The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-119122: unclecode crawl4ai: Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability in the Docker server that allows API…5.3 Medium6.9 MediumN/AOct 29, 2026
CVE-2026-119120: unclecode crawl4ai: Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request…7.5 High7.7 HighN/AOct 29, 2026
CVE-2026-119119: unclecode crawl4ai: Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where _clamp_untrusted()…7.5 High8.7 HighN/AOct 29, 2026
CVE-2026-119118: unclecode crawl4ai: Crawl4AI before 0.9.5 contains an improper certificate validation vulnerability that allows network attackers to…6.5 Medium8.3 HighN/AOct 29, 2026
CVE-2026-118673: keepassxreboot keepassxc: KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password SafeN/A4.1 MediumN/AOct 29, 2026
CVE-2026-118085: Global Payments GlobalPayments WooCommerce: Unauthenticated Cross Site Scripting (XSS) in GlobalPayments WooCommerce <= 1.23.3 versions.7.1 HighN/AN/AOct 29, 2026
CVE-2026-118084: nicdark Hotel Booking: Subscriber Insecure Direct Object References (IDOR) in Hotel Booking <= 3.8 versions.6.5 MediumN/AN/AOct 29, 2026
CVE-2026-118083: Themeum WP Crowdfunding: Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions.7.5 HighN/AN/AOct 29, 2026
CVE-2026-118082: BuddyBoss Buddyboss Platform: Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions.8.8 HighN/AN/AOct 29, 2026
CVE-2026-118081: 10Web 10Web Social Photo Feed: Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions.8.8 HighN/AN/AOct 29, 2026
CVE-2026-118079: FolioVision FV Flowplayer Video Player: Shop manager PHP Object Injection in FV Flowplayer Video Player <= 8.3.4 versions.7.2 HighN/AN/AOct 29, 2026
CVE-2026-118078: PixelYourSite Product Catalog Feed by PixelYourSite: Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions.7.2 HighN/AN/AOct 29, 2026
CVE-2026-118077: Fast Themes Sastra Essential Addons for Elementor: Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions.7.2 HighN/AN/AOct 29, 2026
CVE-2026-118076: Frisbii Frisbii Pay: Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions.8.8 HighN/AN/AOct 29, 2026
CVE-2026-118074: Daman Jeet Finale Lite: Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions.7.2 HighN/AN/AOct 29, 2026
CVE-2026-118073: blazethemes News Kit Elementor Addons: Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions.8.8 HighN/AN/AOct 29, 2026
CVE-2026-116869: myPOS Payments myPOS Checkout: Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions.7.2 HighN/AN/AOct 29, 2026
CVE-2026-116868: BuddyDev BuddyPress Xprofile Custom Field Types: Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3.1 versions.8.8 HighN/AN/AOct 29, 2026
CVE-2026-116866: Dotstore Extra Fees Plugin for WooCommerce: Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 versions.8.8 HighN/AN/AOct 29, 2026
CVE-2026-116865: Gesundheit Bewegt GmbH Zippy: Editor PHP Object Injection in Zippy <= 1.7.0 versions.7.2 HighN/AN/AOct 29, 2026
CVE-2026-116864: Arni Cinco WPCargo Track & Trace: Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions.7.2 HighN/AN/AOct 29, 2026
CVE-2026-116848: POSIMYTH Innovations The Plus Addons for Elementor Page Builder Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-115795: RT-Labs P-Net: P-Net before 1.0.3 does not check that a complete block header is present in the received data before reading the next…N/A5.3 MediumN/AOct 29, 2026
CVE-2026-115794: RT-Labs P-Net: P-Net before 1.0.3 passes the application alarm callback a data length derived from the variable part length field of a…N/A2.3 LowN/AOct 29, 2026
CVE-2026-115793: RT-Labs P-Net: P-Net before 1.0.3 does not release the RPC session allocated for an RPC request that names an unknown interface or…N/A8.7 HighN/AOct 29, 2026
126-150 of 538495