The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-79978: zephyrproject zephyr: The RTIO streaming completion callback adxl345_process_fifo_samples_cb() in drivers/sensor/adi/adxl345/adxl345_stream.c…3.6 LowN/AN/AOct 23, 2026
CVE-2026-79977: zephyrproject zephyr: The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not…8.2 HighN/AN/AOct 23, 2026
CVE-2026-19741: zephyrproject zephyr: Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with default "J01NME" in…7.5 HighN/AN/AOct 23, 2026
CVE-2026-115796: Tenda F6: A security flaw has been discovered in Tenda F6 12.02.01.734.3 Medium2.1 LowN/AOct 23, 2026
CVE-2026-115585: py-pdf pypdf: pypdf is a free and open-source pure-python PDF libraryN/A7.1 HighN/AOct 23, 2026
CVE-2026-115580: py-pdf pypdf: pypdf is a free and open-source pure-python PDF libraryN/A7.1 HighN/AOct 23, 2026
CVE-2026-115572: py-pdf pypdf: pypdf is a free and open-source pure-python PDF libraryN/A7.1 HighN/AOct 23, 2026
CVE-2026-91093: HP Inc. HP One Agent Software: A potential security vulnerability has been identified in HP One Agent for certain HP PC products, which might allow…N/A8.5 HighN/AOct 23, 2026
CVE-2026-115570: electron: Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS7.4 HighN/AN/AOct 23, 2026
CVE-2026-115569: fallow-rs, @fallow-cli: Fallow is a codebase intelligence tool for TypeScript and JavaScript3.3 LowN/AN/AOct 23, 2026
CVE-2026-112342: Tandoor Recipes: Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_helper.py that allows…7.1 High7.1 HighN/AOct 23, 2026
CVE-2026-115845: AWS AWS MCP Server: An incomplete list of disallowed inputs in the Python code validator of the run_script tool in AWS MCP Server might…6.4 Medium5.3 MediumN/AOct 23, 2026
CVE-2026-115863: ConnMan: ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message7.6 HighN/AN/AOct 23, 2026
CVE-2026-115813: AWS multi-model-server: Server-side request forgery in the model download path in Amazon Web Services Multi Model Server 1.1.11 and earlier…5.8 Medium6.9 MediumN/AOct 23, 2026
CVE-2026-115812: AWS multi-model-server: Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier…9.8 Critical9.3 CriticalN/AOct 23, 2026
CVE-2026-115567: tokio-rs tokio: Tokio is a runtime for writing applications with RustN/A5.8 MediumN/AOct 23, 2026
CVE-2026-110975: A flaw was found in Kruize Autotune7.4 HighN/AN/AOct 23, 2026
CVE-2026-87901: phpBB: Improper sanitization in the registration module allows reflected Cross-Site Scripting.8.3 HighN/AN/AOct 23, 2026
CVE-2026-115810: TandoorRecipes recipes: Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows…7.7 High6.3 MediumN/AOct 23, 2026
CVE-2026-106074: nodejs node: A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`,…4.8 MediumN/AN/AOct 23, 2026
CVE-2026-106073: nodejs node: A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read…3.3 LowN/AN/AOct 23, 2026
CVE-2026-106072: nodejs node: A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint…6.7 MediumN/AN/AOct 23, 2026
CVE-2026-106071: nodejs node: A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard…3.6 LowN/AN/AOct 23, 2026
CVE-2026-106070: nodejs node: A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after…3.7 LowN/AN/AOct 23, 2026
CVE-2026-106069: nodejs node: A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP…7.4 HighN/AN/AOct 23, 2026
26-50 of 413321
‹›