The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-90436: Apache Software Foundation Apache Axis 1.x (EOL): ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated…N/AN/AN/ANov 6, 2026
CVE-2026-80303: Gen Digital: An integer underflow vulnerability in the Avast Windows Filtering Platform (WFP) stream parser on Windows allows denial…N/AN/AN/ANov 6, 2026
CVE-2026-80302: Gen Digital: Insufficient isolation in the Avast sandbox file virtualization layer on Windows allows a local, low-privileged…N/AN/AN/ANov 6, 2026
CVE-2026-80301: Gen Digital: Improper isolation in the Avast sandbox on Windows allows a local, low-privileged attacker executing inside the sandbox…N/AN/AN/ANov 6, 2026
CVE-2026-66987: HCL Software HCL AION: HCL AION is affected by a vulnerability where the account lockout mechanism did not sufficiently restrict repeated…5.3 MediumN/AN/ANov 6, 2026
CVE-2026-66986: HCL Software HCL AION: HCL AION is affected by a vulnerability where user sessions did not expire after a sufficient period of inactivity3.3 LowN/AN/ANov 6, 2026
CVE-2026-66984: HCL Software HCL AION: HCL AION is affected by a vulnerability where certain application responses revealed internal server file system paths3.1 LowN/AN/ANov 6, 2026
CVE-2026-66982: HCL Software HCL AION: HCL AION is affected by a vulnerability where browser autocomplete was enabled on sensitive login form fields, allowing…3.3 LowN/AN/ANov 6, 2026
CVE-2026-66981: HCL Software HCL AION: HCL AION is affected by a vulnerability where the application trusted the value of the HTTP Host header supplied in…6.5 MediumN/AN/ANov 6, 2026
CVE-2026-21834: HCL Software HCL AION: HCL AION is affected by a vulnerability where the Content-Security-Policy (CSP) security response header was missing…3.1 LowN/AN/ANov 6, 2026
CVE-2026-12067: Gen Digital: Missing exception handlers in AvastSvc native message dispatcher (ashServ.dll) on Windows allow a local, unprivileged…N/AN/AN/ANov 6, 2026
CVE-2026-123792: sensiolabs symfony: The Symfony Yaml components Inline and Parser, parse some YAML documents inefficiently, so that a small crafted…N/A8.7 HighN/ANov 6, 2026
CVE-2026-123676: xxyopen, 201206030 novel: A vulnerability has been found in xxyopen/201206030 novel up to 3.5.05.3 Medium5.5 MediumN/ANov 6, 2026
CVE-2026-123623: gridaco grida: Grida through 0.0.24 contains a missing authorization vulnerability in the Forms file-preview API routes that allows…5.9 Medium8.2 HighN/ANov 6, 2026
CVE-2026-121881: Posit Software, PBC Posit Workbench: SQL injection vulnerability in the get_last_seen code-server session-state RPC in Posit Software, PBC Posit Workbench…N/A5.7 MediumN/ANov 6, 2026
CVE-2026-121880: Posit Software, PBC: Authorization bypass through user-controlled key in the localhost port-proxy (/p/<token>/) in Posit Software, PBC…N/A4.7 MediumN/ANov 6, 2026
CVE-2026-121623: sensiolabs symfony: The Symfony Serializer component DataUriNormalizer::denormalize() matches the data: scheme with a case-sensitive…N/A8.2 HighN/ANov 6, 2026
CVE-2026-123855: JetBrains Toolbox App: In JetBrains Toolbox App before 3.6.1 command injection was possible via enterprise configuration URLs7.5 HighN/AN/ANov 6, 2026
CVE-2026-123854: JetBrains PyCharm: In JetBrains PyCharm before 2026.3 code execution was possible in Safe Mode via a crafted Jupyter notebook widget module5.5 MediumN/AN/ANov 6, 2026
CVE-2026-123853: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via project-controlled JVM…7.8 HighN/AN/ANov 6, 2026
CVE-2026-123849: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File…7.0 HighN/AN/ANov 6, 2026
CVE-2026-123848: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3 host name verification was missing for server TLS certificates7.4 HighN/AN/ANov 6, 2026
CVE-2026-123847: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3 command execution was possible via control characters in terminal command…5.3 MediumN/AN/ANov 6, 2026
CVE-2026-123841: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings archive7.8 HighN/AN/ANov 6, 2026
CVE-2026-123838: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer form file7.8 HighN/AN/ANov 6, 2026
426-450 of 425038
‹›