The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-103375: Unknown Antom Payments: The Antom Payments WordPress plugin through 2.0.11 does not perform any ownership or authorisation check before…N/AN/AN/ANov 8, 2026
CVE-2026-97195: Unknown Secure Custom Fields: The Secure Custom Fields WordPress plugin before 6.9.8 does not sanitize a persisted field definition before emitting…N/AN/AN/ANov 8, 2026
CVE-2026-97194: Unknown Secure Custom Fields: The Secure Custom Fields WordPress plugin before 6.9.8 does not perform a read-permission check when it renders and…N/AN/AN/ANov 8, 2026
CVE-2026-97193: Unknown Secure Custom Fields: The Secure Custom Fields WordPress plugin before 6.9.8 does not verify that a user is allowed to edit the target object…N/AN/AN/ANov 8, 2026
CVE-2026-97192: Unknown Secure Custom Fields: The Secure Custom Fields WordPress plugin before 6.9.8 does not re-apply its field-group location rules when persisting…N/AN/AN/ANov 8, 2026
CVE-2026-85344: Unknown FV Flowplayer Video Player: The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not perform any authorization check on an AJAX…N/AN/AN/ANov 8, 2026
CVE-2026-122085: Unknown Event Tickets Manager for WooCommerce: The Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 does not perform authorisation or a valid nonce…N/AN/AN/ANov 8, 2026
CVE-2026-122062: Unknown: The Pronamic Pay WordPress plugin before 11.1.0, Pronamic Pay doneren met Mollie WordPress plugin before 1.7.1 do not…N/AN/AN/ANov 8, 2026
CVE-2026-122060: Unknown WP Recipe Maker: The WP Recipe Maker WordPress plugin before 10.9.2 does not check whether the post a recipe is embedded in is password…N/AN/AN/ANov 8, 2026
CVE-2026-114713: UnrealIRCd: The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when…8.6 HighN/AN/ANov 8, 2026
CVE-2026-124422: jihong88 suneditor: SunEditor from 3.0.0 before 3.4.0 contains a stored cross-site scripting vulnerability in html.clean() that rebuilds…6.1 Medium5.3 MediumN/ANov 8, 2026
CVE-2026-123616: imgproxy: imgproxy from 3.3.0 before 4.0.16 contains an unbounded memory allocation vulnerability in the ICO loader that fails to…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123615: imgproxy: imgproxy 3.3.0 before 4.0.17 contains an out-of-bounds heap read and write in the ICO loader's BMP header…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123614: imgproxy: imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that allows remote attackers to…9.8 Critical9.3 CriticalN/ANov 8, 2026
CVE-2026-123613: rustls: Rustls from 0.23.13 before 0.23.45 accepts TLS 1.3 handshake messages at the wrong encryption level when they follow a…5.3 Medium6.9 MediumN/ANov 8, 2026
CVE-2026-123612: rustls: rustls 0.23.44 and 0.23.45 contain an information disclosure vulnerability that sends application data buffered before…2.3 Low4.6 MediumN/ANov 8, 2026
CVE-2026-123611: rustls: rustls before 0.23.46 contains a key exchange downgrade vulnerability that allows network attackers to poison the…3.7 Low6.3 MediumN/ANov 8, 2026
CVE-2026-123610: rustls: rustls before 0.23.46 contains an uncontrolled memory allocation flaw in its optional Brotli certificate decompression,…3.7 Low6.3 MediumN/ANov 8, 2026
CVE-2026-123609: rustls: Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where…4.0 Medium4.1 MediumN/ANov 8, 2026
CVE-2026-123608: hickory-dns: Hickory DNS hickory-proto from 0.3.1 before 0.26.1 contains a denial of service vulnerability in BinEncoder that allows…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123607: hickory-dns: Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 and hickory-net before 0.26.1 contain an unbounded loop…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123606: hickory-dns: The hickory-dns recursor in hickory-recursor 0.25.0-alpha.3 through 0.25.2 and hickory-resolver 0.26.0-alpha.1 before…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123605: hickory-dns: Hickory DNS hickory-proto 0.1 through 0.25.0-alpha.3 and hickory-net before 0.26.2 contain a DNSSEC validation bypass…8.8 High8.7 HighN/ANov 8, 2026
CVE-2026-123604: hickory-dns: Hickory DNS hickory-resolver 0.26.0-beta.1 before 0.26.2 contains an unbounded retry loop in NameServerPool::try_send,…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123603: hickory-dns: hickory-proto and hickory-resolver 0.26.0 before 0.26.2, hickory-server 0.25.0-alpha.1 before 0.26.2, and…6.5 Medium6.9 MediumN/ANov 8, 2026
151-175 of 418627
‹›