The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-111881: FreeRDP: FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride…7.6 High7.2 HighN/AOct 17, 2026
CVE-2026-111880: FreeRDP: FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that…7.4 High8.3 HighN/AOct 17, 2026
CVE-2026-110882: Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications: Missing Authorization vulnerability in Cozy Vision Technologies Pvt4.3 MediumN/AN/AOct 17, 2026
CVE-2025-71435: coder: Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access…4.2 Medium2.3 LowN/AOct 17, 2026
CVE-2024-58398: coder: Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in…4.3 Medium5.3 MediumN/AOct 17, 2026
CVE-2026-109701: PAYCOMET PAYCOMET for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PAYCOMET PAYCOMET…7.1 HighN/AN/AOct 17, 2026
CVE-2026-110889: Gantry Gantry 5 Framework: Generation of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framework gantry5 allows…7.5 HighN/AN/AOct 17, 2026
CVE-2026-111110: stiofansisland: The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored…7.2 HighN/AN/AOct 17, 2026
CVE-2026-110253: boldgrid weForms – Easy Drag & Drop Contact Form Builder For WordPress: The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media…5.4 MediumN/AN/AOct 17, 2026
CVE-2026-109983: wssoffice21 YMC Filter: The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'post_title'…6.4 MediumN/AN/AOct 17, 2026
CVE-2026-100316: davidanderson European VAT Compliance Assistant for WooCommerce: The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting…7.2 HighN/AN/AOct 17, 2026
CVE-2026-110384: Heateor Support Fancy Comments WordPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support…7.1 HighN/AN/AOct 17, 2026
CVE-2026-97314: Unknown ThirstyAffiliates: The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its…N/AN/AN/AOct 17, 2026
CVE-2026-92433: Unknown Patreon WordPress: The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account,…N/AN/AN/AOct 17, 2026
CVE-2026-92432: Unknown Patreon WordPress: The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting,…N/AN/AN/AOct 17, 2026
CVE-2026-92431: Unknown Patreon WordPress: The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality,…N/AN/AN/AOct 17, 2026
CVE-2026-91074: Unknown BSK PDF Manager: The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter before using it in…N/AN/AN/AOct 17, 2026
CVE-2026-81344: Unknown ACF Frontend Admin by DynamiApps: The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be…N/AN/AN/AOct 17, 2026
CVE-2026-81343: Unknown ACF Frontend Admin by DynamiApps: The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on one of its…N/AN/AN/AOct 17, 2026
CVE-2026-110527: Unknown WP User Manager: The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account it creates during…N/AN/AN/AOct 17, 2026
CVE-2026-106470: Unknown WP Data Access: The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions,…N/AN/AN/AOct 17, 2026
CVE-2026-104246: Unknown Contact Form 7 Signature Addon: The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before…N/AN/AN/AOct 17, 2026
CVE-2026-104122: Unknown Ukr-To-Lat: The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query,…N/AN/AN/AOct 17, 2026
CVE-2026-103376: Unknown: The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)…N/AN/AN/AOct 17, 2026
CVE-2026-96660: wpeverest: The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom…7.2 HighN/AN/AOct 17, 2026
51-75 of 552532
‹›