The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-111498: Dell OpenManage Enterprise: OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Resource Locking vulnerability4.7 MediumN/AN/AOct 30, 2026
CVE-2026-100355: basecamp once-campfire: Campfire is a web-based chat application3.1 LowN/AN/AOct 30, 2026
CVE-2026-119656: CoreUnion CoreShop: CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the…7.5 High8.7 HighN/AOct 30, 2026
CVE-2026-119655: CoreUnion CoreShop: CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Good/GetGoodsPageList…7.5 High8.7 HighN/AOct 30, 2026
CVE-2026-119647: dromara RuoYi-Vue-Plus: RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerability in SysUserServiceImpl.selectUserListByDept…4.3 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-91917: Dell OpenManage Enterprise: Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Input Validation vulnerability8.0 HighN/AN/AOct 30, 2026
CVE-2026-87768: Inefficient Algorithmic ComplexityN/AN/AN/AOct 30, 2026
CVE-2026-75882: ESET spol. s.r.o.: An improper access control vulnerability in ESET Endpoint Encryption and ESET Full Disk Encryption allow attacker with…N/A8.5 HighN/AOct 30, 2026
CVE-2026-64860: Rejected reason: Further research determined the issue is not a vulnerability.N/AN/AN/AOct 30, 2026
CVE-2026-13576: Use of Password Hash With Insufficient Computational EffortN/AN/AN/AOct 30, 2026
CVE-2026-119038: Authorization Bypass Through User-Controlled KeyN/AN/AN/AOct 30, 2026
CVE-2026-119037: Improper Verification of Cryptographic SignatureN/AN/AN/AOct 30, 2026
CVE-2026-119036: Allocation of Resources Without Limits or ThrottlingN/AN/AN/AOct 30, 2026
CVE-2026-118996: Improper Removal of Sensitive Data Before Storage or TransferN/AN/AN/AOct 30, 2026
CVE-2026-118995: Permissive Regular ExpressionN/AN/AN/AOct 30, 2026
CVE-2026-118994: CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login nameN/AN/AN/AOct 30, 2026
CVE-2026-118993: Inefficient Regular Expression Complexity (ReDoS)N/AN/AN/AOct 30, 2026
CVE-2026-118992: OS Command Injection8.4 HighN/AN/AOct 30, 2026
CVE-2026-118991: Use of Password Hash With Insufficient Computational EffortN/AN/AN/AOct 30, 2026
CVE-2026-118990: Improper Link Resolution Before File AccessN/AN/AN/AOct 30, 2026
CVE-2026-118988: Path TraversalN/AN/AN/AOct 30, 2026
CVE-2026-116130: Null Byte Interaction Error (Poison Null Byte)N/AN/AN/AOct 30, 2026
CVE-2026-116128: Allocation of Resources Without Limits or ThrottlingN/AN/AN/AOct 30, 2026
CVE-2026-116127: Inconsistent Interpretation of HTTP RequestsN/AN/AN/AOct 30, 2026
CVE-2026-115866: Inefficient Regular Expression Complexity (ReDoS)N/AN/AN/AOct 30, 2026
376-400 of 418318