The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-119596: HDInnovations UNIT3D: UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZipController::show that allows…4.3 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119577: ArcadeData arcadedb: ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows revoked users to retain access…6.8 Medium7.6 HighN/AOct 30, 2026
CVE-2026-119576: ArcadeData arcadedb: ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerability that allows users with only…4.3 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119575: ArcadeData arcadedb: ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated…6.5 Medium7.1 HighN/AOct 30, 2026
CVE-2026-119574: traefik: Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastProxy that allows unauthenticated…5.9 Medium8.2 HighN/AOct 30, 2026
CVE-2026-119573: traefik: Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the Kubernetes Ingress NGINX provider that skips the…4.4 Medium2.1 LowN/AOct 30, 2026
CVE-2026-119572: traefik: Traefik from 3.7.0-ea.1 before 3.7.15 contains an authentication bypass vulnerability in the Kubernetes Ingress NGINX…8.7 High7.0 HighN/AOct 30, 2026
CVE-2026-119571: parse-community parse-server: Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an authorization flaw that applies _Installation updates…3.7 Low6.3 MediumN/AOct 30, 2026
CVE-2026-119570: parse-community parse-server: Parse Server from 9.7.0 before 9.10.5-alpha.7 contains an information disclosure vulnerability that allows clients to…3.1 Low2.3 LowN/AOct 30, 2026
CVE-2026-119569: parse-community parse-server: Parse Server before 8.6.108 and 9.0.0 before 9.10.5-alpha.9 contains a prototype pollution vulnerability because…5.3 Medium6.0 MediumN/AOct 30, 2026
CVE-2026-119542: Red Hat: A flaw was found in the Ickle query parser in Infinispan4.3 MediumN/AN/AOct 30, 2026
CVE-2026-119528: Red Hat: A flaw was found in GIMP7.8 HighN/AN/AOct 30, 2026
CVE-2026-118987: CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie headerN/AN/AN/AOct 30, 2026
CVE-2026-118986: Use of Cryptographically Weak Pseudo-Random Number GeneratorN/AN/AN/AOct 30, 2026
CVE-2026-117350: n/a: Bitcoin Core prior to 29.5, 30.4, 31.2 and 32.1 is vulnerable to an OOM issue.N/AN/AN/AOct 30, 2026
CVE-2026-117028: n/a: Skuul School Management System through version 2.6.5 is vulnerable to incorrect access control in the…N/AN/AN/AOct 30, 2026
CVE-2026-115683: GNOME Epiphany: A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate warning page6.8 MediumN/AN/AOct 30, 2026
CVE-2026-112348: Themeum Kirki: Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers…6.5 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-112347: Themeum Kirki: Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST…7.6 High7.2 HighN/AOct 30, 2026
CVE-2026-111500: Dell OpenManage Enterprise: Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Missing Authentication for Critical Function…5.4 MediumN/AN/AOct 30, 2026
CVE-2026-111499: Dell OpenManage Enterprise: Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource…5.5 MediumN/AN/AOct 30, 2026
CVE-2026-111498: Dell OpenManage Enterprise: OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Resource Locking vulnerability4.7 MediumN/AN/AOct 30, 2026
CVE-2026-100355: basecamp once-campfire: Campfire is a web-based chat application3.1 LowN/AN/AOct 30, 2026
CVE-2026-119656: CoreUnion CoreShop: CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the…7.5 High8.7 HighN/AOct 30, 2026
CVE-2026-119655: CoreUnion CoreShop: CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Good/GetGoodsPageList…7.5 High8.7 HighN/AOct 30, 2026
351-375 of 418318