The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-105667: Missing Authentication for Critical Function7.5 High8.7 High0%Oct 16, 2026
CVE-2026-105279: Missing Authentication for Critical Function9.1 Critical9.3 Critical0%Oct 16, 2026
CVE-2026-105273: Loop with Unreachable Exit Condition7.5 High8.7 High0%Oct 16, 2026
CVE-2026-101021: Inefficient Algorithmic Complexity7.5 High8.7 High0%Oct 16, 2026
CVE-2025-52097: n/a: Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary…N/AN/A0%Oct 16, 2026
CVE-2026-97858: Improperly Controlled Modification of Dynamically-Determined Object Attributes5.3 Medium6.9 Medium0%Oct 16, 2026
CVE-2026-97470: Improper Neutralization of Input During Web Page Generation6.4 MediumN/A0%Oct 16, 2026
CVE-2026-90821: Improper Neutralization of Input During Web Page Generation5.4 MediumN/A0%Oct 16, 2026
CVE-2026-18516: Improper Encoding or Escaping of Output9.6 CriticalN/A0%Oct 16, 2026
CVE-2026-111593: Undefined Security WeaknessN/AN/AN/AOct 16, 2026
CVE-2026-111413: Cross-Site Request Forgery (CSRF)8.8 HighN/A0%Oct 16, 2026
CVE-2026-110806: Incorrect Authorization6.5 MediumN/A0%Oct 16, 2026
CVE-2026-110805: Server-Side Request Forgery (SSRF)2.6 LowN/A0%Oct 16, 2026
CVE-2026-110804: Improperly Controlled Modification of Dynamically-Determined Object Attributes4.3 MediumN/A0%Oct 16, 2026
CVE-2026-110287: Incorrect Authorization4.3 MediumN/A0%Oct 16, 2026
CVE-2026-107617: Use of Hard-coded Credentials9.8 Critical9.3 Critical0%Oct 16, 2026
CVE-2026-105664: Observable Response Discrepancy5.3 Medium6.9 Medium0%Oct 16, 2026
CVE-2026-68571: Improper Control of Generation of Code8.8 HighN/A0%Oct 16, 2026
CVE-2026-64959: Improper Neutralization of Special Elements used in an SQL Command9.8 CriticalN/A0%Oct 16, 2026
CVE-2026-64610: Deserialization of Untrusted Data9.8 CriticalN/A0%Oct 16, 2026
CVE-2026-63619: Missing Authorization9.1 CriticalN/A0%Oct 16, 2026
CVE-2026-63618: Exposure of Sensitive Information to an Unauthorized Actor7.5 HighN/A0%Oct 16, 2026
CVE-2026-111555: Improper Validation of Specified Index, Position, or Offset in Input6.0 MediumN/A0%Oct 16, 2026
CVE-2026-111409: Missing Authorization5.3 MediumN/A0%Oct 16, 2026
CVE-2026-111405: Improper Neutralization of Input During Web Page Generation6.5 MediumN/A0%Oct 16, 2026
4976-5000 of 530113
‹›