The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-88800: Unknown: The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on…9.1 CriticalN/AN/ANov 6, 2026
CVE-2026-88799: Unknown: The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check ownership or…8.8 HighN/AN/ANov 6, 2026
CVE-2026-65022: HCLSoftware BigFix MCM & Mobile: The MDM App Catalog / App Store preview does not properly sanitize or encode user-supplied HTML before rendering it6.3 MediumN/AN/ANov 6, 2026
CVE-2026-121824: LY Corporation Armeria: A vulnerability has been identified in armeria versions prior to 1.43.0, where processing malformed Thrift messages can…N/A8.7 HighN/ANov 6, 2026
CVE-2026-121823: LY Corporation Armeria: A vulnerability has been identified in armeria versions prior to 1.43.0, where inconsistent request path normalization…N/A8.7 HighN/ANov 6, 2026
CVE-2026-121822: LY Corporation Armeria: A vulnerability has been identified in armeria versions 0.80.0 through 1.42.0, where attackers who control file names…N/A2.4 LowN/ANov 6, 2026
CVE-2026-121821: LY Corporation Armeria: A vulnerability has been identified in armeria versions 0.84.0 through 1.42.0, where any-origin CORS policies do not…N/A5.3 MediumN/ANov 6, 2026
CVE-2026-121820: LY Corporation Armeria: A vulnerability has been identified in armeria-saml versions prior to 1.43.0, where the HTTP-Redirect binding decoder…N/A8.7 HighN/ANov 6, 2026
CVE-2026-121819: LY Corporation Armeria: A vulnerability has been identified in armeria-xds versions 1.40.0 through 1.42.0, where DataSourcePolicy checks…N/A5.9 MediumN/ANov 6, 2026
CVE-2026-121636: Unknown Quick Event Manager: The Quick Event Manager WordPress plugin before 9.19 does not verify the authenticity of PayPal payment notifications…5.3 MediumN/AN/ANov 6, 2026
CVE-2026-121633: Unknown Order Tracking: The Order Tracking WordPress plugin before 3.6.0 does not verify that a PayPal payment notification was sent to the…5.3 MediumN/AN/ANov 6, 2026
CVE-2026-121006: HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic timeN/AN/AN/ANov 6, 2026
CVE-2026-120844: miniOrange OAuth Single Sign On – SSO (OAuth Client): Incorrect Privilege Assignment vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client)…9.8 CriticalN/AN/ANov 6, 2026
CVE-2026-119516: Mamunur Rashid Radius Booking — Booking Calendar for Appointments & Services: Deserialization of Untrusted Data vulnerability in Mamunur Rashid Radius Booking — Booking Calendar for Appointments…9.8 CriticalN/AN/ANov 6, 2026
CVE-2026-118423: Unknown WP Libre Form: The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions,…10.0 CriticalN/AN/ANov 6, 2026
CVE-2026-118166: Unknown MC4WP: Mailchimp for WordPress: The MC4WP: Mailchimp for WordPress WordPress plugin before 4.15.0 does not prevent request-derived values in its…4.8 MediumN/AN/ANov 6, 2026
CVE-2026-119472: David Anderson Redux Framework: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Anderson…6.5 MediumN/AN/ANov 6, 2026
CVE-2026-39744: WC Lovers WCFM Membership: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WC Lovers WCFM…7.1 HighN/AN/ANov 6, 2026
CVE-2026-119488: Shamim Rajani Pie Register: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamim Rajani Pie…7.1 HighN/AN/ANov 6, 2026
CVE-2026-119499: BAKKBONE Australia FloristPress: Insertion of Sensitive Information Into Sent Data vulnerability in BAKKBONE Australia FloristPress…7.5 HighN/AN/ANov 6, 2026
CVE-2026-9797: Red Hat Red Hat Build of Keycloak: A flaw was found in Keycloak's administrative services (org.keycloak.services.resources.admin)6.5 MediumN/AN/ANov 6, 2026
CVE-2026-83494: Red Hat Red Hat OpenShift AI (RHOAI): A flaw was found in the training-operatorN/AN/AN/ANov 6, 2026
CVE-2026-73473: GStreamer gst-plugins-good: A flaw was found in GStreamer gst-plugins-good (avidemux)5.5 MediumN/AN/ANov 6, 2026
CVE-2026-73472: GStreamer gst-plugins-good: A flaw was found in GStreamer gst-plugins-good (avidemux)6.1 MediumN/AN/ANov 6, 2026
CVE-2026-73471: GStreamer gst-plugins-good: A flaw was found in GStreamer gst-plugins-good (avidemux)6.1 MediumN/AN/ANov 6, 2026
201-225 of 427367
‹›