The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-125431: Mamunur Rashid Food Menu – Restaurant Menu & Online Ordering for WooCommerce: Missing Authorization vulnerability in Mamunur Rashid Food Menu – Restaurant Menu & Online Ordering for WooCommerce…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-125046: John-Michael L'Allier Create: Missing Authorization vulnerability in John-Michael L'Allier Create mediavine-create allows Exploiting Incorrectly…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-125045: John-Michael L'Allier Create: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in John-Michael…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-124745: Red Hat: A flaw was found in BusyBox6.3 MediumN/AN/ANov 11, 2026
CVE-2026-124744: Red Hat: A flaw was found in BusyBox6.3 MediumN/AN/ANov 11, 2026
CVE-2026-124417: Ahmad WP Job Portal: Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured…4.3 MediumN/AN/ANov 11, 2026
CVE-2026-124416: Ahmad WP Job Portal: Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured…4.3 MediumN/AN/ANov 11, 2026
CVE-2026-124411: Brainstorm Force SureCart: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-124269: weDevs Happy Addons for Elementor: Missing Authorization vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Exploiting…4.3 MediumN/AN/ANov 11, 2026
CVE-2026-124263: plainware Locatoraid Store Locator: Cross-Site Request Forgery (CSRF) vulnerability in plainware Locatoraid Store Locator locatoraid allows Cross Site…5.4 MediumN/AN/ANov 11, 2026
CVE-2026-124262: Igor Funa Ad Inserter: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Igor Funa Ad Inserter…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-124261: Magepeople inc. Taxi Booking Manager for WooCommerce: Missing Authorization vulnerability in Magepeople inc5.3 MediumN/AN/ANov 11, 2026
CVE-2026-123481: WP Extended The Ultimate WordPress Toolkit – WP Extended: Missing Authorization vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended allows…4.3 MediumN/AN/ANov 11, 2026
CVE-2026-123480: Fullworks Plugins Display Eventbrite Events: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fullworks Plugins…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-123374: Apache Software Foundation Apache Roller: Deserialization of Untrusted Data vulnerability in Apache RollerN/AN/AN/ANov 11, 2026
CVE-2026-122300: Apache Software Foundation Apache Roller: Missing Authorization vulnerability in Apache Roller 4.0 through 6.1.6 allows a weblog member with the Limited role to…N/AN/AN/ANov 11, 2026
CVE-2026-122096: Apache Software Foundation Apache DataSketches Java: Uncontrolled Resource Consumption vulnerability in the sketch deserialization of Apache DataSketches JavaN/AN/AN/ANov 11, 2026
CVE-2026-118414: Apache Software Foundation Apache Roller: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.2 through…5.4 MediumN/AN/ANov 11, 2026
CVE-2026-118413: Apache Software Foundation Apache Roller: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 4.0 through 6.1.6…5.4 MediumN/AN/ANov 11, 2026
CVE-2026-118412: Apache Software Foundation Apache Roller: Improper Authentication in Apache Roller 5.1.0 through 6.1.6 allows a user whose account an administrator has disabled…3.1 LowN/AN/ANov 11, 2026
CVE-2026-118411: Apache Software Foundation Apache Roller: Cross-Site Request Forgery (CSRF) in Apache Roller 5.0.1 through 6.1.6 allows an unauthenticated attacker to create an…8.8 HighN/AN/ANov 11, 2026
CVE-2026-118410: Apache Software Foundation Apache Roller: Exposure of Resource to Wrong Sphere in Apache Roller 4.0 through 6.1.6 allows an unauthenticated visitor to read an…3.7 LowN/AN/ANov 11, 2026
CVE-2026-118409: Apache Software Foundation Apache Roller: Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows an unauthenticated…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-118408: Apache Software Foundation Apache Roller: Missing Authorization in Apache Roller 4.0 through 6.1.6 allows any logged-in user to read unpublished entries of a…3.1 LowN/AN/ANov 11, 2026
CVE-2026-118405: Apache Software Foundation Apache Roller: Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows any logged-in user…4.3 MediumN/AN/ANov 11, 2026
176-200 of 511254