The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-111398: PT Norther Lights Production MapSVG: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PT Norther Lights…7.7 HighN/AN/AOct 19, 2026
CVE-2026-110898: WPDeveloper Essential Addons for Elementor: Incorrect Privilege Assignment vulnerability in WPDeveloper Essential Addons for Elementor…6.4 MediumN/AN/AOct 19, 2026
CVE-2026-111407: Themeum Tutor LMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS…6.5 MediumN/AN/AOct 19, 2026
CVE-2026-111408: ExpressTech Quiz And Survey Master: Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object…8.8 HighN/AN/AOct 19, 2026
CVE-2026-110379: Ays Pro Quiz Maker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Quiz…7.1 HighN/AN/AOct 19, 2026
CVE-2026-111406: PT Norther Lights Production MapSVG: Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG…9.9 CriticalN/AN/AOct 19, 2026
CVE-2026-112094: michaelrsweet mxml: A security vulnerability has been detected in michaelrsweet mxml 4.0.5/4.0.65.5 Medium2.0 LowN/AOct 19, 2026
CVE-2026-112093: subhajitkhan online-clinic-management-system: A vulnerability has been found in subhajitkhan online-clinic-management-system up to…4.3 Medium2.1 LowN/AOct 19, 2026
CVE-2026-112092: subhajitkhan online-clinic-management-system: A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a5784.3 Medium2.1 LowN/AOct 19, 2026
CVE-2026-112091: Dav-ee dairy-management-system: A flaw has been found in Dav-ee dairy-management-system…5.3 Medium5.5 MediumN/AOct 19, 2026
CVE-2026-112090: Dav-ee dairy-management-system: A vulnerability was detected in Dav-ee dairy-management-system…6.3 Medium2.1 LowN/AOct 19, 2026
CVE-2026-111439: openGauss-server: 在 openGauss-server的 src/common/backend/utils/adt/genfile.cpp 模块中，内置函数 pg_read_binary_file_blocks()…4.3 MediumN/AN/AOct 19, 2026
CVE-2026-110034: Unknown Salon Booking System: The Salon Booking System WordPress plugin before 10.31.11 does not enforce a minimum of zero when subtracting a…3.7 LowN/AN/AOct 19, 2026
CVE-2026-106010: Unknown BDM Digital Payment Gateway: The BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not verify the credentials on its public…5.3 MediumN/AN/AOct 19, 2026
CVE-2026-103311: Unknown Coinbase Commerce Payment Gateway for WooCommerce: The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not verify the authenticity…5.3 MediumN/AN/AOct 19, 2026
CVE-2026-94294: Unknown App Builder: The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing…5.3 MediumN/AN/AOct 19, 2026
CVE-2026-94272: Unknown Snap Finance: The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status…5.3 MediumN/AN/AOct 19, 2026
CVE-2026-94231: Unknown TrueBooker: The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in place in some of its functionality,…5.3 MediumN/AN/AOct 19, 2026
CVE-2026-94230: Unknown TrueBooker: The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in some of its AJAX actions, and does…5.3 MediumN/AN/AOct 19, 2026
CVE-2026-94229: Unknown TrueBooker: The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its…5.3 MediumN/AN/AOct 19, 2026
CVE-2026-94228: Unknown TrueBooker: The TrueBooker WordPress plugin before 1.3.0 does not perform any capability check on one of its setup handlers, and…5.3 MediumN/AN/AOct 19, 2026
CVE-2026-91831: Unknown Subscribe to Comments: The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification…3.8 LowN/AN/AOct 19, 2026
CVE-2026-86791: Unknown iPOSpays Payment Gateway for WooCommerce: The iPOSpays Payment Gateway for WooCommerce WordPress plugin before 1.4.7 does not verify that a payment was actually…5.3 MediumN/AN/AOct 19, 2026
CVE-2026-74922: Unknown Document Gallery: The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook…5.3 MediumN/AN/AOct 19, 2026
CVE-2026-74921: Unknown Document Gallery: The Document Gallery WordPress plugin through 5.1.1 does not sanitise or escape several gallery shortcode attributes…6.8 MediumN/AN/AOct 19, 2026
51-75 of 409174
‹›