The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-39738: FunnelKit FunnelKit Automations: Unauthenticated PHP Object Injection in FunnelKit Automations <= 3.8.6.1 versions.9.8 CriticalN/AN/AOct 30, 2026
CVE-2026-39734: Saad Iqbal WP EasyPay: Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions.7.5 HighN/AN/AOct 30, 2026
CVE-2026-39732: Ivijan-Stefan Stipic Transliterator: Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions.9.3 CriticalN/AN/AOct 30, 2026
CVE-2026-28160: e4jvikwp VikRentCar: Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.10 versions.7.1 HighN/AN/AOct 30, 2026
CVE-2026-27061: wpeverest User Registration: Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 versions.6.5 MediumN/AN/AOct 30, 2026
CVE-2026-120046: nezhahq nezha: Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats that…5.3 Medium6.0 MediumN/AOct 30, 2026
CVE-2026-120007: NodeBB: NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that allows unauthenticated visitors to act…6.5 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-119842: Red Hat: A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser6.5 MediumN/AN/AOct 30, 2026
CVE-2026-119729: Red Hat: A flaw was found in GStreamer6.5 MediumN/AN/AOct 30, 2026
CVE-2026-119728: Red Hat: A flaw was found in the H.264 video parser in gst-plugins-bad5.5 MediumN/AN/AOct 30, 2026
CVE-2026-119727: Red Hat: A flaw was found in GStreamer's gst-plugins-bad H.265 video parser6.5 MediumN/AN/AOct 30, 2026
CVE-2026-119526: ThemeREX Royal Event: Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection9.8 CriticalN/AN/AOct 30, 2026
CVE-2026-119117: AWS amazon-kinesis-producer: Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the…6.5 Medium8.2 HighN/AOct 30, 2026
CVE-2026-118090: Stylemix MasterStudy LMS: Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions.8.8 HighN/AN/AOct 30, 2026
CVE-2026-118089: RexTheme Product Feed Manager: Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions.7.2 HighN/AN/AOct 30, 2026
CVE-2026-118086: Hakan Ozevin WP BASE Booking: Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions.8.8 HighN/AN/AOct 30, 2026
CVE-2026-116862: Acato WP REST Cache: Unauthenticated Broken Access Control in WP REST Cache <= 2026.3.1 versions.7.5 HighN/AN/AOct 30, 2026
CVE-2026-116861: wpdesk Flexible Chat: Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions.7.5 HighN/AN/AOct 30, 2026
CVE-2026-116854: Aguila Technologies WP Customer Area: Subscriber Cross Site Scripting (XSS) in WP Customer Area <= 8.4.0 versions.6.5 MediumN/AN/AOct 30, 2026
CVE-2026-116853: Nexcess GiveWP: Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions.6.5 MediumN/AN/AOct 30, 2026
CVE-2026-116852: Marketing Fire Widget Options: Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions.9.1 CriticalN/AN/AOct 30, 2026
CVE-2026-116851: impleCode eCommerce Product Catalog: Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.6.5 versions.7.1 HighN/AN/AOct 30, 2026
CVE-2026-116847: Kitae Park Mang Board WP: Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.6 versions.7.1 HighN/AN/AOct 30, 2026
CVE-2026-116410: masteriyo Masteriyo - LMS: Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS <= 3.4.3 versions.6.5 MediumN/AN/AOct 30, 2026
CVE-2026-116405: e4jvikwp VikRentCar: Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.9 versions.7.1 HighN/AN/AOct 30, 2026
126-150 of 418318