The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-104309: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-104308: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to cause a denial of service due to…4.3 MediumN/AN/AOct 29, 2026
CVE-2026-103092: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary SQL commands due…8.8 HighN/AN/AOct 29, 2026
CVE-2026-102590: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due…7.7 HighN/AN/AOct 29, 2026
CVE-2026-101288: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to…8.8 HighN/AN/AOct 29, 2026
CVE-2025-13050: Centreon: Broken Function Level Authorization allows execution of poller post-restart commands by authenticated user5.4 MediumN/AN/AOct 29, 2026
CVE-2026-118084: nicdark Hotel Booking: Subscriber Insecure Direct Object References (IDOR) in Hotel Booking <= 3.8 versions.6.5 MediumN/AN/AOct 29, 2026
CVE-2026-118083: Themeum WP Crowdfunding: Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions.7.5 HighN/AN/AOct 29, 2026
CVE-2026-118082: BuddyBoss Buddyboss Platform: Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions.8.8 HighN/AN/AOct 29, 2026
CVE-2026-118079: FolioVision FV Flowplayer Video Player: Shop manager PHP Object Injection in FV Flowplayer Video Player <= 8.3.4 versions.7.2 HighN/AN/AOct 29, 2026
CVE-2026-118078: PixelYourSite Product Catalog Feed by PixelYourSite: Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions.7.2 HighN/AN/AOct 29, 2026
CVE-2026-118077: Fast Themes Sastra Essential Addons for Elementor: Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions.7.2 HighN/AN/AOct 29, 2026
CVE-2026-118074: Daman Jeet Finale Lite: Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions.7.2 HighN/AN/AOct 29, 2026
CVE-2026-118073: blazethemes News Kit Elementor Addons: Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions.8.8 HighN/AN/AOct 29, 2026
CVE-2026-116869: myPOS Payments myPOS Checkout: Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions.7.2 HighN/AN/AOct 29, 2026
CVE-2026-116866: Dotstore Extra Fees Plugin for WooCommerce: Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 versions.8.8 HighN/AN/AOct 29, 2026
CVE-2026-116865: Gesundheit Bewegt GmbH Zippy: Editor PHP Object Injection in Zippy <= 1.7.0 versions.7.2 HighN/AN/AOct 29, 2026
CVE-2026-116864: Arni Cinco WPCargo Track & Trace: Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions.7.2 HighN/AN/AOct 29, 2026
CVE-2026-62131: Zoho Flow: Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-62016: ThemeREX Gamic: Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-62015: ThemeREX Gamezone: Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-62014: ThemeREX EmojiNation: Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-62011: ThemeREX Bonbon: Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-62010: ThemeREX Avventure: Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-62009: ThemeREX Filmax: Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.9.8 CriticalN/AN/AOct 29, 2026
826-850 of 418318