The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-95723: Hewlett Packard Enterprise (HPE) Virtual Intranet Access (VIA): A missing integrity verification vulnerability has been discovered in the Virtual Intranet Access (VIA) client8.4 HighN/AN/ANov 3, 2026
CVE-2026-95722: Hewlett Packard Enterprise (HPE) Virtual Intranet Access (VIA): A local privilege escalation vulnerability has been discovered in the Virtual Intranet Access (VIA) client8.8 HighN/AN/ANov 3, 2026
CVE-2026-93325: Docker Docker Buildx: Buildx bake requires the user to grant entitlements with --allow or an interactive prompt before a build reaches…N/A7.3 HighN/ANov 3, 2026
CVE-2026-88968: anthropics claude-code: Claude Code is an agentic coding toolN/A7.7 HighN/ANov 3, 2026
CVE-2026-88066: anthropics claude-code: Claude Desktop is Anthropic's desktop application for interacting with ClaudeN/A7.5 HighN/ANov 3, 2026
CVE-2026-63502: yeti-platform yeti: Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline8.3 HighN/AN/ANov 3, 2026
CVE-2026-63501: Agamnentzar ag-psd: ag-psd is a JavaScript library for reading and writing Photoshop Document files7.5 HighN/AN/ANov 3, 2026
CVE-2026-63489: yeti-platform yeti: Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline7.6 HighN/AN/ANov 3, 2026
CVE-2026-63478: isomorphic-git: isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers5.3 MediumN/AN/ANov 3, 2026
CVE-2026-63476: isomorphic-git: isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers4.3 MediumN/AN/ANov 3, 2026
CVE-2026-63475: isomorphic-git: isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers4.3 MediumN/AN/ANov 3, 2026
CVE-2026-63471: koxudaxi fastapi-code-generator: fastapi-code-generator creates FastAPI applications from OpenAPI filesN/A9.3 CriticalN/ANov 3, 2026
CVE-2026-63470: koxudaxi fastapi-code-generator: fastapi-code-generator creates FastAPI applications from OpenAPI filesN/A9.3 CriticalN/ANov 3, 2026
CVE-2026-63469: koxudaxi fastapi-code-generator: fastapi-code-generator creates FastAPI applications from OpenAPI filesN/A9.3 CriticalN/ANov 3, 2026
CVE-2026-63433: franklioxygen MyTube: MyTube is a self-hosted downloader and player for several video websites6.8 MediumN/AN/ANov 3, 2026
CVE-2026-63395: isomorphic-git: isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers8.8 HighN/AN/ANov 3, 2026
CVE-2026-45146: chamilo chamilo-lms: Chamilo LMS is an open-source learning management system7.2 HighN/AN/ANov 3, 2026
CVE-2026-121577: lucasrodes whatstk: Inefficient Regular Expression Complexity (CWE-1333) in generate_regex() (whatstk/whatsapp/parser.py) in whatstk from…N/A6.7 MediumN/ANov 3, 2026
CVE-2026-120567: MongoDB Entity Framework Core Provider: The MongoDB Entity Framework Core provider does not neutralize special elements when it places a caller-supplied value…5.4 Medium2.3 LowN/ANov 3, 2026
CVE-2026-110826: team-alembic ash_authentication: Improper Session Invalidation after Authentication Credential Change vulnerability in team-alembic ash_authentication…N/A6.3 MediumN/ANov 3, 2026
CVE-2026-105822: TP-Link Systems Inc. Tapo Cloud Service: The Tapo Cloud MQTT proxy contains a server-side request forgery (SSRF) vulnerability because it accepts a…N/A8.3 HighN/ANov 3, 2026
CVE-2026-105821: TP-Link Systems Inc. Tapo Cloud Service: The Tapo Cloud MQTT broker contains a broken access control vulnerability in a proxy topic used by authenticated Tapo…N/A8.3 HighN/ANov 3, 2026
CVE-2025-71452: Vembu Technologies BDRSuite: Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in…6.1 Medium5.1 MediumN/ANov 3, 2026
CVE-2025-71451: Vembu Technologies BDRSuite: Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in…6.1 Medium5.1 MediumN/ANov 3, 2026
CVE-2026-61495: hathach TinyUSB: TinyUSB through 0.21.0, fixed in commit e85c2b8, contains an out-of-bounds write vulnerability in the MTP device class…6.8 Medium7.0 HighN/ANov 3, 2026
351-375 of 528356
‹›