The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-108292: IBM Process Mining: IBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated user to upload a file with dangerous types that…5.5 MediumN/AN/ANov 8, 2026
CVE-2026-108284: IBM WebSphere Application Server - Liberty: IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 could allow an authenticated user with the Reader…6.5 MediumN/AN/ANov 8, 2026
CVE-2026-107331: IBM DataStage on Cloud Pak for Data: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information…9.9 CriticalN/AN/ANov 8, 2026
CVE-2026-107330: IBM DataStage on Cloud Pak for Data: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information…7.7 HighN/AN/ANov 8, 2026
CVE-2026-105473: IBM QRadar: IBM QRadar 7.5.0 through 7.5.0 Update Pack 16 Interim Fix 02, and 7.6.0.0 through 7.6.0.5 is vulnerable to Open Redirect4.6 MediumN/AN/ANov 8, 2026
CVE-2026-105467: IBM QRadar: IBM QRadar 7.5.0 through 7.5.0 Update Pack 16 Interim Fix 02, and 7.6.0.0 through 7.6.0.5 is vulnerable to Reflected XSS8.1 HighN/AN/ANov 8, 2026
CVE-2026-61987: WC Lovers WCFM – Frontend Manager for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WC Lovers WCFM –…6.5 MediumN/AN/ANov 8, 2026
CVE-2026-120858: WP ManageNinja LLC FluentForm: Missing Authorization vulnerability in WP ManageNinja LLC FluentForm fluentform allows Exploiting Incorrectly…6.5 MediumN/AN/ANov 8, 2026
CVE-2026-114189: WPVibes AnyWhere Elementor: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPVibes AnyWhere…8.5 HighN/AN/ANov 8, 2026
CVE-2026-114188: WPVibes AnyWhere Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes AnyWhere…6.5 MediumN/AN/ANov 8, 2026
CVE-2026-114186: WPVibes AnyWhere Elementor: Missing Authorization vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Exploiting Incorrectly…6.5 MediumN/AN/ANov 8, 2026
CVE-2026-109900: Melapress Melapress Role Editor: Incorrect Privilege Assignment vulnerability in Melapress Melapress Role Editor melapress-role-editor allows Privilege…9.6 CriticalN/AN/ANov 8, 2026
CVE-2026-109899: Melapress Melapress Role Editor: Missing Authorization vulnerability in Melapress Melapress Role Editor melapress-role-editor allows Exploiting…7.1 HighN/AN/ANov 8, 2026
CVE-2026-103320: IBM WebSphere Application Server - Liberty: IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 could allow an authenticated user with the Reader…4.3 MediumN/AN/ANov 8, 2026
CVE-2026-102618: IBM i: IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated user to indirectly disable system auditing, which they…3.6 LowN/AN/ANov 8, 2026
CVE-2026-101117: IBM WebSphere Extreme Scale: IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 could allow a remote attacker to bypass security restrictions due…9.1 CriticalN/AN/ANov 8, 2026
CVE-2025-36075: IBM Safer Payments: IBM Safer Payments 6.4.0.00 through 6.4.2.11, 6.5.0.00 through 6.5.0.09, 6.6.0.00 through 6.6.0.07, 6.7.0.00 through…5.3 MediumN/AN/ANov 8, 2026
CVE-2025-1837: IBM watsonx Orchestrate Cartridge for Cloud Pak for Data: IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could allow an…5.4 MediumN/AN/ANov 8, 2026
CVE-2025-0166: IBM watsonx Orchestrate Cartridge for Cloud Pak for Data: IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could disclose…2.7 LowN/AN/ANov 8, 2026
CVE-2024-41786: IBM Engineering Requirements Management DOORS Next: IBM Engineering Requirements Management DOORS Next 7.1, and 7.2 could allow a remote attacker to force the Web server…5.3 MediumN/AN/ANov 8, 2026
CVE-2026-124553: funstory-ai BabelDOC: BabelDOC from 0.3.61 before 0.7.0 contains a resource exhaustion vulnerability that allows remote attackers to exhaust…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-124494: JiHong88 suneditor: SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean() sanitizer's…N/A9.3 CriticalN/ANov 8, 2026
CVE-2026-124493: JiHong88 suneditor: SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the DocumentType constructor that…N/A9.3 CriticalN/ANov 8, 2026
CVE-2026-124492: JiHong88 suneditor: SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in ModalAnchorEditor's #createBookmarkList,…7.6 High8.3 HighN/ANov 8, 2026
CVE-2026-124491: JiHong88 suneditor: SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create() method…6.4 Medium5.3 MediumN/ANov 8, 2026
76-100 of 418829
‹›