The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-39741: RelyWP Simple Cloudflare Turnstile: Missing Authorization vulnerability in RelyWP Simple Cloudflare Turnstile simple-cloudflare-turnstile allows Exploiting…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-39735: Crocoblock JetEngine: Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-24533: CozyThemes Cozy Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-22386: Ahmad WP Job Portal: Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured…4.3 MediumN/AN/AOct 29, 2026
CVE-2026-118094: Igor Funa Ad Inserter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-118093: WPFunnels Team Product Feed Manager: Missing Authorization vulnerability in WPFunnels Team Product Feed Manager best-woocommerce-feed allows Exploiting…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-118087: Gemini Labs Site Reviews: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gemini Labs Site…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-113690: BMC BMC IT Service Management Suite: Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01,…N/A4.8 MediumN/AOct 29, 2026
CVE-2026-113689: BMC BMC IT Service Management Suite: Stored cross-site scripting in the SmartIT work-notes feature of BMC IT Service Management Suite versions 25.3.01,…N/A5.1 MediumN/AOct 29, 2026
CVE-2026-113688: BMC BMC IT Service Management Suite: Server-side request forgery in the SmartIT URL-based attachment feature of BMC IT Service Management Suite versions…N/A5.3 MediumN/AOct 29, 2026
CVE-2026-93006: Red Hat: A flaw was found in dnsmasq6.8 MediumN/AN/AOct 29, 2026
CVE-2026-93007: Red Hat: A flaw was found in dnsmasq5.3 MediumN/AN/AOct 29, 2026
CVE-2026-49142: openemr: OpenEMR before 8.5.0 contains an authenticated SQL injection vulnerability in the Syndromic Surveillance module that…8.8 High8.7 HighN/AOct 29, 2026
CVE-2026-93008: Red Hat: A flaw was found in dnsmasq6.8 MediumN/AN/AOct 29, 2026
CVE-2026-5702: SABBATIC SABBATIC app: Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application that allows an attacker can trick an…N/A4.8 MediumN/AOct 29, 2026
CVE-2026-5700: SABBATIC SABBATIC app: Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript…N/A4.8 MediumN/AOct 29, 2026
CVE-2026-5699: SABBATIC SABBATIC app: Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript…N/A4.8 MediumN/AOct 29, 2026
CVE-2026-5698: SABBATIC SABBATIC app: Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript…N/A4.8 MediumN/AOct 29, 2026
CVE-2026-5697: SABBATIC SABBATIC app: Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript…N/A4.8 MediumN/AOct 29, 2026
CVE-2026-119028: oapi-codegen: oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by…8.8 High8.7 HighN/AOct 29, 2026
CVE-2026-119027: oapi-codegen: oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by…7.5 High7.7 HighN/AOct 29, 2026
CVE-2026-119025: sindresorhus, modelcontextprotocol, anomalyco: open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell…7.5 High7.7 HighN/AOct 29, 2026
CVE-2026-109822: Yamaha Corporation NWR100: Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an issue with insecure storage of sensitive…6.5 Medium7.1 HighN/AOct 29, 2026
CVE-2026-97854: Yamaha Corporation NWR100: Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability9.8 Critical9.3 CriticalN/AOct 29, 2026
CVE-2026-103665: Yamaha Corporation Yamaha LAN Monitor for Windows: The installer for Yamaha LAN Monitor for Windows provided by Yamaha Corporation may insecurely load Dynamic Link…7.8 High8.4 HighN/AOct 29, 2026
51-75 of 538495