The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-111735: RT-Labs P-Net: P-Net before 1.0.3 contains an integer underflow in pf_cpm_c_data_ind()N/A7.1 HighN/AOct 29, 2026
CVE-2026-111734: RT-Labs P-Net: P-Net before 1.0.3 does not validate the length of a received Ethernet frame in pf_eth_recv() before reading the…N/A7.1 HighN/AOct 29, 2026
CVE-2026-111733: RT-Labs P-Net: P-Net before 1.0.3 dereferences a NULL AR pointer when handling an implicit read request without a valid target AR UUID…N/A8.7 HighN/AOct 29, 2026
CVE-2026-111732: RT-Labs P-Net: P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data length from a field of the…N/A9.3 CriticalN/AOct 29, 2026
CVE-2026-111731: RT-Labs P-Net: P-Net before 1.0.3 enters an infinite loop when handling a read request for the PDPortDataCheck record with subslot 0…N/A8.7 HighN/AOct 29, 2026
CVE-2026-111730: RT-Labs P-Net: P-Net before 1.0.3 does not validate the LengthPeerStationName field of a CheckPeers block in get_check_peer()N/A7.2 HighN/AOct 29, 2026
CVE-2026-112256: OpenText Advanced Authentication Server: Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server…N/A9.2 CriticalN/AOct 29, 2026
CVE-2026-112255: OpenText Advanced Authentication Server: Initialization of a resource with an insecure default vulnerability in OpenText Advanced Authentication Server allows…N/A2.9 LowN/AOct 29, 2026
CVE-2026-118084: nicdark Hotel Booking: Subscriber Insecure Direct Object References (IDOR) in Hotel Booking <= 3.8 versions.6.5 MediumN/AN/AOct 29, 2026
CVE-2026-118083: Themeum WP Crowdfunding: Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions.7.5 HighN/AN/AOct 29, 2026
CVE-2026-118082: BuddyBoss Buddyboss Platform: Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions.8.8 HighN/AN/AOct 29, 2026
CVE-2026-118081: 10Web 10Web Social Photo Feed: Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions.8.8 HighN/AN/AOct 29, 2026
CVE-2026-118080: Social Snap: Contributor PHP Object Injection in Social Snap <= 1.5.4 versions.8.8 HighN/AN/AOct 29, 2026
CVE-2026-118079: FolioVision FV Flowplayer Video Player: Shop manager PHP Object Injection in FV Flowplayer Video Player <= 8.3.4 versions.7.2 HighN/AN/AOct 29, 2026
CVE-2026-118078: PixelYourSite Product Catalog Feed by PixelYourSite: Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions.7.2 HighN/AN/AOct 29, 2026
CVE-2026-118077: Fast Themes Sastra Essential Addons for Elementor: Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions.7.2 HighN/AN/AOct 29, 2026
CVE-2026-118076: Frisbii Frisbii Pay: Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions.8.8 HighN/AN/AOct 29, 2026
CVE-2026-118075: dbarrere WP Media folders: Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions.8.8 HighN/AN/AOct 29, 2026
CVE-2026-118074: Daman Jeet Finale Lite: Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions.7.2 HighN/AN/AOct 29, 2026
CVE-2026-118073: blazethemes News Kit Elementor Addons: Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions.8.8 HighN/AN/AOct 29, 2026
CVE-2026-116869: myPOS Payments myPOS Checkout: Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions.7.2 HighN/AN/AOct 29, 2026
CVE-2026-116868: BuddyDev BuddyPress Xprofile Custom Field Types: Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3.1 versions.8.8 HighN/AN/AOct 29, 2026
CVE-2026-116867: sosidee Dynamic QR Code &#8211; generator: Contributor PHP Object Injection in Dynamic QR Code &#8211; generator <= 1.0.1 versions.8.8 HighN/AN/AOct 29, 2026
CVE-2026-116866: Dotstore Extra Fees Plugin for WooCommerce: Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 versions.8.8 HighN/AN/AOct 29, 2026
CVE-2026-116865: Gesundheit Bewegt GmbH Zippy: Editor PHP Object Injection in Zippy <= 1.7.0 versions.7.2 HighN/AN/AOct 29, 2026
51-75 of 538495