The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-109161: Welotec: Insufficient bounds checking in the Digital I/O function may allow a remote attacker with high privileges to cause a…4.9 Medium6.9 MediumN/ANov 3, 2026
CVE-2026-105982: Welotec: Improper input validation in the IPsec VPN function may allow a remote attacker with high privileges to inject system…7.2 High8.6 HighN/ANov 3, 2026
CVE-2026-105981: Welotec: Improper input validation in the Digital I/O function may allow a remote attacker with high privileges to inject…7.2 High8.6 HighN/ANov 3, 2026
CVE-2026-105980: Welotec: Improper input validation in the WireGuard VPN function may allow a remote attacker with high privileges to inject…7.2 High8.6 HighN/ANov 3, 2026
CVE-2026-105979: Welotec: Improper input validation in the ZeroTier VPN function may allow a remote attacker with high privileges to inject…7.2 High8.6 HighN/ANov 3, 2026
CVE-2026-105978: Welotec: Improper input validation in management control functions may allow a remote attacker with high privileges to inject…7.2 High8.6 HighN/ANov 3, 2026
CVE-2026-103327: Unknown CryptoCloud: The CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 does not verify the authenticity of the payment notifications…5.3 MediumN/AN/ANov 3, 2026
CVE-2026-74846: Observable Timing DiscrepancyN/AN/AN/ANov 3, 2026
CVE-2026-4052: WSO2: This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database…9.8 CriticalN/AN/ANov 3, 2026
CVE-2026-16900: Zohocorp: Zohocorp ManageEngine Log360 and EventLog Analyzer versions 13071 and below are vulnerable to an authentication bypass…7.5 HighN/AN/ANov 3, 2026
CVE-2026-13594: Zohocorp: Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that…9.1 CriticalN/AN/ANov 3, 2026
CVE-2026-120988: NAVER billboard.js: billboard.js before 4.1.3 allows an attacker to execute malicious JavaScript due to improper sanitization of series ids…N/AN/AN/ANov 3, 2026
CVE-2026-103653: Qt: An out-of-bounds read vulnerability in the Qt CoAP message parsing (QCoapInternalReply::createFromFrame()) of the Qt…N/A6.7 MediumN/ANov 3, 2026
CVE-2026-120987: NAVER NAVER Whale browser: Whale Browser before 5.39.412.57 allows an attacker to bypass the iframe sandbox in a dual-tab environment.N/AN/AN/ANov 3, 2026
CVE-2025-5769: WSO2: The authentication endpoint does not properly encode user-supplied input before rendering it within the web page6.1 MediumN/AN/ANov 3, 2026
CVE-2025-1397: WSO2: When utilizing JWT Bearer or SAML2 Bearer grant types, the system fails to validate the status of the Identity Provider…4.8 MediumN/AN/ANov 3, 2026
CVE-2026-115205: Unknown AZEXO Store Locator: The AZEXO Store Locator WordPress plugin through 1.4 does not have a capability check or any authorization control when…N/AN/AN/ANov 3, 2026
CVE-2026-106004: Unknown DT LMS: The DT LMS WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions,…N/AN/AN/ANov 3, 2026
CVE-2026-105993: Unknown DT Directory Lite Addon: The DT Directory Lite Addon WordPress plugin through 1.1 does not perform nonce or capability checks on its settings…N/AN/AN/ANov 3, 2026
CVE-2026-105967: Unknown Gallery for Social Photo: The Gallery for Social Photo WordPress plugin through 1.0.0.41 does not validate a user-supplied URL before using it to…N/AN/AN/ANov 3, 2026
CVE-2026-104648: Unknown weMail: The weMail WordPress plugin through 2.1.6 does not restrict a site-wide third-party email-service API key to…N/AN/AN/ANov 3, 2026
CVE-2026-104647: Unknown weMail: The weMail WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permission…N/AN/AN/ANov 3, 2026
CVE-2026-103379: Unknown WATI Chat and Notification: The WATI Chat and Notification WordPress plugin through 1.1.8 does not require a valid, non-empty secret on a public…N/AN/AN/ANov 3, 2026
CVE-2026-120971: Red Hat: A flaw was found in RESTEasy's default exception mapper5.3 MediumN/AN/ANov 3, 2026
CVE-2026-120578: migkapa AI Alt Text Generator: The AI Alt Text Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and…5.3 MediumN/AN/ANov 3, 2026
201-225 of 528356
‹›