The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-97854: Yamaha Corporation NWR100: Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability9.8 Critical9.3 CriticalN/AOct 29, 2026
CVE-2026-27401: YITH YITH PayPal Express Checkout for WooCommerce: Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-115821: NewsmanApp: The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billing_first_name,…7.2 HighN/AN/AOct 29, 2026
CVE-2026-110184: blazethemes Newsmatic: The Newsmatic theme for WordPress is vulnerable to blind SQL Injection via the 'slug' parameter in all versions up to,…7.5 HighN/AN/AOct 29, 2026
CVE-2026-92086: websoudan MW WP Form: The MW WP Form plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-109216: metabox Meta Box – A Framework for Dynamic Websites: The Meta Box – A Framework for Dynamic Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…4.9 MediumN/AN/AOct 29, 2026
CVE-2026-96767: webaways NEX-Forms – Ultimate Forms Plugin for WordPress: The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting…7.2 HighN/AN/AOct 29, 2026
CVE-2026-115942: Apache Software Foundation Apache Qpid Proton C: A misconfigured wildcard TLS certificate causes a stack read overflowN/AN/AN/AOct 29, 2026
CVE-2026-114230: Apache Software Foundation Apache Qpid Proton C: When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL…N/AN/AN/AOct 29, 2026
CVE-2026-105042: Apache Software Foundation Apache Qpid Proton C: A message body that is deeply nested and decoded by pn_message_body() could overflow the stack and cause a crashN/AN/AN/AOct 29, 2026
CVE-2026-105031: Apache Software Foundation Apache Qpid Proton C: When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() &…N/AN/AN/AOct 29, 2026
CVE-2026-5702: SABBATIC SABBATIC app: Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application that allows an attacker can trick an…N/A4.8 MediumN/AOct 29, 2026
CVE-2026-5700: SABBATIC SABBATIC app: Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript…N/A4.8 MediumN/AOct 29, 2026
CVE-2026-5699: SABBATIC SABBATIC app: Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript…N/A4.8 MediumN/AOct 29, 2026
CVE-2026-5698: SABBATIC SABBATIC app: Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript…N/A4.8 MediumN/AOct 29, 2026
CVE-2026-5697: SABBATIC SABBATIC app: Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript…N/A4.8 MediumN/AOct 29, 2026
CVE-2026-115611: PluginUs.Net TableOn: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net…7.1 HighN/AN/AOct 29, 2026
CVE-2026-115964: StylemixThemes Motors: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes…9.3 CriticalN/AN/AOct 29, 2026
CVE-2026-115962: myCred: Authentication Bypass by Spoofing vulnerability in myCred myCred mycred allows Identity Spoofing.This issue affects…4.3 MediumN/AN/AOct 29, 2026
CVE-2026-115592: OceanWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OceanWP OceanWP…7.1 HighN/AN/AOct 29, 2026
CVE-2026-116409: WP Swings Upsell Order Bump Offer for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Swings Upsell…7.1 HighN/AN/AOct 29, 2026
CVE-2026-112827: VillaTheme HANDMADE – Dropshipping for Etsy and WooCommerce: Missing Authorization vulnerability in VillaTheme HANDMADE – Dropshipping for Etsy and WooCommerce…7.1 HighN/AN/AOct 29, 2026
CVE-2026-114193: Eyal Fitoussi GEO my WordPress: Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp allows Exploiting Incorrectly…7.5 HighN/AN/AOct 29, 2026
CVE-2026-115599: ThimPress LearnPress: Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access…7.5 HighN/AN/AOct 29, 2026
CVE-2026-115965: BuddyPress: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress…8.5 HighN/AN/AOct 29, 2026
51-75 of 415363