The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-109150: Unknown WP PageNavi Style: The WP PageNavi Style WordPress plugin through 1.4 does not sanitise and escape some of its settings, and has no CSRF…N/AN/AN/ANov 5, 2026
CVE-2026-107787: Unknown CatFolders: The CatFolders WordPress plugin before 2.5.7 does not have authorisation checks on a folder maintenance action,…N/AN/AN/ANov 5, 2026
CVE-2026-107786: Unknown CatFolders: The CatFolders WordPress plugin before 2.5.7 does not properly sanitize and escape a user-controlled sort setting…N/AN/AN/ANov 5, 2026
CVE-2026-107775: Unknown Dokan: AI Powered WooCommerce Multivendor Marketplace Solution: The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not verify that…N/AN/AN/ANov 5, 2026
CVE-2026-107774: Unknown Dokan: AI Powered WooCommerce Multivendor Marketplace Solution: The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not use a trusted…N/AN/AN/ANov 5, 2026
CVE-2026-107773: Unknown Dokan: AI Powered WooCommerce Multivendor Marketplace Solution: The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not correctly…N/AN/AN/ANov 5, 2026
CVE-2026-105971: Unknown Car Dealer (Dealership) and Vehicle sales: The Car Dealer (Dealership) and Vehicle sales WordPress plugin through 4.73 does not restrict its unauthenticated…N/AN/AN/ANov 5, 2026
CVE-2026-105259: Unknown Easy Social Icons: The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise SVG files, which it adds to the list of file…N/AN/AN/ANov 5, 2026
CVE-2026-100144: Unknown IVPAY payments: The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it…N/AN/AN/ANov 5, 2026
CVE-2025-15702: Unknown Cloud Blocks: The Cloud Blocks WordPress plugin through 1.1.8 does not perform any authorisation or sanitisation when storing block…N/AN/AN/ANov 5, 2026
CVE-2025-15701: Unknown Easy Social Icons: The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of its settings before outputting…N/AN/AN/ANov 5, 2026
CVE-2026-93389: litespeedtech LiteSpeed Cache: The LiteSpeed Cache plugin for WordPress is vulnerable to unauthenticated disclosure of sensitive WooCommerce customer…8.2 HighN/AN/ANov 5, 2026
CVE-2026-123012: Gogs: In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read…N/A7.1 HighN/ANov 5, 2026
CVE-2026-123011: STMicroelectronics st-mems-android-linux-sensors-hal: STMicroelectronics st-mems-android-linux-sensors-hal before 7bdf334 does not check whether the allowed number of…4.2 MediumN/AN/ANov 5, 2026
CVE-2026-123010: twilio-labs netlify-okta-auth: @twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim7.2 HighN/AN/ANov 5, 2026
CVE-2026-120553: ivole Customer Reviews for WooCommerce: The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…6.4 MediumN/AN/ANov 5, 2026
CVE-2026-120533: davidanderson Redux Framework: The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via theme_opts Parameter via User…6.4 MediumN/AN/ANov 5, 2026
CVE-2026-118193: stellarwp GiveWP – Donation Plugin and Fundraising Platform: The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Privilege Escalation in all…8.8 HighN/AN/ANov 5, 2026
CVE-2026-116617: stylemix Motors – Car Dealership & Classified Listings Plugin: The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to File Deletion in all…8.1 HighN/AN/ANov 5, 2026
CVE-2026-104812: davidanderson Redux Framework: The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'multi_media' Field Array Key…6.4 MediumN/AN/ANov 5, 2026
CVE-2026-122190: SourceCodester Online Food Ordering System: A vulnerability was found in SourceCodester Online Food Ordering System 1.02.4 Low1.9 LowN/ANov 5, 2026
CVE-2026-122236: n/a OpenHands: A vulnerability has been found in OpenHands up to 1.24.06.3 Medium2.1 LowN/ANov 5, 2026
CVE-2026-122191: itsourcecode Airline Reservation System: A vulnerability was determined in itsourcecode Airline Reservation System 1.06.3 Medium2.1 LowN/ANov 5, 2026
CVE-2026-69068: Samsung Semiconductor: Insufficient length validation in the GNSS firmware loader may lead to corruption of kernel memory.N/AN/AN/ANov 5, 2026
CVE-2026-69066: Samsung Semiconductor: Memory corruption in GPU driver due to improper validation of VMID reservation.N/AN/AN/ANov 5, 2026
76-100 of 424783
‹›