The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-115714: Elastic Elastic Docker images: Improper Certificate Validation (CWE-295) in the operating system certificate bundle shipped in the Docker images of…7.4 HighN/AN/ANov 3, 2026
CVE-2026-115710: Elastic Elasticsearch: Use of Cache Containing Sensitive Information (CWE-524) in Elasticsearch can lead to information disclosure and…4.2 MediumN/AN/ANov 3, 2026
CVE-2026-115298: Elastic Elasticsearch: Incorrect Authorization (CWE-863) in Elasticsearch can lead to information disclosure via Accessing Functionality Not…4.3 MediumN/AN/ANov 3, 2026
CVE-2026-115297: Elastic Packetbeat: NULL Pointer Dereference (CWE-476) in the AMQP protocol parser in Packetbeat can lead to denial of service via…6.5 MediumN/AN/ANov 3, 2026
CVE-2026-115295: Elastic Kibana: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing…4.3 MediumN/AN/ANov 3, 2026
CVE-2026-115294: Elastic Kibana: Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in the Kibana Fleet feature can lead to…7.3 HighN/AN/ANov 3, 2026
CVE-2026-115293: Elastic Kibana: Insertion of Sensitive Information Into Sent Data (CWE-201) in Kibana Observability onboarding can lead to disclosure…6.5 MediumN/AN/ANov 3, 2026
CVE-2026-115292: Elastic Kibana: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana Machine Learning can lead to information…4.3 MediumN/AN/ANov 3, 2026
CVE-2026-115290: Elastic Elasticsearch: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested…7.5 HighN/AN/ANov 3, 2026
CVE-2026-115289: Elastic APM Server: Use of Multiple Resources with Duplicate Identifier (CWE-694) in APM Server can lead to information disclosure via a…4.3 MediumN/AN/ANov 3, 2026
CVE-2026-114183: WPVibes AnyWhere Elementor: Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows…6.5 MediumN/AN/ANov 3, 2026
CVE-2026-109594: SonicWall Global Management System (GMS): Post-authentication Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability…6.8 MediumN/AN/ANov 3, 2026
CVE-2026-109593: SonicWall Global Management System (GMS): An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read…9.1 CriticalN/AN/ANov 3, 2026
CVE-2026-103916: Docker Docker Sandboxes: Docker Sandboxes sbx cp does not safely confine host-side paths to a shared workspaceN/A8.4 HighN/ANov 3, 2026
CVE-2026-103077: myCred: Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control…4.3 MediumN/AN/ANov 3, 2026
CVE-2026-121263: phpMyAdmin MoTranslator: A vulnerability was determined in phpMyAdmin MoTranslator up to 6.0.16.3 Medium2.1 LowN/ANov 3, 2026
CVE-2026-121628: bagisto: Bagisto before 2.3.16 and 2.4.x before 2.4.1 contains a race condition vulnerability in manageCartRule() that allows…3.7 Low6.3 MediumN/ANov 3, 2026
CVE-2026-121627: jarun buku: buku 5.0 through 5.1.1 contains a stored cross-site scripting vulnerability in the bukuserver bookmark list that allows…6.1 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-121626: willamowius gnugk: GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in H46024Socket::ReceivedProbePacket()…3.7 Low6.3 MediumN/ANov 3, 2026
CVE-2026-121625: willamowius gnugk: GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in ParseRTCP() in ProxyChannel.cxx that…3.7 Low6.3 MediumN/ANov 3, 2026
CVE-2026-121624: Nanosystems Supremo: Nanosystems Supremo for Windows and macOS before 5.0.2.3874 contains an improper certificate validation vulnerability…6.8 Medium7.6 HighN/ANov 3, 2026
CVE-2026-121631: lightdash: Lightdash 0.2609.0 before 3.137.0 contains an authorization bypass vulnerability in the RenameService that allows…4.2 Medium2.3 LowN/ANov 3, 2026
CVE-2026-119509: eranfl ClickCease Click Fraud Protection: Missing Authorization vulnerability in eranfl ClickCease Click Fraud Protection clickcease-click-fraud-protection…5.3 MediumN/AN/ANov 3, 2026
CVE-2026-97072: myCred: Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control…4.3 MediumN/AN/ANov 3, 2026
CVE-2026-114187: WPVibes AnyWhere Elementor: Missing Authorization vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Exploiting Incorrectly…5.3 MediumN/AN/ANov 3, 2026
376-400 of 528356
‹›