Rapid7 Vulnerability & Exploit Database

Emergent Threat6

CVE-2026-63030:wp2shell a Critical Remote Code Execution Vulnerability in WordPress CoreBlog ↗CVE details

CVE-2026-63030:wp2shell a Critical Remote Code Execution Vulnerability in WordPress Core

CVE-2026-58644:Microsoft SharePoint Server Unauthenticated Remote Code Execution Vulnerability Exploited in the Wild

CVE-2026-15409:Rapid7 MDR Team Discovers New SonicWall SMA1000 Zero Days being Actively Exploited (CVE-2026-15409, CVE-2026-15410)

Blog ↗CVE details

CVE-2026-35273:Active Exploitation of Oracle PeopleSoft Zero-Day (CVE-2026-35273)

Blog ↗CVE details

CVE-2026-10520:, CVE-2026-10523 - Multiple critical vulnerabilities affecting Ivanti Sentry

Blog ↗CVE details

CVE-2026-50751:Critical Check Point VPN Zero-Day Exploited in the Wild (CVE-2026-50751)

Blog ↗CVE details

CVE-2026-58644:Microsoft SharePoint Server Unauthenticated Remote Code Execution Vulnerability Exploited in the WildBlog ↗CVE details

CVE-2026-15409:Rapid7 MDR Team Discovers New SonicWall SMA1000 Zero Days being Actively Exploited (CVE-2026-15409, CVE-2026-15410)Blog ↗CVE details

CVE-2026-35273:Active Exploitation of Oracle PeopleSoft Zero-Day (CVE-2026-35273)Blog ↗CVE details

CVE-2026-10520:, CVE-2026-10523 - Multiple critical vulnerabilities affecting Ivanti SentryBlog ↗CVE details

CVE-2026-50751:Critical Check Point VPN Zero-Day Exploited in the Wild (CVE-2026-50751)Blog ↗CVE details

Title			EitW	Modules

Title
CVE-2026-16270: Open Mercato: Open Mercato does not validate regex rules	N/A	6.9 Medium	N/A	Jul 22, 2026
CVE-2026-8152: Unblu inc. Unblu Spark: Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS)…	N/A	7.0 High	N/A	Jul 22, 2026
CVE-2026-65603: getgrav grav: The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege escalation flaw in the authenticated…	8.8 High	8.7 High	N/A	Jul 22, 2026
CVE-2026-65602: traefik: Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for…	N/A	5.3 Medium	N/A	Jul 22, 2026
CVE-2026-65601: traefik: Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider	N/A	5.3 Medium	N/A	Jul 22, 2026
CVE-2026-65600: traefik: Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path…	N/A	7.8 High	N/A	Jul 22, 2026
CVE-2026-65599: n8n-io n8n: n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a credential exposure vulnerability: when configured with a…	N/A	5.1 Medium	N/A	Jul 22, 2026
CVE-2026-65597: n8n-io n8n: n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in…	N/A	8.2 High	N/A	Jul 22, 2026
CVE-2026-65596: n8n-io n8n: n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based…	N/A	5.1 Medium	N/A	Jul 22, 2026
CVE-2026-65595: n8n-io n8n: n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exchange module…	N/A	8.9 High	N/A	Jul 22, 2026
CVE-2026-65594: n8n-io n8n: n8n before 2.29.8 and 2.30.x before 2.30.1 (affected from 2.27.0, when the OAuth 2.1 consent and token-issuance flow…	N/A	5.1 Medium	N/A	Jul 22, 2026
CVE-2026-65593: n8n-io n8n: n8n versions before 1.123.64 contain a server-side request forgery vulnerability in the dynamic-node-parameters…	N/A	6.3 Medium	N/A	Jul 22, 2026
CVE-2026-65591: n8n-io n8n: n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler	N/A	8.9 High	N/A	Jul 22, 2026
CVE-2026-65590: n8n-io n8n: n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the…	N/A	5.5 Medium	N/A	Jul 22, 2026
CVE-2026-65589: n8n-io n8n: n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data,…	N/A	5.1 Medium	N/A	Jul 22, 2026
CVE-2026-65016: n8n-io n8n: n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO…	N/A	7.7 High	N/A	Jul 22, 2026
CVE-2026-65015: n8n-io n8n: n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the…	N/A	7.2 High	N/A	Jul 22, 2026
CVE-2026-44192: Red Hat Red Hat Ansible Automation Platform 2: A flaw was found in the Ansible Lightspeed Model Context Protocol (MCP) server	6.6 Medium	N/A	N/A	Jul 22, 2026
CVE-2026-44190: Red Hat Red Hat Ansible Automation Platform 2: A flaw was found in the Ansible Lightspeed Visual Studio Code extension	7.8 High	N/A	N/A	Jul 22, 2026
CVE-2026-44187: Red Hat Red Hat Ansible Automation Platform 2: A flaw was found in the Ansible Lightspeed extension for Visual Studio Code	3.3 Low	N/A	N/A	Jul 22, 2026
CVE-2026-16544: Red Hat Red Hat Ansible Automation Platform 2: A flaw was found in AWX	6.5 Medium	N/A	N/A	Jul 22, 2026
CVE-2026-44191: Red Hat Red Hat Ansible Automation Platform 2: A flaw was found in the Visual Studio Code Ansible Lightspeed extension	7.8 High	N/A	N/A	Jul 22, 2026
CVE-2026-4773: Magarsus Consulting Ltd. Co. IDM-MFA: Improper validation of specified type of input vulnerability in Magarsus Consulting Ltd	8.1 High	N/A	N/A	Jul 22, 2026
CVE-2026-44189: Red Hat Red Hat Ansible Automation Platform 2: A flaw was found in the Visual Studio Code Ansible Lightspeed extension's AnsiblePlaybookRunProvider	7.8 High	N/A	N/A	Jul 22, 2026
CVE-2025-13146: sevenspark Contact Form 7 – Dynamic Text Extension: The The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to arbitrary shortcode execution in…	6.5 Medium	N/A	N/A	Jul 22, 2026

Rows per page

1-25 of 369410