The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-119408: n8n-io n8n: n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability via…8.8 High8.7 HighN/AOct 30, 2026
CVE-2026-119407: element-hq: Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession,…7.1 High7.1 HighN/AOct 30, 2026
CVE-2026-119379: SQLite: SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in…7.8 High8.5 HighN/AOct 30, 2026
CVE-2026-119378: SQLite: SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make…5.5 Medium6.8 MediumN/AOct 30, 2026
CVE-2026-119377: SQLite: SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only…2.5 Low2.0 LowN/AOct 30, 2026
CVE-2026-119376: SQLite: SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the…5.5 Medium6.8 MediumN/AOct 30, 2026
CVE-2026-119375: SQLite: SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized…5.5 Medium6.8 MediumN/AOct 30, 2026
CVE-2026-119374: SQLite: SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to…7.8 High8.5 HighN/AOct 30, 2026
CVE-2026-119373: SQLite: SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the…7.8 High8.5 HighN/AOct 30, 2026
CVE-2026-119372: SQLite: SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in…5.5 Medium6.8 MediumN/AOct 30, 2026
CVE-2026-119371: SQLite: SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the…5.5 Medium6.8 MediumN/AOct 30, 2026
CVE-2026-119364: ProFTPD Project ProFTPD: ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 contains a link-following vulnerability in mod_copy that allows…5.3 Medium6.0 MediumN/AOct 30, 2026
CVE-2026-119147: ProFTPD Project ProFTPD: ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy-file extension handler that…4.3 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119146: ProFTPD Project ProFTPD: ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overflow vulnerability in the mod_rewrite int:utf8trans…5.6 Medium6.3 MediumN/AOct 30, 2026
CVE-2026-85268: Google Cloud Identity Platform and Firebase Authentication: A Cross-Site Scripting (XSS) (CWE-79) vulnerability in the auth/handler in Google Cloud Identity Platform and Firebase…N/A8.7 HighN/AOct 30, 2026
CVE-2026-22114: Delta Electronics Delta UFC500: HTTP basic auth enforces no retry limit or backoffN/A5.3 MediumN/AOct 30, 2026
CVE-2026-22110: Delta Electronics Delta UFC500: The web server does not check authentication on POST or PUTN/A8.7 HighN/AOct 30, 2026
CVE-2026-22109: Delta Electronics Delta UFC500: The shipped WebUI template database retains the factory default passwords for all five account types in cleartextN/A8.4 HighN/AOct 30, 2026
CVE-2026-22105: Delta Electronics Delta UFC500: Delta UFC500 charging stations derive the default credentials of the Service account from character positions of the…N/A8.7 HighN/AOct 30, 2026
CVE-2026-116366: ClickHouse: An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user…N/A9.5 CriticalN/AOct 30, 2026
CVE-2025-31704: Dahua Intelligent Connection Center: A vulnerability has been found in the Dahua Intelligent Connection Center9.8 CriticalN/AN/AOct 30, 2026
CVE-2026-14467: Forocoches Forocoches comments editor: An information disclosure vulnerability in the Forocoches comments editor that allows an attacker to obtain…N/A8.2 HighN/AOct 30, 2026
CVE-2026-65874: Apache Software Foundation Apache Fineract: This issue affects Apache Fineract versions up to and including 1.15.0N/AN/AN/AOct 30, 2026
CVE-2026-64618: Apache Software Foundation Apache Fineract: Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache…N/AN/AN/AOct 30, 2026
CVE-2026-59388: Cloud Foundry Foundation: Cloud Controller (CAPI) leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are…6.5 MediumN/AN/AOct 30, 2026
51-75 of 520238
‹›