The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-88210: Microsoft: Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass…7.8 HighN/AN/AOct 13, 2026
CVE-2026-88178: Microsoft: Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.9.8 CriticalN/AN/AOct 13, 2026
CVE-2026-88156: Microsoft: Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.9.8 CriticalN/AN/AOct 13, 2026
CVE-2026-88143: Microsoft: Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges…6.7 MediumN/AN/AOct 13, 2026
CVE-2026-88102: Microsoft: Use after free in Windows Failover Cluster allows an unauthorized attacker to execute code over a network.9.8 CriticalN/AN/AOct 13, 2026
CVE-2026-88100: Microsoft: Use after free in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.7.8 HighN/AN/AOct 13, 2026
CVE-2026-88092: Microsoft: Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized…9.4 CriticalN/AN/AOct 13, 2026
CVE-2026-88075: Microsoft: Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager…8.8 HighN/AN/AOct 13, 2026
CVE-2026-88074: Microsoft: Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to…7.8 HighN/AN/AOct 13, 2026
CVE-2026-87699: Microsoft: Heap-based buffer overflow in Winlogon allows an authorized attacker to elevate privileges locally.7.8 HighN/AN/AOct 13, 2026
CVE-2026-87697: Microsoft: Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.8.8 HighN/AN/AOct 13, 2026
CVE-2026-87696: Microsoft: Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate…7.5 HighN/AN/AOct 13, 2026
CVE-2026-87695: Microsoft: Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to…7.8 HighN/AN/AOct 13, 2026
CVE-2026-86063: anthropics claude-code: Claude Code is an agentic coding toolN/A7.5 HighN/AOct 13, 2026
CVE-2026-85928: Microsoft: Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an unauthorized attacker to execute code…9.8 CriticalN/AN/AOct 13, 2026
CVE-2026-85927: Microsoft: Heap-based buffer overflow in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to…7.8 HighN/AN/AOct 13, 2026
CVE-2026-85922: Microsoft: Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network.7.4 HighN/AN/AOct 13, 2026
CVE-2026-85918: Microsoft: Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate…7.0 HighN/AN/AOct 13, 2026
CVE-2026-85884: Microsoft: Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized…7.8 HighN/AN/AOct 13, 2026
CVE-2026-85879: Microsoft Windows Subsystem for Linux (WSL2): Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an authorized attacker to…7.0 HighN/AN/AOct 13, 2026
CVE-2026-85865: Microsoft: Improper authentication in Windows DHCP Server allows an authorized attacker to bypass a security feature locally.5.5 MediumN/AN/AOct 13, 2026
CVE-2026-85863: Microsoft: Use after free in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.7.8 HighN/AN/AOct 13, 2026
CVE-2026-85861: Microsoft: Use after free in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.7.8 HighN/AN/AOct 13, 2026
CVE-2026-85856: Microsoft: Heap-based buffer overflow in Windows Internet Connection Sharing (ICS) allows an authorized attacker to execute code…7.1 HighN/AN/AOct 13, 2026
CVE-2026-85834: Microsoft: Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally.7.0 HighN/AN/AOct 13, 2026
526-550 of 417606
‹›