The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-118043: Unknown Bulk Media Register: The Bulk Media Register WordPress plugin before 2.01 does not properly validate a user-supplied path before moving a…N/AN/AN/AOct 31, 2026
CVE-2026-116563: smub: The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Stored…5.4 MediumN/AN/AOct 31, 2026
CVE-2026-116520: buildwps PPWP – Password Protect Pages: The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment /…7.2 HighN/AN/AOct 31, 2026
CVE-2026-110808: Unknown Essential Addons for Elementor: The Essential Addons for Elementor WordPress plugin before 6.8.8 does not correctly restrict who may set the role…N/AN/AN/AOct 31, 2026
CVE-2026-110042: Unknown Payment Forms for Paystack: The Payment Forms for Paystack WordPress plugin before 4.0.6 does not properly restrict access to a page that displays…N/AN/AN/AOct 31, 2026
CVE-2026-109997: kstover: The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is…7.2 HighN/AN/AOct 31, 2026
CVE-2026-109234: tigroumeow Meow Lightbox: The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (bbPress…7.2 HighN/AN/AOct 31, 2026
CVE-2026-101326: kstover: The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress…5.4 MediumN/AN/AOct 31, 2026
CVE-2026-100155: kstover: The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress…6.5 MediumN/AN/AOct 31, 2026
CVE-2026-116755: SoftIron HyperCloud: Improper Neutralization of Special Elements used in a Command ('Command Injection') in the Orchestrator component of…7.4 HighN/AN/AOct 31, 2026
CVE-2026-110176: Drupal File Force Download: The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a…N/A8.7 HighN/AOct 31, 2026
CVE-2026-77152: Drupal Field Collection for Drupal 7: Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a user with the "edit field…N/A5.3 MediumN/AOct 31, 2026
CVE-2026-117656: pow-auth assent: Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth…N/A9.3 CriticalN/AOct 31, 2026
CVE-2026-63414: Shopify shopify_app: Shopify App is a Rails engine for building Shopify applicationsN/A7.6 HighN/AOct 30, 2026
CVE-2026-63410: sgbett secp256k1-native: secp256k1-native is a native C secp256k1 implementation for Ruby5.9 MediumN/AN/AOct 30, 2026
CVE-2026-63402: i18next: i18next is an internationalization framework for JavaScript5.9 MediumN/AN/AOct 30, 2026
CVE-2026-63401: roostorg coop: Coop is an open source review and moderation tool from ROOSTN/A5.3 MediumN/AOct 30, 2026
CVE-2026-63400: roostorg coop: Coop is an open source review and moderation tool from ROOSTN/A2.3 LowN/AOct 30, 2026
CVE-2026-63399: roostorg coop: Coop is an open source review and moderation tool from ROOSTN/A6.9 MediumN/AOct 30, 2026
CVE-2026-63398: roostorg coop: Coop is an open source review and moderation tool from ROOSTN/A7.4 HighN/AOct 30, 2026
CVE-2026-63396: roostorg coop: Coop is an open source review and moderation tool from ROOSTN/A8.7 HighN/AOct 30, 2026
CVE-2026-63393: opensearch-project sql: OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing LanguageN/A8.7 HighN/AOct 30, 2026
CVE-2026-63378: fctr-id okta-ai-agent: TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language8.8 HighN/AN/AOct 30, 2026
CVE-2026-63377: fctr-id okta-ai-agent: TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language9.8 CriticalN/AN/AOct 30, 2026
CVE-2026-63346: christianhelle refitter: Refitter is a tool for generating a C# REST API client using the Refit libraryN/A8.6 HighN/AOct 30, 2026
76-100 of 414948