The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-119654: devlive-community DataCap: DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate…8.8 High8.7 HighN/AOct 30, 2026
CVE-2026-119653: admpub nging: Nging through 5.3.5 contains an information disclosure vulnerability that allows any authenticated backend user to list…4.3 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119652: HuLaSpark HuLa-Server: HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList…4.3 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119651: HuLaSpark HuLa-Server: HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FeedController.delFeed that…5.4 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119650: HuLaSpark HuLa-Server: HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows…5.4 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119649: OrchardCMS Orchard: Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in…7.1 High7.1 HighN/AOct 30, 2026
CVE-2026-119648: TencentBlueKing bk-cmdb: Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization vulnerability that allows authenticated…4.3 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119646: Open Web Analytics: Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other…4.3 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119645: easysoft zentaopms: ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated…6.5 Medium7.1 HighN/AOct 30, 2026
CVE-2026-119644: blossom-editor Blossom: Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to…5.4 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119482: Crocoblock JetFormBuilder: Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly…5.3 MediumN/AN/AOct 30, 2026
CVE-2026-119370: Liquid Web / StellarWP The Events Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web /…6.5 MediumN/AN/AOct 30, 2026
CVE-2026-119368: Liquid Web / StellarWP The Events Calendar: Missing Authorization vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Exploiting…5.3 MediumN/AN/AOct 30, 2026
CVE-2026-117349: n/a: Bitcoin Core prior to 29.5, 30.4, 31.2 and 32.1 is vulnerable to an OOM issue.N/AN/AN/AOct 30, 2026
CVE-2026-117346: n/a: Bitcoin Core through 31.1 is vulnerable to Denial of Service via undo files having no size limitN/AN/AN/AOct 30, 2026
CVE-2026-116860: Arraytics Timetics: Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access…5.3 MediumN/AN/AOct 30, 2026
CVE-2026-111487: qt Qt Framework: An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module.N/A4.3 MediumN/AOct 30, 2026
CVE-2026-110799: givanz Vvveb: Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores9.8 CriticalN/AN/AOct 30, 2026
CVE-2015-20130: Netsweeper: Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in…6.1 Medium5.1 MediumN/AOct 30, 2026
CVE-2010-20125: DedeCMS: DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated…7.5 High8.7 HighN/AOct 30, 2026
CVE-2026-112905: givanz Vvveb: Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores9.0 CriticalN/AN/AOct 30, 2026
CVE-2026-91915: Dell OpenManage Enterprise: Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements in Output…6.8 MediumN/AN/AOct 30, 2026
CVE-2026-91914: Dell OpenManage Enterprise: Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Authentication Bypass by Spoofing vulnerability7.1 HighN/AN/AOct 30, 2026
CVE-2026-91913: Dell OpenManage Enterprise: Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an…8.8 HighN/AN/AOct 30, 2026
CVE-2026-91912: Dell OpenManage Enterprise: Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Use of Hard-coded Cryptographic Key vulnerability7.3 HighN/AN/AOct 30, 2026
301-325 of 418318