The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-100300: Apache Software Foundation Apache ZooKeeper: Improper handling of exceptional conditions in the quota subsystem of Apache ZooKeeper allows an attacker able to write…N/A8.7 HighN/ANov 4, 2026
CVE-2026-100252: Apache Software Foundation Apache ZooKeeper: Improper Authorization vulnerability in Apache ZooKeeperN/A8.6 HighN/ANov 4, 2026
CVE-2026-100235: Apache Software Foundation Apache ZooKeeper: Incorrect authorization due to a time-of-check to time-of-use (TOCTOU) race condition in the setACL request handling of…N/A6.0 MediumN/ANov 4, 2026
CVE-2026-90629: Apache Software Foundation Apache OpenOffice: An uncontrolled memory access in the WMF import code of Apache OpenOffice versions through 4.1.16 allows a crafted WMF…N/AN/AN/ANov 4, 2026
CVE-2026-90628: Apache Software Foundation Apache OpenOffice: An uncontrolled memory access in the PDF export code of Apache OpenOffice versions through 4.1.16 allows a crafted CFF…N/AN/AN/ANov 4, 2026
CVE-2026-90627: Apache Software Foundation Apache OpenOffice: The flat file database driver in Apache Openoffice versions through 4.1.16 allows a crafted document to read the…N/AN/AN/ANov 4, 2026
CVE-2026-90626: Apache Software Foundation Apache OpenOffice: An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF…N/AN/AN/ANov 4, 2026
CVE-2026-90624: Apache Software Foundation Apache OpenOffice: An unchecked memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 on allows a crafted PDF…N/AN/AN/ANov 4, 2026
CVE-2026-59268: Apache Software Foundation Apache OpenOffice: An out-of-bounds Write vulnerability in Apache OpenOffice versions through 4.1.16 could allow an attacker to craft a…N/AN/AN/ANov 4, 2026
CVE-2026-59264: Apache Software Foundation Apache OpenOffice: The Windows installers of Apache OpenOffice 4.1.16 and earlier allow an already manipulated system to run external code…N/AN/AN/ANov 4, 2026
CVE-2026-95649: I.R.I.S S.A. IRISPowerscan: IRISPowerscan insufficiently restrict the use of untrusted scriptsN/A6.1 MediumN/ANov 4, 2026
CVE-2026-94460: I.R.I.S S.A. IRISPowerscan: IRISPowerscan contain an insecure default configuration where the built-in installation account is assigned elevated…N/A7.2 HighN/ANov 4, 2026
CVE-2026-94459: I.R.I.S S.A. IRISPowerscan: IRISPowerscan contain default user accounts with predictable credentialsN/A7.2 HighN/ANov 4, 2026
CVE-2026-93900: elliotvs Simple CAPTCHA with Cloudflare Turnstile: The Simple CAPTCHA with Cloudflare Turnstile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…6.4 MediumN/AN/ANov 4, 2026
CVE-2026-120554: carazo Import and export users and customers: The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up…8.8 HighN/AN/ANov 4, 2026
CVE-2026-120422: Sogou Sogou Input Method: Sogou Input Method for Windows contains a vulnerability in the configuration retrieval mechanism of its SGTool.exe…N/A8.9 HighN/ANov 4, 2026
CVE-2026-115498: wingerspeed Slim Jetpack: The Slim Jetpack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'g<PAGE_ID>-website (Website…7.2 HighN/AN/ANov 4, 2026
CVE-2026-111822: Apache Software Foundation: Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime ConfigN/AN/AN/ANov 4, 2026
CVE-2026-111821: Apache Software Foundation: Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDBN/AN/AN/ANov 4, 2026
CVE-2026-111040: Coupa Coupa Total Spend Management Platform: The platform allows persistent HTML injection into editable fields managed by TinyMCEN/A5.1 MediumN/ANov 4, 2026
CVE-2026-111038: Coupa Coupa Total Spend Management Platform: CSV formula injection vulnerability in the export functionality of the Coupa Supplier Portal SaaS platformN/A7.3 HighN/ANov 4, 2026
CVE-2026-111037: Coupa Coupa Total Spend Management Platform: A reflected Cross-Site Scripting (XSS) vulnerability in the Tenders module of the Coupa Supplier Portal SaaS platformN/A5.1 MediumN/ANov 4, 2026
CVE-2026-111036: Coupa Coupa Total Spend Management Platform: Server-side request forgery (SSRF) vulnerability in the Coupa Supplier Portal SaaS platform, specifically in the…N/A8.4 HighN/ANov 4, 2026
CVE-2026-110935: Phoenix Contact PLCnext Engineer: The PFI plugin framework deployment routine does not validate path components when extracting archive entries to the…8.4 High8.6 HighN/ANov 4, 2026
CVE-2026-110022: Phoenix Contact PLCnext Engineer: The PFI plugin framework deploys executable assemblies (DLLs) from a signed plugin package into the local plugin…8.4 High8.6 HighN/ANov 4, 2026
51-75 of 426484
‹›