Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-129267: sergix44 XBackBone: A vulnerability was found in sergix44 XBackBone up to 3.8.23.5 Low2.0 Low0%Nov 14, 2026
CVE-2026-129447: yuzutech kroki: Kroki before 0.36.0 contains a reflected cross-site scripting vulnerability in the /dbml/svg endpoint that allows…6.1 Medium5.3 Medium0%Nov 14, 2026
CVE-2026-129264: n/a sox_ng: A security vulnerability has been detected in sox_ng up to 14.8.15.5 Medium2.0 Low0%Nov 14, 2026
CVE-2026-129262: Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System: A weakness has been identified in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management…7.3 High5.5 Medium0%Nov 14, 2026
CVE-2026-129261: Kingston FURY CTRL RGB Control Software: A vulnerability was found in Kingston FURY CTRL RGB Control Software up to 2.0.66.08.2 High9.3 Critical0%Nov 14, 2026
CVE-2026-129260: Mereithhh VanBlog: A security vulnerability has been detected in Mereithhh VanBlog up to 0.54.06.6 Medium2.0 Low1%Nov 14, 2026
CVE-2026-116753: ninjateam Multi Step for Contact Form 7: The Multi Step for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'multipart…7.2 HighN/A0%Nov 14, 2026
CVE-2026-127115: themekraft BuddyForms: The BuddyForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buddyforms_form_content'…5.4 MediumN/A0%Nov 14, 2026
CVE-2026-120687: fooplugins Lightbox & Modal Popup WordPress Plugin – FooBox: The Lightbox & Modal Popup WordPress Plugin – FooBox plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site…7.2 HighN/A0%Nov 14, 2026
CVE-2026-110531: foliovision FV Player 8: The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fv_player_videos' parameter…6.4 MediumN/A0%Nov 14, 2026
CVE-2026-129258: Insufficient Verification of Data Authenticity9.1 Critical8.5 High0%Nov 14, 2026
CVE-2026-129259: Mereithhh VanBlog: A weakness has been identified in Mereithhh VanBlog up to 0.54.03.5 Low2.0 Low0%Nov 14, 2026
CVE-2011-10042: CRLF InjectionN/AN/A1%Nov 14, 2026
CVE-2026-19907: Shipo: The Shipo plugin for WordPress is vulnerable to Authentication Bypass in versions 1.6 through 1.8.09.8 CriticalN/A0%Nov 14, 2026
CVE-2026-18053: LearnDash MemberDash: The MemberDash plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.8.78.8 HighN/A0%Nov 14, 2026
CVE-2026-129433: dokploy: Dokploy before 0.31.1 contains an OS command injection vulnerability in getComposeContainerCommand() that allows…9.9 Critical9.4 Critical2%Nov 14, 2026
CVE-2026-129432: ettercap: Ettercap through 0.8.5.1 contains a heap out-of-bounds read vulnerability in dissector_mountd() in…6.5 Medium7.1 High0%Nov 14, 2026
CVE-2026-129431: ettercap: Ettercap through 0.8.5.1 contains a heap out-of-bounds read vulnerability in dissector_socks() in…6.5 Medium7.1 High0%Nov 14, 2026
CVE-2026-129430: axeloz filesharing: Axeloz Filesharing before 2.14.3 contains a stored cross-site scripting vulnerability that allows authenticated users…5.4 Medium5.1 Medium0%Nov 14, 2026
CVE-2026-129429: frappe india-payroll: Frappe india-payroll before 16.0.4 contains a missing authorization vulnerability in the get_employee_details,…7.1 High7.1 High0%Nov 14, 2026
CVE-2026-129428: rcourtman Pulse: Pulse from 5.0.17 before 6.8.0 contains a missing authorization vulnerability in the /api/ai/approvals endpoints that…5.4 Medium5.3 Medium0%Nov 14, 2026
CVE-2026-129255: CoolerMaster MASTERPLUS+: A vulnerability was identified in CoolerMaster MASTERPLUS+ 1.9.68.8 High9.3 Critical0%Nov 14, 2026
CVE-2026-129254: Opixido OCMS: A flaw has been found in Opixido OCMS up to b7c15660aba83d96677c1a9abaa69c082a24f21c4.3 Medium2.1 Low0%Nov 14, 2026
CVE-2026-120522: fluentwiz: The Cloud Storage Manager for Fluent Forms – Google Drive, Dropbox, OneDrive, S3 Uploads plugin for WordPress is…9.8 CriticalN/A1%Nov 14, 2026
CVE-2025-71465: kolkov angular-editor: @kolkov/angular-editor before 3.0.3 contains a cross-site scripting vulnerability in refreshView() that writes HTML…6.1 Medium5.3 Medium0%Nov 14, 2026
76-100 of 421774