The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-114183: WPVibes AnyWhere Elementor: Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows…6.5 MediumN/AN/ANov 3, 2026
CVE-2026-116859: WPMU DEV Forminator: Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access…5.3 MediumN/AN/ANov 3, 2026
CVE-2026-116858: WPMU DEV Forminator: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WPMU DEV Forminator…4.3 MediumN/AN/ANov 3, 2026
CVE-2026-39743: WC Lovers WCFM Membership: Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting…5.3 MediumN/AN/ANov 3, 2026
CVE-2026-120846: Uncanny Owl Uncanny Automator: Missing Authorization vulnerability in Uncanny Owl Uncanny Automator uncanny-automator allows Exploiting Incorrectly…5.3 MediumN/AN/ANov 3, 2026
CVE-2026-115714: Elastic Elastic Docker images: Improper Certificate Validation (CWE-295) in the operating system certificate bundle shipped in the Docker images of…7.4 HighN/AN/ANov 3, 2026
CVE-2026-115716: Elastic APM Server: Allocation of Resources Without Limits or Throttling (CWE-770) in APM Server can lead to denial of service via…6.5 MediumN/AN/ANov 3, 2026
CVE-2026-115715: Elastic Elasticsearch: Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to denial of service via a…6.5 MediumN/AN/ANov 3, 2026
CVE-2026-115710: Elastic Elasticsearch: Use of Cache Containing Sensitive Information (CWE-524) in Elasticsearch can lead to information disclosure and…4.2 MediumN/AN/ANov 3, 2026
CVE-2026-115298: Elastic Elasticsearch: Incorrect Authorization (CWE-863) in Elasticsearch can lead to information disclosure via Accessing Functionality Not…4.3 MediumN/AN/ANov 3, 2026
CVE-2026-115297: Elastic Packetbeat: NULL Pointer Dereference (CWE-476) in the AMQP protocol parser in Packetbeat can lead to denial of service via…6.5 MediumN/AN/ANov 3, 2026
CVE-2026-115295: Elastic Kibana: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing…4.3 MediumN/AN/ANov 3, 2026
CVE-2026-115294: Elastic Kibana: Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in the Kibana Fleet feature can lead to…7.3 HighN/AN/ANov 3, 2026
CVE-2026-115293: Elastic Kibana: Insertion of Sensitive Information Into Sent Data (CWE-201) in Kibana Observability onboarding can lead to disclosure…6.5 MediumN/AN/ANov 3, 2026
CVE-2026-115292: Elastic Kibana: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana Machine Learning can lead to information…4.3 MediumN/AN/ANov 3, 2026
CVE-2026-115290: Elastic Elasticsearch: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested…7.5 HighN/AN/ANov 3, 2026
CVE-2026-115289: Elastic APM Server: Use of Multiple Resources with Duplicate Identifier (CWE-694) in APM Server can lead to information disclosure via a…4.3 MediumN/AN/ANov 3, 2026
CVE-2026-119521: Cozmoslabs Paid Member Subscriptions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs Paid…6.5 MediumN/AN/ANov 3, 2026
CVE-2026-119495: WebberZone Better Search: Missing Authorization vulnerability in WebberZone Better Search better-search allows Exploiting Incorrectly Configured…5.3 MediumN/AN/ANov 3, 2026
CVE-2026-121261: phpMyAdmin ShapeFile: A vulnerability has been found in phpMyAdmin ShapeFile up to 4.0.14.3 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-121259: Red Hat: A flaw was found in the GStreamer JPEG 2000 decimator in gst-plugins-bad6.5 MediumN/AN/ANov 3, 2026
CVE-2026-109594: SonicWall Global Management System (GMS): Post-authentication Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability…N/AN/AN/ANov 3, 2026
CVE-2026-121604: wlroots: wlroots before 0.20.2 contains an out-of-bounds read vulnerability in read_surface_class() in xwayland/xwm.c that…3.3 Low4.8 MediumN/ANov 3, 2026
CVE-2026-121603: solanum-ircd solanum: Solanum before commit 2ea1382 contains a buffer overflow vulnerability in ms_kill() that allows malicious linked…6.5 Medium8.5 HighN/ANov 3, 2026
CVE-2026-121602: solanum-ircd solanum: Solanum before commit 2ce64de contains a heap-based buffer overflow vulnerability that allows a malicious linked server…6.5 Medium8.5 HighN/ANov 3, 2026
1-25 of 528356
›