The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-66912: Synacor Zimbra Collaboration: Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in…N/A5.3 MediumN/AOct 29, 2026
CVE-2026-66911: Synacor Zimbra Collaboration: Zimbra is vulnerable to stored cross-site scripting (XSS) via the Content-Location MIME header in email attachmentsN/A5.3 MediumN/AOct 29, 2026
CVE-2026-62131: Zoho Flow: Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-62018: ThemeREX Gunslinger: Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-62017: ThemeREX Good Homes: Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-62016: ThemeREX Gamic: Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-62015: ThemeREX Gamezone: Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-62014: ThemeREX EmojiNation: Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-62013: ThemeREX Edge Decor: Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-62012: ThemeREX Coinpress: Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-62011: ThemeREX Bonbon: Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-62010: ThemeREX Avventure: Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-62009: ThemeREX Filmax: Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-62008: ThemeREX Orpheus: Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-62006: ThemeREX Nuts: Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-62005: ThemeREX Muzicon: Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-62004: ThemeREX Motorix: Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-62003: ThemeREX Mission: Unauthenticated PHP Object Injection in Mission <= 1.22 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-62002: ThemeREX Meals & Wheels: Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-62001: ThemeREX Marcell: Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-61998: ThemeREX Le Truffe: Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-61997: ThemeREX Legal Stone: Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-61996: favethemes MLS On The Fly: Subscriber SQL Injection in MLS On The Fly <= 1.8.1.5 versions.8.5 HighN/AN/AOct 29, 2026
CVE-2026-61995: emarket-design YouTube Showcase: Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase <= 4.1.0 versions.7.1 HighN/AN/AOct 29, 2026
CVE-2026-61993: Blockonomics: Unauthenticated Cross Site Scripting (XSS) in Blockonomics 3.11.0 versions.7.1 HighN/AN/AOct 29, 2026
1-25 of 538495
›