The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
CVE-2026-76461:Critical Cisco Secure Email Gateway Vulnerability Exploited in the Wild
Blog ↗CVE details
CVE-2026-85706:Critical GitLab Path Traversal Exploited in the Wild
Blog ↗CVE details
CVE-2026-83548:Critical SonicWall SMA1000 Vulnerabilities CVE-2026-83548, CVE-2026-83549 Exploited in the Wild
Blog ↗CVE details
CVE-2026-81578:PaperCut NG/MF Critical Zero-Day Exploited in the Wild
Blog ↗CVE details
CVE-2026-63520:Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520)
Blog ↗CVE details
CVE-2026-19490:Critical Vulnerability Affecting Citrix NetScaler ADC and NetScaler Gateway
Blog ↗CVE details
TitleEitWModules
CVE-2026-44461: Improper Neutralization of Special Elements used in an OS Command8.6 HighN/A0%May 28, 2026
CVE-2026-24444: Use of Hard-coded Credentials9.8 Critical9.3 Critical1%May 28, 2026
CVE-2026-49238: Improper Limitation of a Pathname to a Restricted Directory8.4 HighN/A1%May 28, 2026
CVE-2026-49237: Incorrect Default Permissions7.8 HighN/A0%May 28, 2026
CVE-2026-47269: Improper Access Control7.4 HighN/A0%May 27, 2026
CVE-2026-48064: Incorrect Authorization8.1 HighN/A0%May 27, 2026
CVE-2026-45570: Improper Encoding or Escaping of Output9.6 Critical2.3 Low0%May 27, 2026
CVE-2026-45361: Key Exchange without Entity Authentication8.1 HighN/A1%May 25, 2026
CVE-2026-40610: Improper Link Resolution Before File Access5.5 MediumN/A0%May 22, 2026
CVE-2025-46371: Use of a Broken or Risky Cryptographic Algorithm5.5 MediumN/A0%May 22, 2026
CVE-2026-46598: Improper Validation of Array Index5.3 MediumN/A0%May 22, 2026
CVE-2026-46597: Incorrect Type Conversion or Cast7.5 HighN/A0%May 22, 2026
CVE-2026-46595: Incorrect Authorization10.0 CriticalN/A1%May 22, 2026
CVE-2026-42508: Improper Certificate Validation9.1 CriticalN/A7%May 22, 2026
CVE-2026-39835: Improper Certificate Validation5.3 MediumN/A1%May 22, 2026
CVE-2026-39834: Integer Overflow or Wraparound9.1 CriticalN/A1%May 22, 2026
CVE-2026-39833: Missing Authorization9.1 CriticalN/A0%May 22, 2026
CVE-2026-39832: Deserialization of Untrusted Data9.1 CriticalN/A1%May 22, 2026
CVE-2026-39831: Undefined Security Weakness9.1 CriticalN/A0%May 22, 2026
CVE-2026-39827: Improper Enforcement of Message Integrity During Transmission in a Communication Channel6.5 MediumN/A0%May 22, 2026
CVE-2026-39829: Improper Verification of Cryptographic SignatureN/AN/A0%May 22, 2026
CVE-2026-39830: Improper Restriction of Operations within the Bounds of a Memory BufferN/AN/A1%May 22, 2026
CVE-2026-39828: Improper Certificate ValidationN/AN/A0%May 22, 2026
CVE-2026-24218: Use of Hard-coded Cryptographic Key8.1 HighN/A1%May 20, 2026
CVE-2026-35593: Improper Limitation of a Pathname to a Restricted Directory6.8 MediumN/A1%May 20, 2026
301-325 of 1962
‹›