The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-119645: easysoft zentaopms: ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated…6.5 Medium7.1 HighN/AOct 30, 2026
CVE-2026-119482: Crocoblock JetFormBuilder: Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly…5.3 MediumN/AN/AOct 30, 2026
CVE-2026-119370: Liquid Web / StellarWP The Events Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web /…6.5 MediumN/AN/AOct 30, 2026
CVE-2026-119368: Liquid Web / StellarWP The Events Calendar: Missing Authorization vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Exploiting…5.3 MediumN/AN/AOct 30, 2026
CVE-2026-117349: n/a: Bitcoin Core prior to 29.5, 30.4, 31.2 and 32.1 is vulnerable to an OOM issue.N/AN/AN/AOct 30, 2026
CVE-2026-116860: Arraytics Timetics: Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access…5.3 MediumN/AN/AOct 30, 2026
CVE-2026-111487: qt Qt Framework: An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module.N/A4.3 MediumN/AOct 30, 2026
CVE-2026-110799: givanz Vvveb: Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores9.8 CriticalN/AN/AOct 30, 2026
CVE-2010-20125: DedeCMS: DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated…7.5 High8.7 HighN/AOct 30, 2026
CVE-2026-119721: Blender Foundation Blender: Blender before 4.5.15 and 5.x before 5.2.3 contains an out-of-bounds read vulnerability in blo_bhead_id_* accessors in…6.1 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-119717: up9inc pybars4: pybars4 through 0.9.13 contains a code injection vulnerability in pybars/_compiler.py that allows attackers to execute…8.1 High9.2 CriticalN/AOct 30, 2026
CVE-2026-119713: paperclipai @paperclipai/server: Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders…8.8 High8.7 HighN/AOct 30, 2026
CVE-2026-119709: goniszewski grimoire: Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata…5.8 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-119705: towfiqi serpbear: SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remote…5.3 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-119701: WPGraphQL: WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood…5.3 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-104066: Scribus: Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when…7.8 High8.5 HighN/AOct 30, 2026
CVE-2026-104062: Scribus: Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the PICT image loader and import plugin that…7.8 High8.5 HighN/AOct 30, 2026
CVE-2026-46499: CollaboraOnline online: Collabora Online is a collaborative online office suite based on LibreOffice technology4.3 MediumN/AN/AOct 30, 2026
CVE-2026-61626: libass: libass is a portable subtitle renderer for the ASS/SSA (Advanced Substation Alpha/Substation Alpha) subtitle formatN/A7.3 HighN/AOct 30, 2026
CVE-2015-20130: Netsweeper: Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in…6.1 Medium5.1 MediumN/AOct 30, 2026
CVE-2026-119682: ManageEngine SharePoint Manager Plus: An improper access control vulnerability exists in the multi-factor authentication (MFA) functionality of ManageEngine…N/A7.9 HighN/AOct 30, 2026
CVE-2026-112905: givanz Vvveb: Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores9.0 CriticalN/AN/AOct 30, 2026
CVE-2026-91915: Dell OpenManage Enterprise: Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements in Output…6.8 MediumN/AN/AOct 30, 2026
CVE-2026-91914: Dell OpenManage Enterprise: Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Authentication Bypass by Spoofing vulnerability7.1 HighN/AN/AOct 30, 2026
CVE-2026-91913: Dell OpenManage Enterprise: Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an…8.8 HighN/AN/AOct 30, 2026
201-225 of 418318