The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-109933: Improper Neutralization of Input During Web Page Generation6.8 MediumN/A0%Oct 23, 2026
CVE-2026-107858: Missing Origin Validation in WebSocketsN/A7.2 High0%Oct 23, 2026
CVE-2026-86055: Weak Password Recovery Mechanism for Forgotten PasswordN/A8.7 High0%Oct 23, 2026
CVE-2026-86020: Improper Input Validation4.6 MediumN/A0%Oct 23, 2026
CVE-2026-86019: Uncontrolled Resource ConsumptionN/A5.3 Medium0%Oct 23, 2026
CVE-2026-86018: Uncontrolled Resource ConsumptionN/A5.3 Medium0%Oct 23, 2026
CVE-2026-59188: Improper Neutralization of Input During Web Page Generation5.4 MediumN/A0%Oct 23, 2026
CVE-2026-55835: Improper Handling of ParametersN/A6.9 Medium0%Oct 23, 2026
CVE-2026-115497: Improper Limitation of a Pathname to a Restricted Directory7.5 HighN/A1%Oct 23, 2026
CVE-2026-109198: Improper Neutralization of Input During Web Page Generation7.2 HighN/A0%Oct 23, 2026
CVE-2026-90458: Improper Validation of Specified Type of Input5.4 MediumN/A0%Oct 23, 2026
CVE-2026-89419: Improper Protection of Alternate Path5.0 MediumN/A0%Oct 23, 2026
CVE-2026-55600: Improper Neutralization of Input During Web Page GenerationN/A5.7 Medium0%Oct 23, 2026
CVE-2026-54631: Use of Hard-coded Credentials6.3 MediumN/A0%Oct 23, 2026
CVE-2026-54630: Unrestricted Upload of File with Dangerous Type9.6 CriticalN/A0%Oct 23, 2026
CVE-2026-54615: Improper Neutralization of Input During Web Page GenerationN/A6.0 Medium0%Oct 23, 2026
CVE-2026-115638: Improper Handling of Highly Compressed Data (Data Amplification)4.3 MediumN/A0%Oct 23, 2026
CVE-2026-115547: Improper Control of Generation of Code9.1 CriticalN/A1%Oct 23, 2026
CVE-2026-115546: Authorization Bypass Through User-Controlled Key8.1 HighN/A0%Oct 23, 2026
CVE-2026-19678: Server-Side Request Forgery (SSRF)N/A8.7 High0%Oct 23, 2026
CVE-2026-19677: Missing Authentication for Critical FunctionN/A9.3 Critical1%Oct 23, 2026
CVE-2026-115537: URL Redirection to Untrusted Site4.3 Medium2.1 Low0%Oct 23, 2026
CVE-2026-115536: Improper Neutralization of Input During Web Page Generation4.3 Medium2.1 Low0%Oct 23, 2026
CVE-2026-115535: Improper Neutralization of Input During Web Page Generation2.4 Low1.9 Low0%Oct 23, 2026
CVE-2026-115486: Out-of-bounds Read7.1 HighN/A0%Oct 23, 2026
2976-3000 of 416436