The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-114178: Bold Grid W3 Total Cache: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Grid W3…7.1 HighN/A0%Oct 24, 2026
CVE-2026-112869: Noah Hearle We’re Open!: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Hearle We’re…7.1 HighN/A0%Oct 24, 2026
CVE-2026-112866: WPFactory Product Filter by WBW: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product…9.3 CriticalN/A0%Oct 24, 2026
CVE-2026-112844: Arraytics WP Event Solution: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics WP…7.1 HighN/A0%Oct 24, 2026
CVE-2026-111402: Tribulant Software Newsletters: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant…9.3 CriticalN/A0%Oct 24, 2026
CVE-2026-110892: Brainstorm Force SureDash: Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured…6.5 MediumN/A0%Oct 24, 2026
CVE-2026-115975: CervantesSec cervantes: Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or…7.1 HighN/A0%Oct 24, 2026
CVE-2026-115803: n/a Scada-LTS: A flaw has been found in Scada-LTS 2.8.04.3 Medium2.1 Low0%Oct 24, 2026
CVE-2026-115802: InternScience InternAgent: A weakness has been identified in InternScience InternAgent 1.5.04.3 Medium2.1 Low0%Oct 24, 2026
CVE-2026-108013: HCL Software BigFix Platform: BigFix Platform uses Mozilla CA certificate bundle (PEM)6.8 MediumN/A0%Oct 24, 2026
CVE-2026-97353: Unknown News Kit Addons For Elementor: The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before…5.4 MediumN/A0%Oct 24, 2026
CVE-2026-97352: Unknown News Kit Addons For Elementor: The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check on one of its AJAX…4.3 MediumN/A0%Oct 24, 2026
CVE-2026-87835: Unknown Front End Users: The Front End Users WordPress plugin through 3.2.35 does not restrict which account attributes a visitor may set when…6.5 MediumN/A0%Oct 24, 2026
CVE-2026-114429: Unknown WPVR: The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before…6.8 MediumN/A0%Oct 24, 2026
CVE-2026-113674: Unknown GeoDirectory: The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by…3.7 LowN/A0%Oct 24, 2026
CVE-2026-113673: Unknown GeoDirectory: The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it…7.2 HighN/A0%Oct 24, 2026
CVE-2026-113493: Unknown GeoDirectory: The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes…6.8 MediumN/A0%Oct 24, 2026
CVE-2026-113492: Unknown GeoDirectory: The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading…5.3 MediumN/A0%Oct 24, 2026
CVE-2026-113491: Unknown GeoDirectory: The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local…6.4 MediumN/A0%Oct 24, 2026
CVE-2026-113490: Unknown GeoDirectory: The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a…5.3 MediumN/A0%Oct 24, 2026
CVE-2026-113489: Unknown GeoDirectory: The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing…4.3 MediumN/A0%Oct 24, 2026
CVE-2026-112207: Unknown Download Monitor: The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site…7.1 HighN/A0%Oct 24, 2026
CVE-2026-110956: Unknown asVereinbase: The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before…9.8 CriticalN/A0%Oct 24, 2026
CVE-2026-107907: Unknown MAS Videos: The MAS Videos WordPress plugin through 1.3.4 does not perform any capability or ownership check when handling its…6.5 MediumN/A0%Oct 24, 2026
CVE-2026-107887: Unknown Advanced Twenty Seventeen: The Advanced Twenty Seventeen WordPress plugin through 1.3.1 does not perform any capability or nonce check on the…5.4 MediumN/A0%Oct 24, 2026
76-100 of 558284
‹›