The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-118036: Progress Software Telerik Document Processing Libraries: In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite…7.5 HighN/AN/AOct 28, 2026
CVE-2026-118035: Progress Software Telerik Document Processing Libraries: In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, inefficient…7.5 HighN/AN/AOct 28, 2026
CVE-2026-116404: David Anderson Redux Framework: Missing Authorization vulnerability in David Anderson Redux Framework redux-framework allows Lifting Sensitive Data…6.5 MediumN/AN/AOct 28, 2026
CVE-2026-116393: iHomefinder, Inc. Optima Express: Missing Authorization vulnerability in iHomefinder, Inc7.5 HighN/AN/AOct 28, 2026
CVE-2026-116392: PickPlugins Accordion: Deserialization of Untrusted Data vulnerability in PickPlugins Accordion accordions allows Object Injection.This issue…7.2 HighN/AN/AOct 28, 2026
CVE-2026-116391: GS Plugins GS Logo Slider: Deserialization of Untrusted Data vulnerability in GS Plugins GS Logo Slider gs-logo-slider allows Object…8.8 HighN/AN/AOct 28, 2026
CVE-2026-115957: WP Discussion Board: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Discussion…6.5 MediumN/AN/AOct 28, 2026
CVE-2026-115904: topluyo App: Topluyo is a social networking platform9.6 CriticalN/AN/AOct 28, 2026
CVE-2026-115612: iova.mihai SliceWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.mihai…7.1 HighN/AN/AOct 28, 2026
CVE-2026-115609: Stiofan GetPaid: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan GetPaid…7.1 HighN/AN/AOct 28, 2026
CVE-2026-115607: Crowd Favorite DXP ToolKit: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crowd Favorite…9.3 CriticalN/AN/AOct 28, 2026
CVE-2026-115606: Crowd Favorite DXP ToolKit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crowd Favorite…7.1 HighN/AN/AOct 28, 2026
CVE-2026-115596: impleCode eCommerce Product Catalog: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode…7.1 HighN/AN/AOct 28, 2026
CVE-2026-115593: Unlimited Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited…7.1 HighN/AN/AOct 28, 2026
CVE-2026-115591: Supsystic Contact Form by Supsystic: Insertion of Sensitive Information Into Sent Data vulnerability in Supsystic Contact Form by Supsystic…7.5 HighN/AN/AOct 28, 2026
CVE-2026-111850: BuddyPress: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress…8.5 HighN/AN/AOct 28, 2026
CVE-2026-111411: Aman FunnelKit Automations: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman FunnelKit…9.3 CriticalN/AN/AOct 28, 2026
CVE-2026-81472: Dell: Dell iDRAC Service Module (iSM) for Windows, Dell iDRAC Service Module (iSM) for Linux, and Dell iDRAC Service Module…4.2 MediumN/AN/AOct 28, 2026
CVE-2026-118485: Axel Download Accelerator Axel: Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename…8.1 High7.0 HighN/AOct 28, 2026
CVE-2026-118477: EISGE Kalifast: The ei_git_repo_url parameter in the Git remote configuration endpoint of KaliFast is vulnerable to OS Command Injection9.8 Critical8.7 HighN/AOct 28, 2026
CVE-2026-116855: wphocus My auctions allegro: Missing Authorization vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Exploiting…5.4 MediumN/AN/AOct 28, 2026
CVE-2026-114278: Eclipse Foundation Eclipse Che: The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and…9.8 CriticalN/AN/AOct 28, 2026
CVE-2026-102799: icagenda.com iCagenda extension for Joomla: Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16N/A5.3 MediumN/AOct 28, 2026
CVE-2026-102790: icagenda.com iCagenda extension for Joomla: Joomla Extension - icagenda.com - Stored XSS via url-type event Custom Field in iCagenda 3.2.1 to 4.0.16N/A8.6 HighN/AOct 28, 2026
CVE-2026-99216: Linux: In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Don't reset VMBus connection state on…N/AN/AN/AOct 28, 2026
126-150 of 417096