 2026
CVE-2026-105262: Unknown Falang multilanguage for WordPress: The Falang multilanguage for WordPress plugin before 1.4.6 does not perform a capability check when saving term…8.0 HighN/A0%Oct 21, 2026
CVE-2026-105257: Unknown Appointment Booking Plugin: The Appointment Booking Plugin WordPress plugin before 5.7.5 does not verify that an authenticated agent-level user is…2.7 LowN/A0%Oct 21, 2026
CVE-2026-103302: Unknown Payment Gateway for Idram: The Payment Gateway for Idram WordPress plugin before 2.1.6 does not verify the authenticity of incoming payment…5.3 MediumN/A0%Oct 21, 2026
CVE-2026-102499: Unknown: The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before…7.7 HighN/A0%Oct 21, 2026
CVE-2026-100145: Unknown Synchrony Financing: The Synchrony Financing WordPress plugin before 1.1.2 does not properly authorise requests to one of its REST routes…6.5 MediumN/A0%Oct 21, 2026
CVE-2026-82819: Cerberus Cerberus FTP Server: A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a…N/A7.1 High0%Oct 21, 2026
CVE-2026-92824: Red Hat: A flaw was found in libmodulemd6.2 MediumN/A0%Oct 21, 2026
CVE-2026-92823: Red Hat: A flaw was found in libmodulemd6.2 MediumN/A0%Oct 21, 2026
CVE-2026-92822: Red Hat: A flaw was found in libmodulemd6.2 MediumN/A0%Oct 21, 2026
CVE-2026-114040: DT42 BerryNet: A security vulnerability has been detected in DT42 BerryNet up to 3.10.23.5 Low2.0 Low0%Oct 21, 2026
CVE-2026-114039: projectworlds Advanced Library Management System: A weakness has been identified in projectworlds Advanced Library Management System 1.06.3 Medium2.1 Low0%Oct 21, 2026
CVE-2026-82814: smub, Duplicator: The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to,…8.8 HighN/A1%Oct 21, 2026
CVE-2026-113744: Tenda AC19: A security vulnerability has been detected in Tenda AC19 16.03.10.0710.0 Critical9.3 Critical1%Oct 21, 2026
CVE-2026-113743: Tenstorrent tt-metal: A weakness has been identified in Tenstorrent tt-metal up to 0.80.06.3 Medium2.1 Low0%Oct 21, 2026
CVE-2026-114198: Mandiant FLARE floss: Deserialization of untrusted data in Mandiant FLARE floss releases before 3.2.0 allows arbitrary code execution when a…N/A8.7 High0%Oct 21, 2026
CVE-2026-114197: Mandiant FLARE capa: Deserialization of untrusted data in Mandiant FLARE capa releases before 10.0.0 allows arbitrary code execution when a…N/A8.7 High0%Oct 21, 2026
CVE-2026-114119: Best Practice Software Bp Premier: Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that…9.8 Critical9.3 Critical0%Oct 21, 2026
701-725 of 564809
‹›