The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-12877: Improper Authentication9.1 CriticalN/A0%Jul 24, 2026
CVE-2026-12690: Missing Authorization3.8 LowN/A0%Jul 24, 2026
CVE-2026-12689: Missing Authorization5.4 MediumN/A0%Jul 24, 2026
CVE-2026-12688: Improper Access Control6.5 MediumN/A0%Jul 24, 2026
CVE-2026-12497: Improper Privilege Management7.5 HighN/A0%Jul 24, 2026
CVE-2026-16870: Stack-based Buffer Overflow8.8 HighN/A0%Jul 24, 2026
CVE-2026-66141: Inclusion of Functionality from Untrusted Control Sphere7.8 HighN/A0%Jul 24, 2026
CVE-2026-66140: Path Traversal: '../filedir'7.8 HighN/A0%Jul 24, 2026
CVE-2026-66139: Missing Authentication for Critical Function4.8 MediumN/A0%Jul 24, 2026
CVE-2026-66138: Improper Neutralization of Special Elements used in an OS Command7.2 HighN/A0%Jul 24, 2026
CVE-2026-54422: Insufficiently Protected Credentials5.5 MediumN/A0%Jul 24, 2026
CVE-2026-6454: Improper Neutralization of Input During Web Page Generation6.4 MediumN/A0%Jul 24, 2026
CVE-2026-15420: Improper Limitation of a Pathname to a Restricted Directory4.3 MediumN/A1%Jul 24, 2026
CVE-2026-15100: Improper Neutralization of Input During Web Page Generation6.4 MediumN/A0%Jul 24, 2026
CVE-2026-13464: Authorization Bypass Through User-Controlled Key5.3 MediumN/A0%Jul 24, 2026
CVE-2026-12736: Improper Privilege Management8.0 HighN/A0%Jul 24, 2026
CVE-2026-11922: Authentication Bypass by Spoofing6.5 MediumN/A0%Jul 24, 2026
CVE-2026-11354: Missing Authorization5.3 MediumN/A0%Jul 24, 2026
CVE-2025-9205: Improper Neutralization of Input During Web Page Generation6.4 MediumN/A0%Jul 24, 2026
CVE-2026-58275: Missing Authorization10.0 CriticalN/A1%Jul 24, 2026
CVE-2026-62825: Improper Authentication10.0 CriticalN/A1%Jul 24, 2026
CVE-2026-56191: Improper Authentication10.0 CriticalN/A1%Jul 24, 2026
CVE-2026-50517: Deserialization of Untrusted Data9.9 CriticalN/A1%Jul 24, 2026
CVE-2026-49159: Exposure of Sensitive Information to an Unauthorized Actor6.5 MediumN/A1%Jul 24, 2026
CVE-2026-35425: Improper Access Control8.0 HighN/A0%Jul 24, 2026
28426-28450 of 400317