The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-123317: JetBrains Ktor: In JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookies8.1 HighN/AN/ANov 6, 2026
CVE-2026-123307: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 unauthenticated connection to an arbitrary host via run…6.8 MediumN/AN/ANov 6, 2026
CVE-2026-123306: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3 improper checks allowed server certificates to be added to the trust store…7.4 HighN/AN/ANov 6, 2026
CVE-2026-123297: JetBrains Hub: In JetBrains Hub before 2026.2.52519 two-factor authentication bypass was possible via the password reset flow6.8 MediumN/AN/ANov 6, 2026
CVE-2026-123295: JetBrains Hub: In JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the profile update…8.1 HighN/AN/ANov 6, 2026
CVE-2026-84155: Ericsson CodeChecker: CodeChecker's web server fails to fully invalidate a session token on logout when the server runs with more than one…N/A5.3 MediumN/ANov 6, 2026
CVE-2026-66294: qcam saxy: XML injection in the Saxy XML encoderN/A2.1 LowN/ANov 6, 2026
CVE-2026-66295: qcam saxy: Saxy's XML encoder writes the target and the content of a processing instruction into the output document verbatim,…N/A2.1 LowN/ANov 6, 2026
CVE-2026-66293: qcam saxy: XML injection in the encoder of SaxyN/A2.1 LowN/ANov 6, 2026
WordPress Plugin: wp-parsidate: CVE-2026-97642: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')6.4 MediumN/A0%Nov 6, 2026
WordPress Plugin: webappick-product-feed-for-woocommerce: CVE-2026-87964: Improper Control of Generation of Code ('Code Injection')7.2 HighN/A1%Nov 6, 2026
CVE-2026-123087: Atmira SIREC: SQL injection vulnerability in Atmira’s SIRECN/A8.7 High0%Nov 6, 2026
WordPress Plugin: wpcf7-redirect: CVE-2026-120659: Missing Authorization5.3 MediumN/A0%Nov 6, 2026
WordPress Plugin: wp-user-manager: CVE-2026-120550: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')6.4 MediumN/A0%Nov 6, 2026
CVE-2026-120474: undici: undici is an HTTP client for Node.js6.5 MediumN/A0%Nov 6, 2026
CVE-2026-120423: undici: undici is an HTTP client for Node.js5.9 MediumN/AN/ANov 6, 2026
CVE-2026-120415: undici: undici is an HTTP client for Node.js5.9 MediumN/AN/ANov 6, 2026
CVE-2026-120222: undici: undici is an HTTP client for Node.js5.9 MediumN/AN/ANov 6, 2026
CVE-2026-116592: undici: undici is an HTTP client for Node.js7.4 HighN/AN/ANov 6, 2026
WordPress Plugin: wp-meta-data-filter-and-taxonomy-filter: CVE-2026-110776: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')7.2 HighN/A0%Nov 6, 2026
WordPress Plugin: yaysmtp: CVE-2026-109977: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')4.9 MediumN/A0%Nov 6, 2026
CVE-2026-33379: Grafana: A user with any role, including Viewer or a service account with no permissions, can create, externally publish, and…8.5 HighN/AN/ANov 6, 2026
WordPress Plugin: vod-infomaniak: CVE-2026-115831: Missing Authorization4.3 MediumN/A0%Nov 6, 2026
WordPress Plugin: wp-event-solution: CVE-2026-109994: Missing Authorization6.5 MediumN/A0%Nov 6, 2026
CVE-2026-19877: INFINITT Healthcare INFINITT ULite: INFINITT ULite 5.0.2.1_BN48_20260528 and earlier protects image-share links with a low-entropy password and does not…7.5 HighN/A0%Nov 6, 2026
826-850 of 423316
‹›