The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-123292: In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid2.7 LowN/AN/ANov 6, 2026
CVE-2026-123291: Authorization Bypass Through User-Controlled Key4.3 MediumN/AN/ANov 6, 2026
CVE-2026-123290: Insertion of Sensitive Information Into Sent Data5.3 MediumN/AN/ANov 6, 2026
CVE-2026-123289: Incorrect Authorization5.4 MediumN/AN/ANov 6, 2026
CVE-2026-123288: Cross-site Scripting (XSS)5.4 MediumN/AN/ANov 6, 2026
CVE-2026-123287: Incorrect Authorization5.9 MediumN/AN/ANov 6, 2026
CVE-2026-123286: Incorrect Authorization5.9 MediumN/AN/ANov 6, 2026
CVE-2026-123285: Argument Injection6.3 MediumN/AN/ANov 6, 2026
CVE-2026-123284: Incorrect Authorization6.5 MediumN/AN/ANov 6, 2026
CVE-2026-123283: In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account6.8 MediumN/AN/ANov 6, 2026
CVE-2026-123282: Operation on a Resource after Expiration or Release7.4 HighN/AN/ANov 6, 2026
CVE-2026-123281: Argument Injection7.5 HighN/AN/ANov 6, 2026
CVE-2026-123280: Incorrect Authorization8.1 HighN/AN/ANov 6, 2026
CVE-2026-123279: Incorrect Authorization9.0 CriticalN/AN/ANov 6, 2026
CVE-2026-123278: Missing Authentication for Critical Function6.7 MediumN/AN/ANov 6, 2026
CVE-2026-123277: Missing Authentication for Critical Function5.0 MediumN/AN/ANov 6, 2026
CVE-2026-123276: Inclusion of Functionality from Untrusted Control Sphere7.8 HighN/AN/ANov 6, 2026
CVE-2026-116630: undici is an HTTP client for Node.js5.9 MediumN/AN/ANov 6, 2026
CVE-2026-115701: Allocation of Resources Without Limits or ThrottlingN/A8.2 HighN/ANov 6, 2026
CVE-2026-113431: Allocation of Resources Without Limits or ThrottlingN/A8.7 HighN/ANov 6, 2026
CVE-2026-97642: man4toman Parsi Date | بسته فارسی ساز وردپرس و ووکامرس پارسی دیت: The Wp Parsidate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the calendar Gutenberg block's…6.4 MediumN/AN/ANov 6, 2026
CVE-2026-87964: wahid0003: The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels plugin for WordPress…7.2 HighN/AN/ANov 6, 2026
CVE-2026-33379: Missing Authorization8.5 HighN/AN/ANov 6, 2026
CVE-2026-123087: Atmira SIREC: SQL injection vulnerability in Atmira’s SIRECN/A8.7 HighN/ANov 6, 2026
CVE-2026-120659: themeisle Redirection for Contact Form 7: The Redirection for Contact Form 7 plugin for WordPress is vulnerable to authorization bypass in all versions up to,…5.3 MediumN/AN/ANov 6, 2026
51-75 of 423114
‹›