The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-120474: undici: undici is an HTTP client for Node.js6.5 MediumN/AN/ANov 6, 2026
CVE-2026-115831: infomaniak-dev VOD Infomaniak: The VOD Infomaniak plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including,…4.3 MediumN/AN/ANov 6, 2026
CVE-2026-97642: man4toman Parsi Date | بسته فارسی ساز وردپرس و ووکامرس پارسی دیت: The Wp Parsidate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the calendar Gutenberg block's…6.4 MediumN/AN/ANov 6, 2026
CVE-2026-120659: themeisle Redirection for Contact Form 7: The Redirection for Contact Form 7 plugin for WordPress is vulnerable to authorization bypass in all versions up to,…5.3 MediumN/AN/ANov 6, 2026
CVE-2026-109977: yaycommerce: The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to time-based SQL…4.9 MediumN/AN/ANov 6, 2026
CVE-2026-109994: arraytics: The Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to…6.5 MediumN/AN/ANov 6, 2026
CVE-2026-110776: realmag777 MDTF – Meta Data and Taxonomies Filter: The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…7.2 HighN/AN/ANov 6, 2026
CVE-2026-87964: wahid0003: The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels plugin for WordPress…7.2 HighN/AN/ANov 6, 2026
CVE-2026-120550: wpusermanager: The WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory plugin for WordPress is…6.4 MediumN/AN/ANov 6, 2026
CVE-2026-123087: Atmira SIREC: SQL injection vulnerability in Atmira’s SIRECN/A8.7 HighN/ANov 6, 2026
CVE-2026-19877: INFINITT Healthcare INFINITT ULite: INFINITT ULite 5.0.2.1_BN48_20260528 and earlier protects image-share links with a low-entropy password and does not…7.5 HighN/AN/ANov 6, 2026
CVE-2026-19876: INFINITT Healthcare INFINITT ULite: A reflected cross-site scripting (XSS) vulnerability in the login/SSO error page of INFINITT ULite…6.1 MediumN/AN/ANov 6, 2026
CVE-2026-123660: vulnerability-lookup: In Vulnerability-Lookup 5.5.1 up to but not including 6.4.1, a signed-in user could make the server allocate memory far…N/A5.3 MediumN/ANov 6, 2026
CVE-2026-122222: mbis Permalink Manager Lite: The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slug' parameter…6.4 MediumN/AN/ANov 6, 2026
CVE-2026-121794: magepeopleteam Travelly – Tour & Travel Booking Manager for WooCommerce: The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass…6.5 MediumN/AN/ANov 6, 2026
CVE-2026-120671: stiofansisland: The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for…6.4 MediumN/AN/ANov 6, 2026
CVE-2026-118189: barn2media Posts Table with Search & Sort: The Posts Table with Search & Sort plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…6.4 MediumN/AN/ANov 6, 2026
CVE-2026-110291: iqonicdesign Graphina – Charts and Graphs For Elementor: The Graphina – Charts and Graphs For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…7.2 HighN/AN/ANov 6, 2026
CVE-2026-108018: HCLSoftware BigFix MCM & Mobile: The BigFix MCM admin portal is directly accessible from the internet without VPN or network restriction6.3 MediumN/AN/ANov 6, 2026
CVE-2026-103682: Checkmk GmbH Checkmk: Invocation of the Jolokia special agent with the login password in the command line in Checkmk versions 2.5.0 before…N/A2.0 LowN/ANov 6, 2026
CVE-2026-103674: Checkmk GmbH Checkmk: Invocation of the NetApp ONTAP special agent with the login password in the command line in Checkmk version 2.5.0…N/A2.0 LowN/ANov 6, 2026
CVE-2026-88801: Unknown: The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check a capability or a…8.0 HighN/AN/ANov 6, 2026
CVE-2026-88800: Unknown: The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on…9.1 CriticalN/AN/ANov 6, 2026
CVE-2026-88799: Unknown: The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check ownership or…8.8 HighN/AN/ANov 6, 2026
CVE-2026-65022: HCLSoftware BigFix MCM & Mobile: The MDM App Catalog / App Store preview does not properly sanitize or encode user-supplied HTML before rendering it6.3 MediumN/AN/ANov 6, 2026
1-25 of 423114
›