The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-110893: Brainstorm Force SureDash: Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured…5.3 MediumN/A0%Oct 22, 2026
CVE-2026-114460: pbuchbinder mod_qos: A flaw was found in mod_qos5.3 MediumN/A0%Oct 22, 2026
CVE-2026-114459: pbuchbinder mod_qos: A flaw was found in mod_qos3.7 LowN/A0%Oct 22, 2026
CVE-2026-114458: pbuchbinder mod_qos: A flaw was found in mod_qos5.9 MediumN/A0%Oct 22, 2026
CVE-2026-114457: pbuchbinder mod_qos: A flaw was found in mod_qos3.7 LowN/A0%Oct 22, 2026
CVE-2026-114184: WPVibes Elementor Addon Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes Elementor…6.5 MediumN/A0%Oct 22, 2026
CVE-2026-114182: IdeaBox Creations PowerPack Addons for Elementor: Missing Authorization vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor…4.3 MediumN/A0%Oct 22, 2026
CVE-2026-114180: Wpmet Metform: Missing Authorization vulnerability in Wpmet Metform metform allows Exploiting Incorrectly Configured Access Control…5.3 MediumN/A0%Oct 22, 2026
CVE-2026-114177: Xpro Xpro Elementor Addons: Cross-Site Request Forgery (CSRF) vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Cross Site…8.8 HighN/A0%Oct 22, 2026
CVE-2026-114175: DigitalME eRoom: Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meetings-webinar allows Exploiting Incorrectly…5.4 MediumN/A0%Oct 22, 2026
CVE-2026-112867: H5P: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in H5P H5P h5p…6.5 MediumN/A0%Oct 22, 2026
CVE-2026-112843: WP Chill Strong Testimonials: Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly…4.3 MediumN/A0%Oct 22, 2026
CVE-2026-112826: eLightUp Falcon – WordPress Optimizations & Tweaks: Missing Authorization vulnerability in eLightUp Falcon – WordPress Optimizations & Tweaks falcon allows Exploiting…5.3 MediumN/A0%Oct 22, 2026
CVE-2026-111847: Kings Plugins MarketKing: Missing Authorization vulnerability in Kings Plugins MarketKing marketking-multivendor-marketplace-for-woocommerce…5.4 MediumN/A0%Oct 22, 2026
CVE-2026-105270: arekinath, handnot2, dropbox esaml: Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml allows an…N/A8.7 High0%Oct 22, 2026
CVE-2026-103634: Apache Software Foundation Apache DataSketches: Out-of-bounds read and write in the Count-Min sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp)N/AN/A0%Oct 22, 2026
CVE-2026-97328: Unknown WebP Express: The WebP Express WordPress plugin before 0.25.16 does not escape values that its bundled HTML parser re-emits into…7.5 HighN/A0%Oct 22, 2026
CVE-2026-88849: Unknown MasterStudy LMS WordPress Plugin: The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not verify that a user targeted through its…2.7 LowN/A0%Oct 22, 2026
CVE-2026-78392: Unknown Link Library: The Link Library WordPress plugin before 7.9.6 does not sanitise and escape a link field before outputting it inside an…6.8 MediumN/A0%Oct 22, 2026
CVE-2026-114570: WordPress Foundation WordPress: WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2…4.9 MediumN/A0%Oct 22, 2026
CVE-2026-111972: Unknown Photo Engine (Media Organizer & Lightroom): The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not verify that a user is authorised…4.9 MediumN/A0%Oct 22, 2026
CVE-2026-111971: Unknown Photo Engine (Media Organizer & Lightroom): The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not sanitise and escape collection…6.8 MediumN/A0%Oct 22, 2026
CVE-2026-111958: Unknown Royal MCP: The Royal MCP WordPress plugin before 1.5.7 does not limit a preview-link token to the single preview it was issued…7.5 HighN/A0%Oct 22, 2026
CVE-2026-110011: Unknown MB Custom Post Types & Custom Taxonomies: The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform a capability check in its…2.7 LowN/A0%Oct 22, 2026
CVE-2026-110010: Unknown MB Custom Post Types & Custom Taxonomies: The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform any capability or…4.8 MediumN/A0%Oct 22, 2026
776-800 of 545063
‹›