The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-61992: Von Eyal Fitoussi GEO my WordPress: Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-61991: Ajax Load More AjaxLoadMore Cache: Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions.10.0 CriticalN/AN/AOct 29, 2026
CVE-2026-61989: Merv Barrett Easy Property Listings: Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings <= 3.5.25 versions.7.1 HighN/AN/AOct 29, 2026
CVE-2026-61988: morehawes Auction Nudge – Your eBay on Your Site: Unauthenticated Cross Site Scripting (XSS) in Auction Nudge – Your eBay on Your Site <= 8.4.0 versions.7.1 HighN/AN/AOct 29, 2026
CVE-2026-54866: Razorpay Razorpay Payment Button Elementor Plugin: Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button Elementor Plugin <= 1.2.8 versions.7.1 HighN/AN/AOct 29, 2026
CVE-2026-54865: Podamibe Nepal Podamibe Custom User Gravatar: Subscriber Cross Site Scripting (XSS) in Podamibe Custom User Gravatar <= 1.0.8 versions.6.5 MediumN/AN/AOct 29, 2026
CVE-2026-54864: nicashmu Post Video Players: Unauthenticated Cross Site Scripting (XSS) in Post Video Players <= 1.165 versions.7.1 HighN/AN/AOct 29, 2026
CVE-2026-54860: ThemeREX Ozisti: Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-54859: ThemeREX Preservation: Unauthenticated PHP Object Injection in Preservation <= 1.15 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-54858: ThemeREX Printy: Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-54857: ThemeREX Quirky: Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-54856: ThemeREX RexCoin: Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-42701: YayCommerce YayMail: Shop manager PHP Object Injection in YayMail <= 4.4.6 versions.7.2 HighN/AN/AOct 29, 2026
CVE-2026-42692: Themeum WP Crowdfunding: Unauthenticated Cross Site Scripting (XSS) in WP Crowdfunding <= 2.2.2 versions.7.1 HighN/AN/AOct 29, 2026
CVE-2026-42690: ThimPress LearnPress: Subscriber Broken Access Control in LearnPress <= 4.4.10 versions.5.4 MediumN/AN/AOct 29, 2026
CVE-2026-27394: Jyothis Joy Eventer: Unauthenticated Cross Site Scripting (XSS) in Eventer <= 0.1.1 versions.7.1 HighN/AN/AOct 29, 2026
CVE-2026-118085: Global Payments GlobalPayments WooCommerce: Unauthenticated Cross Site Scripting (XSS) in GlobalPayments WooCommerce <= 1.23.3 versions.7.1 HighN/AN/AOct 29, 2026
CVE-2026-66912: Synacor Zimbra Collaboration: Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in…N/A5.3 MediumN/AOct 29, 2026
CVE-2026-66911: Synacor Zimbra Collaboration: Zimbra is vulnerable to stored cross-site scripting (XSS) via the Content-Location MIME header in email attachmentsN/A5.3 MediumN/AOct 29, 2026
CVE-2026-88078: Microsoft Microsoft Edge (Chromium-based): Improper verification of cryptographic signature in Microsoft Edge (Chromium-based) allows an unauthorized attacker to…4.3 MediumN/AN/AOct 29, 2026
CVE-2026-88077: Microsoft Microsoft Edge (Chromium-based): Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges…8.8 HighN/AN/AOct 29, 2026
CVE-2026-96196: Microsoft Microsoft Edge (Chromium-based): Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a…8.8 HighN/AN/AOct 29, 2026
CVE-2026-96187: Microsoft Microsoft Edge (Chromium-based): Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized…7.4 HighN/AN/AOct 29, 2026
CVE-2026-85899: Microsoft Microsoft Edge (Chromium-based): Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges over a network.8.1 HighN/AN/AOct 29, 2026
CVE-2026-85330: Microsoft Microsoft Edge (Chromium-based): Incorrect authorization in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over…4.3 MediumN/AN/AOct 29, 2026
101-125 of 538495