The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-22109: Delta Electronics Delta UFC500: The shipped WebUI template database retains the factory default passwords for all five account types in cleartextN/A8.4 HighN/AOct 30, 2026
CVE-2026-22114: Delta Electronics Delta UFC500: HTTP basic auth enforces no retry limit or backoffN/A5.3 MediumN/AOct 30, 2026
CVE-2026-85268: Google Cloud Identity Platform and Firebase Authentication: A Cross-Site Scripting (XSS) (CWE-79) vulnerability in the auth/handler in Google Cloud Identity Platform and Firebase…N/A8.7 HighN/AOct 30, 2026
CVE-2026-14467: Forocoches Forocoches comments editor: An information disclosure vulnerability in the Forocoches comments editor that allows an attacker to obtain…N/A8.2 HighN/AOct 30, 2026
CVE-2026-65874: Apache Software Foundation Apache Fineract: This issue affects Apache Fineract versions up to and including 1.15.0N/AN/AN/AOct 30, 2026
CVE-2026-64618: Apache Software Foundation Apache Fineract: Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache…N/AN/AN/AOct 30, 2026
CVE-2026-59396: Cloud Foundry: A denial-of-service vulnerability exists in UAA's private_key_jwt client-authentication mechanism4.9 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-59388: Cloud Foundry Foundation: Cloud Controller (CAPI) leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are…6.5 MediumN/AN/AOct 30, 2026
CVE-2026-59387: Cloud Foundry: The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/…8.8 HighN/AN/AOct 30, 2026
CVE-2026-115456: Red Hat: A flaw was found in gcc3.7 LowN/AN/AOct 30, 2026
CVE-2026-97209: elixir-lang elixir: Insecure Temporary File vulnerability in Mix deps.partition in Elixir allows a local user to execute code as another…N/A5.4 MediumN/AOct 30, 2026
CVE-2026-115274: elixir-lang elixir: Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an…N/A6.9 MediumN/AOct 30, 2026
CVE-2026-109821: elixir-lang elixir: Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's URI module allows an…N/A6.3 MediumN/AOct 30, 2026
CVE-2026-59385: Cloud Foundry: A user with SpaceDeveloper privileges could modify the URL of a space-scoped broker without altering its credentials,…2.7 LowN/AN/AOct 30, 2026
CVE-2026-59386: Cloud Foundry: A SpaceSupporter could improperly modify an application's start command and buildpack—actions requiring SpaceDeveloper…6.5 MediumN/AN/AOct 30, 2026
CVE-2026-115455: Red Hat: A flaw was found in GCC libstdc++6.5 MediumN/AN/AOct 30, 2026
CVE-2026-114691: Red Hat: A flaw was found in the libstdc++ component of GCC5.9 MediumN/AN/AOct 30, 2026
CVE-2026-114690: Red Hat: A flaw was found in GCC6.2 MediumN/AN/AOct 30, 2026
CVE-2026-82104: Teltonika Networks: In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9…N/A9.4 CriticalN/AOct 30, 2026
CVE-2026-97645: Gravity Forms: The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via List Field in all versions up…7.2 HighN/AN/AOct 30, 2026
CVE-2026-90437: Gravity Forms: The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Excerpt / Post Custom…7.2 HighN/AN/AOct 30, 2026
CVE-2026-89435: strategy11team: The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is…8.8 HighN/AN/AOct 30, 2026
CVE-2026-118952: Red Hat: A flaw was found in the Kroxylicious ACL authorizer6.5 MediumN/AN/AOct 30, 2026
CVE-2026-118593: Red Hat: A flaw was found in Red Hat Enterprise Linux 9 kernel builds5.9 MediumN/AN/AOct 30, 2026
CVE-2026-116622: wpscripts Food Store – Online Food Delivery & Pickup: The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…7.2 HighN/AN/AOct 30, 2026
251-275 of 413289