The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-119649: OrchardCMS Orchard: Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in…7.1 High7.1 HighN/AOct 30, 2026
CVE-2026-119648: TencentBlueKing bk-cmdb: Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization vulnerability that allows authenticated…4.3 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119647: dromara RuoYi-Vue-Plus: RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerability in SysUserServiceImpl.selectUserListByDept…4.3 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119646: Open Web Analytics: Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other…4.3 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119645: easysoft zentaopms: ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated…6.5 Medium7.1 HighN/AOct 30, 2026
CVE-2026-119644: blossom-editor Blossom: Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to…5.4 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119680: ManageEngine SharePoint Manager Plus: A stored cross-site scripting (XSS) vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) due to…N/A8.5 HighN/AOct 30, 2026
CVE-2026-100355: basecamp once-campfire: Campfire is a web-based chat application3.1 LowN/AN/AOct 30, 2026
CVE-2026-112348: Themeum Kirki: Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers…6.5 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-112347: Themeum Kirki: Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST…7.6 High7.2 HighN/AOct 30, 2026
CVE-2026-119542: Red Hat: A flaw was found in the Ickle query parser in Infinispan4.3 MediumN/AN/AOct 30, 2026
CVE-2026-91912: Dell OpenManage Enterprise: Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Use of Hard-coded Cryptographic Key vulnerability7.3 HighN/AN/AOct 30, 2026
CVE-2026-91913: Dell OpenManage Enterprise: Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an…8.8 HighN/AN/AOct 30, 2026
CVE-2026-111498: Dell OpenManage Enterprise: OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Resource Locking vulnerability4.7 MediumN/AN/AOct 30, 2026
CVE-2026-86715: Crypttech Crypto and Informatics Technologies Industry and Trade Inc. Vatos DLP: Plaintext storage of a password vulnerability in Crypttech Crypto and Informatics Technologies Industry and Trade Inc7.1 HighN/AN/AOct 30, 2026
CVE-2026-111499: Dell OpenManage Enterprise: Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource…5.5 MediumN/AN/AOct 30, 2026
CVE-2026-91914: Dell OpenManage Enterprise: Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Authentication Bypass by Spoofing vulnerability7.1 HighN/AN/AOct 30, 2026
CVE-2026-111500: Dell OpenManage Enterprise: Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Missing Authentication for Critical Function…5.4 MediumN/AN/AOct 30, 2026
CVE-2026-115683: GNOME Epiphany: A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate warning page6.8 MediumN/AN/AOct 30, 2026
CVE-2026-91915: Dell OpenManage Enterprise: Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements in Output…6.8 MediumN/AN/AOct 30, 2026
CVE-2026-64860: Rejected reason: Further research determined the issue is not a vulnerability.N/AN/AN/AOct 30, 2026
CVE-2026-13576: Use of Password Hash With Insufficient Computational EffortN/AN/AN/AOct 30, 2026
CVE-2026-119038: Authorization Bypass Through User-Controlled KeyN/AN/AN/AOct 30, 2026
CVE-2026-119037: Improper Verification of Cryptographic SignatureN/AN/AN/AOct 30, 2026
CVE-2026-119036: Allocation of Resources Without Limits or ThrottlingN/AN/AN/AOct 30, 2026
101-125 of 413289