The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-118414: Apache Software Foundation Apache Roller: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.2 through…5.4 MediumN/AN/ANov 11, 2026
CVE-2026-118413: Apache Software Foundation Apache Roller: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 4.0 through 6.1.6…5.4 MediumN/AN/ANov 11, 2026
CVE-2026-118412: Apache Software Foundation Apache Roller: Improper Authentication in Apache Roller 5.1.0 through 6.1.6 allows a user whose account an administrator has disabled…3.1 LowN/AN/ANov 11, 2026
CVE-2026-118411: Apache Software Foundation Apache Roller: Cross-Site Request Forgery (CSRF) in Apache Roller 5.0.1 through 6.1.6 allows an unauthenticated attacker to create an…8.8 HighN/AN/ANov 11, 2026
CVE-2026-118410: Apache Software Foundation Apache Roller: Exposure of Resource to Wrong Sphere in Apache Roller 4.0 through 6.1.6 allows an unauthenticated visitor to read an…3.7 LowN/AN/ANov 11, 2026
CVE-2026-118409: Apache Software Foundation Apache Roller: Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows an unauthenticated…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-118408: Apache Software Foundation Apache Roller: Missing Authorization in Apache Roller 4.0 through 6.1.6 allows any logged-in user to read unpublished entries of a…3.1 LowN/AN/ANov 11, 2026
CVE-2026-118405: Apache Software Foundation Apache Roller: Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows any logged-in user…4.3 MediumN/AN/ANov 11, 2026
CVE-2026-112201: Keycloak, Red Hat: A flaw was found in the login-failure storage component of Keycloak, the identity and access management solution4.8 MediumN/AN/ANov 11, 2026
CVE-2026-111824: Apache Software Foundation Apache Roller: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.6 allows an…N/AN/AN/ANov 11, 2026
CVE-2026-108338: Apache Software Foundation Apache Roller: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 5.0.1 through…N/AN/AN/ANov 11, 2026
CVE-2026-105154: Apache Software Foundation Apache Roller: Cross-Site Request Forgery (CSRF) in the Planet feed aggregator administration of Apache Roller 4.0 through 6.1.6…6.1 MediumN/AN/ANov 11, 2026
CVE-2026-105153: Apache Software Foundation Apache Roller: Improper Restriction of XML External Entity Reference in Apache Roller 4.0 through 6.1.6 allows an authenticated user…7.7 HighN/AN/ANov 11, 2026
CVE-2026-105152: Apache Software Foundation Apache Roller: Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows a weblog…4.3 MediumN/AN/ANov 11, 2026
CVE-2026-126627: Apache Software Foundation Apache XML Graphics FOP: Creation of Temporary File With Insecure Permissions vulnerability in Apache XML Graphics FOPN/AN/AN/ANov 11, 2026
WordPress Plugin: restropress: CVE-2026-125784: Cross-Site Request Forgery (CSRF)8.8 HighN/AN/ANov 11, 2026
WordPress Plugin: event-post: CVE-2026-125781: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')6.5 MediumN/AN/ANov 11, 2026
WordPress Plugin: profile-builder: CVE-2026-125777: Exposure of Sensitive Information to an Unauthorized Actor5.3 MediumN/AN/ANov 11, 2026
CVE-2026-125761: YITH YITH WooCommerce Ajax Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH…6.5 MediumN/AN/ANov 11, 2026
WordPress Plugin: bold-page-builder: CVE-2026-125680: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')6.5 MediumN/AN/ANov 11, 2026
WordPress Plugin: bold-page-builder: CVE-2026-125455: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')6.5 MediumN/AN/ANov 11, 2026
WordPress Plugin: b-blocks: CVE-2026-125451: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')6.5 MediumN/AN/ANov 11, 2026
WordPress Plugin: king-addons: CVE-2026-125444: Missing Authorization5.3 MediumN/AN/ANov 11, 2026
WordPress Plugin: convertkit: CVE-2026-125439: Missing Authorization5.3 MediumN/AN/ANov 11, 2026
WordPress Plugin: computer-repair-shop: CVE-2026-125438: Missing Authorization5.3 MediumN/AN/ANov 11, 2026
926-950 of 568796