The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-107868: YITHEMES YITH WooCommerce Product Add-Ons: Unauthenticated Bypass Vulnerability in YITH WooCommerce Product Add-Ons <= 4.34.0 versions.5.3 MediumN/AN/AOct 30, 2026
CVE-2026-78527: GS Plugins GS Testimonial Slider: Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 versions.8.8 HighN/AN/AOct 30, 2026
CVE-2026-48201: Raul P. Fast Velocity Minify: Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 versions.7.1 HighN/AN/AOct 30, 2026
CVE-2026-28160: e4jvikwp VikRentCar: Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.10 versions.7.1 HighN/AN/AOct 30, 2026
CVE-2026-62162: cardano-scaling hydra: Hydra is a layer-two scalability solution for CardanoN/A8.2 HighN/AOct 30, 2026
CVE-2026-61840: vantern-org questbot: Quest Bot is an opensource Discord BotN/A2.3 LowN/AOct 30, 2026
CVE-2026-9239: tigroumeow Meow Gallery: The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment Alt Text (aria-label…6.4 MediumN/AN/AOct 30, 2026
CVE-2026-97638: wpmudev: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure…7.5 HighN/AN/AOct 30, 2026
CVE-2026-96894: wedevs: The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Stored…7.2 HighN/AN/AOct 30, 2026
CVE-2026-84243: The GNU C Library glibc: The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries…7.0 HighN/AN/AOct 30, 2026
CVE-2026-76012: smub: The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code…7.5 HighN/AN/AOct 30, 2026
CVE-2026-69446: Microsoft Microsoft Edge (Chromium-based): Incorrect authorization in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally.4.4 MediumN/AN/AOct 30, 2026
CVE-2026-13747: tigroumeow Meow Gallery: The Meow Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.5.4…6.5 MediumN/AN/AOct 30, 2026
CVE-2026-119979: Element Labs LM Studio: LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model downloader's resolveDownloadRequest that…8.8 High8.7 HighN/AOct 30, 2026
CVE-2026-119978: FlowiseAI Flowise: Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authenticated users to execute OS commands by…8.5 High9.0 CriticalN/AOct 30, 2026
CVE-2026-119777: Red Hat: A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser7.8 HighN/AN/AOct 30, 2026
CVE-2026-119764: its-a-feature Mythic: Mythic 3.2.16 through 3.4.0.61 contains a stored cross-site scripting vulnerability that allows attackers controlling…6.8 Medium7.4 HighN/AOct 30, 2026
CVE-2026-119763: thechangelog changelog.com: changelog.com before commit 7b35e829 contains a missing authorization vulnerability that allows unauthenticated…5.3 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-119762: Axigen Axigen Mail Server: Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unauthenticated denial…7.5 High8.7 HighN/AOct 30, 2026
CVE-2026-119761: Axigen Axigen Mail Server: Axigen Mail Server WebMail before 10.6.39 and 10.7.1 contains a stored cross-site scripting vulnerability that allows…6.1 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119760: dlundquist sniproxy: sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in resolv_cancel() that allows remote…7.5 High8.7 HighN/AOct 30, 2026
CVE-2026-119620: 37954679 cak-filemanagement-system: A vulnerability was determined in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a0492977.3 High5.5 MediumN/AOct 30, 2026
CVE-2026-119619: 37954679 cak-filemanagement-system: A vulnerability was found in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a0492977.3 High5.5 MediumN/AOct 30, 2026
CVE-2026-119176: codepeople CP Multi View Events Calendar: The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject'…6.4 MediumN/AN/AOct 30, 2026
CVE-2026-119113: paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to…6.4 MediumN/AN/AOct 30, 2026
176-200 of 418318