The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-115596: impleCode eCommerce Product Catalog: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode…7.1 HighN/AN/AOct 28, 2026
CVE-2026-115593: Unlimited Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited…7.1 HighN/AN/AOct 28, 2026
CVE-2026-115591: Supsystic Contact Form by Supsystic: Insertion of Sensitive Information Into Sent Data vulnerability in Supsystic Contact Form by Supsystic…7.5 HighN/AN/AOct 28, 2026
CVE-2026-111850: BuddyPress: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress…8.5 HighN/AN/AOct 28, 2026
CVE-2026-111411: Aman FunnelKit Automations: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman FunnelKit…9.3 CriticalN/AN/AOct 28, 2026
CVE-2026-81472: Dell: Dell iDRAC Service Module (iSM) for Windows, Dell iDRAC Service Module (iSM) for Linux, and Dell iDRAC Service Module…4.2 MediumN/AN/AOct 28, 2026
CVE-2026-118485: Axel Download Accelerator Axel: Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename…8.1 High7.0 HighN/AOct 28, 2026
CVE-2026-118477: EISGE Kalifast: The ei_git_repo_url parameter in the Git remote configuration endpoint of KaliFast is vulnerable to OS Command Injection9.8 Critical8.7 HighN/AOct 28, 2026
CVE-2026-116855: wphocus My auctions allegro: Missing Authorization vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Exploiting…5.4 MediumN/AN/AOct 28, 2026
CVE-2026-114278: Eclipse Foundation Eclipse Che: The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and…9.8 CriticalN/AN/AOct 28, 2026
CVE-2026-102799: icagenda.com iCagenda extension for Joomla: Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16N/A5.3 MediumN/AOct 28, 2026
CVE-2026-102790: icagenda.com iCagenda extension for Joomla: Joomla Extension - icagenda.com - Stored XSS via url-type event Custom Field in iCagenda 3.2.1 to 4.0.16N/A8.6 HighN/AOct 28, 2026
CVE-2026-99216: Linux: In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Don't reset VMBus connection state on…N/AN/AN/AOct 28, 2026
CVE-2026-99215: Linux: In the Linux kernel, the following vulnerability has been resolved: power: supply: core: prevent unregistering a power…N/AN/AN/AOct 28, 2026
CVE-2026-99214: Linux: In the Linux kernel, the following vulnerability has been resolved: drm/vc4: hdmi: Move packet RAM enable to PM runtime…N/AN/AN/AOct 28, 2026
CVE-2026-99213: Linux: In the Linux kernel, the following vulnerability has been resolved: vsock: treat TCP_CLOSING as once-established Handle…N/AN/AN/AOct 28, 2026
CVE-2026-99212: Linux: In the Linux kernel, the following vulnerability has been resolved: net/rds: don't let the rdma_cm destroy an id RDS…N/AN/AN/AOct 28, 2026
CVE-2026-99211: Linux: In the Linux kernel, the following vulnerability has been resolved: netlink: reset skb headers before unicast and…N/AN/AN/AOct 28, 2026
CVE-2026-99210: Linux: In the Linux kernel, the following vulnerability has been resolved: accel/rocket: clear rdev on device init failure…N/AN/AN/AOct 28, 2026
CVE-2026-99209: Linux: In the Linux kernel, the following vulnerability has been resolved: drm/xe: skip eviction of a BO with no resource…N/AN/AN/AOct 28, 2026
CVE-2026-99208: Linux: In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Zero OA buffer at allocation…N/AN/AN/AOct 28, 2026
CVE-2026-99207: Linux: In the Linux kernel, the following vulnerability has been resolved: scsi: target: Disable interrupts while holding…N/AN/AN/AOct 28, 2026
CVE-2026-99206: Linux: In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix race in discovery auth…N/AN/AN/AOct 28, 2026
CVE-2026-99205: Linux: In the Linux kernel, the following vulnerability has been resolved: sched/core: Call wakeup_preempt() for queued tasks…N/AN/AN/AOct 28, 2026
CVE-2026-99204: Linux: In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: Protect the recovery list during debugfs…N/AN/AN/AOct 28, 2026
51-75 of 417096