The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-124970: WP BASE WP BASE Booking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE…9.3 CriticalN/AN/ANov 13, 2026
CVE-2026-125851: themagnifico52 Hotel Booking Lite: Unrestricted Upload of File with Dangerous Type vulnerability in themagnifico52 Hotel Booking Lite hotel-booking-lite…9.9 CriticalN/AN/ANov 13, 2026
CVE-2026-125858: CleverReach CleverReach® WP: Missing Authorization vulnerability in CleverReach CleverReach® WP cleverreach-wp allows Exploiting Incorrectly…6.3 MediumN/AN/ANov 13, 2026
CVE-2026-125855: Elextensions ELEX WordPress HelpDesk & Customer Ticketing System: Deserialization of Untrusted Data vulnerability in Elextensions ELEX WordPress HelpDesk & Customer Ticketing System…9.8 CriticalN/AN/ANov 13, 2026
CVE-2026-125853: Everestthemes Everest Backup: Missing Authorization vulnerability in Everestthemes Everest Backup everest-backup allows Exploiting Incorrectly…6.5 MediumN/AN/ANov 13, 2026
CVE-2026-125852: Realtyna Realtyna Organic IDX plugin: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Realtyna Realtyna…7.7 HighN/AN/ANov 13, 2026
CVE-2026-103769: Acowebs PDF Invoices and Packing Slips For WooCommerce: Deserialization of Untrusted Data vulnerability in Acowebs PDF Invoices and Packing Slips For WooCommerce…7.2 HighN/AN/ANov 13, 2026
CVE-2026-82175: Dell: Dell PowerStore contains a Server-Side Request Forgery (SSRF) vulnerability3.8 LowN/AN/ANov 13, 2026
CVE-2026-107522: Dell: Dell PowerStore contains an Improper Authorization vulnerability7.2 HighN/AN/ANov 13, 2026
CVE-2026-125802: Brainstorm Force Spectra: Insertion of Sensitive Information Into Sent Data vulnerability in Brainstorm Force Spectra…5.3 MediumN/AN/ANov 13, 2026
CVE-2026-125825: Webful Creations RepairBuddy: Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Exploiting Incorrectly…5.3 MediumN/AN/ANov 13, 2026
CVE-2026-125792: Andy Moyle Church Admin: Missing Authorization vulnerability in Andy Moyle Church Admin church-admin allows Exploiting Incorrectly Configured…5.3 MediumN/AN/ANov 13, 2026
CVE-2026-125834: WP Media Imagify: Missing Authorization vulnerability in WP Media Imagify imagify allows Exploiting Incorrectly Configured Access Control…4.3 MediumN/AN/ANov 13, 2026
CVE-2026-125827: Liquid Web / StellarWP Event Tickets: Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly…5.3 MediumN/AN/ANov 13, 2026
CVE-2026-125811: myCred: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in myCred myCred…8.5 HighN/AN/ANov 13, 2026
CVE-2026-125810: myCred: Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control…4.3 MediumN/AN/ANov 13, 2026
CVE-2026-111547: Dell: Dell PowerStore contains an out-of-bounds read vulnerability8.1 HighN/AN/ANov 13, 2026
CVE-2026-125835: Crocoblock JetTabs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock…6.5 MediumN/AN/ANov 13, 2026
CVE-2026-124409: VillaTheme CURCY: Missing Authorization vulnerability in VillaTheme CURCY woo-multi-currency allows Exploiting Incorrectly Configured…5.3 MediumN/AN/ANov 13, 2026
CVE-2026-125807: HTMega HT Mega: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HTMega HT Mega…6.5 MediumN/AN/ANov 13, 2026
CVE-2026-125808: HTMega HT Mega: Missing Authorization vulnerability in HTMega HT Mega ht-mega-for-elementor allows Exploiting Incorrectly Configured…5.3 MediumN/AN/ANov 13, 2026
CVE-2026-125824: WP Go Maps: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Go Maps WP Go…6.5 MediumN/AN/ANov 13, 2026
CVE-2026-125819: PublishPress Gutenberg Blocks: Missing Authorization vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg allows Exploiting Incorrectly…5.3 MediumN/AN/ANov 13, 2026
CVE-2026-92241: zephyrproject zephyr: The AVRCP browsing channel's L2CAP receive-buffer callback, browsing_avrcp_l2cap_alloc_buf() in…5.7 MediumN/AN/ANov 13, 2026
CVE-2026-91094: Debian dpkg: A directory traversal bug was discovered when unpacking 3.0 (quilt) source packages, where the packaging tarball could…N/AN/AN/ANov 13, 2026
126-150 of 532044