The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-101019: F5 NGINX JavaScript: Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes…6.5 Medium8.3 HighN/AOct 14, 2026
CVE-2026-104795: Red Hat Red Hat OpenShift Container Platform 4: The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`) that scans container processes for…8.8 HighN/AN/AOct 14, 2026
CVE-2026-73792: Hewlett Packard Enterprise HPE NonStop Java JToolkit: A security vulnerability in HPE NonStop Java JToolkit can allow command Injection and buffer overflow.3.8 LowN/A0%Oct 14, 2026
CVE-2026-104748: wpazleen: The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is…9.8 CriticalN/A1%Oct 14, 2026
CVE-2026-107178: Unknown Image Photo Gallery Final Tiles Grid: The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration…6.8 MediumN/A0%Oct 14, 2026
CVE-2026-106469: Unknown Gutenverse Form: The Gutenverse Form WordPress plugin before 3.0.11 does not sanitize SVG icon markup stored in its form blocks before…6.8 MediumN/A0%Oct 14, 2026
CVE-2026-105261: Unknown: The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories…6.8 MediumN/A0%Oct 14, 2026
CVE-2026-104644: Unknown Image Photo Gallery Final Tiles Grid: The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.15 does not sanitize or escape gallery…6.8 MediumN/A0%Oct 14, 2026
CVE-2026-93885: blackworks1 Cryptocurrency Donation Box – Bitcoin & Crypto Donations: The Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin for WordPress is vulnerable to Stored Cross-Site…7.2 HighN/A0%Oct 14, 2026
CVE-2026-110445: TEAMPLUS TECHNOLOGY TeamPlus Messenger: TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability8.8 High8.6 High1%Oct 14, 2026
CVE-2026-110444: TEAMPLUS TECHNOLOGY TeamPlus Messenger: TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability8.8 High8.6 High1%Oct 14, 2026
CVE-2026-103423: masaakitanaka Booking Package: The Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including,…7.5 HighN/A1%Oct 14, 2026
CVE-2026-85473: Auth0 java-jwt: The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat)…5.3 MediumN/A0%Oct 13, 2026
CVE-2026-63169: Omnispace Agora Project: Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated…6.4 Medium5.3 Medium0%Oct 13, 2026
CVE-2026-63156: Omnispace Agora Project: Omnispace Agora Project before 26.10.0 contains a reflected cross-site scripting vulnerability that allows…6.1 Medium5.1 Medium0%Oct 13, 2026
CVE-2026-104587: Undefined Security Weakness5.4 MediumN/A0%Oct 13, 2026
CVE-2026-86016: vnotex vnote: VNote is a note-taking platform8.2 HighN/A0%Oct 13, 2026
CVE-2026-83960: Adobe: Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability5.4 MediumN/A0%Oct 13, 2026
CVE-2026-83958: Adobe: Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability5.4 MediumN/A0%Oct 13, 2026
CVE-2026-48398: Adobe Adobe Experience Manager 6.5: Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability5.4 MediumN/A0%Oct 13, 2026
CVE-2026-110082: Improper Neutralization of Input During Web Page Generation5.4 MediumN/A0%Oct 13, 2026
CVE-2026-110081: Improper Neutralization of Input During Web Page Generation5.4 MediumN/A0%Oct 13, 2026
CVE-2026-110080: Improper Neutralization of Input During Web Page Generation5.4 MediumN/A0%Oct 13, 2026
CVE-2026-110079: Improper Neutralization of Input During Web Page Generation5.4 MediumN/A0%Oct 13, 2026
CVE-2026-110078: Improper Neutralization of Input During Web Page Generation5.4 MediumN/A0%Oct 13, 2026
51-75 of 16382
‹›