The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
WordPress Plugin: wp-event-solution: CVE-2026-109994: Missing Authorization6.5 MediumN/A0%Nov 6, 2026
WordPress Plugin: yaysmtp: CVE-2026-109977: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')4.9 MediumN/A0%Nov 6, 2026
CVE-2026-33379: Grafana: A user with any role, including Viewer or a service account with no permissions, can create, externally publish, and…8.5 HighN/A0%Nov 6, 2026
WordPress Plugin: vod-infomaniak: CVE-2026-115831: Missing Authorization4.3 MediumN/A0%Nov 6, 2026
CVE-2026-19877: INFINITT Healthcare INFINITT ULite: INFINITT ULite 5.0.2.1_BN48_20260528 and earlier protects image-share links with a low-entropy password and does not…7.5 HighN/A0%Nov 6, 2026
CVE-2026-19876: INFINITT Healthcare INFINITT ULite: A reflected cross-site scripting (XSS) vulnerability in the login/SSO error page of INFINITT ULite…6.1 MediumN/A0%Nov 6, 2026
CVE-2026-123660: vulnerability-lookup: In Vulnerability-Lookup 5.5.1 up to but not including 6.4.1, a signed-in user could make the server allocate memory far…N/A5.3 Medium0%Nov 6, 2026
WordPress Plugin: permalink-manager: CVE-2026-122222: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')6.4 MediumN/A0%Nov 6, 2026
WordPress Plugin: userswp: CVE-2026-120671: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')6.4 MediumN/A0%Nov 6, 2026
WordPress Plugin: posts-data-table: CVE-2026-118189: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')6.4 MediumN/A0%Nov 6, 2026
WordPress Plugin: graphina-elementor-charts-and-graphs: CVE-2026-110291: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')7.2 HighN/A0%Nov 6, 2026
CVE-2026-108018: HCLSoftware BigFix MCM & Mobile: The BigFix MCM admin portal is directly accessible from the internet without VPN or network restriction6.3 MediumN/A0%Nov 6, 2026
CVE-2026-103682: Checkmk GmbH Checkmk: Invocation of the Jolokia special agent with the login password in the command line in Checkmk versions 2.5.0 before…N/A2.0 Low0%Nov 6, 2026
CVE-2026-103674: Checkmk GmbH Checkmk: Invocation of the NetApp ONTAP special agent with the login password in the command line in Checkmk version 2.5.0…N/A2.0 Low0%Nov 6, 2026
WordPress Plugin: tour-booking-manager: CVE-2026-121794: Missing Authorization6.5 MediumN/A0%Nov 6, 2026
CVE-2026-88801: Unknown: The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check a capability or a…8.0 HighN/A0%Nov 6, 2026
CVE-2026-88800: Unknown: The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on…9.1 CriticalN/A0%Nov 6, 2026
CVE-2026-88799: Unknown: The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check ownership or…8.8 HighN/A0%Nov 6, 2026
CVE-2026-65022: HCLSoftware BigFix MCM & Mobile: The MDM App Catalog / App Store preview does not properly sanitize or encode user-supplied HTML before rendering it6.3 MediumN/A0%Nov 6, 2026
CVE-2026-39744: WC Lovers WCFM Membership: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WC Lovers WCFM…7.1 HighN/A0%Nov 6, 2026
CVE-2026-121824: LY Corporation Armeria: A vulnerability has been identified in armeria versions prior to 1.43.0, where processing malformed Thrift messages can…N/A8.7 High0%Nov 6, 2026
CVE-2026-121823: LY Corporation Armeria: A vulnerability has been identified in armeria versions prior to 1.43.0, where inconsistent request path normalization…N/A8.7 High0%Nov 6, 2026
CVE-2026-121822: LY Corporation Armeria: A vulnerability has been identified in armeria versions 0.80.0 through 1.42.0, where attackers who control file names…N/A2.4 Low0%Nov 6, 2026
CVE-2026-121821: LY Corporation Armeria: A vulnerability has been identified in armeria versions 0.84.0 through 1.42.0, where any-origin CORS policies do not…N/A5.3 Medium0%Nov 6, 2026
CVE-2026-121820: LY Corporation Armeria: A vulnerability has been identified in armeria-saml versions prior to 1.43.0, where the HTTP-Redirect binding decoder…N/A8.7 High0%Nov 6, 2026
851-875 of 522604
‹›