The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-119596: HDInnovations UNIT3D: UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZipController::show that allows…4.3 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119576: ArcadeData arcadedb: ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerability that allows users with only…4.3 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119575: ArcadeData arcadedb: ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated…6.5 Medium7.1 HighN/AOct 30, 2026
CVE-2026-119572: traefik: Traefik from 3.7.0-ea.1 before 3.7.15 contains an authentication bypass vulnerability in the Kubernetes Ingress NGINX…8.7 High7.0 HighN/AOct 30, 2026
CVE-2026-119571: parse-community parse-server: Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an authorization flaw that applies _Installation updates…3.7 Low6.3 MediumN/AOct 30, 2026
CVE-2026-119528: Red Hat: A flaw was found in GIMP7.8 HighN/AN/AOct 30, 2026
CVE-2026-118987: CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie headerN/AN/AN/AOct 30, 2026
CVE-2026-118986: Use of Cryptographically Weak Pseudo-Random Number GeneratorN/AN/AN/AOct 30, 2026
CVE-2026-117028: n/a: Skuul School Management System through version 2.6.5 is vulnerable to incorrect access control in the…N/AN/AN/AOct 30, 2026
CVE-2026-119665: MGdaasLab WHartTest: WHartTest 2.2.0 through 2.8.1 contains a missing authorization vulnerability in ScheduledTaskViewSet and…6.3 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119664: wannabespace tamery: Tamery (formerly Conar) 0.26.1 before 0.99.0 contains an authorization bypass vulnerability in the cloud sync API…4.3 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119663: wannabespace tamery: Tamery (formerly Conar) 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API…4.3 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119662: songloft-org songloft: Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to…8.8 High8.7 HighN/AOct 30, 2026
CVE-2026-119661: star7th ShowDoc: ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint…4.2 Medium2.3 LowN/AOct 30, 2026
CVE-2026-119660: yincongcyincong MuseBot: MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge…9.8 Critical9.3 CriticalN/AOct 30, 2026
CVE-2026-119659: blossom-editor Blossom: Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated users to access other…5.4 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119658: PowerDNS-Admin: PowerDNS-Admin through 2026.08.1 contains an authorization bypass vulnerability that allows authenticated User-role…4.3 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119657: zyx0814 FilePress: FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated…5.0 Medium2.3 LowN/AOct 30, 2026
CVE-2026-119656: CoreUnion CoreShop: CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the…7.5 High8.7 HighN/AOct 30, 2026
CVE-2026-119655: CoreUnion CoreShop: CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Good/GetGoodsPageList…7.5 High8.7 HighN/AOct 30, 2026
CVE-2026-119654: devlive-community DataCap: DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate…8.8 High8.7 HighN/AOct 30, 2026
CVE-2026-119653: admpub nging: Nging through 5.3.5 contains an information disclosure vulnerability that allows any authenticated backend user to list…4.3 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119652: HuLaSpark HuLa-Server: HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList…4.3 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119651: HuLaSpark HuLa-Server: HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FeedController.delFeed that…5.4 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119650: HuLaSpark HuLa-Server: HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows…5.4 Medium5.3 MediumN/AOct 30, 2026
76-100 of 413289