The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-119364: ProFTPD Project ProFTPD: ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 contains a link-following vulnerability in mod_copy that allows…5.3 Medium6.0 MediumN/AOct 30, 2026
CVE-2026-119147: ProFTPD Project ProFTPD: ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy-file extension handler that…4.3 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119146: ProFTPD Project ProFTPD: ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overflow vulnerability in the mod_rewrite int:utf8trans…5.6 Medium6.3 MediumN/AOct 30, 2026
CVE-2026-111505: Dell OpenManage Enterprise: Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an…8.8 HighN/AN/AOct 30, 2026
CVE-2026-111504: Dell OpenManage Enterprise: Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Argument Delimiters in a…7.2 HighN/AN/AOct 30, 2026
CVE-2026-110972: Zakład Ubezpieczeń Społecznych Płatnik: Płatnik performs client-side authenticationN/A8.6 HighN/AOct 30, 2026
CVE-2026-110971: Zakład Ubezpieczeń Społecznych Płatnik: Use of a weak password encoding algorithm in Płatnik software allows a user who obtains encoded password to easily…N/A7.7 HighN/AOct 30, 2026
CVE-2026-110970: Zakład Ubezpieczeń Społecznych Płatnik: Płatnik uses HTTP protocol to download updates, libraries and support filesN/A2.3 LowN/AOct 30, 2026
CVE-2026-105924: Qt: A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module.N/A4.3 MediumN/AOct 30, 2026
CVE-2026-101214: Dell OpenManage Enterprise: Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an…7.2 HighN/AN/AOct 30, 2026
CVE-2026-101213: Dell OpenManage Enterprise: Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Privilege Management vulnerability7.8 HighN/AN/AOct 30, 2026
CVE-2026-101210: Dell OpenManage Enterprise: Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an…7.2 HighN/AN/AOct 30, 2026
CVE-2026-101209: Dell OpenManage Enterprise: Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Server-Side Request Forgery (SSRF) vulnerability2.7 LowN/AN/AOct 30, 2026
CVE-2025-68395: ARKETEAM: ARKETEAM Protectel modules PROTECTELMAJ and BDF contain a note editor module vulnerable to Stored XSSN/A5.1 MediumN/AOct 30, 2026
CVE-2025-68394: ARKETEAM: ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerabilityN/A8.4 HighN/AOct 30, 2026
CVE-2025-68393: ARKETEAM: ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerabilityN/A8.4 HighN/AOct 30, 2026
CVE-2025-68392: ARKETEAM: ARKETEAM Protectel modules PROTECTELMAJ and BDF allow low privileged users to use some of the functionalities reserved…N/A5.1 MediumN/AOct 30, 2026
CVE-2025-68391: ARKETEAM: ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to arbitrary file uploadN/A5.3 MediumN/AOct 30, 2026
CVE-2026-111503: Dell OpenManage Enterprise: Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an…7.1 HighN/AN/AOct 30, 2026
CVE-2026-112374: FOSSBilling: FOSSBilling before 0.8.9 contains a Cross-Site Request Forgery vulnerability in the staff guest login endpoint (POST…4.3 Medium5.1 MediumN/AOct 30, 2026
CVE-2026-85268: Google Cloud Identity Platform and Firebase Authentication: A Cross-Site Scripting (XSS) (CWE-79) vulnerability in the auth/handler in Google Cloud Identity Platform and Firebase…N/A8.7 HighN/AOct 30, 2026
CVE-2026-22114: Delta Electronics Delta UFC500: HTTP basic auth enforces no retry limit or backoffN/A5.3 MediumN/AOct 30, 2026
CVE-2026-22110: Delta Electronics Delta UFC500: The web server does not check authentication on POST or PUTN/A8.7 HighN/AOct 30, 2026
CVE-2026-22109: Delta Electronics Delta UFC500: The shipped WebUI template database retains the factory default passwords for all five account types in cleartextN/A8.4 HighN/AOct 30, 2026
CVE-2026-22105: Delta Electronics Delta UFC500: Delta UFC500 charging stations derive the default credentials of the Service account from character positions of the…N/A8.7 HighN/AOct 30, 2026
101-125 of 520238