The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-124269: weDevs Happy Addons for Elementor: Missing Authorization vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Exploiting…4.3 MediumN/AN/ANov 11, 2026
CVE-2026-124263: plainware Locatoraid Store Locator: Cross-Site Request Forgery (CSRF) vulnerability in plainware Locatoraid Store Locator locatoraid allows Cross Site…5.4 MediumN/AN/ANov 11, 2026
CVE-2026-124262: Igor Funa Ad Inserter: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Igor Funa Ad Inserter…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-124261: Magepeople inc. Taxi Booking Manager for WooCommerce: Missing Authorization vulnerability in Magepeople inc5.3 MediumN/AN/ANov 11, 2026
CVE-2026-123481: WP Extended The Ultimate WordPress Toolkit – WP Extended: Missing Authorization vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended allows…4.3 MediumN/AN/ANov 11, 2026
CVE-2026-123480: Fullworks Plugins Display Eventbrite Events: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fullworks Plugins…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-123374: Apache Software Foundation Apache Roller: Deserialization of Untrusted Data vulnerability in Apache RollerN/AN/AN/ANov 11, 2026
CVE-2026-122300: Apache Software Foundation Apache Roller: Missing Authorization vulnerability in Apache Roller 4.0 through 6.1.6 allows a weblog member with the Limited role to…N/AN/AN/ANov 11, 2026
CVE-2026-122096: Apache Software Foundation Apache DataSketches Java: Uncontrolled Resource Consumption vulnerability in the sketch deserialization of Apache DataSketches JavaN/AN/AN/ANov 11, 2026
CVE-2026-118414: Apache Software Foundation Apache Roller: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.2 through…5.4 MediumN/AN/ANov 11, 2026
CVE-2026-118413: Apache Software Foundation Apache Roller: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 4.0 through 6.1.6…5.4 MediumN/AN/ANov 11, 2026
CVE-2026-118412: Apache Software Foundation Apache Roller: Improper Authentication in Apache Roller 5.1.0 through 6.1.6 allows a user whose account an administrator has disabled…3.1 LowN/AN/ANov 11, 2026
CVE-2026-118411: Apache Software Foundation Apache Roller: Cross-Site Request Forgery (CSRF) in Apache Roller 5.0.1 through 6.1.6 allows an unauthenticated attacker to create an…8.8 HighN/AN/ANov 11, 2026
CVE-2026-118410: Apache Software Foundation Apache Roller: Exposure of Resource to Wrong Sphere in Apache Roller 4.0 through 6.1.6 allows an unauthenticated visitor to read an…3.7 LowN/AN/ANov 11, 2026
CVE-2026-118409: Apache Software Foundation Apache Roller: Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows an unauthenticated…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-118408: Apache Software Foundation Apache Roller: Missing Authorization in Apache Roller 4.0 through 6.1.6 allows any logged-in user to read unpublished entries of a…3.1 LowN/AN/ANov 11, 2026
CVE-2026-118405: Apache Software Foundation Apache Roller: Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows any logged-in user…4.3 MediumN/AN/ANov 11, 2026
CVE-2026-112201: Keycloak, Red Hat: A flaw was found in the login-failure storage component of Keycloak, the identity and access management solution4.8 MediumN/AN/ANov 11, 2026
CVE-2026-111824: Apache Software Foundation Apache Roller: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.6 allows an…N/AN/AN/ANov 11, 2026
CVE-2026-108338: Apache Software Foundation Apache Roller: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 5.0.1 through…N/AN/AN/ANov 11, 2026
CVE-2026-105154: Apache Software Foundation Apache Roller: Cross-Site Request Forgery (CSRF) in the Planet feed aggregator administration of Apache Roller 4.0 through 6.1.6…6.1 MediumN/AN/ANov 11, 2026
CVE-2026-105153: Apache Software Foundation Apache Roller: Improper Restriction of XML External Entity Reference in Apache Roller 4.0 through 6.1.6 allows an authenticated user…7.7 HighN/AN/ANov 11, 2026
CVE-2026-105152: Apache Software Foundation Apache Roller: Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows a weblog…4.3 MediumN/AN/ANov 11, 2026
CVE-2026-126627: Apache Software Foundation Apache XML Graphics FOP: Creation of Temporary File With Insecure Permissions vulnerability in Apache XML Graphics FOPN/AN/AN/ANov 11, 2026
CVE-2026-125784: Magnigenie RestroPress: Cross-Site Request Forgery (CSRF) vulnerability in Magnigenie RestroPress restropress allows Cross Site Request…8.8 HighN/AN/ANov 11, 2026
76-100 of 511254