The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-119560: opnsense core: OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append…5.9 Medium6.0 MediumN/AOct 30, 2026
CVE-2026-119559: litespeedtech openlitespeed: OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerability that allows unauthenticated remote…5.9 Medium8.2 HighN/AOct 30, 2026
CVE-2026-119558: OpenCart: OpenCart through 4.1.0.4 contains a business logic vulnerability that allows logged-in customers to place unpaid…3.1 Low2.3 LowN/AOct 30, 2026
CVE-2026-119557: n8n-io n8n: n8n from 2.14.0 through 2.46.3 contains a path traversal vulnerability in the Databricks node that allows…5.9 Medium8.2 HighN/AOct 30, 2026
CVE-2026-119556: Moodle Project moodle: Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain a…4.3 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119555: Moodle Project moodle: Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain an…4.3 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119554: Moodle Project moodle: Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contain an sql…5.9 Medium6.0 MediumN/AOct 30, 2026
CVE-2026-119553: Moodle Project moodle: Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contains a path…6.5 Medium7.1 HighN/AOct 30, 2026
CVE-2026-119552: louislam uptime-kuma: Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run setup handler that allows…4.8 Medium6.3 MediumN/AOct 30, 2026
CVE-2026-119551: jellyfin: Jellyfin through 12.4 contains an authorization bypass vulnerability in SuggestionsController.GetSuggestions that…6.5 Medium7.1 HighN/AOct 30, 2026
CVE-2026-119550: jellyfin: Jellyfin through 12.4 contains an information disclosure vulnerability in PlaylistsController.GetPlaylist that allows…3.5 Low5.1 MediumN/AOct 30, 2026
CVE-2026-119549: jellyfin: Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass…7.1 High7.1 HighN/AOct 30, 2026
CVE-2026-119548: getlago lago: Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows…3.1 Low2.3 LowN/AOct 30, 2026
CVE-2026-119547: forgejo: Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains an information disclosure…4.3 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119546: forgejo: Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a path traversal vulnerability in…5.5 Medium6.8 MediumN/AOct 30, 2026
CVE-2026-119545: forgejo: Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a server-side request forgery…5.3 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-119429: phpMyAdmin: phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to…4.3 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119428: phpMyAdmin: phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to…3.7 Low6.3 MediumN/AOct 30, 2026
CVE-2026-119427: phpMyAdmin: phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated…4.2 Medium2.3 LowN/AOct 30, 2026
CVE-2026-119426: phpMyAdmin: phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute…7.5 High7.7 HighN/AOct 30, 2026
CVE-2026-119425: opnsense core: OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming…5.4 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119424: opnsense core: OPNsense core before 26.7.8 contains a configuration line injection vulnerability that allows authenticated users with…6.8 Medium6.1 MediumN/AOct 30, 2026
CVE-2026-119423: opnsense core: OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant…5.3 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-119422: juspay hyperswitch: Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers…5.9 Medium8.2 HighN/AOct 30, 2026
CVE-2026-119421: juspay hyperswitch: Juspay Hyperswitch through 1.128.0 (and builds before 2026.10.19.0) contains a missing authorization vulnerability that…5.9 Medium8.2 HighN/AOct 30, 2026
26-50 of 520238