The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-85888: Microsoft: Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.7.7 HighN/AN/AOct 13, 2026
CVE-2026-85886: Microsoft: Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.8.5 HighN/AN/AOct 13, 2026
CVE-2026-85876: Microsoft: Use after free in SQL Server allows an authorized attacker to elevate privileges locally.7.0 HighN/AN/AOct 13, 2026
CVE-2026-85473: Auth0 java-jwt: The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat)…5.3 MediumN/AN/AOct 13, 2026
CVE-2026-83966: Adobe Substance 3D Sampler: Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution…7.8 HighN/AN/AOct 13, 2026
CVE-2026-83965: Adobe Substance 3D Sampler: Substance3D - Sampler is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code…7.8 HighN/AN/AOct 13, 2026
CVE-2026-83945: Microsoft: Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.6.6 MediumN/AN/AOct 13, 2026
CVE-2026-83661: Adobe Photoshop: Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code…7.8 HighN/AN/AOct 13, 2026
CVE-2026-79715: IBM WebSphere Application Server - Liberty: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a local attacker to traverse…5.5 MediumN/AN/AOct 13, 2026
CVE-2026-78633: Okta Okta RADIUS Agent: The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute6.5 MediumN/AN/AOct 13, 2026
CVE-2026-78632: Okta Okta RADIUS Agent: The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\ALL SERVICES and CREATOR OWNER…5.3 MediumN/AN/AOct 13, 2026
CVE-2026-78628: Okta Okta Credential Provider for Windows: The Okta Credential Provider for Windows does not validate a serialized credential buffer before interpreting it as a…6.0 MediumN/AN/AOct 13, 2026
CVE-2026-77816: IBM WebSphere Application Server - Liberty: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 administrative client could allow…6.5 MediumN/AN/AOct 13, 2026
CVE-2026-76001: Adobe: ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation7.1 HighN/AN/AOct 13, 2026
CVE-2026-75996: Adobe: ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application…7.5 HighN/AN/AOct 13, 2026
CVE-2026-75995: Adobe: ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in…8.4 HighN/AN/AOct 13, 2026
CVE-2026-75994: Adobe: ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the…9.6 CriticalN/AN/AOct 13, 2026
CVE-2026-75748: Adobe: ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation7.6 HighN/AN/AOct 13, 2026
CVE-2026-71385: Adobe: ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the…8.4 HighN/AN/AOct 13, 2026
CVE-2026-63171: Omnispace Agora Project: Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated…5.4 Medium5.1 MediumN/AOct 13, 2026
CVE-2026-63169: Omnispace Agora Project: Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated…6.4 Medium5.3 MediumN/AOct 13, 2026
CVE-2026-63168: Omnispace Agora Project: Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated…5.4 Medium5.1 MediumN/AOct 13, 2026
CVE-2026-63157: Omnispace Agora Project: Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated…5.4 Medium5.1 MediumN/AOct 13, 2026
CVE-2026-63156: Omnispace Agora Project: Omnispace Agora Project before 26.10.0 contains a reflected cross-site scripting vulnerability that allows…6.1 Medium5.1 MediumN/AOct 13, 2026
CVE-2026-49950: xorbitsai xoscar: Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to…9.8 Critical9.3 CriticalN/AOct 13, 2026
226-250 of 657253
‹›