The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-62056: WP ManageNinja LLC Fluent CRM: Missing Authorization vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Exploiting Incorrectly…5.3 MediumN/AN/AOct 30, 2026
CVE-2026-62047: Liquid Web / StellarWP Event Tickets: Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly…4.3 MediumN/AN/AOct 30, 2026
CVE-2026-62023: Unlimited Elements: Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons,…4.3 MediumN/AN/AOct 30, 2026
CVE-2026-62019: Liquid Web / StellarWP BookIt: Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured…4.3 MediumN/AN/AOct 30, 2026
CVE-2026-61854: jackh54 VoiceSentinel: VoiceSentinel is a real-time voice moderation system for Minecraft servers8.2 HighN/AN/AOct 30, 2026
CVE-2026-61848: rgrove crass: Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specificationN/A6.3 MediumN/AOct 30, 2026
CVE-2026-61847: rgrove crass: Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specificationN/A6.3 MediumN/AOct 30, 2026
CVE-2026-61846: rgrove crass: Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specificationN/A6.3 MediumN/AOct 30, 2026
CVE-2026-61845: rgrove crass: Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specificationN/A8.9 HighN/AOct 30, 2026
CVE-2026-61840: vantern-org questbot: Quest Bot is an opensource Discord BotN/A2.3 LowN/AOct 30, 2026
CVE-2026-61586: copernik-eu copernik-xml-factory: Copernik XML Factory provides secure-by-default JAXP factory creation for JavaN/A8.2 HighN/AOct 30, 2026
CVE-2026-59978: adminneo-org adminneo: AdminNeo is a full-featured database management tool written in PHP7.5 HighN/AN/AOct 30, 2026
CVE-2026-54855: Cozmoslabs Profile Builder: Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions.7.1 HighN/AN/AOct 30, 2026
CVE-2026-54854: Cozmoslabs Profile Builder: Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions.6.3 MediumN/AN/AOct 30, 2026
CVE-2026-54850: magepeopleteam Booking and Rental Manager: Subscriber Broken Access Control in Booking and Rental Manager <= 2.8.2 versions.6.5 MediumN/AN/AOct 30, 2026
CVE-2026-52710: ithemelandco GIFTiT &#8211; Free Gifts for WooCommerce: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ithemelandco GIFTiT…5.3 MediumN/AN/AOct 30, 2026
CVE-2026-48201: Raul P. Fast Velocity Minify: Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 versions.7.1 HighN/AN/AOct 30, 2026
CVE-2026-46560: OpenIdentityPlatform OpenAM: Open Access Management (OpenAM) is an access management solution7.5 HighN/AN/AOct 30, 2026
CVE-2026-39786: bookingalgorithms BA Book Everything: Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions.7.1 HighN/AN/AOct 30, 2026
CVE-2026-39739: Brainstorm Force Ultimate Addons for Elementor - Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force…6.5 MediumN/AN/AOct 30, 2026
CVE-2026-39738: FunnelKit FunnelKit Automations: Unauthenticated PHP Object Injection in FunnelKit Automations <= 3.8.6.1 versions.9.8 CriticalN/AN/AOct 30, 2026
CVE-2026-39734: Saad Iqbal WP EasyPay: Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions.7.5 HighN/AN/AOct 30, 2026
CVE-2026-39732: Ivijan-Stefan Stipic Transliterator: Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions.9.3 CriticalN/AN/AOct 30, 2026
CVE-2026-28160: e4jvikwp VikRentCar: Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.10 versions.7.1 HighN/AN/AOct 30, 2026
CVE-2026-27061: wpeverest User Registration: Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 versions.6.5 MediumN/AN/AOct 30, 2026
101-125 of 418318