The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-119466: WPExperts APIExperts Square for WooCommerce: Cross-Site Request Forgery (CSRF) vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Cross…5.4 MediumN/AN/AOct 30, 2026
CVE-2026-65566: Meow Apps AI Engine: Cross-Site Request Forgery (CSRF) vulnerability in Meow Apps AI Engine ai-engine allows Cross Site Request Forgery.This…8.8 HighN/AN/AOct 30, 2026
CVE-2026-119298: schollz croc: croc is a tool that allows any two computers to simply and securely transfer files and folders4.2 MediumN/AN/AOct 30, 2026
CVE-2026-119148: AWS aws-nitro-enclaves-sdk-c: Incomplete string validation in AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow a third party to impersonate the…6.5 Medium8.2 HighN/AOct 30, 2026
CVE-2026-104623: SUSE Rancher: A security vulnerability exists in the authorization handling for the local (management) cluster shell feature of SUSE…6.3 MediumN/AN/AOct 30, 2026
CVE-2026-62055: Liquid Web / StellarWP Event Tickets: Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly…4.3 MediumN/AN/AOct 30, 2026
CVE-2026-119365: bPlugins Media Player Addons for Elementor – Media Player widget for WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Media…6.5 MediumN/AN/AOct 30, 2026
CVE-2026-119116: AWS kmstool-enclave: A use-after-free and double-free issue in the SetClient command handler of the kmstool-enclave sample application of…7.8 High8.7 HighN/AOct 30, 2026
CVE-2026-119367: Liquid Web / StellarWP The Events Calendar: Missing Authorization vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Exploiting…5.4 MediumN/AN/AOct 30, 2026
CVE-2026-61789: bytebase dbhub: DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLiteN/A6.1 MediumN/AOct 30, 2026
CVE-2026-65444: Creative Themes Blocksy Companion: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative Themes…6.5 MediumN/AN/AOct 30, 2026
CVE-2026-61739: socfortress CoPilot: SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs7.5 HighN/AN/AOct 30, 2026
CVE-2026-61737: huajian123 ng-antd-admin: ng-antd-admin is an Angular and NestJS administration system template9.8 CriticalN/AN/AOct 30, 2026
CVE-2026-61730: socfortress CoPilot: SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs9.3 CriticalN/AN/AOct 30, 2026
CVE-2026-61708: socfortress CoPilot: SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs8.5 HighN/AN/AOct 30, 2026
CVE-2026-61627: libass: libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation Alpha/Substation Alpha) subtitle formatN/A7.3 HighN/AOct 30, 2026
CVE-2026-48164: CollaboraOnline online: Collabora Online is a collaborative online office suite based on LibreOffice technology4.7 MediumN/AN/AOct 30, 2026
CVE-2026-45145: chamilo chamilo-lms: Chamilo LMS is an open-source learning management system7.5 HighN/AN/AOct 30, 2026
CVE-2026-45141: chamilo chamilo-lms: Chamilo LMS is an open-source learning management system6.5 MediumN/AN/AOct 30, 2026
CVE-2026-119665: MGdaasLab WHartTest: WHartTest 2.2.0 through 2.8.1 contains a missing authorization vulnerability in ScheduledTaskViewSet and…6.3 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119661: star7th ShowDoc: ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint…4.2 Medium2.3 LowN/AOct 30, 2026
CVE-2026-119657: zyx0814 FilePress: FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated…5.0 Medium2.3 LowN/AOct 30, 2026
CVE-2026-119653: admpub nging: Nging through 5.3.5 contains an information disclosure vulnerability that allows any authenticated backend user to list…4.3 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119649: OrchardCMS Orchard: Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in…7.1 High7.1 HighN/AOct 30, 2026
CVE-2026-119645: easysoft zentaopms: ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated…6.5 Medium7.1 HighN/AOct 30, 2026
51-75 of 413289