The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-63120: Aiven-Open pghoard: pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores8.4 HighN/AN/AOct 23, 2026
CVE-2026-57210: dadrus heimdall: Heimdall is a cloud native Identity Aware Proxy and Access Control Decision serviceN/A7.0 HighN/AOct 23, 2026
CVE-2026-57209: dadrus heimdall: Heimdall is a cloud native Identity Aware Proxy and Access Control Decision serviceN/A7.0 HighN/AOct 23, 2026
CVE-2026-57146: MervinPraison PraisonAI: PraisonAI is a multi-agent teams system7.5 HighN/AN/AOct 23, 2026
CVE-2026-57144: MervinPraison PraisonAI: PraisonAI is a multi-agent teams system8.8 HighN/AN/AOct 23, 2026
CVE-2026-57142: MervinPraison PraisonAI: PraisonAI is a multi-agent teams system7.8 HighN/AN/AOct 23, 2026
CVE-2026-57121: MervinPraison PraisonAI: PraisonAI is a multi-agent teams system8.1 HighN/AN/AOct 23, 2026
CVE-2026-57117: MervinPraison PraisonAI: PraisonAI is a multi-agent teams system8.8 HighN/AN/AOct 23, 2026
CVE-2026-57116: MervinPraison PraisonAI: PraisonAI is a multi-agent teams system9.8 CriticalN/AN/AOct 23, 2026
CVE-2026-57114: MervinPraison PraisonAI: PraisonAI is a multi-agent teams system7.2 HighN/AN/AOct 23, 2026
CVE-2026-57113: MervinPraison PraisonAI: PraisonAI is a multi-agent teams system8.1 HighN/AN/AOct 23, 2026
CVE-2026-55889: flatpak xdg-desktop-portal: XDG Desktop Portal is a desktop integration portalN/A8.3 HighN/AOct 23, 2026
CVE-2026-55888: flatpak xdg-desktop-portal: XDG Desktop Portal is a desktop integration portalN/A8.8 HighN/AOct 23, 2026
CVE-2026-55422: conda-forge conda-forge.github.io: conda-forge is a GitHub organization containing repositories of conda recipes4.6 MediumN/AN/AOct 23, 2026
CVE-2026-55190: eventschedule: Event Schedule is an open-source platform to share events, sell tickets and bring communities together6.5 MediumN/AN/AOct 23, 2026
CVE-2026-54711: Aiven-Open pghoard: pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object storesN/A2.4 LowN/AOct 23, 2026
CVE-2026-115752: SignalK signalk-server: Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store…4.2 Medium2.3 LowN/AOct 23, 2026
CVE-2026-115751: agentfront mcp-from-openapi: Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows…3.7 Low6.3 MediumN/AOct 23, 2026
CVE-2026-115750: agentfront mcp-from-openapi: mcp-from-openapi from 2.5.0 before 2.9.0 contains a credential exposure vulnerability that allows attackers to capture…3.7 Low6.3 MediumN/AOct 23, 2026
CVE-2026-115749: hydra-ecosystem hydra-ray-launcher: hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an arbitrary module import…3.3 Low4.8 MediumN/AOct 23, 2026
CVE-2026-115730: i18next i18next-http-backend: i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation…3.1 Low2.3 LowN/AOct 23, 2026
CVE-2026-115729: pdfme common: @pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to…6.8 Medium8.9 HighN/AOct 23, 2026
CVE-2026-115728: hapijs @hapi/content: @hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in…7.5 High8.7 HighN/AOct 23, 2026
CVE-2026-112863: Hogash KALLYAS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hogash KALLYAS…7.1 HighN/AN/AOct 23, 2026
CVE-2026-112859: ThemeREX Group Little Birdies: Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object…9.8 CriticalN/AN/AOct 23, 2026
301-325 of 413321
‹›