The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-107789: Unknown SmartyParcel: The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label…5.3 MediumN/A0%Oct 21, 2026
CVE-2026-107788: Unknown SmartyParcel: The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label…4.3 MediumN/A0%Oct 21, 2026
CVE-2026-107506: Unknown Simple Banner: The Simple Banner WordPress plugin before 3.3.3 does not correctly limit the capabilities it grants to the user roles…7.5 HighN/A0%Oct 21, 2026
CVE-2026-107237: Unknown Backup and Staging by WP Time Capsule: The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks…8.2 HighN/A0%Oct 21, 2026
CVE-2026-107128: Unknown Uncanny Toolkit for LearnDash: The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to…5.0 MediumN/A0%Oct 21, 2026
CVE-2026-107127: Unknown Uncanny Toolkit for LearnDash: The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset…7.5 HighN/A0%Oct 21, 2026
CVE-2026-106932: Unknown Moloni: The Moloni WordPress plugin before 5.0.14 does not perform capability or nonce checks on several of its authenticated…6.5 MediumN/A0%Oct 21, 2026
CVE-2026-105999: Unknown Booking Package: The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning…5.3 MediumN/A0%Oct 21, 2026
CVE-2026-105998: Unknown Booking Package: The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before…5.3 MediumN/A0%Oct 21, 2026
CVE-2026-105996: Unknown Booking Package: The Booking Package WordPress plugin before 1.7.31 does not generate booking cancellation tokens using a secure source…4.8 MediumN/A0%Oct 21, 2026
CVE-2026-105992: Unknown Ettrick Escape Room Booking: The Ettrick Escape Room Booking WordPress plugin before 1.3.1 does not verify a booking's payment status against the…5.3 MediumN/A0%Oct 21, 2026
CVE-2026-105262: Unknown Falang multilanguage for WordPress: The Falang multilanguage for WordPress plugin before 1.4.6 does not perform a capability check when saving term…8.0 HighN/A0%Oct 21, 2026
CVE-2026-105257: Unknown Appointment Booking Plugin: The Appointment Booking Plugin WordPress plugin before 5.7.5 does not verify that an authenticated agent-level user is…2.7 LowN/A0%Oct 21, 2026
CVE-2026-103302: Unknown Payment Gateway for Idram: The Payment Gateway for Idram WordPress plugin before 2.1.6 does not verify the authenticity of incoming payment…5.3 MediumN/A0%Oct 21, 2026
CVE-2026-102499: Unknown: The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before…7.7 HighN/A0%Oct 21, 2026
CVE-2026-100145: Unknown Synchrony Financing: The Synchrony Financing WordPress plugin before 1.1.2 does not properly authorise requests to one of its REST routes…6.5 MediumN/A0%Oct 21, 2026
CVE-2026-82819: Cerberus Cerberus FTP Server: A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a…N/A7.1 High0%Oct 21, 2026
CVE-2026-92824: Red Hat: A flaw was found in libmodulemd6.2 MediumN/A0%Oct 21, 2026
CVE-2026-92823: Red Hat: A flaw was found in libmodulemd6.2 MediumN/A0%Oct 21, 2026
CVE-2026-92822: Red Hat: A flaw was found in libmodulemd6.2 MediumN/A0%Oct 21, 2026
CVE-2026-114040: DT42 BerryNet: A security vulnerability has been detected in DT42 BerryNet up to 3.10.23.5 Low2.0 Low0%Oct 21, 2026
CVE-2026-114039: projectworlds Advanced Library Management System: A weakness has been identified in projectworlds Advanced Library Management System 1.06.3 Medium2.1 Low0%Oct 21, 2026
CVE-2026-82814: smub, Duplicator: The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to,…8.8 HighN/A1%Oct 21, 2026
CVE-2026-113744: Tenda AC19: A security vulnerability has been detected in Tenda AC19 16.03.10.0710.0 Critical9.3 Critical1%Oct 21, 2026
CVE-2026-113743: Tenstorrent tt-metal: A weakness has been identified in Tenstorrent tt-metal up to 0.80.06.3 Medium2.1 Low0%Oct 21, 2026
726-750 of 526573
‹›