The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-62126: miniOrange SAML SP Single Sign On: Allocation of Resources Without Limits or Throttling vulnerability in miniOrange SAML SP Single Sign On…7.5 HighN/AN/ANov 4, 2026
CVE-2026-62007: Unlimited Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited…7.1 HighN/AN/ANov 4, 2026
CVE-2026-57775: RelyWP Simple Cloudflare Turnstile: Authentication Bypass Using an Alternate Path or Channel vulnerability in RelyWP Simple Cloudflare Turnstile…5.3 MediumN/AN/ANov 4, 2026
CVE-2026-57666: Aguila Technologies WP Customer Area: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila…7.1 HighN/AN/ANov 4, 2026
CVE-2026-57639: Roland Murg WP Booking System: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Roland Murg WP…7.1 HighN/AN/ANov 4, 2026
CVE-2026-56065: Doofinder Doofinder for WooCommerce: Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Doofinder Doofinder…7.5 HighN/AN/ANov 4, 2026
CVE-2026-54861: Aguila Technologies WP Customer Area: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila…7.1 HighN/AN/ANov 4, 2026
CVE-2026-119477: Jacob N. Breetvelt WP Photo Album Plus: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacob N7.1 HighN/AN/ANov 4, 2026
CVE-2026-119366: AdvancedCoding wpDiscuz: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AdvancedCoding…7.1 HighN/AN/ANov 4, 2026
CVE-2026-110944: qt Qt Framework: Resource exhaustion vulnerability in the HTTP request handling of the QHttpServer component of Qt HTTP Server.N/A2.7 LowN/ANov 4, 2026
CVE-2026-62000: WC Lovers WCFM Marketplace: Missing Authorization vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Exploiting…7.5 HighN/AN/ANov 4, 2026
CVE-2026-54851: Awesomemotive Contact Form by WPForms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Awesomemotive…7.1 HighN/AN/ANov 4, 2026
CVE-2026-121818: About Time Technologies Herowatch Go: Herowatch Mini developed by About Time Technologies has a system signing vulnerability7.8 High8.5 HighN/ANov 4, 2026
CVE-2026-121817: About Time Technologies Herowatch Go Server: Herowatch Go Server developed by About Time Technologies has a Insecure Direct Object Reference vulnerability7.5 High8.7 HighN/ANov 4, 2026
CVE-2026-121816: About Time Technologies Herowatch Mini: Herowatch Mini developed by About Time Technologies has a Missing Authentication vulnerability8.8 High8.7 HighN/ANov 4, 2026
CVE-2026-77779: Zohocorp ManageEngine Key Manager Plus: ManageEngine Key Manager Plus versions before 7151 were vulnerable to an Improper Access Control vulnerability that…7.7 HighN/AN/ANov 4, 2026
CVE-2026-77690: Zohocorp ManageEngine Key Manager Plus: ZohoCorp ManageEngine Key Manager Plus versions before 7151 were vulnerable to a Command Injection vulnerability that…8.8 HighN/AN/ANov 4, 2026
CVE-2025-11229: WSO2: The system fails to properly enforce scope authorization when the `authorize_all_scopes` configuration is enabled7.2 HighN/AN/ANov 4, 2026
CVE-2026-87044: zephyrproject zephyr: The Mbed TLS crypto shim driver in drivers/crypto/crypto_mbedtls_shim.c drives PSA multipart cipher and AEAD operations6.5 MediumN/AN/ANov 4, 2026
CVE-2026-87043: zephyrproject zephyr: The entropy-device random number generator in subsys/random/random_entropy_device.c returned early with -ENODEV from…4.8 MediumN/AN/ANov 4, 2026
CVE-2026-87041: zephyrproject zephyr: The RTIO submission-queue verifier rtio_vrfy_sqe() in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before…7.8 HighN/AN/ANov 4, 2026
CVE-2026-87040: zephyrproject zephyr: The nRF link-layer receive paths of the open-source Bluetooth LE Controller did not validate the on-air LENGTH field of…8.3 HighN/AN/ANov 4, 2026
CVE-2026-87039: zephyrproject zephyr: The user-mode syscall verifier z_vrfy_i2s_configure() in drivers/i2s/i2s_handlers.c copies the caller's struct…7.8 HighN/AN/ANov 4, 2026
CVE-2026-87038: zephyrproject zephyr: The user-mode verification handler for the i3c_transfer() system call, z_vrfy_i3c_transfer() in…7.0 HighN/AN/ANov 4, 2026
CVE-2026-16511: zephyrproject zephyr: Two RTIO syscall verifiers, in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0), did not…8.8 HighN/AN/ANov 4, 2026
51-75 of 523860
‹›