The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-96963: Unknown Pie Register: The Pie Register WordPress plugin through 3.8.4.15 does not perform an authorisation check in one of its AJAX actions,…2.7 LowN/AN/ANov 8, 2026
CVE-2026-96961: Unknown Pie Register: The Pie Register WordPress plugin through 3.8.4.15 does not perform any capability, nonce or authentication check on…6.5 MediumN/AN/ANov 8, 2026
CVE-2026-85344: Unknown FV Flowplayer Video Player: The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not perform any authorization check on an AJAX…4.3 MediumN/AN/ANov 8, 2026
CVE-2026-122085: Unknown Event Tickets Manager for WooCommerce: The Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 does not perform authorisation or a valid nonce…6.5 MediumN/AN/ANov 8, 2026
CVE-2026-122062: Unknown: The Pronamic Pay WordPress plugin before 11.1.0, Pronamic Pay doneren met Mollie WordPress plugin before 1.7.1 do not…5.3 MediumN/AN/ANov 8, 2026
CVE-2026-122060: Unknown WP Recipe Maker: The WP Recipe Maker WordPress plugin before 10.9.2 does not check whether the post a recipe is embedded in is password…5.3 MediumN/AN/ANov 8, 2026
CVE-2026-114432: Unknown Contact Form 7: The Contact Form 7 WordPress plugin before 6.2.4 does not validate the type or extension of files uploaded through a…9.8 CriticalN/AN/ANov 8, 2026
CVE-2026-110963: Unknown Userplace: The Userplace WordPress plugin through 1.2.0 does not perform authorization checks on an AJAX action available to…9.8 CriticalN/AN/ANov 8, 2026
CVE-2026-110132: Unknown Sync Post With Other Site: The Sync Post With Other Site WordPress plugin before 1.9.4 does not properly authorize a content-management action for…4.9 MediumN/AN/ANov 8, 2026
CVE-2026-109925: Unknown Productive Commerce: The Productive Commerce WordPress plugin before 1.1.54 does not sanitise and escape a parameter before using it in a…8.6 HighN/AN/ANov 8, 2026
CVE-2026-106015: Unknown Ecommerce Affiliate: The Ecommerce Affiliate WordPress plugin through 1.0.0 does not restrict one-time password issuance and verification to…8.1 HighN/AN/ANov 8, 2026
CVE-2026-105970: Unknown Thanh Toán Quét Mã QR Code Tự Động: The Thanh Toán Quét Mã QR Code Tự Động WordPress plugin through 2.0.1 does not properly verify the authenticity of…5.3 MediumN/AN/ANov 8, 2026
CVE-2026-104639: Unknown Razorpay for WooCommerce: The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not sanitize and escape a value derived from an…4.1 MediumN/AN/ANov 8, 2026
CVE-2026-104338: Unknown Razorpay for WooCommerce: The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not perform an authorization check on one of its REST…3.7 LowN/AN/ANov 8, 2026
CVE-2026-104337: Unknown Razorpay for WooCommerce: The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not verify ownership of an order before returning a…5.3 MediumN/AN/ANov 8, 2026
CVE-2026-104307: Unknown BackUpWordPress: The BackUpWordPress plugin before 3.15 does not perform a capability or nonce check on an AJAX action that cleans up…5.4 MediumN/AN/ANov 8, 2026
CVE-2026-103375: Unknown Antom Payments: The Antom Payments WordPress plugin through 2.0.11 does not perform any ownership or authorisation check before…5.3 MediumN/AN/ANov 8, 2026
CVE-2026-103303: Unknown Turisbook Booking System: The Turisbook Booking System WordPress plugin through 1.3.8 does not have authorisation and CSRF checks when saving its…8.8 HighN/AN/ANov 8, 2026
CVE-2026-114713: UnrealIRCd: The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when…8.6 HighN/AN/ANov 8, 2026
CVE-2026-124422: jihong88 suneditor: SunEditor from 3.0.0 before 3.4.0 contains a stored cross-site scripting vulnerability in html.clean() that rebuilds…6.1 Medium5.3 MediumN/ANov 8, 2026
CVE-2026-123616: imgproxy: imgproxy from 3.3.0 before 4.0.16 contains an unbounded memory allocation vulnerability in the ICO loader that fails to…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123615: imgproxy: imgproxy 3.3.0 before 4.0.17 contains an out-of-bounds heap read and write in the ICO loader's BMP header…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123614: imgproxy: imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that allows remote attackers to…9.8 Critical9.3 CriticalN/ANov 8, 2026
CVE-2026-123613: rustls: Rustls from 0.23.13 before 0.23.45 accepts TLS 1.3 handshake messages at the wrong encryption level when they follow a…5.3 Medium6.9 MediumN/ANov 8, 2026
CVE-2026-123612: rustls: rustls 0.23.44 and 0.23.45 contain an information disclosure vulnerability that sends application data buffered before…2.3 Low4.6 MediumN/ANov 8, 2026
176-200 of 422454
‹›