The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-95649: I.R.I.S S.A. IRISPowerscan: IRISPowerscan insufficiently restrict the use of untrusted scriptsN/A6.1 MediumN/ANov 4, 2026
CVE-2026-94460: I.R.I.S S.A. IRISPowerscan: IRISPowerscan contain an insecure default configuration where the built-in installation account is assigned elevated…N/A7.2 HighN/ANov 4, 2026
CVE-2026-94459: I.R.I.S S.A. IRISPowerscan: IRISPowerscan contain default user accounts with predictable credentialsN/A7.2 HighN/ANov 4, 2026
CVE-2026-93900: elliotvs Simple CAPTCHA with Cloudflare Turnstile: The Simple CAPTCHA with Cloudflare Turnstile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…6.4 MediumN/AN/ANov 4, 2026
CVE-2026-120554: carazo Import and export users and customers: The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up…8.8 HighN/AN/ANov 4, 2026
CVE-2026-120422: Sogou Sogou Input Method: Sogou Input Method for Windows contains a vulnerability in the configuration retrieval mechanism of its SGTool.exe…N/A8.9 HighN/ANov 4, 2026
CVE-2026-115498: wingerspeed Slim Jetpack: The Slim Jetpack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'g<PAGE_ID>-website (Website…7.2 HighN/AN/ANov 4, 2026
CVE-2026-111822: Apache Software Foundation: Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime ConfigN/AN/AN/ANov 4, 2026
CVE-2026-111821: Apache Software Foundation: Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDBN/AN/AN/ANov 4, 2026
CVE-2026-111040: Coupa Coupa Total Spend Management Platform: The platform allows persistent HTML injection into editable fields managed by TinyMCEN/A5.1 MediumN/ANov 4, 2026
CVE-2026-111038: Coupa Coupa Total Spend Management Platform: CSV formula injection vulnerability in the export functionality of the Coupa Supplier Portal SaaS platformN/A7.3 HighN/ANov 4, 2026
CVE-2026-111037: Coupa Coupa Total Spend Management Platform: A reflected Cross-Site Scripting (XSS) vulnerability in the Tenders module of the Coupa Supplier Portal SaaS platformN/A5.1 MediumN/ANov 4, 2026
CVE-2026-111036: Coupa Coupa Total Spend Management Platform: Server-side request forgery (SSRF) vulnerability in the Coupa Supplier Portal SaaS platform, specifically in the…N/A8.4 HighN/ANov 4, 2026
CVE-2026-110935: Phoenix Contact PLCnext Engineer: The PFI plugin framework deployment routine does not validate path components when extracting archive entries to the…8.4 High8.6 HighN/ANov 4, 2026
CVE-2026-110022: Phoenix Contact PLCnext Engineer: The PFI plugin framework deploys executable assemblies (DLLs) from a signed plugin package into the local plugin…8.4 High8.6 HighN/ANov 4, 2026
CVE-2026-110021: Phoenix Contact PLCnext Engineer: PLCnext Engineer checks GSDX manifest reference digests but does not cryptographically verify the XML `SignatureValue`…6.2 Medium6.9 MediumN/ANov 4, 2026
CVE-2026-108949: Apache Software Foundation: Denial of Service via OOM vulnerability in Apache ActiveMQ, ActiveMQ BrokerN/AN/AN/ANov 4, 2026
CVE-2026-19731: TÜBİTAK BİLGEM Software Technologies Research Institute İmzager: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TÜBİTAK BİLGEM Software…3.3 LowN/AN/ANov 4, 2026
CVE-2026-19721: TÜBİTAK BİLGEM Software Technologies Research Institute İmzager: Improper restriction of XML external entity reference vulnerability in TÜBİTAK BİLGEM Software Technologies Research…3.3 LowN/AN/ANov 4, 2026
CVE-2026-114426: SEPPmail AG SEPPmail Secure Email Gateway (SEG): SEPPmail Secure Email Gateway before 15.1.1 processes and writes v1 file-interface upload data before authenticating…N/A8.7 HighN/ANov 4, 2026
CVE-2026-114425: SEPPmail AG SEPPmail Secure Email Gateway (SEG): SEPPmail Secure Email Gateway before 15.1.1 trusts a file path supplied in externally provided Large File Transfer…N/A9.2 CriticalN/ANov 4, 2026
CVE-2026-114424: SEPPmail AG SEPPmail Secure Email Gateway (SEG): SEPPmail Secure Email Gateway before 15.1.1 can evaluate attacker-influenced replacement text as Perl code in sender or…N/A9.2 CriticalN/ANov 4, 2026
CVE-2026-114421: SEPPmail AG SEPPmail Secure Email Gateway (SEG): SEPPmail Secure Email Gateway before 15.1.1 permits password recovery for a created but unregistered GINA account whose…N/A8.3 HighN/ANov 4, 2026
CVE-2026-114420: SEPPmail AG SEPPmail Secure Email Gateway (SEG): SEPPmail Secure Email Gateway before 15.1.1 does not neutralize LDAP metacharacters in an unauthenticated…N/A6.9 MediumN/ANov 4, 2026
CVE-2026-62126: miniOrange SAML SP Single Sign On: Allocation of Resources Without Limits or Throttling vulnerability in miniOrange SAML SP Single Sign On…7.5 HighN/AN/ANov 4, 2026
101-125 of 537178
‹›