The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-110369: GS Plugins WordPress Team Members – GS Plugins: Deserialization of Untrusted Data vulnerability in GS Plugins WordPress Team Members – GS Plugins gs-team-members…8.8 HighN/A0%Oct 21, 2026
CVE-2026-105923: Qt: A malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference in VectorImage QML…N/A4.0 Medium0%Oct 21, 2026
CVE-2026-97206: NLnet Labs Unbound: NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by…7.5 HighN/A0%Oct 21, 2026
CVE-2026-96405: NLnet Labs Unbound: NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual…5.3 MediumN/A0%Oct 21, 2026
CVE-2026-85683: Unknown Jane Menu: The Jane Menu WordPress plugin before 1.5.1 does not have any capability or nonce checks on one of its form handlers,…8.8 HighN/A0%Oct 21, 2026
CVE-2026-70387: OnePlus OxygenOS: Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on AndroidN/A8.4 High0%Oct 21, 2026
CVE-2026-70386: OnePlus OxygenOS: Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization…N/A8.5 High1%Oct 21, 2026
CVE-2026-50106: NLnet Labs Unbound: When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an…6.5 MediumN/A0%Oct 21, 2026
CVE-2026-35501: NLnet Labs Unbound: When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust anchor and an…3.7 LowN/A0%Oct 21, 2026
CVE-2026-14556: Unknown HappyForms: The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before…5.4 MediumN/A0%Oct 21, 2026
CVE-2026-114236: Red Hat: storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file…3.3 LowN/A0%Oct 21, 2026
CVE-2026-110938: Eclipse Foundation Eclipse OpenJ9: In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper…N/A8.7 High0%Oct 21, 2026
CVE-2026-109125: NLnet Labs Unbound: In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be exposed with…5.3 MediumN/A0%Oct 21, 2026
CVE-2026-107447: Unknown Contest Gallery: The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its…5.3 MediumN/A0%Oct 21, 2026
CVE-2026-105256: Unknown LatePoint: The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplied value that determines how much is…5.3 MediumN/A0%Oct 21, 2026
CVE-2026-104642: Unknown Simple Shopping Cart: The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify submitted product prices against a value only…2.7 LowN/A0%Oct 21, 2026
CVE-2026-104641: Unknown Simple Shopping Cart: The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a…5.3 MediumN/A0%Oct 21, 2026
CVE-2026-103301: Unknown Payment Gateway for Telcell: The Payment Gateway for Telcell WordPress plugin before 2.0.5 does not verify the authenticity of incoming payment…5.3 MediumN/A0%Oct 21, 2026
CVE-2026-101138: Unknown CMP – Coming Soon & Maintenance: The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.21 does not correctly apply maintenance mode to pages…5.3 MediumN/A0%Oct 21, 2026
CVE-2026-17557: Red Hat Red Hat OpenShift AI (RHOAI): A flaw was found in the `lm-evaluation-harness` component of Red Hat OpenShift AI6.5 MediumN/A0%Oct 21, 2026
CVE-2026-111075: Eclipse Foundation Eclipse OpenJ9: In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on…N/A8.7 High0%Oct 21, 2026
CVE-2026-111074: Eclipse Foundation Eclipse OpenJ9: In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial…N/A8.7 High0%Oct 21, 2026
CVE-2026-110899: Kevin Stover Ninja Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover…7.1 HighN/A0%Oct 21, 2026
CVE-2026-107435: WP Chill Strong Testimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong…7.1 HighN/A0%Oct 21, 2026
CVE-2026-96901: Unknown Cart Abandonment Recovery for WooCommerce: The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.2.0 does not verify the integrity of its…3.7 LowN/A0%Oct 21, 2026
851-875 of 418797
‹›