The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-115998: CervantesSec cervantes: IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings,…4.3 MediumN/A0%Oct 24, 2026
CVE-2026-115994: CervantesSec cervantes: BOLA Allows Cross-Project Target Tampering in Cervantes version v1.3-beta could allow an attacker modify or delete…5.4 MediumN/A0%Oct 24, 2026
CVE-2026-114705: quadlayers WP Social Feed Gallery: Missing Authorization vulnerability in quadlayers WP Social Feed Gallery insta-gallery allows Exploiting Incorrectly…6.5 MediumN/A0%Oct 24, 2026
CVE-2026-114194: Igor Funa Ad Inserter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad…6.5 MediumN/A0%Oct 24, 2026
CVE-2026-115993: CervantesSec cervantes: Stored XSS vulnerability in the “Notes” field of the Checklists in Cervantes version v1.3-beta could allow an attacker…6.8 MediumN/A0%Oct 24, 2026
CVE-2026-94075: Tribulant Software Newsletters: Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object…9.8 CriticalN/A1%Oct 24, 2026
CVE-2026-114697: QuarkA QA Analytics: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuarkA QA…7.1 HighN/A0%Oct 24, 2026
CVE-2026-114695: Infomaniak Network VOD Infomaniak: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infomaniak…7.1 HighN/A0%Oct 24, 2026
CVE-2026-114694: Pixelite Events Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events…7.1 HighN/A0%Oct 24, 2026
CVE-2026-114693: Plugins360 Labs All-in-One Video Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugins360 Labs…6.5 MediumN/A0%Oct 24, 2026
CVE-2026-114196: paytiumsupport Paytium: Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue…9.8 CriticalN/A1%Oct 24, 2026
CVE-2026-114190: Hai Zheng / Lite Speed Cache LiteSpeed Cache: Insertion of Sensitive Information Into Sent Data vulnerability in Hai Zheng / Lite Speed Cache LiteSpeed Cache…5.9 MediumN/A0%Oct 24, 2026
CVE-2026-114179: wordplus BP Better Messages: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordplus BP…7.1 HighN/A0%Oct 24, 2026
CVE-2026-114178: Bold Grid W3 Total Cache: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Grid W3…7.1 HighN/A0%Oct 24, 2026
CVE-2026-112869: Noah Hearle We’re Open!: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Hearle We’re…7.1 HighN/A0%Oct 24, 2026
CVE-2026-112866: WPFactory Product Filter by WBW: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product…9.3 CriticalN/A0%Oct 24, 2026
CVE-2026-112844: Arraytics WP Event Solution: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics WP…7.1 HighN/A0%Oct 24, 2026
CVE-2026-111402: Tribulant Software Newsletters: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant…9.3 CriticalN/A0%Oct 24, 2026
CVE-2026-110892: Brainstorm Force SureDash: Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured…6.5 MediumN/A0%Oct 24, 2026
CVE-2026-115975: CervantesSec cervantes: Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or…7.1 HighN/A0%Oct 24, 2026
CVE-2026-115803: n/a Scada-LTS: A flaw has been found in Scada-LTS 2.8.04.3 Medium2.1 Low0%Oct 24, 2026
CVE-2026-115802: InternScience InternAgent: A weakness has been identified in InternScience InternAgent 1.5.04.3 Medium2.1 Low0%Oct 24, 2026
CVE-2026-108013: HCL Software BigFix Platform: BigFix Platform uses Mozilla CA certificate bundle (PEM)6.8 MediumN/A0%Oct 24, 2026
CVE-2026-97353: Unknown News Kit Addons For Elementor: The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before…5.4 MediumN/A0%Oct 24, 2026
CVE-2026-97352: Unknown News Kit Addons For Elementor: The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check on one of its AJAX…4.3 MediumN/A0%Oct 24, 2026
151-175 of 537999
‹›