The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-48391: Untrusted Search Path8.2 HighN/A0%Jul 28, 2026
CVE-2026-48390: Incorrect Authorization8.2 HighN/A0%Jul 28, 2026
CVE-2026-48374: Improper Limitation of a Pathname to a Restricted Directory7.8 HighN/A0%Jul 28, 2026
CVE-2026-48058: Sensitive Cookie in HTTPS Session Without 'Secure' AttributeN/A4.6 Medium0%Jul 28, 2026
CVE-2026-47768: Use of GET Request Method With Sensitive Query Strings5.5 MediumN/A0%Jul 28, 2026
CVE-2026-47726: Improper AuthorizationN/A7.1 High0%Jul 28, 2026
CVE-2026-47725: Cross-Site Request Forgery (CSRF)N/A6.9 Medium0%Jul 28, 2026
CVE-2026-18107: Improper Privilege Management7.8 HighN/A0%Jul 28, 2026
CVE-2026-16771: Missing Authentication for Critical Function8.8 HighN/A0%Jul 28, 2026
CVE-2026-16498: Exposure of Data Element to Wrong Session10.0 CriticalN/A0%Jul 28, 2026
CVE-2026-16496: Session Fixation8.9 HighN/A0%Jul 28, 2026
CVE-2026-15992: Improper Privilege Management8.8 HighN/A1%Jul 28, 2026
CVE-2026-15304: Improper Neutralization of Special Elements used in an SQL Command6.5 MediumN/A0%Jul 28, 2026
CVE-2026-14869: Server-Side Request Forgery (SSRF)8.6 HighN/A0%Jul 28, 2026
CVE-2026-59933: Uncontrolled Resource Consumption7.5 HighN/A0%Jul 28, 2026
CVE-2026-59931: Server-Side Request Forgery (SSRF)7.7 HighN/A0%Jul 28, 2026
CVE-2026-54635: Improper Authentication7.5 HighN/A1%Jul 28, 2026
CVE-2026-48388: Uncontrolled Search Path Element8.6 HighN/A0%Jul 28, 2026
CVE-2026-48372: Heap-based Buffer Overflow7.8 HighN/A0%Jul 28, 2026
CVE-2026-48025: Improper Clearing of Heap Memory Before ReleaseN/A6.9 Medium1%Jul 28, 2026
CVE-2026-67185: Improper Limitation of a Pathname to a Restricted Directory7.5 High8.7 High1%Jul 28, 2026
CVE-2026-67184: NULL Pointer Dereference7.5 High8.7 High1%Jul 28, 2026
CVE-2026-67183: Missing Release of Memory after Effective Lifetime7.5 High8.7 High1%Jul 28, 2026
CVE-2026-67182: Inconsistent Interpretation of HTTP Requests7.5 High6.9 Medium1%Jul 28, 2026
CVE-2026-54620: Use After FreeN/A2.0 Low0%Jul 28, 2026
44551-44575 of 417011