The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-119426: phpMyAdmin: phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute…7.5 High7.7 HighN/AOct 30, 2026
CVE-2026-119424: opnsense core: OPNsense core before 26.7.8 contains a configuration line injection vulnerability that allows authenticated users with…6.8 Medium6.1 MediumN/AOct 30, 2026
CVE-2026-119423: opnsense core: OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant…5.3 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-119422: juspay hyperswitch: Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers…5.9 Medium8.2 HighN/AOct 30, 2026
CVE-2026-119420: getlago lago: Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain…8.8 High8.7 HighN/AOct 30, 2026
CVE-2026-119419: cakephp: CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying…8.1 High9.2 CriticalN/AOct 30, 2026
CVE-2026-119418: cakephp: CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying…8.1 High9.2 CriticalN/AOct 30, 2026
CVE-2026-119416: cakephp: CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the Http Client CookieCollection…4.8 Medium6.3 MediumN/AOct 30, 2026
CVE-2026-119415: cakephp: CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that allows attackers to inject MIME…3.7 Low6.3 MediumN/AOct 30, 2026
CVE-2026-119414: bitwarden server: Bitwarden Server before 2026.10.1 on Entity Framework backends contains an authorization bypass vulnerability that…4.3 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119408: n8n-io n8n: n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability via…8.8 High8.7 HighN/AOct 30, 2026
CVE-2026-119407: element-hq: Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession,…7.1 High7.1 HighN/AOct 30, 2026
CVE-2026-119379: SQLite: SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in…7.8 High8.5 HighN/AOct 30, 2026
CVE-2026-119377: SQLite: SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only…2.5 Low2.0 LowN/AOct 30, 2026
CVE-2026-119376: SQLite: SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the…5.5 Medium6.8 MediumN/AOct 30, 2026
CVE-2026-119373: SQLite: SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the…7.8 High8.5 HighN/AOct 30, 2026
CVE-2026-119372: SQLite: SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in…5.5 Medium6.8 MediumN/AOct 30, 2026
CVE-2026-119147: ProFTPD Project ProFTPD: ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy-file extension handler that…4.3 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119146: ProFTPD Project ProFTPD: ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overflow vulnerability in the mod_rewrite int:utf8trans…5.6 Medium6.3 MediumN/AOct 30, 2026
CVE-2026-111503: Dell OpenManage Enterprise: Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an…7.1 HighN/AN/AOct 30, 2026
CVE-2026-101209: Dell OpenManage Enterprise: Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Server-Side Request Forgery (SSRF) vulnerability2.7 LowN/AN/AOct 30, 2026
CVE-2026-105924: Qt: A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module.N/A4.3 MediumN/AOct 30, 2026
CVE-2026-111504: Dell OpenManage Enterprise: Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Argument Delimiters in a…7.2 HighN/AN/AOct 30, 2026
CVE-2026-101210: Dell OpenManage Enterprise: Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an…7.2 HighN/AN/AOct 30, 2026
CVE-2026-110972: Zakład Ubezpieczeń Społecznych Płatnik: Płatnik performs client-side authenticationN/A8.6 HighN/AOct 30, 2026
176-200 of 413289