The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-119656: CoreUnion CoreShop: CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the…7.5 High8.7 HighN/AOct 30, 2026
CVE-2026-119655: CoreUnion CoreShop: CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Good/GetGoodsPageList…7.5 High8.7 HighN/AOct 30, 2026
CVE-2026-119652: HuLaSpark HuLa-Server: HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList…4.3 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119651: HuLaSpark HuLa-Server: HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FeedController.delFeed that…5.4 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119648: TencentBlueKing bk-cmdb: Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization vulnerability that allows authenticated…4.3 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119647: dromara RuoYi-Vue-Plus: RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerability in SysUserServiceImpl.selectUserListByDept…4.3 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119644: blossom-editor Blossom: Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to…5.4 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119680: ManageEngine SharePoint Manager Plus: A stored cross-site scripting (XSS) vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) due to…N/A8.5 HighN/AOct 30, 2026
CVE-2026-100355: basecamp once-campfire: Campfire is a web-based chat application3.1 LowN/AN/AOct 30, 2026
CVE-2026-112348: Themeum Kirki: Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers…6.5 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-112347: Themeum Kirki: Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST…7.6 High7.2 HighN/AOct 30, 2026
CVE-2026-86715: Crypttech Crypto and Informatics Technologies Industry and Trade Inc. Vatos DLP: Plaintext storage of a password vulnerability in Crypttech Crypto and Informatics Technologies Industry and Trade Inc7.1 HighN/AN/AOct 30, 2026
CVE-2026-115683: GNOME Epiphany: A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate warning page6.8 MediumN/AN/AOct 30, 2026
CVE-2026-91917: Dell OpenManage Enterprise: Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Input Validation vulnerability8.0 HighN/AN/AOct 30, 2026
CVE-2026-87768: Inefficient Algorithmic ComplexityN/AN/AN/AOct 30, 2026
CVE-2026-75882: ESET spol. s.r.o.: An improper access control vulnerability in ESET Endpoint Encryption and ESET Full Disk Encryption allow attacker with…N/A8.5 HighN/AOct 30, 2026
CVE-2026-64860: Rejected reason: Further research determined the issue is not a vulnerability.N/AN/AN/AOct 30, 2026
CVE-2026-13576: Use of Password Hash With Insufficient Computational EffortN/AN/AN/AOct 30, 2026
CVE-2026-119038: Authorization Bypass Through User-Controlled KeyN/AN/AN/AOct 30, 2026
CVE-2026-119037: Improper Verification of Cryptographic SignatureN/AN/AN/AOct 30, 2026
CVE-2026-119036: Allocation of Resources Without Limits or ThrottlingN/AN/AN/AOct 30, 2026
CVE-2026-118996: Improper Removal of Sensitive Data Before Storage or TransferN/AN/AN/AOct 30, 2026
CVE-2026-118995: Permissive Regular ExpressionN/AN/AN/AOct 30, 2026
CVE-2026-118994: CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login nameN/AN/AN/AOct 30, 2026
CVE-2026-118993: Inefficient Regular Expression Complexity (ReDoS)N/AN/AN/AOct 30, 2026
176-200 of 418318