The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-114614: authlib: Authlib is a Python library which builds OAuth and OpenID Connect servers2.6 LowN/AN/AOct 22, 2026
CVE-2026-114583: Python Software Foundation CPython: tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names,…N/A6.9 MediumN/AOct 22, 2026
CVE-2026-114625: Arista Networks VeloCloud Orchestrator: VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access…9.9 Critical9.4 CriticalN/AOct 22, 2026
CVE-2026-115417: AWS aws-c-mqtt: Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0.16.2…7.5 High8.2 HighN/AOct 22, 2026
CVE-2026-115419: AWS: The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 and Amazon Strands Agents SDK for…8.1 High8.6 HighN/AOct 22, 2026
CVE-2026-112332: GDATASoftwareAG motornet: Motor.NET before 0.19.0 contains an uncaught exception vulnerability in JsonNetDeserializer.Deserialize that allows a…7.5 High8.7 HighN/AOct 22, 2026
CVE-2026-112331: GDATASoftwareAG motornet: Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produce…7.5 High8.7 HighN/AOct 22, 2026
CVE-2026-112330: GDATASoftwareAG motornet: Motor.NET before 0.19.0 contains a denial of service vulnerability that allows a remote attacker who can publish to a…7.5 High8.7 HighN/AOct 22, 2026
CVE-2026-115509: jitsucom jitsu: Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that…4.2 Medium2.3 LowN/AOct 22, 2026
CVE-2026-115508: unclecode crawl4ai: Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API…6.5 Medium7.1 HighN/AOct 22, 2026
CVE-2026-115507: go-vikunja vikunja: Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in…3.5 Low5.1 MediumN/AOct 22, 2026
CVE-2026-115506: libexpat: libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in…7.5 High8.7 HighN/AOct 22, 2026
CVE-2026-115505: sahlberg libsmb2: libsmb2 before 6.3 contains integer overflow vulnerabilities in the DCE/RPC NDR decoder in lib/dcerpc.c that allow heap…7.6 High7.2 HighN/AOct 22, 2026
CVE-2026-115504: HEASARC cfitsio: CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts…7.8 High8.5 HighN/AOct 22, 2026
CVE-2026-115503: NationalSecurityAgency ghidra: Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in…5.5 Medium6.8 MediumN/AOct 22, 2026
CVE-2026-115398: NationalSecurityAgency ghidra: Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSystemIndexHelper used by…5.5 Medium6.8 MediumN/AOct 22, 2026
CVE-2026-115397: NationalSecurityAgency ghidra: Ghidra before 12.2 contains a resource allocation without limits vulnerability in…5.5 Medium6.8 MediumN/AOct 22, 2026
CVE-2026-115396: NationalSecurityAgency ghidra: Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data vulnerability in…5.5 Medium6.8 MediumN/AOct 22, 2026
CVE-2026-115395: NationalSecurityAgency ghidra: Ghidra 10.3 before 12.2 contains a resource allocation without limits vulnerability in ThemeReader.readZipTheme() that…5.5 Medium6.8 MediumN/AOct 22, 2026
CVE-2026-114655: MongoDB libmongocrypt: libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key…5.9 Medium6.0 MediumN/AOct 22, 2026
CVE-2026-115394: NationalSecurityAgency ghidra: Ghidra through 12.2 contains an uncontrolled memory allocation vulnerability in BinaryField.read() that allows…5.5 Medium6.8 MediumN/AOct 22, 2026
CVE-2026-114654: MongoDB C# Driver: A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range binary…6.5 Medium6.9 MediumN/AOct 22, 2026
CVE-2026-115393: bytecodealliance wasmtime: Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 contains a type…3.8 Low1.0 LowN/AOct 22, 2026
CVE-2026-115392: bytecodealliance wasmtime: Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem…7.9 High8.8 HighN/AOct 22, 2026
CVE-2026-114653: MongoDB C# Driver: A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field…6.5 Medium7.1 HighN/AOct 22, 2026
26-50 of 416054
‹›