The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-110897: IdeaBox Creations PowerPack Lite for Beaver Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations…7.1 HighN/AN/AOct 18, 2026
CVE-2026-110895: DevItems Support Genix: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems Support…8.5 HighN/AN/AOct 18, 2026
CVE-2026-110886: QuantumCloud Conversational Forms for ChatBot: Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms…9.8 CriticalN/AN/AOct 18, 2026
CVE-2026-110885: HivePress: Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Code…6.5 MediumN/AN/AOct 18, 2026
CVE-2026-110883: VideoWhisper.com 2Way VideoCalls and Random Chat: Authentication Bypass by Primary Weakness vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat…6.5 MediumN/AN/AOct 18, 2026
CVE-2026-110880: Kit Kit (formerly ConvertKit): Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly…6.5 MediumN/AN/AOct 18, 2026
CVE-2026-110383: WP E-Signature Electronic Signature Add-on for Fluent Forms: Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent…7.5 HighN/AN/AOct 18, 2026
CVE-2026-110382: NSquared Simply Schedule Appointments: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NSquared Simply…7.1 HighN/AN/AOct 18, 2026
CVE-2026-110373: Hamid Alinia Login with phone number: Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows…8.1 HighN/AN/AOct 18, 2026
CVE-2026-110372: Brainstorm Force OttoKit: Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This…9.8 CriticalN/AN/AOct 18, 2026
CVE-2026-110365: WPExperts Advanced File Manager: Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced allows Exploiting…6.5 MediumN/AN/AOct 18, 2026
CVE-2026-109895: Arraytics Booktics: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics…7.1 HighN/AN/AOct 18, 2026
CVE-2026-109894: Arraytics Booktics: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics…9.3 CriticalN/AN/AOct 18, 2026
CVE-2026-108485: ThemeGrill eStore: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill eStore…7.1 HighN/AN/AOct 18, 2026
CVE-2026-107436: WP Chill Strong Testimonials: Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials allows Object…8.8 HighN/AN/AOct 18, 2026
CVE-2026-111942: hrisikeshpal Blood_Bank_Management_System: A weakness has been identified in hrisikeshpal Blood_Bank_Management_System 1.0.04.3 Medium2.1 LowN/AOct 18, 2026
CVE-2026-111877: dext34-morgan Books4Cash: A vulnerability was determined in dext34-morgan Books4Cash up to a8d3e357db75c07ac5ffbadcbaee2aeb4db3e5714.3 Medium2.1 LowN/AOct 18, 2026
CVE-2026-111876: alexpasmantier television: A vulnerability was found in alexpasmantier television up to 0.15.95.3 Medium1.9 LowN/AOct 18, 2026
CVE-2026-111875: David-Crty Databasement: A vulnerability has been found in David-Crty Databasement up to 1.8.14.7 Medium2.0 LowN/AOct 18, 2026
CVE-2026-111874: n/a OpenCATS: A flaw has been found in OpenCATS 0.10.03.7 Low2.9 LowN/AOct 18, 2026
CVE-2026-96534: Unknown: The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before…N/AN/AN/AOct 18, 2026
CVE-2026-111041: Unknown AI Engine: The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management…N/AN/AN/AOct 18, 2026
CVE-2026-110981: Unknown WP Photo Album Plus: The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before…N/AN/AN/AOct 18, 2026
CVE-2026-110976: Unknown AI Engine: The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to…N/AN/AN/AOct 18, 2026
CVE-2026-110070: Unknown Modern Events Calendar Lite: The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the…N/AN/AN/AOct 18, 2026
1-25 of 406803
›