The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
CVE-2026-76461:Critical Cisco Secure Email Gateway Vulnerability Exploited in the Wild
Blog ↗CVE details
CVE-2026-85706:Critical GitLab Path Traversal Exploited in the Wild
Blog ↗CVE details
CVE-2026-83548:Critical SonicWall SMA1000 Vulnerabilities CVE-2026-83548, CVE-2026-83549 Exploited in the Wild
Blog ↗CVE details
CVE-2026-81578:PaperCut NG/MF Critical Zero-Day Exploited in the Wild
Blog ↗CVE details
CVE-2026-63520:Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520)
Blog ↗CVE details
CVE-2026-19490:Critical Vulnerability Affecting Citrix NetScaler ADC and NetScaler Gateway
Blog ↗CVE details
TitleEitWModules
CVE-2026-57879: Stack-based Buffer Overflow9.8 CriticalN/A1%Jun 26, 2026
CVE-2026-12527: Missing Authentication for Critical FunctionN/A6.0 Medium0%Jun 18, 2026
CVE-2026-8714: Improper Input Validation6.5 Medium7.1 High0%Jun 5, 2026
CVE-2026-1871: Stack-based Buffer Overflow6.5 Medium7.1 High0%Jun 2, 2026
CVE-2026-49129: Server-Side Request Forgery (SSRF)5.8 Medium6.9 Medium0%May 28, 2026
CVE-2026-41470: Incorrect Authorization5.9 Medium8.2 High0%May 19, 2026
CVE-2026-41417: Improper Neutralization of CRLF Sequences5.3 MediumN/A0%May 6, 2026
CVE-2026-6526: NULL Pointer Dereference5.5 MediumN/A0%Apr 30, 2026
CVE-2026-35903: Improper Authentication9.8 CriticalN/A0%Apr 27, 2026
CVE-2026-35902: Improper Restriction of Excessive Authentication Attempts6.2 MediumN/A0%Apr 27, 2026
CVE-2026-35901: Uncontrolled Resource Consumption4.4 MediumN/A0%Apr 27, 2026
CVE-2026-31256: NULL Pointer Dereference7.5 HighN/A0%Apr 27, 2026
CVE-2026-26340: Missing Authentication for Critical Function7.5 High8.7 High1%Feb 24, 2026
CVE-2025-15368: Improper Control of Filename for Include/Require Statement in PHP Program8.8 HighN/A1%Feb 4, 2026
CVE-2026-1110: Buffer Copy without Checking Size of Input5.3 Medium1.9 Low0%Jan 18, 2026
CVE-2026-1109: Buffer Copy without Checking Size of Input5.3 Medium1.9 Low0%Jan 18, 2026
CVE-2026-1108: Buffer Copy without Checking Size of Input5.3 Medium1.9 Low0%Jan 18, 2026
CVE-2025-66049: Missing Authentication for Critical Function7.5 High8.7 High0%Jan 9, 2026
CVE-2025-60458: Uncontrolled Resource Consumption6.5 MediumN/A0%Dec 29, 2025
CVE-2019-25248: Missing Authentication for Critical Function7.5 High8.7 High0%Dec 24, 2025
CVE-2018-25141: Missing Authentication for Critical Function7.5 High8.7 High0%Dec 24, 2025
CVE-2018-25139: Missing Authentication for Critical Function7.5 High8.7 High1%Dec 24, 2025
CVE-2025-65857: Exposure of Private Personal Information to an Unauthorized Actor7.5 HighN/A0%Dec 22, 2025
CVE-2025-14747: Improper Resource Shutdown or Release4.3 Medium2.1 Low1%Dec 16, 2025
CVE-2025-14746: Improper Authentication4.3 Medium2.1 Low1%Dec 16, 2025
26-50 of 206
‹›