The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-85825: Microsoft: Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate…7.0 HighN/AN/AOct 13, 2026
CVE-2026-85820: Microsoft: Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate…7.8 HighN/AN/AOct 13, 2026
CVE-2026-85818: Microsoft: Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to perform…9.0 CriticalN/AN/AOct 13, 2026
CVE-2026-85814: Microsoft: Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a…9.8 CriticalN/AN/AOct 13, 2026
CVE-2026-85810: Microsoft: Use after free in Windows Telephony Server allows an authorized attacker to elevate privileges locally.7.0 HighN/AN/AOct 13, 2026
CVE-2026-85809: Microsoft: Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized…9.8 CriticalN/AN/AOct 13, 2026
CVE-2026-85807: Microsoft: Integer overflow or wraparound in Windows USB Video Driver allows an authorized attacker to elevate privileges locally.7.8 HighN/AN/AOct 13, 2026
CVE-2026-85805: Microsoft: Improperly implemented security check for standard in Windows PowerShell allows an unauthorized attacker to bypass a…6.5 MediumN/AN/AOct 13, 2026
CVE-2026-85802: Microsoft: Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.7.0 HighN/AN/AOct 13, 2026
CVE-2026-85795: Microsoft: Use after free in Windows Text Services Framework allows an authorized attacker to elevate privileges locally.7.8 HighN/AN/AOct 13, 2026
CVE-2026-85792: Microsoft: Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized…9.8 CriticalN/AN/AOct 13, 2026
CVE-2026-85747: distribution: Distribution is a toolkit to pack, ship, store, and deliver container content6.8 MediumN/AN/AOct 13, 2026
CVE-2026-85375: Microsoft: Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate…7.8 HighN/AN/AOct 13, 2026
CVE-2026-85373: Microsoft: Heap-based buffer overflow in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to…7.8 HighN/AN/AOct 13, 2026
CVE-2026-85368: Microsoft: Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally.7.8 HighN/AN/AOct 13, 2026
CVE-2026-85363: Microsoft: Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network.8.8 HighN/AN/AOct 13, 2026
CVE-2026-85356: Microsoft: Out-of-bounds read in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges…7.8 HighN/AN/AOct 13, 2026
CVE-2026-85341: Microsoft: Heap-based buffer overflow in Windows USB Video Driver allows an authorized attacker to elevate privileges locally.7.8 HighN/AN/AOct 13, 2026
CVE-2026-85329: Microsoft: Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Account allows…7.0 HighN/AN/AOct 13, 2026
CVE-2026-85323: Microsoft: Weak authentication in Network Device Enrollment Service (NDES) allows an authorized attacker to perform spoofing over…6.8 MediumN/AN/AOct 13, 2026
CVE-2026-84994: QwikDev, @builder.io qwik: Qwik is a performance-focused JavaScript frameworkN/A8.7 HighN/AOct 13, 2026
CVE-2026-84015: Microsoft: Heap-based buffer overflow in Remote Access Point-to-Point Protocol (PPP) EAP-TLS allows an unauthorized attacker to…9.8 CriticalN/AN/AOct 13, 2026
CVE-2026-84013: Microsoft: Use after free in Windows Telephony Server allows an authorized attacker to elevate privileges locally.7.8 HighN/AN/AOct 13, 2026
CVE-2026-84011: Microsoft: Incorrect authorization in Windows SMB Client allows an authorized attacker to bypass a security feature locally.5.5 MediumN/AN/AOct 13, 2026
CVE-2026-84008: Microsoft: Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.7.5 HighN/AN/AOct 13, 2026
551-575 of 417606
‹›