The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-62047: Liquid Web / StellarWP Event Tickets: Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly…4.3 MediumN/AN/AOct 30, 2026
CVE-2026-39739: Brainstorm Force Ultimate Addons for Elementor - Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force…6.5 MediumN/AN/AOct 30, 2026
CVE-2026-73322: Apache Software Foundation Apache Pinot: Incorrect Authorization vulnerability in the single-stage query engine of Apache PinotN/AN/AN/AOct 30, 2026
CVE-2026-52710: ithemelandco GIFTiT – Free Gifts for WooCommerce: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ithemelandco GIFTiT…5.3 MediumN/AN/AOct 30, 2026
CVE-2026-62057: Fahim Reza Divi Contact Form 7: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Fahim Reza Divi Contact…5.3 MediumN/AN/AOct 30, 2026
CVE-2026-62121: Unlimited Elements: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability…6.5 MediumN/AN/AOct 30, 2026
CVE-2026-62122: Arraytics Booktics: Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access…5.3 MediumN/AN/AOct 30, 2026
CVE-2026-119117: AWS amazon-kinesis-producer: Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the…6.5 Medium8.2 HighN/AOct 30, 2026
CVE-2026-119979: Element Labs LM Studio: LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model downloader's resolveDownloadRequest that…8.8 High8.7 HighN/AOct 30, 2026
CVE-2026-119620: 37954679 cak-filemanagement-system: A vulnerability was determined in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a0492977.3 High5.5 MediumN/AOct 30, 2026
CVE-2026-118697: JetBrains: In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA before 2026.3 and 2026.2.4, the jetbrainsd daemon…9.0 CriticalN/AN/AOct 30, 2026
CVE-2026-118696: JetBrains: In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and…8.0 HighN/AN/AOct 30, 2026
CVE-2026-119763: thechangelog changelog.com: changelog.com before commit 7b35e829 contains a missing authorization vulnerability that allows unauthenticated…5.3 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-119762: Axigen Axigen Mail Server: Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unauthenticated denial…7.5 High8.7 HighN/AOct 30, 2026
CVE-2026-65566: Meow Apps AI Engine: Cross-Site Request Forgery (CSRF) vulnerability in Meow Apps AI Engine ai-engine allows Cross Site Request Forgery.This…8.8 HighN/AN/AOct 30, 2026
CVE-2026-62055: Liquid Web / StellarWP Event Tickets: Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly…4.3 MediumN/AN/AOct 30, 2026
CVE-2026-61826: morpheus65535 bazarr: Bazarr is a companion application to Sonarr and Radarr10.0 CriticalN/AN/AOct 30, 2026
CVE-2026-61806: frappe lms: Frappe Learning Management System (LMS) is a learning system that helps users structure their contentN/A5.3 MediumN/AOct 30, 2026
CVE-2026-61805: frappe lms: Frappe Learning Management System (LMS) is a learning system that helps users structure their contentN/A5.3 MediumN/AOct 30, 2026
CVE-2026-61804: myTinyWMS: myTinyWMS is a free, open-source warehouse management system8.1 HighN/AN/AOct 30, 2026
CVE-2026-61803: frappe lms: Frappe Learning Management System (LMS) is a learning system that helps users structure their contentN/A5.3 MediumN/AOct 30, 2026
CVE-2026-61789: bytebase dbhub: DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLiteN/A6.1 MediumN/AOct 30, 2026
CVE-2026-55551: infonl dimpact-zaakafhandelcomponent: ZAC is an open-source, workflow-based Common Ground component for Dutch municipal case management6.5 MediumN/AN/AOct 30, 2026
CVE-2026-37468: n/a: Cross Site Scripting vulnerability in BeeHome MyBeeHome before 2025-11-01 allows a remote attacker to execute arbitrary…N/AN/AN/AOct 30, 2026
CVE-2026-119466: WPExperts APIExperts Square for WooCommerce: Cross-Site Request Forgery (CSRF) vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Cross…5.4 MediumN/AN/AOct 30, 2026
101-125 of 418318