The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-87038: zephyrproject zephyr: The user-mode verification handler for the i3c_transfer() system call, z_vrfy_i3c_transfer() in…7.0 HighN/AN/ANov 4, 2026
CVE-2026-85036: zephyrproject zephyr: The Bluetooth Classic AVDTP layer defers releasing a session's stream endpoints: bt_avdtp_l2cap_disconnected() in…5.7 MediumN/AN/ANov 4, 2026
CVE-2026-77779: Zohocorp ManageEngine Key Manager Plus: ManageEngine Key Manager Plus versions before 7151 were vulnerable to an Improper Access Control vulnerability that…7.7 HighN/AN/ANov 4, 2026
CVE-2026-77690: Zohocorp ManageEngine Key Manager Plus: ZohoCorp ManageEngine Key Manager Plus versions before 7151 were vulnerable to a Command Injection vulnerability that…8.8 HighN/AN/ANov 4, 2026
CVE-2026-16511: zephyrproject zephyr: Two RTIO syscall verifiers, in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0), did not…8.8 HighN/AN/ANov 4, 2026
CVE-2026-11753: LY Corporation Armeria: A vulnerability has been identified in armeria-saml versions prior to 1.41.1, where attacker-controlled RelayState is…N/A5.1 MediumN/ANov 4, 2026
CVE-2026-11749: LY Corporation Armeria: A vulnerability has been identified in armeria-saml prior to 1.41.1, where bearer assertions are not enforced for…N/A7.6 HighN/ANov 4, 2026
CVE-2026-118983: Unknown VikWidgetsLoader: The VikWidgetsLoader WordPress plugin before 1.12.3 does not sanitise or escape several block attributes before…6.8 MediumN/AN/ANov 4, 2026
CVE-2026-118783: Unknown All-in-One Video Gallery: The All-in-One Video Gallery WordPress plugin before 5.0.0 does not validate and escape some of its shortcode…6.8 MediumN/AN/ANov 4, 2026
CVE-2026-118637: Unknown Simple Download Monitor: The Simple Download Monitor WordPress plugin before 4.1.3 does not properly check the visibility of the content…2.7 LowN/AN/ANov 4, 2026
CVE-2026-118523: Unknown EventPrime: The EventPrime WordPress plugin before 4.3.6.1 does not keep the built-in Pending Review post status non-public,…5.3 MediumN/AN/ANov 4, 2026
CVE-2026-118422: Unknown Stape Conversion Tracking: The Stape Conversion Tracking WordPress plugin before 2.3.11 does not validate the sub-path appended to its same-origin…7.1 HighN/AN/ANov 4, 2026
CVE-2026-118407: Unknown Premium Packages: The Premium Packages WordPress plugin before 7.3.1 does not verify that a user claiming a guest order is the original…5.4 MediumN/AN/ANov 4, 2026
CVE-2026-118404: Unknown Premium Packages: The Premium Packages WordPress plugin before 7.3.1 does not verify ownership or session binding when loading a…5.3 MediumN/AN/ANov 4, 2026
CVE-2026-118403: Unknown Premium Packages: The Premium Packages WordPress plugin before 7.3.1 does not verify that the requester owns a guest order before…3.7 LowN/AN/ANov 4, 2026
CVE-2026-115426: Unknown: The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.138 does not properly validate a backup storage…5.5 MediumN/AN/ANov 4, 2026
CVE-2026-115262: Unknown: The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not restrict its…4.8 MediumN/AN/ANov 4, 2026
CVE-2026-115257: Unknown WP Roster: The WP Roster WordPress plugin before 2.36 does not perform any capability or nonce checks before writing its stored…5.3 MediumN/AN/ANov 4, 2026
CVE-2026-115250: Unknown Text Typing: The Text Typing WordPress plugin before 2.2.2 does not properly sanitize and escape a block attribute before storing it…6.8 MediumN/AN/ANov 4, 2026
CVE-2026-115243: Unknown: The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not validate the extension of the file…6.7 MediumN/AN/ANov 4, 2026
CVE-2026-115242: Unknown: The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not sanitize the staging destination…5.5 MediumN/AN/ANov 4, 2026
CVE-2026-115241: Unknown: The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not verify that a submitted snapshot…6.5 MediumN/AN/ANov 4, 2026
CVE-2026-114431: Unknown Enable Media Replace: The Enable Media Replace WordPress plugin before 4.2.3 does not pass a replaced media file through the WordPress upload…6.4 MediumN/AN/ANov 4, 2026
CVE-2026-112244: Unknown: The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not prevent direct…5.3 MediumN/AN/ANov 4, 2026
CVE-2026-112243: Unknown: The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not sanitise and escape…5.8 MediumN/AN/ANov 4, 2026
151-175 of 416458
‹›