The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-124551: classroomio: ClassroomIO through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users of any…5.3 Medium6.0 MediumN/ANov 8, 2026
CVE-2026-124474: meeting-room-booking-system mrbs-code: MRBS (Meeting Room Booking System) before 1.12.3 contains a reflected cross-site scripting vulnerability that allows…6.1 Medium5.3 MediumN/ANov 8, 2026
CVE-2026-124465: Trendyol kafka-konsumer: Trendyol kafka-konsumer from 2.3.3 before 2.6.18 contains a denial of service vulnerability in batch_consumer.go that…6.5 Medium7.1 HighN/ANov 8, 2026
CVE-2026-124330: FlowCI flow-core-x: A vulnerability was determined in FlowCI flow-core-x up to 1.23.495.0 Medium1.3 LowN/ANov 8, 2026
CVE-2026-124329: FlowCI flow-core-x: A vulnerability was found in FlowCI flow-core-x up to 1.23.495.0 Medium1.3 LowN/ANov 8, 2026
CVE-2026-124328: FlowCI flow-core-x: A vulnerability has been found in FlowCI flow-core-x up to 1.23.497.4 High2.1 LowN/ANov 8, 2026
CVE-2026-124326: DataLinkDC Dinky: A flaw has been found in DataLinkDC Dinky up to 1.2.55.4 Medium2.1 Low0%Nov 8, 2026
CVE-2026-97195: Unknown Secure Custom Fields: The Secure Custom Fields WordPress plugin before 6.9.8 does not sanitize a persisted field definition before emitting…3.5 LowN/A0%Nov 8, 2026
CVE-2026-97194: Unknown Secure Custom Fields: The Secure Custom Fields WordPress plugin before 6.9.8 does not perform a read-permission check when it renders and…2.7 LowN/A0%Nov 8, 2026
CVE-2026-97193: Unknown Secure Custom Fields: The Secure Custom Fields WordPress plugin before 6.9.8 does not verify that a user is allowed to edit the target object…2.7 LowN/A0%Nov 8, 2026
CVE-2026-97192: Unknown Secure Custom Fields: The Secure Custom Fields WordPress plugin before 6.9.8 does not re-apply its field-group location rules when persisting…2.7 LowN/A0%Nov 8, 2026
CVE-2026-96963: Unknown Pie Register: The Pie Register WordPress plugin through 3.8.4.15 does not perform an authorisation check in one of its AJAX actions,…2.7 LowN/A0%Nov 8, 2026
CVE-2026-96961: Unknown Pie Register: The Pie Register WordPress plugin through 3.8.4.15 does not perform any capability, nonce or authentication check on…6.5 MediumN/A0%Nov 8, 2026
CVE-2026-85344: Unknown FV Flowplayer Video Player: The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not perform any authorization check on an AJAX…4.3 MediumN/A0%Nov 8, 2026
CVE-2026-122085: Unknown Event Tickets Manager for WooCommerce: The Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 does not perform authorisation or a valid nonce…6.5 MediumN/A0%Nov 8, 2026
CVE-2026-122062: Unknown: The Pronamic Pay WordPress plugin before 11.1.0, Pronamic Pay doneren met Mollie WordPress plugin before 1.7.1 do not…5.3 MediumN/A0%Nov 8, 2026
CVE-2026-122060: Unknown WP Recipe Maker: The WP Recipe Maker WordPress plugin before 10.9.2 does not check whether the post a recipe is embedded in is password…5.3 MediumN/A0%Nov 8, 2026
CVE-2026-114432: Unknown Contact Form 7: The Contact Form 7 WordPress plugin before 6.2.4 does not validate the type or extension of files uploaded through a…9.8 CriticalN/A0%Nov 8, 2026
CVE-2026-110963: Unknown Userplace: The Userplace WordPress plugin through 1.2.0 does not perform authorization checks on an AJAX action available to…9.8 CriticalN/A0%Nov 8, 2026
CVE-2026-110132: Unknown Sync Post With Other Site: The Sync Post With Other Site WordPress plugin before 1.9.4 does not properly authorize a content-management action for…4.9 MediumN/A0%Nov 8, 2026
CVE-2026-109925: Unknown Productive Commerce: The Productive Commerce WordPress plugin before 1.1.54 does not sanitise and escape a parameter before using it in a…8.6 HighN/A0%Nov 8, 2026
CVE-2026-106015: Unknown Ecommerce Affiliate: The Ecommerce Affiliate WordPress plugin through 1.0.0 does not restrict one-time password issuance and verification to…8.1 HighN/A0%Nov 8, 2026
CVE-2026-105970: Unknown Thanh Toán Quét Mã QR Code Tự Động: The Thanh Toán Quét Mã QR Code Tự Động WordPress plugin through 2.0.1 does not properly verify the authenticity of…5.3 MediumN/A0%Nov 8, 2026
CVE-2026-104639: Unknown Razorpay for WooCommerce: The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not sanitize and escape a value derived from an…4.1 MediumN/A0%Nov 8, 2026
CVE-2026-104338: Unknown Razorpay for WooCommerce: The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not perform an authorization check on one of its REST…3.7 LowN/A0%Nov 8, 2026
176-200 of 418829
‹›