The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-107147: alexandregz twofactor_gauthenticator: The twofactor_gauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address…N/A6.3 MediumN/AOct 27, 2026
CVE-2026-107146: alexandregz twofactor_gauthenticator: The twofactor_gauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verificationN/A6.3 MediumN/AOct 27, 2026
CVE-2026-107145: alexandregz twofactor_gauthenticator: The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor codeN/A6.3 MediumN/AOct 27, 2026
CVE-2026-102789: balbooa.com Gridbox extension for Joomla: Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2 -…N/A9.3 CriticalN/AOct 27, 2026
CVE-2026-102788: balbooa.com Gridbox extension for Joomla: Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 - On store product list pages, the…N/A9.3 CriticalN/AOct 27, 2026
CVE-2026-102787: phoca.cz Phoca Download extension for Joomla: Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5N/A5.3 MediumN/AOct 27, 2026
CVE-2026-92885: Qode Themes Qode Membership: The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all…9.8 CriticalN/AN/AOct 27, 2026
CVE-2026-65213: SMCI MBD-X12SPI: This issue may allow an IPMI authenticated administrator to execute commands as the operating system root user on the…6.6 MediumN/AN/AOct 27, 2026
CVE-2026-65211: SMCI MBD-X12SPI: This issue may allow an authenticated IPMI Administrator to read and write arbitrary BMC physical memory and thereby…7.2 HighN/AN/AOct 27, 2026
CVE-2026-65220: SMCI MBD-X12SPI: A logic flaw in the BMC IPMI implementation may allow an attacker to send specially crafted RAKP+ messages and escalate…8.8 HighN/AN/AOct 27, 2026
CVE-2026-65219: SMCI MBD-X12SPI: A flaw in the BMC RAKP+ implementation may allow an attacker to send a request followed by a specially crafted RAKP…7.4 HighN/AN/AOct 27, 2026
CVE-2026-65210: SMCI MBD-X12SPI: This issue may allow an authenticated IPMI Administrator to read arbitrary files from the BMC filesystem, disclosing…4.9 MediumN/AN/AOct 27, 2026
CVE-2026-18451: SMCI MBD-X12SPI: The HTML5 KVM-over-IP console authenticates with a token returned by the web interface3.1 LowN/AN/AOct 27, 2026
CVE-2026-18450: SMCI X12SPI: The BMC does not correctly enforce integrity and encryption requirements for IPMI commands9.8 CriticalN/AN/AOct 27, 2026
CVE-2026-18449: SMCI X12SPI: The BMC does not correctly enforce integrity and encryption requirements for IPMI commands7.5 HighN/AN/AOct 27, 2026
CVE-2026-16521: SMCI MBD-X12STW-F: An OS command injection vulnerability exists because of insufficient input filtering7.2 HighN/AN/AOct 27, 2026
CVE-2026-111461: Moxa OnCell G3150A-LTE Series: An OS command injection vulnerability exists in OnCell G3150A-LTE SeriesN/A7.5 HighN/AOct 27, 2026
CVE-2026-111460: Moxa OnCell G3150A-LTE Series: A hard-coded cryptographic key vulnerability exists in the OnCell G3150A-LTE SeriesN/A7.7 HighN/AOct 27, 2026
CVE-2026-111459: Moxa Moxa Remote Connect Suite (MRC Client): An improper certificate validation vulnerability exists in Moxa Remote Connect Suite (MRC Client)N/A7.6 HighN/AOct 27, 2026
CVE-2026-10511: artbees Jupiter X Core: The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'forget_password_link'…6.4 MediumN/AN/AOct 27, 2026
CVE-2026-107472: Qt: An out-of-bounds read vulnerability in the QTextCodec TSCII encoding of the Qt 5 Compatibility APIs module (Qt Core in…N/A4.3 MediumN/AOct 27, 2026
CVE-2026-101034: Broadcom Symantec Ghost Solution Suite: An attacker who obtained the hardcoded key could decrypt domain/service account passwords, task run-as credentials, and…N/A6.8 MediumN/AOct 27, 2026
CVE-2026-75891: themeum: The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to,…8.8 HighN/AN/AOct 27, 2026
CVE-2026-110910: ljharb qs: ### Summary `qs.stringify` with `allowEmptyArrays: true` writes the key of an empty array without encoding it, even…3.7 Low6.3 MediumN/AOct 27, 2026
CVE-2026-105946: qt: Out-of-bounds read in the QAuthenticator NTLM authentication handling in the Qt Network module in Qt Group Qt allows…N/A5.3 MediumN/AOct 27, 2026
51-75 of 417478