The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-111962: Unknown WP Remote Users Sync: The WP Remote Users Sync WordPress plugin before 2.2.0 does not adequately restrict access to the user export files it…3.7 LowN/AN/ANov 4, 2026
CVE-2026-111740: Unknown Post Duplicator: The Post Duplicator WordPress plugin before 3.0.17 does not check whether the requesting user may view each post before…2.7 LowN/AN/ANov 4, 2026
CVE-2026-110964: Unknown Essential Real Estate: The Essential Real Estate WordPress plugin before 5.3.5 does not verify that a media attachment belongs to the…6.5 MediumN/AN/ANov 4, 2026
CVE-2026-110692: Unknown: The PowerPack Addons for Elementor: Widgets, Form Styler and Templates WordPress plugin before 3.1.3 does not validate…4.1 MediumN/AN/ANov 4, 2026
CVE-2026-108068: Unknown FV Flowplayer Video Player: The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform proper authorization checks on one…3.8 LowN/AN/ANov 4, 2026
CVE-2026-108067: Unknown FV Flowplayer Video Player: The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not properly verify record ownership before…3.8 LowN/AN/ANov 4, 2026
CVE-2026-108041: Unknown SEOPress: The SEOPress WordPress plugin before 10.4 does not sanitise and escape some of its analytics tracking settings before…7.1 HighN/AN/ANov 4, 2026
CVE-2026-106649: Unknown Kali Forms — Contact Form & Drag-and-Drop Builder: The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.29 does not prevent users with…6.8 MediumN/AN/ANov 4, 2026
CVE-2026-106000: Unknown Booking Package: The Booking Package WordPress plugin before 1.7.34 does not require payment to be completed before saving a booking on…5.3 MediumN/AN/ANov 4, 2026
CVE-2026-105413: Unknown Form Maker by 10Web: The Form Maker by 10Web WordPress plugin before 1.15.51 does not consistently escape user-submitted field values before…7.5 HighN/AN/ANov 4, 2026
CVE-2026-105191: Unknown: The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce WordPress plugin before 1.17.11 does not perform a…4.3 MediumN/AN/ANov 4, 2026
CVE-2026-104719: Unknown CookieYes: The CookieYes WordPress plugin before 3.5.8 does not correctly restrict who can write its cookie-category script…6.4 MediumN/AN/ANov 4, 2026
CVE-2026-101166: Unknown Mollie Payments for WooCommerce: The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify a product's publication status before…3.7 LowN/AN/ANov 4, 2026
CVE-2026-101165: Unknown Mollie Payments for WooCommerce: The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify an order's payment state or the…3.7 LowN/AN/ANov 4, 2026
CVE-2025-11229: WSO2: The system fails to properly enforce scope authorization when the `authorize_all_scopes` configuration is enabled7.2 HighN/AN/ANov 4, 2026
CVE-2026-105296: Akeeba Ltd.: Multiple Akeeba products lack the anti-CSRF check on some actions5.4 Medium5.1 MediumN/ANov 4, 2026
CVE-2026-80335: Unisoc (Shanghai) Technologies Co., Ltd. Bootloader: In the bootloader download module, there is a possible out-of-bounds write due to a failure to reset a global offset…7.6 HighN/AN/ANov 4, 2026
CVE-2026-79405: Unisoc (Shanghai) Technologies Co., Ltd. Modem: In Modem Firmware, there is a possible system crash due to improper input validation of dedicated PUCCH configuration7.5 HighN/AN/ANov 4, 2026
CVE-2026-121803: Out-of-bounds Write9.3 CriticalN/AN/ANov 4, 2026
CVE-2026-121802: better-auth Better Auth: @better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any…9.1 CriticalN/AN/ANov 4, 2026
CVE-2026-121618: Linksys E5600: A weakness has been identified in Linksys E5600 1.1.0.265.3 Medium5.5 MediumN/ANov 4, 2026
CVE-2026-121617: Linksys E5600: A security flaw has been discovered in Linksys E5600 1.1.0.267.5 High7.7 HighN/ANov 4, 2026
CVE-2026-121616: Linksys E5600: A vulnerability was identified in Linksys E5600 1.1.0.265.3 Medium5.5 MediumN/ANov 4, 2026
CVE-2026-121615: Linksys E5600: A vulnerability was determined in Linksys E5600 1.1.0.2610.0 Critical9.3 CriticalN/ANov 4, 2026
CVE-2026-84730: ASUS Router firmware: Stack-based buffer overflow in certain ASUS Router firmware allows an unauthenticated nearby attacker to execute…N/A8.7 HighN/ANov 4, 2026
176-200 of 544388
‹›