The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-96741: mlfactory DSGVO All in one for WP: The DSGVO All in one for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via…7.2 HighN/AN/AOct 29, 2026
CVE-2026-96669: wpscripts Food Store – Online Food Delivery & Pickup: The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…7.2 HighN/AN/AOct 29, 2026
CVE-2026-96666: vberkel Schema App Structured Data: The Schema App Structured Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content…7.2 HighN/AN/AOct 29, 2026
CVE-2026-96228: sslplugins SSL Wireless SMS Notification: SSL Wireless SMS Notification for WordPress is vulnerable to Authentication Bypass in all versions up to, and…8.1 HighN/AN/AOct 29, 2026
CVE-2026-93904: dejanmarkovic: The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to generic…7.5 HighN/AN/AOct 29, 2026
CVE-2026-93855: brewlabs SendPress Newsletters: The SendPress Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'subscriberid'…7.5 HighN/AN/AOct 29, 2026
CVE-2026-93757: wild-apricot Wild Apricot Login: The Wild Apricot Login plugin for WordPress is vulnerable to Authentication Bypass via SSO Email-Collision Account…7.5 HighN/AN/AOct 29, 2026
CVE-2026-42949: Frangoteam: A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (version(s): 1.3.2-2809)5.6 MediumN/AN/AOct 29, 2026
CVE-2026-42922: Frangoteam: A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809)9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-40063: Frangoteam: A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s):…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-118426: Octopus Deploy Octopus Server: In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call…N/A5.3 MediumN/AOct 29, 2026
CVE-2026-109516: guruteam Bot for Telegram on WooCommerce: The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account…9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-66092: Apereo Foundation openEQUELLA: In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logon page without…N/A4.8 MediumN/AOct 29, 2026
CVE-2026-66091: Apereo Foundation openEQUELLA: In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or…N/A6.9 MediumN/AOct 29, 2026
CVE-2026-66090: Apereo Foundation openEQUELLA: In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolutionN/A7.1 HighN/AOct 29, 2026
CVE-2026-66089: Apereo Foundation openEQUELLA: In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves…N/A6.1 MediumN/AOct 29, 2026
CVE-2026-66088: Apereo Foundation openEQUELLA: In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating…N/A9.4 CriticalN/AOct 29, 2026
CVE-2026-16889: Apereo Foundation openEQUELLA: In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /api/preloginnotice/image/{name}) does…N/A4.8 MediumN/AOct 29, 2026
CVE-2026-114173: canva ortto: The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-113409: canva ortto: The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to…4.8 MediumN/AN/AOct 29, 2026
CVE-2026-113387: canva ortto: The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a…8.6 HighN/AN/AOct 29, 2026
CVE-2026-21157: Samsung Mobile Bixby: Improper input validation in Bixby prior to version 4.0.85.6 allows privileged local attackers to launch arbitrary…N/A8.3 HighN/AOct 29, 2026
CVE-2026-118590: nipy nibabel: A security vulnerability has been detected in nipy nibabel up to 5.4.25.3 Medium6.9 MediumN/AOct 29, 2026
CVE-2026-113957: Apple: An attacker who controls the registry, a mirror, or the network path to it may be able to serve arbitrary image content…N/AN/AN/AOct 29, 2026
CVE-2026-118589: nschloe meshio: A weakness has been identified in nschloe meshio up to 5.3.55.3 Medium6.9 MediumN/AOct 29, 2026
101-125 of 536029