The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
WordPress Plugin: content-protector: CVE-2026-121574: Missing Authorization5.3 MediumN/AN/ANov 11, 2026
CVE-2026-121028: WP Chill Strong Testimonials: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WP Chill Strong…5.3 MediumN/AN/ANov 11, 2026
WordPress Plugin: wp-job-portal: CVE-2026-121014: Missing Authorization5.3 MediumN/AN/ANov 11, 2026
CVE-2026-119615: maltesesolutions Reset Database: The Reset Database plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.1.38.8 HighN/AN/ANov 11, 2026
CVE-2026-119097: denis-de-bernardy Author Image: The Author Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in…6.4 MediumN/AN/ANov 11, 2026
WordPress Plugin: restrict-user-access: CVE-2026-115600: Missing Authorization5.3 MediumN/AN/ANov 11, 2026
CVE-2026-103883: sixstorage 6Storage Rentals: The 6Storage Rentals plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account…8.8 HighN/AN/ANov 11, 2026
Red Hat: CVE-2026-124743: busybox: Divide-by-zero and heap over-read in the volume_id HFS+ prober5.5 MediumN/AN/ANov 11, 2026
Red Hat: CVE-2026-124742: busybox: Divide-by-zero in the volume_id FAT prober via a zero sectors_per_cluster value5.5 MediumN/AN/ANov 11, 2026
CVE-2026-90993: Improper Restriction of XML External Entity ReferenceN/AN/AN/ANov 11, 2026
WordPress Plugin: staggs: CVE-2026-78287: Improper Control of Generation of Code ('Code Injection')10.0 CriticalN/AN/ANov 11, 2026
CVE-2026-124741: Red Hat: A flaw was found in BusyBox7.6 HighN/AN/ANov 11, 2026
WordPress Plugin: calculated-fields-form: CVE-2026-124253: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')7.1 HighN/AN/ANov 11, 2026
WordPress Plugin: ai-engine: CVE-2026-123478: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')7.1 HighN/AN/ANov 11, 2026
CVE-2026-111792: Apache Software Foundation Apache XML Graphics Batik: Uncontrolled Recursion vulnerability in Apache XML Graphics BatikN/AN/AN/ANov 11, 2026
CVE-2026-118965: Checkmk GmbH Checkmk: Path traversal in the discovered host label synchronization in Checkmk <2.5.0p19, <2.4.0p40 and 2.3.0 (EOL) allows an…N/A9.4 CriticalN/ANov 11, 2026
CVE-2026-120495: Checkmk GmbH Checkmk: Path traversal in the Synthetic Monitoring "Robotmk" test service of Checkmk <2.5.0p19, <2.4.0p40, and 2.3.0 (EOL)…N/A9.4 CriticalN/ANov 11, 2026
CVE-2026-121374: Checkmk GmbH Checkmk: Argument injection in the Kubernetes special agent in Checkmk <2.5.0p19, <2.4.0p40, and 2.3.0 (EOL) allows a user with…N/A9.4 CriticalN/ANov 11, 2026
Red Hat: CVE-2026-124739: busybox: httpd stack buffer overflow via an "I:" rule in a subdirectory httpd.conf7.5 HighN/AN/ANov 11, 2026
WordPress Plugin: bp-better-messages: CVE-2026-124257: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')6.5 MediumN/AN/ANov 11, 2026
WordPress Plugin: woo-delivery: CVE-2026-124256: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')6.5 MediumN/AN/ANov 11, 2026
WordPress Plugin: geodirectory: CVE-2026-124250: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')7.1 HighN/AN/ANov 11, 2026
CVE-2026-112174: Local privilege escalation vulnerability in Iperius Backup 8.8.3, due to insufficient separation between the graphical…N/A9.3 CriticalN/ANov 11, 2026
Red Hat: CVE-2026-124737: busybox: Heap buffer overflow in the tftp client on fallback to the default block size7.5 HighN/AN/ANov 11, 2026
CVE-2026-18769: Exposed IOCTL with Insufficient Access Control7.8 High8.5 HighN/ANov 11, 2026
976-1000 of 422975