The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-45145: chamilo chamilo-lms: Chamilo LMS is an open-source learning management system7.5 HighN/A0%Oct 30, 2026
CVE-2026-45144: chamilo chamilo-lms: Chamilo LMS is an open-source learning management system8.9 HighN/A0%Oct 30, 2026
CVE-2026-45141: chamilo chamilo-lms: Chamilo LMS is an open-source learning management system6.5 MediumN/A0%Oct 30, 2026
CVE-2026-44344: chamilo chamilo-lms: Chamilo LMS is an open-source learning management system6.6 MediumN/A0%Oct 30, 2026
CVE-2026-119682: ManageEngine SharePoint Manager Plus: An improper access control vulnerability exists in the multi-factor authentication (MFA) functionality of ManageEngine…N/A7.9 High0%Oct 30, 2026
CVE-2026-119680: ManageEngine SharePoint Manager Plus: A stored cross-site scripting (XSS) vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) due to…N/A8.5 High0%Oct 30, 2026
CVE-2026-119665: MGdaasLab WHartTest: WHartTest 2.2.0 through 2.8.1 contains a missing authorization vulnerability in ScheduledTaskViewSet and…6.3 Medium5.3 Medium0%Oct 30, 2026
CVE-2026-119664: wannabespace tamery: Tamery (formerly Conar) 0.26.1 before 0.99.0 contains an authorization bypass vulnerability in the cloud sync API…4.3 Medium5.3 Medium0%Oct 30, 2026
CVE-2026-119663: wannabespace tamery: Tamery (formerly Conar) 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API…4.3 Medium5.3 Medium0%Oct 30, 2026
CVE-2026-119662: songloft-org songloft: Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to…8.8 High8.7 High0%Oct 30, 2026
CVE-2026-119661: star7th ShowDoc: ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint…4.2 Medium2.3 Low0%Oct 30, 2026
CVE-2026-119660: yincongcyincong MuseBot: MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge…9.8 Critical9.3 Critical1%Oct 30, 2026
CVE-2026-119659: blossom-editor Blossom: Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated users to access other…5.4 Medium5.3 Medium0%Oct 30, 2026
CVE-2026-119658: PowerDNS-Admin: PowerDNS-Admin through 2026.08.1 contains an authorization bypass vulnerability that allows authenticated User-role…4.3 Medium5.3 Medium0%Oct 30, 2026
CVE-2026-119657: zyx0814 FilePress: FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated…5.0 Medium2.3 Low0%Oct 30, 2026
CVE-2026-119656: CoreUnion CoreShop: CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the…7.5 High8.7 High0%Oct 30, 2026
CVE-2026-119655: CoreUnion CoreShop: CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Good/GetGoodsPageList…7.5 High8.7 High0%Oct 30, 2026
CVE-2026-119654: devlive-community DataCap: DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate…8.8 High8.7 High0%Oct 30, 2026
CVE-2026-119653: admpub nging: Nging through 5.3.5 contains an information disclosure vulnerability that allows any authenticated backend user to list…4.3 Medium5.3 Medium0%Oct 30, 2026
CVE-2026-119652: HuLaSpark HuLa-Server: HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList…4.3 Medium5.3 Medium0%Oct 30, 2026
CVE-2026-119651: HuLaSpark HuLa-Server: HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FeedController.delFeed that…5.4 Medium5.3 Medium0%Oct 30, 2026
CVE-2026-119650: HuLaSpark HuLa-Server: HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows…5.4 Medium5.3 Medium0%Oct 30, 2026
CVE-2026-119649: OrchardCMS Orchard: Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in…7.1 High7.1 High0%Oct 30, 2026
CVE-2026-119648: TencentBlueKing bk-cmdb: Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization vulnerability that allows authenticated…4.3 Medium5.3 Medium0%Oct 30, 2026
CVE-2026-119647: dromara RuoYi-Vue-Plus: RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerability in SysUserServiceImpl.selectUserListByDept…4.3 Medium5.3 Medium0%Oct 30, 2026
451-475 of 418648