The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-123958: TOTOLINK CA300-PoE: A vulnerability was identified in TOTOLINK CA300-PoE 6.2c.8849.9 Critical8.6 HighN/ANov 7, 2026
CVE-2026-123957: TOTOLINK CA300-PoE: A vulnerability was determined in TOTOLINK CA300-PoE 6.2c.8849.9 Critical8.6 HighN/ANov 7, 2026
CVE-2026-121768: Markus Wiesenhofer Contact Form 7 – Post Fields: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Markus…6.5 MediumN/AN/ANov 7, 2026
CVE-2026-121767: weDevs weDocs: Missing Authorization vulnerability in weDevs weDocs wedocs allows Exploiting Incorrectly Configured Access Control…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-121761: Infomaniak Network VOD Infomaniak: Missing Authorization vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Exploiting Incorrectly…4.3 MediumN/AN/ANov 7, 2026
CVE-2026-120849: WC Lovers WCFM Marketplace: Missing Authorization vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Exploiting…4.3 MediumN/AN/ANov 7, 2026
CVE-2026-120848: WC Lovers WCFM Marketplace: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WC Lovers WCFM…6.5 MediumN/AN/ANov 7, 2026
CVE-2026-119510: Saeed MC Woocommerce Wishlist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saeed MC…6.5 MediumN/AN/ANov 7, 2026
CVE-2026-119489: Bootstrapped Ventures WP Recipe Maker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bootstrapped…6.5 MediumN/AN/ANov 7, 2026
CVE-2026-104738: nasirahmed Advanced Form Integration — Connect Forms to 300+ Apps: The Advanced Form Integration — Connect Forms to 300+ Apps plugin for WordPress is vulnerable to PHP Object Injection…8.1 HighN/AN/ANov 7, 2026
CVE-2026-119502: BdThemes Ultimate Store Kit Elementor Addons: Missing Authorization vulnerability in BdThemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-122668: myCred: Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control…4.3 MediumN/AN/ANov 7, 2026
CVE-2026-120853: Brainstorm Force CartFlows: Missing Authorization vulnerability in Brainstorm Force CartFlows cartflows allows Exploiting Incorrectly Configured…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-119491: David Lingren Media LIbrary Assistant: Missing Authorization vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Exploiting…4.3 MediumN/AN/ANov 7, 2026
CVE-2026-119484: Supsystic Photo Gallery by Supsystic: Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Photo Gallery by Supsystic gallery-by-supsystic allows…6.3 MediumN/AN/ANov 7, 2026
CVE-2026-120847: Wpmet Metform: Missing Authorization vulnerability in Wpmet Metform metform allows Exploiting Incorrectly Configured Access Control…4.3 MediumN/AN/ANov 7, 2026
CVE-2026-119511: Saeed MC Woocommerce Wishlist: Missing Authorization vulnerability in Saeed MC Woocommerce Wishlist smart-wishlist-for-more-convert allows Exploiting…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-121766: Blubrry Podcasting PowerPress Podcasting: Missing Authorization vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Exploiting…5.4 MediumN/AN/ANov 7, 2026
CVE-2026-123466: LeapWorx Premium Blocks – Gutenberg Blocks for WordPress: Missing Authorization vulnerability in LeapWorx Premium Blocks – Gutenberg Blocks for WordPress…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-52713: ThimPress LearnPress: Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access…5.4 MediumN/AN/ANov 7, 2026
CVE-2026-119467: WPVibes AnyWhere Elementor: Missing Authorization vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Exploiting Incorrectly…5.4 MediumN/AN/ANov 7, 2026
CVE-2026-66669: Suplugins: Cross-Site Request Forgery (CSRF) vulnerability in Suplugins Superb Addons: Blocks, Patterns & Theme Designer…8.8 HighN/AN/ANov 7, 2026
CVE-2026-121781: WP ManageNinja LLC Fluent Booking: Missing Authorization vulnerability in WP ManageNinja LLC Fluent Booking fluent-booking allows Exploiting Incorrectly…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-124274: myCred: Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-122675: Wpmet Wp Social: Cross-Site Request Forgery (CSRF) vulnerability in Wpmet Wp Social wp-social allows Cross Site Request Forgery.This…5.4 MediumN/AN/ANov 7, 2026
151-175 of 431014
‹›