The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-90629: Apache Software Foundation Apache OpenOffice: An uncontrolled memory access in the WMF import code of Apache OpenOffice versions through 4.1.16 allows a crafted WMF…N/AN/AN/ANov 4, 2026
CVE-2026-90628: Apache Software Foundation Apache OpenOffice: An uncontrolled memory access in the PDF export code of Apache OpenOffice versions through 4.1.16 allows a crafted CFF…N/AN/AN/ANov 4, 2026
CVE-2026-90627: Apache Software Foundation Apache OpenOffice: The flat file database driver in Apache Openoffice versions through 4.1.16 allows a crafted document to read the…N/AN/AN/ANov 4, 2026
CVE-2026-90626: Apache Software Foundation Apache OpenOffice: An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF…N/AN/AN/ANov 4, 2026
CVE-2026-90624: Apache Software Foundation Apache OpenOffice: An unchecked memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 on allows a crafted PDF…N/AN/AN/ANov 4, 2026
CVE-2026-59268: Apache Software Foundation Apache OpenOffice: An out-of-bounds Write vulnerability in Apache OpenOffice versions through 4.1.16 could allow an attacker to craft a…N/AN/AN/ANov 4, 2026
CVE-2026-95649: I.R.I.S S.A. IRISPowerscan: IRISPowerscan insufficiently restrict the use of untrusted scriptsN/A6.1 MediumN/ANov 4, 2026
CVE-2026-94460: I.R.I.S S.A. IRISPowerscan: IRISPowerscan contain an insecure default configuration where the built-in installation account is assigned elevated…N/A7.2 HighN/ANov 4, 2026
CVE-2026-94459: I.R.I.S S.A. IRISPowerscan: IRISPowerscan contain default user accounts with predictable credentialsN/A7.2 HighN/ANov 4, 2026
CVE-2026-93900: elliotvs Simple CAPTCHA with Cloudflare Turnstile: The Simple CAPTCHA with Cloudflare Turnstile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…6.4 MediumN/AN/ANov 4, 2026
CVE-2026-120554: carazo Import and export users and customers: The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up…8.8 HighN/AN/ANov 4, 2026
CVE-2026-120422: Sogou Sogou Input Method: Sogou Input Method for Windows contains a vulnerability in the configuration retrieval mechanism of its SGTool.exe…N/A8.9 HighN/ANov 4, 2026
CVE-2026-115498: wingerspeed Slim Jetpack: The Slim Jetpack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'g<PAGE_ID>-website (Website…7.2 HighN/AN/ANov 4, 2026
CVE-2026-111822: Apache Software Foundation: Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime ConfigN/AN/AN/ANov 4, 2026
CVE-2026-111821: Apache Software Foundation: Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDBN/AN/AN/ANov 4, 2026
CVE-2026-111040: Coupa Coupa Total Spend Management Platform: The platform allows persistent HTML injection into editable fields managed by TinyMCEN/A5.1 MediumN/ANov 4, 2026
CVE-2026-111038: Coupa Coupa Total Spend Management Platform: CSV formula injection vulnerability in the export functionality of the Coupa Supplier Portal SaaS platformN/A7.3 HighN/ANov 4, 2026
CVE-2026-111037: Coupa Coupa Total Spend Management Platform: A reflected Cross-Site Scripting (XSS) vulnerability in the Tenders module of the Coupa Supplier Portal SaaS platformN/A5.1 MediumN/ANov 4, 2026
CVE-2026-111036: Coupa Coupa Total Spend Management Platform: Server-side request forgery (SSRF) vulnerability in the Coupa Supplier Portal SaaS platform, specifically in the…N/A8.4 HighN/ANov 4, 2026
CVE-2026-110935: Phoenix Contact PLCnext Engineer: The PFI plugin framework deployment routine does not validate path components when extracting archive entries to the…8.4 High8.6 HighN/ANov 4, 2026
CVE-2026-110022: Phoenix Contact PLCnext Engineer: The PFI plugin framework deploys executable assemblies (DLLs) from a signed plugin package into the local plugin…8.4 High8.6 HighN/ANov 4, 2026
CVE-2026-110021: Phoenix Contact PLCnext Engineer: PLCnext Engineer checks GSDX manifest reference digests but does not cryptographically verify the XML `SignatureValue`…6.2 Medium6.9 MediumN/ANov 4, 2026
CVE-2026-108949: Apache Software Foundation: Denial of Service via OOM vulnerability in Apache ActiveMQ, ActiveMQ BrokerN/AN/AN/ANov 4, 2026
CVE-2026-19731: TÜBİTAK BİLGEM Software Technologies Research Institute İmzager: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TÜBİTAK BİLGEM Software…3.3 LowN/AN/ANov 4, 2026
CVE-2026-19721: TÜBİTAK BİLGEM Software Technologies Research Institute İmzager: Improper restriction of XML external entity reference vulnerability in TÜBİTAK BİLGEM Software Technologies Research…3.3 LowN/AN/ANov 4, 2026
51-75 of 426484
‹›