The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-124965: rtCamp Inc.: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rtCamp Inc6.5 MediumN/AN/ANov 13, 2026
CVE-2026-124418: Ahmad WP Job Portal: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ahmad WP Job…6.5 MediumN/AN/ANov 13, 2026
CVE-2026-124272: Dimitri Grassi Salon booking system: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dimitri Grassi…7.1 HighN/AN/ANov 13, 2026
CVE-2026-124260: Jacob N. Breetvelt WP Photo Album Plus: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacob N7.1 HighN/AN/ANov 13, 2026
CVE-2026-124420: Themeisle Woody ad snippets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Woody…7.1 HighN/AN/ANov 13, 2026
CVE-2026-125783: madalin.ungureanu Custom Post Types and Custom Fields creator – WCK: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in madalin.ungureanu…7.1 HighN/AN/ANov 13, 2026
CVE-2026-125856: Sarah Giles Dynamic User Directory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sarah Giles…7.1 HighN/AN/ANov 13, 2026
CVE-2026-125854: Unbounce Unbounce Landing Pages: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unbounce Unbounce…7.1 HighN/AN/ANov 13, 2026
CVE-2026-125837: thethemefoundry Make: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thethemefoundry…7.1 HighN/AN/ANov 13, 2026
CVE-2026-125452: Denishua WPJAM Basic: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Denishua WPJAM…7.1 HighN/AN/ANov 13, 2026
CVE-2026-125794: hupe13 Extension for Leaflet Map: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hupe13 Extension…6.5 MediumN/AN/ANov 13, 2026
CVE-2026-125831: IdeaBox Creations PowerPack Lite for Beaver Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations…6.5 MediumN/AN/ANov 13, 2026
CVE-2026-125809: myCred: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in myCred myCred…6.5 MediumN/AN/ANov 13, 2026
CVE-2026-107524: Dell: Dell PowerStore contains an integer overflow vulnerability8.8 HighN/AN/ANov 13, 2026
CVE-2026-92241: zephyrproject zephyr: The AVRCP browsing channel's L2CAP receive-buffer callback, browsing_avrcp_l2cap_alloc_buf() in…5.7 MediumN/AN/ANov 13, 2026
CVE-2026-91094: Debian dpkg: A directory traversal bug was discovered when unpacking 3.0 (quilt) source packages, where the packaging tarball could…N/AN/AN/ANov 13, 2026
CVE-2026-86353: Dell: Dell PowerStore contains a use of a weak cryptographic algorithm vulnerability that could allow an attacker with…5.0 MediumN/AN/ANov 13, 2026
CVE-2026-82179: Dell: Dell PowerStore contains an authorization bypass vulnerability4.9 MediumN/AN/ANov 13, 2026
CVE-2026-82177: Dell: Dell PowerStore contains an OS Command Injection vulnerability7.2 HighN/AN/ANov 13, 2026
CVE-2026-77706: Fileorbis Bilişim Hizmetleri Ticaret Anonim Şirketi FileOrbis NextGen FileServer: Improper handling of highly compressed data (data amplification) vulnerability in Fileorbis Bilişim Hizmetleri Ticaret…6.5 MediumN/AN/ANov 13, 2026
CVE-2026-128790: Eclipse Foundation Eclipse BaSyx Go Components: In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of the Submodel Repository…N/A7.1 HighN/ANov 13, 2026
CVE-2026-127125: RT-Labs P-Net: P-Net before 1.0.4 aborts the Application Relationship of an RPC session when a fragment of a response has been resent…N/A6.0 MediumN/ANov 13, 2026
CVE-2026-127124: RT-Labs P-Net: P-Net before 1.0.4 keeps the RPC session that is allocated for a fragment of a request with an unknown activity UUID,…N/A7.1 HighN/ANov 13, 2026
CVE-2026-127123: RT-Labs P-Net: P-Net before 1.0.4 releases the Application Relationship of an RPC session, without the abort procedure, when a…N/A6.0 MediumN/ANov 13, 2026
CVE-2026-127122: RT-Labs P-Net: P-Net before 1.0.4 does not check the number of MCR request blocks in a Connect request against the number of multicast…N/A7.2 HighN/ANov 13, 2026
101-125 of 532044