The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-104308: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to cause a denial of service due to…4.3 MediumN/AN/AOct 29, 2026
CVE-2026-102590: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due…5.0 MediumN/AN/AOct 29, 2026
CVE-2026-101288: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to…8.8 HighN/AN/AOct 29, 2026
CVE-2025-13050: Centreon: Broken Function Level Authorization allows execution of poller post-restart commands by authenticated user5.4 MediumN/AN/AOct 29, 2026
CVE-2026-119133: bytecodealliance wasmtime: Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a memory misalignment flaw in VMContext layout that…2.6 Low2.1 LowN/AOct 29, 2026
CVE-2026-119129: zitadel: ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contains a missing authorization vulnerability in Login V2 that…8.1 High8.6 HighN/AOct 29, 2026
CVE-2026-119125: parse-community parse-server: Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 returns the stored value of a field reverted by a…3.1 Low2.3 LowN/AOct 29, 2026
CVE-2026-119121: unclecode crawl4ai: Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability in the Docker API server that allows…4.3 Medium5.3 MediumN/AOct 29, 2026
CVE-2026-118080: Social Snap: Contributor PHP Object Injection in Social Snap <= 1.5.4 versions.8.8 HighN/AN/AOct 29, 2026
CVE-2026-118075: dbarrere WP Media folders: Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions.8.8 HighN/AN/AOct 29, 2026
CVE-2026-116867: sosidee Dynamic QR Code &#8211; generator: Contributor PHP Object Injection in Dynamic QR Code &#8211; generator <= 1.0.1 versions.8.8 HighN/AN/AOct 29, 2026
CVE-2026-62017: ThemeREX Good Homes: Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-62012: ThemeREX Coinpress: Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-62006: ThemeREX Nuts: Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-62001: ThemeREX Marcell: Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-61993: Blockonomics: Unauthenticated Cross Site Scripting (XSS) in Blockonomics 3.11.0 versions.7.1 HighN/AN/AOct 29, 2026
CVE-2026-54866: Razorpay Razorpay Payment Button Elementor Plugin: Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button Elementor Plugin <= 1.2.8 versions.7.1 HighN/AN/AOct 29, 2026
CVE-2026-54858: ThemeREX Printy: Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-42690: ThimPress LearnPress: Subscriber Broken Access Control in LearnPress <= 4.4.10 versions.5.4 MediumN/AN/AOct 29, 2026
CVE-2026-90991: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to cause a denial of service due to…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-103092: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary SQL commands due…8.5 HighN/AN/AOct 29, 2026
CVE-2026-104314: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker with a read or share grant on a target flow…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-80069: Stylemix MasterStudy LMS WordPress Plugin: MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any…4.3 Medium5.3 MediumN/AOct 29, 2026
CVE-2026-80067: Stylemix MasterStudy LMS WordPress Plugin: MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated…5.4 Medium5.3 MediumN/AOct 29, 2026
CVE-2026-54871: Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Addons: Missing Authorization vulnerability in Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder…5.3 MediumN/AN/AOct 29, 2026
201-225 of 538495