The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-125792: Andy Moyle Church Admin: Missing Authorization vulnerability in Andy Moyle Church Admin church-admin allows Exploiting Incorrectly Configured…5.3 MediumN/AN/ANov 13, 2026
CVE-2026-125831: IdeaBox Creations PowerPack Lite for Beaver Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations…6.5 MediumN/AN/ANov 13, 2026
CVE-2026-125834: WP Media Imagify: Missing Authorization vulnerability in WP Media Imagify imagify allows Exploiting Incorrectly Configured Access Control…4.3 MediumN/AN/ANov 13, 2026
CVE-2026-125827: Liquid Web / StellarWP Event Tickets: Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly…5.3 MediumN/AN/ANov 13, 2026
CVE-2026-125811: myCred: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in myCred myCred…8.5 HighN/AN/ANov 13, 2026
CVE-2026-125810: myCred: Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control…4.3 MediumN/AN/ANov 13, 2026
CVE-2026-125809: myCred: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in myCred myCred…6.5 MediumN/AN/ANov 13, 2026
CVE-2026-111547: Dell: Dell PowerStore contains an out-of-bounds read vulnerability8.1 HighN/AN/ANov 13, 2026
CVE-2026-125835: Crocoblock JetTabs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock…6.5 MediumN/AN/ANov 13, 2026
CVE-2026-124409: VillaTheme CURCY: Missing Authorization vulnerability in VillaTheme CURCY woo-multi-currency allows Exploiting Incorrectly Configured…5.3 MediumN/AN/ANov 13, 2026
CVE-2026-125807: HTMega HT Mega: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HTMega HT Mega…6.5 MediumN/AN/ANov 13, 2026
CVE-2026-125808: HTMega HT Mega: Missing Authorization vulnerability in HTMega HT Mega ht-mega-for-elementor allows Exploiting Incorrectly Configured…5.3 MediumN/AN/ANov 13, 2026
CVE-2026-125824: WP Go Maps: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Go Maps WP Go…6.5 MediumN/AN/ANov 13, 2026
CVE-2026-125819: PublishPress Gutenberg Blocks: Missing Authorization vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg allows Exploiting Incorrectly…5.3 MediumN/AN/ANov 13, 2026
CVE-2026-92241: zephyrproject zephyr: The AVRCP browsing channel's L2CAP receive-buffer callback, browsing_avrcp_l2cap_alloc_buf() in…5.7 MediumN/AN/ANov 13, 2026
CVE-2026-91094: Debian dpkg: A directory traversal bug was discovered when unpacking 3.0 (quilt) source packages, where the packaging tarball could…N/AN/AN/ANov 13, 2026
CVE-2026-86353: Dell: Dell PowerStore contains a use of a weak cryptographic algorithm vulnerability that could allow an attacker with…5.0 MediumN/AN/ANov 13, 2026
CVE-2026-82179: Dell: Dell PowerStore contains an authorization bypass vulnerability4.9 MediumN/AN/ANov 13, 2026
CVE-2026-77706: Fileorbis Bilişim Hizmetleri Ticaret Anonim Şirketi FileOrbis NextGen FileServer: Improper handling of highly compressed data (data amplification) vulnerability in Fileorbis Bilişim Hizmetleri Ticaret…6.5 MediumN/AN/ANov 13, 2026
CVE-2026-128790: Eclipse Foundation Eclipse BaSyx Go Components: In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of the Submodel Repository…N/A7.1 HighN/ANov 13, 2026
CVE-2026-127125: RT-Labs P-Net: P-Net before 1.0.4 aborts the Application Relationship of an RPC session when a fragment of a response has been resent…N/A6.0 MediumN/ANov 13, 2026
CVE-2026-127124: RT-Labs P-Net: P-Net before 1.0.4 keeps the RPC session that is allocated for a fragment of a request with an unknown activity UUID,…N/A7.1 HighN/ANov 13, 2026
CVE-2026-127123: RT-Labs P-Net: P-Net before 1.0.4 releases the Application Relationship of an RPC session, without the abort procedure, when a…N/A6.0 MediumN/ANov 13, 2026
CVE-2026-127122: RT-Labs P-Net: P-Net before 1.0.4 does not check the number of MCR request blocks in a Connect request against the number of multicast…N/A7.2 HighN/ANov 13, 2026
CVE-2026-124762: RT-Labs P-Net: P-Net before 1.0.4 finds the RPC session of a received PDU by its activity UUID only, and a reject, fault or cancel PDU…N/A6.0 MediumN/ANov 13, 2026
101-125 of 532044