The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-111768: modelcontextprotocol, @modelcontextprotocol: The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context…7.5 HighN/AN/ANov 5, 2026
CVE-2026-111769: modelcontextprotocol, @modelcontextprotocol: The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context…6.5 MediumN/AN/ANov 5, 2026
CVE-2026-87008: vitali87 code-graph-rag: Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing…7.1 HighN/AN/ANov 5, 2026
CVE-2026-85076: jhuckaby Cronicle: Cronicle is a multi-server task scheduler and runner, with a web based front-end UIN/A9.0 CriticalN/ANov 5, 2026
CVE-2026-81190: kurrent-io KurrentDB: KurrentDB is a database engineered for modern software applications and event-driven architecturesN/A6.9 MediumN/ANov 5, 2026
CVE-2026-77622: BishopFox sliver: Sliver is a command and control frameworkN/A8.2 HighN/ANov 5, 2026
CVE-2026-77463: umputun remark42: Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments6.5 MediumN/AN/ANov 5, 2026
CVE-2026-69143: Rejected reason: This CVE is a duplicate of another CVE.N/AN/AN/ANov 5, 2026
CVE-2026-62268: borgbackup borg: borgbackup is an opensource, deduplicating archiver with compression and authenticated encryptionN/A5.3 MediumN/ANov 5, 2026
CVE-2026-55458: caddyserver caddy: Caddy is an extensible server platform that uses TLS by defaultN/A2.9 LowN/ANov 5, 2026
CVE-2026-54442: NationalSecurityAgency emissary: Emissary is a P2P based data-driven workflow engine4.8 MediumN/AN/ANov 5, 2026
CVE-2026-49272: oauthlib: OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+8.5 HighN/AN/ANov 5, 2026
CVE-2026-48705: Project-MONAI MONAI: MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging9.3 CriticalN/AN/ANov 5, 2026
CVE-2026-46350: dcmjs-org dcmjs: dcmjs is a JavaScript implementation of DICOM manipulation9.1 CriticalN/AN/ANov 5, 2026
CVE-2026-34157: wailsapp wails: Wails is a framework for building desktop applications using Go and web technologiesN/A7.6 HighN/ANov 5, 2026
CVE-2026-119434: silviucpp ezstd: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in silviucpp ezstd allows an attacker…6.2 Medium6.9 MediumN/ANov 5, 2026
CVE-2026-114604: ardatan graphql-tools: GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemasN/A8.4 HighN/ANov 5, 2026
CVE-2026-114134: psf black: Black is the uncompromising Python code formatterN/A8.7 HighN/ANov 5, 2026
Red Hat: CVE-2026-112902: Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tagsN/A8.3 HighN/ANov 5, 2026
Red Hat: CVE-2026-112899: exploit-intelligence/vulnerability-analysis-rhel9 vulnerabilityN/A6.3 MediumN/ANov 5, 2026
CVE-2026-111771: modelcontextprotocol, @modelcontextprotocol: The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context…6.8 MediumN/AN/ANov 5, 2026
CVE-2026-111753: angular: Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and…N/A5.9 MediumN/ANov 5, 2026
CVE-2026-111062: Eugeny russh: russh is a Rust SSH client and server libraryN/A2.3 LowN/ANov 5, 2026
CVE-2026-110802: altair-graphql: Altair is a GraphQL client for all platforms6.1 MediumN/AN/ANov 5, 2026
CVE-2026-77604: vitali87 code-graph-rag: Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing…7.5 HighN/AN/ANov 5, 2026
351-375 of 418946
‹›