The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-103634: Apache Software Foundation Apache DataSketches: Out-of-bounds read and write in the Count-Min sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp)N/AN/A0%Oct 22, 2026
CVE-2026-97328: Unknown WebP Express: The WebP Express WordPress plugin before 0.25.16 does not escape values that its bundled HTML parser re-emits into…7.5 HighN/A0%Oct 22, 2026
CVE-2026-88849: Unknown MasterStudy LMS WordPress Plugin: The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not verify that a user targeted through its…2.7 LowN/A0%Oct 22, 2026
CVE-2026-78392: Unknown Link Library: The Link Library WordPress plugin before 7.9.6 does not sanitise and escape a link field before outputting it inside an…6.8 MediumN/A0%Oct 22, 2026
CVE-2026-114570: WordPress Foundation WordPress: WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2…4.9 MediumN/A0%Oct 22, 2026
CVE-2026-111972: Unknown Photo Engine (Media Organizer & Lightroom): The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not verify that a user is authorised…4.9 MediumN/A0%Oct 22, 2026
CVE-2026-111971: Unknown Photo Engine (Media Organizer & Lightroom): The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not sanitise and escape collection…6.8 MediumN/A0%Oct 22, 2026
CVE-2026-111958: Unknown Royal MCP: The Royal MCP WordPress plugin before 1.5.7 does not limit a preview-link token to the single preview it was issued…7.5 HighN/A0%Oct 22, 2026
CVE-2026-110011: Unknown MB Custom Post Types & Custom Taxonomies: The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform a capability check in its…2.7 LowN/A0%Oct 22, 2026
CVE-2026-110010: Unknown MB Custom Post Types & Custom Taxonomies: The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform any capability or…4.8 MediumN/A0%Oct 22, 2026
CVE-2026-109987: Unknown: The PixelYourSite WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8 do not sanitise and…7.2 HighN/A0%Oct 22, 2026
CVE-2026-109931: Unknown Infility Global: The Infility Global WordPress plugin before 2.16.25 does not perform any authorisation or nonce check on an AJAX action…3.7 LowN/A0%Oct 22, 2026
CVE-2026-109927: Unknown HIPAA Forms: The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when handling a request that rebuilds…7.2 HighN/A0%Oct 22, 2026
CVE-2026-103234: Unknown WP Ultimate Review: The WP Ultimate Review WordPress plugin before 2.4.5 does not neutralise shortcodes in all of the review fields…4.8 MediumN/A0%Oct 22, 2026
CVE-2026-100142: Unknown FluentCart A New Era of eCommerce: The FluentCart A New Era of eCommerce WordPress plugin before 2.2.0 does not verify that a stored customer address…5.3 MediumN/A0%Oct 22, 2026
CVE-2026-114223: NewType Infortech NT OneAPP: NT OneAPP developed by NewType Infortech has an Exposure of Sensitive Information vulnerability5.5 Medium6.7 Medium0%Oct 22, 2026
CVE-2026-114222: NewType Infortech NT OneAPP: NT OneAPP developed by NewType Infortech has an Authentication Bypass vulnerability6.2 Medium6.9 Medium0%Oct 22, 2026
CVE-2026-114221: NewType Infortech NT OneAPP: NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability7.4 High5.9 Medium0%Oct 22, 2026
CVE-2026-114220: NewType Infortech NT OneAPP: NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability9.1 Critical9.3 Critical0%Oct 22, 2026
CVE-2026-114219: NewType Infortech NT OneAPP: NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability7.4 High9.1 Critical0%Oct 22, 2026
CVE-2026-114732: Roundcube Webmail: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in…6.8 MediumN/A0%Oct 22, 2026
CVE-2026-114731: Roundcube Webmail: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption…5.3 MediumN/A0%Oct 22, 2026
CVE-2026-114730: Roundcube Webmail: Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass7.2 HighN/A0%Oct 22, 2026
CVE-2026-114729: Roundcube Webmail: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass5.3 MediumN/A0%Oct 22, 2026
CVE-2026-110354: HAProxy, HAProxy Technologies: HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread…7.5 HighN/A1%Oct 22, 2026
826-850 of 413321
‹›