The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-105822: TP-Link Systems Inc. Tapo Cloud Service: The Tapo Cloud MQTT proxy contains a server-side request forgery (SSRF) vulnerability because it accepts a…N/A8.3 HighN/ANov 3, 2026
CVE-2026-105821: TP-Link Systems Inc. Tapo Cloud Service: The Tapo Cloud MQTT broker contains a broken access control vulnerability in a proxy topic used by authenticated Tapo…N/A8.3 HighN/ANov 3, 2026
CVE-2025-71452: Vembu Technologies BDRSuite: Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in…6.1 Medium5.1 MediumN/ANov 3, 2026
CVE-2025-71451: Vembu Technologies BDRSuite: Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in…6.1 Medium5.1 MediumN/ANov 3, 2026
CVE-2026-88968: anthropics claude-code: Claude Code is an agentic coding toolN/A7.7 HighN/ANov 3, 2026
CVE-2026-63395: isomorphic-git: isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers8.8 HighN/AN/ANov 3, 2026
CVE-2026-63475: isomorphic-git: isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers4.3 MediumN/AN/ANov 3, 2026
CVE-2026-63501: Agamnentzar ag-psd: ag-psd is a JavaScript library for reading and writing Photoshop Document files7.5 HighN/AN/ANov 3, 2026
CVE-2026-82976: Red Hat: A flaw was found in the image-customization-controller used in OpenShift's bare metal provisioning stack7.1 HighN/AN/ANov 3, 2026
CVE-2026-63417: armurox loggingredactor: Logging Redactor is a Python library designed to redact sensitive data in logs based on regex patterns and / or…N/A8.2 HighN/ANov 3, 2026
CVE-2026-63198: traPtitech traQ: traQ is a messenger application built for Digital Creators Club traP7.3 HighN/AN/ANov 3, 2026
CVE-2026-63197: traPtitech traQ: traQ is a messenger application built for Digital Creators Club traP7.3 HighN/AN/ANov 3, 2026
CVE-2026-57154: opnsense core: OPNsense is a FreeBSD based firewall and routing platform8.1 HighN/AN/ANov 3, 2026
CVE-2026-46487: geonetwork core-geonetwork: GeoNetwork is a catalog application to manage spatially referenced resources7.5 HighN/AN/ANov 3, 2026
CVE-2026-39379: geonetwork core-geonetwork: GeoNetwork is a catalog application to manage spatially referenced resources7.1 HighN/AN/ANov 3, 2026
CVE-2026-121652: AWS maplibre-gl-js-amplify: Cross-site scripting (XSS) issue in AWS Amplify maplibre-gl-js-amplify before 4.0.3 might allow remote authenticated…5.4 Medium4.8 MediumN/ANov 3, 2026
CVE-2026-121501: mathurvishal CloudClassroom-PHP-Project: A vulnerability was determined in mathurvishal CloudClassroom-PHP-Project6.3 Medium2.1 LowN/ANov 3, 2026
CVE-2026-121382: Netcore NBR100V2: A vulnerability was determined in Netcore NBR100V2 1.3.240614.0309287.5 High7.7 HighN/ANov 3, 2026
CVE-2026-120956: MongoDB C Driver: The MongoDB C Driver does not validate the type or format of a namespace field returned by the server in a query…7.1 High7.1 HighN/ANov 3, 2026
CVE-2026-120955: MongoDB C Driver: The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain…7.5 High8.7 HighN/ANov 3, 2026
CVE-2026-120954: MongoDB C Driver: A weakness in the BSON library's handling of a specialized binary vector data type allows an arithmetic wraparound when…3.7 Low6.3 MediumN/ANov 3, 2026
CVE-2026-120953: MongoDB Atlas SQL JDBC Driver: A URI redirection weakness exists in the authentication component of the Atlas SQL JDBC Driver4.3 Medium5.1 MediumN/ANov 3, 2026
CVE-2026-120684: MongoDB C Driver: A memory-initialization flaw in the legacy GridFS file handling of the MongoDB C Driver can cause uninitialized process…6.5 Medium6.0 MediumN/ANov 3, 2026
CVE-2026-120678: MongoDB C Driver: A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to…7.5 High8.7 HighN/ANov 3, 2026
CVE-2026-120673: MongoDB Rust Driver: A component of the MongoDB Rust Driver that records diagnostic tracing data can capture command content before…5.5 Medium6.8 MediumN/ANov 3, 2026
326-350 of 528356
‹›