The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-107024: n/a: Insecure permissions in Share 2 Archive Today versionCode 61 allows unauthorized attackers to arbitrarily overwrite…N/AN/AN/AOct 29, 2026
CVE-2026-107021: n/a: Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows…N/AN/AN/AOct 29, 2026
CVE-2026-107020: n/a: An issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News Reader versionCode 116 allows attackers…7.5 HighN/AN/AOct 29, 2026
CVE-2026-107019: n/a: Insecure permissions in the feiertage.ImportActivity component of Arbeitszeiterfassung2 versionCode 159 allows…N/AN/AN/AOct 29, 2026
CVE-2026-107018: n/a: Insecure permissions in Ghost Commander File Manager versionCode 479 allows unauthorized attackers to arbitrarily read…N/AN/AN/AOct 29, 2026
CVE-2026-107016: n/a: Insecure permissions in Fossify v1.3.0 allows unauthorized attackers to access and read another user's stored contacts.N/AN/AN/AOct 29, 2026
CVE-2026-107015: n/a: Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write and read notes in…9.1 CriticalN/AN/AOct 29, 2026
CVE-2026-107014: n/a: Insecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow unauthorized attackers to write and read…N/AN/AN/AOct 29, 2026
CVE-2026-96199: Microsoft Microsoft Edge (Chromium-based): Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a…8.8 HighN/AN/AOct 29, 2026
CVE-2026-96198: Microsoft Microsoft Edge (Chromium-based): Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a…8.8 HighN/AN/AOct 29, 2026
CVE-2026-85897: Microsoft Microsoft Edge (Chromium-based): Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a…8.8 HighN/AN/AOct 29, 2026
CVE-2026-85890: Microsoft Microsoft Edge (Chromium-based): Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.8.8 HighN/AN/AOct 29, 2026
CVE-2026-42694: Themeum Kirki: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Kirki kirki…4.3 MediumN/AN/AOct 29, 2026
CVE-2026-116848: POSIMYTH Innovations The Plus Addons for Elementor Page Builder Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-109891: weDevs Happy Addons for Elementor: Missing Authorization vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Exploiting…6.4 MediumN/AN/AOct 29, 2026
CVE-2026-42691: EventPrime: Authorization Bypass Through User-Controlled Key vulnerability in EventPrime EventPrime…5.4 MediumN/AN/AOct 29, 2026
CVE-2026-54852: miniOrange Page Restriction WordPress (WP): Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and-post-restriction allows…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-27062: WPFunnels Team WPFunnels: Cross-Site Request Forgery (CSRF) vulnerability in WPFunnels Team WPFunnels wpfunnels allows Cross Site Request…4.3 MediumN/AN/AOct 29, 2026
CVE-2026-114706: WP Chill Strong Testimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-27063: Kit Kit (formerly ConvertKit): Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-115601: WP Desk Custom Price for WooCommerce: Missing Authorization vulnerability in WP Desk Custom Price for WooCommerce custom-price-for-woocommerce allows…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-118091: WPFunnels Team WPFunnels: Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunnels allows Exploiting Incorrectly Configured…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-116387: Brainstorm Force SureForms: Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-115610: PublishPress PublishPress Authors: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-79589: n/a: The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure access control flaw that allows an…N/AN/AN/AOct 29, 2026
901-925 of 418318