The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-119087: keywordrush Content Egg – Affiliate Product Importer & Price Comparison: The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to authorization…4.3 MediumN/AN/AOct 30, 2026
CVE-2026-119059: keywordrush Content Egg – Affiliate Product Importer & Price Comparison: The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post…4.3 MediumN/AN/AOct 30, 2026
CVE-2026-118634: liedekef Events Made Easy: The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all…6.4 MediumN/AN/AOct 30, 2026
CVE-2026-118500: coolplugins Cool FormKit Lite – Advanced Form Builder for Elementor: The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based…6.4 MediumN/AN/AOct 30, 2026
CVE-2026-118698: beardev: The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL…6.5 MediumN/AN/AOct 30, 2026
CVE-2026-118194: cyberlord92 Page and Post Restriction: The Page and Post Restriction plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and…6.5 MediumN/AN/AOct 30, 2026
CVE-2026-5461: wpmudev: The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including,…6.5 MediumN/AN/AOct 30, 2026
CVE-2026-104368: webtoffee Export and Import Users and Customers: The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up…8.8 HighN/AN/AOct 30, 2026
CVE-2026-103963: Red Hat: A flaw was found in glib-networking7.5 HighN/AN/AOct 30, 2026
CVE-2026-96389: Drupal Xray Audit: Missing Authorization vulnerability in Drupal Xray Audit allows Forceful BrowsingN/AN/AN/AOct 30, 2026
CVE-2026-118584: Drupal Field Permissions: Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful BrowsingN/AN/AN/AOct 30, 2026
CVE-2026-118583: Drupal Field Permissions: Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful BrowsingN/AN/AN/AOct 30, 2026
CVE-2026-118582: Drupal CAPTCHA: Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality BypassN/AN/AN/AOct 30, 2026
CVE-2026-118576: Drupal Stage File Proxy: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Stage File…N/AN/AN/AOct 30, 2026
CVE-2026-118575: Drupal Signature pad widget: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Signature…N/AN/AN/AOct 30, 2026
CVE-2026-118574: Drupal S3 File System: Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting…N/AN/AN/AOct 30, 2026
CVE-2026-118573: Drupal OAuth2 Token Manager: Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful BrowsingN/AN/AN/AOct 30, 2026
CVE-2026-118572: Drupal OAuth Login - OAuth OIDC SSO: Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OAuth Login - OAuth OIDC SSO allows…N/AN/AN/AOct 30, 2026
CVE-2026-118571: Drupal Media Alias Display: Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting…N/AN/AN/AOct 30, 2026
CVE-2026-118570: Drupal Fasttoggle: Cross-Site Request Forgery (CSRF) vulnerability in Drupal Fasttoggle allows Cross Site Request ForgeryN/AN/AN/AOct 30, 2026
CVE-2026-118569: Drupal Fasttoggle: Incorrect Authorization vulnerability in Drupal Fasttoggle allows Forceful BrowsingN/AN/AN/AOct 30, 2026
CVE-2026-118568: Drupal Content Sync (content-sync.io): Insecure Storage of Sensitive Information vulnerability in Drupal Content Sync (content-sync.io) allows Retrieve…N/AN/AN/AOct 30, 2026
CVE-2026-118567: Drupal Bulk Update User Roles: Incorrect Authorization vulnerability in Drupal Bulk Update User Roles allows Forceful BrowsingN/AN/AN/AOct 30, 2026
CVE-2026-118565: Drupal GroupEx PRO ( Daxko ) integration: Vulnerability in Drupal GroupEx PRO ( Daxko ) integrationN/AN/AN/AOct 30, 2026
CVE-2026-118564: Drupal PayUmoney for Drupal Commerce: Vulnerability in Drupal PayUmoney for Drupal CommerceN/AN/AN/AOct 30, 2026
1-25 of 538495
›