The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-118458: CompuGroup Medical: The shared AIS login routing selects a production-shipped test DAO and plaintext comparison for the H and V application…N/A8.1 HighN/ANov 9, 2026
CVE-2026-118450: CompuGroup Medical Venere: Venere is installed outside Program Files and loads/registers unsigned components from locations where an unprivileged…N/A5.9 MediumN/ANov 9, 2026
CVE-2026-112172: CompuGroup Medical: CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated attackers to manipulate session…N/A8.1 HighN/ANov 9, 2026
CVE-2026-124621: kongxin-github Java_Library_Management_System: A vulnerability was determined in kongxin-github Java_Library_Management_System up to…7.4 High2.1 LowN/ANov 9, 2026
CVE-2026-124591: n/a Bahleel: A vulnerability was detected in Bahleel 0.1.0/0.1.15.5 Medium5.1 MediumN/ANov 9, 2026
CVE-2026-124590: zhangbw409 library_manager_system: A security vulnerability has been detected in zhangbw409 library_manager_system…7.3 High5.5 MediumN/ANov 9, 2026
CVE-2026-123779: Apache Software Foundation Apache Axis2/Java: Direct Request ('Forced Browsing') vulnerability in Apache Axis2/JavaN/AN/AN/ANov 9, 2026
CVE-2026-123770: Apache Software Foundation Apache Axis2/Java: Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/JavaN/AN/AN/ANov 9, 2026
CVE-2026-123766: Apache Software Foundation Apache Axis2/Java: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability in the OpenAPI module…N/AN/AN/ANov 9, 2026
CVE-2026-123753: Apache Software Foundation Apache Axis2/Java: Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/JavaN/AN/AN/ANov 9, 2026
CVE-2026-123476: fifu.app Featured Image from URL: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fifu.app Featured…7.1 HighN/AN/ANov 9, 2026
CVE-2026-123475: PT Norther Lights Production MapSVG: Missing Authorization vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows…7.5 HighN/AN/ANov 9, 2026
CVE-2026-123460: Nickboss WordPress File Upload: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss…7.1 HighN/AN/ANov 9, 2026
CVE-2026-122666: Kitae Park Mang Board WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kitae Park Mang…7.1 HighN/AN/ANov 9, 2026
CVE-2026-122665: Kitae Park Mang Board WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kitae Park Mang…6.5 MediumN/AN/ANov 9, 2026
CVE-2026-122661: wpWax Directorist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Directorist…6.5 MediumN/AN/ANov 9, 2026
CVE-2026-121782: If-So Dynamic Content If-So Dynamic Content Personalization: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic…7.1 HighN/AN/ANov 9, 2026
CVE-2026-121722: WP E-Signature Formidable Forms Signature Online Contract Automation: Missing Authorization vulnerability in WP E-Signature Formidable Forms Signature Online Contract Automation…7.5 HighN/AN/ANov 9, 2026
CVE-2026-121570: WP Chill RSVP and Event Management: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill RSVP and…7.1 HighN/AN/ANov 9, 2026
CVE-2026-120855: TemplateInvaders TI WooCommerce Wishlist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TemplateInvaders…6.5 MediumN/AN/ANov 9, 2026
CVE-2026-120838: Plugins360 Labs All-in-One Video Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugins360 Labs…6.5 MediumN/AN/ANov 9, 2026
CVE-2026-120832: Apache Software Foundation Apache Axis2/Java: Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/JavaN/AN/AN/ANov 9, 2026
CVE-2026-120761: Apache Software Foundation Apache Axis2/Java: Improper Restriction of XML External Entity Reference vulnerability in Apache Axis2/JavaN/AN/AN/ANov 9, 2026
CVE-2026-120367: Apache Software Foundation Apache Axis2/Java: Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/JavaN/AN/AN/ANov 9, 2026
CVE-2026-119524: Aguila Technologies WP Customer Area: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila…6.5 MediumN/AN/ANov 9, 2026
51-75 of 431917
‹›