The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-108537: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.N/AN/AN/AOct 23, 2026
CVE-2026-115938: craftcms cms: Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is…8.8 High8.7 HighN/AOct 23, 2026
CVE-2026-115937: craftcms commerce-mollie: The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong…7.5 High8.7 HighN/AOct 23, 2026
CVE-2026-115935: craftcms cms: The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control…8.8 High8.7 HighN/AOct 23, 2026
CVE-2026-115897: yahoo serialize-javascript: Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functionsN/A2.1 LowN/AOct 23, 2026
CVE-2026-115895: capricorn86 happy-dom: Happy DOM is a JavaScript implementation of a web browser without its graphical user interface8.8 HighN/AN/AOct 23, 2026
CVE-2026-115893: bytecodealliance wasmtime: Wasmtime is a runtime for WebAssembly9.9 CriticalN/AN/AOct 23, 2026
CVE-2026-115892: bytecodealliance wasmtime: Wasmtime is a runtime for WebAssemblyN/A5.7 MediumN/AOct 23, 2026
CVE-2026-115889: bytecodealliance wasmtime: Wasmtime is a runtime for WebAssembly9.9 CriticalN/AN/AOct 23, 2026
CVE-2026-115887: graphql-hive graphql-scalars: GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas7.5 HighN/AN/AOct 23, 2026
CVE-2026-115886: mlflow: MLflow is an open source AI engineering platform for agents, large language models, and machine learning models6.5 MediumN/AN/AOct 23, 2026
CVE-2026-115885: langchain-ai langgraph: The LangGraph CLI is the official command-line interface for LangGraphN/A4.1 MediumN/AOct 23, 2026
CVE-2026-115883: langchain-ai: LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and agentsN/A6.0 MediumN/AOct 23, 2026
CVE-2026-115801: Kakao khaiii: A security flaw has been discovered in Kakao khaiii up to 0.45.3 Medium1.9 LowN/AOct 23, 2026
CVE-2026-83813: twisted: Twisted is an event-based framework for internet applications, supporting Python 3.6+3.1 LowN/AN/AOct 23, 2026
CVE-2026-75525: open-reception appointment-booking-software: OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform5.3 MediumN/AN/AOct 23, 2026
CVE-2026-75524: open-reception appointment-booking-software: OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform5.4 MediumN/AN/AOct 23, 2026
CVE-2026-65825: open-reception appointment-booking-software: OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform7.5 HighN/AN/AOct 23, 2026
CVE-2026-65824: open-reception appointment-booking-software: OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform7.4 HighN/AN/AOct 23, 2026
CVE-2026-58202: open-reception appointment-booking-software: OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform8.3 HighN/AN/AOct 23, 2026
CVE-2026-57849: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.N/AN/AN/AOct 23, 2026
CVE-2026-115877: twisted: Twisted is an event-based framework for internet applications, supporting Python 3.6+5.4 MediumN/AN/AOct 23, 2026
CVE-2026-115800: UbiquitousLearning mllm: A vulnerability was identified in UbiquitousLearning mllm up to 2.0.25.3 Medium1.9 LowN/AOct 23, 2026
CVE-2026-115778: twisted: Twisted is an event-based framework for internet applications, supporting Python 3.6+7.5 HighN/AN/AOct 23, 2026
CVE-2026-115776: twisted: Twisted is an event-based framework for internet applications, supporting Python 3.6+7.5 HighN/AN/AOct 23, 2026
26-50 of 413321
‹›