The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2024-4989: WSO2 WSO2 API Manager: The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by…5.4 MediumN/AN/AOct 21, 2026
CVE-2026-97313: ISC BIND 9: A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0)…7.5 HighN/AN/AOct 21, 2026
CVE-2026-96888: ISC BIND 9: A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an…7.5 HighN/AN/AOct 21, 2026
CVE-2026-94300: ISC BIND 9: Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`"8.1 HighN/AN/AOct 21, 2026
CVE-2026-90484: Apache Software Foundation Apache bRPC: The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a…N/AN/AN/AOct 21, 2026
CVE-2026-87849: Apache Software Foundation Apache bRPC: The Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) calls RapidJSON object-only accessors…N/AN/AN/AOct 21, 2026
CVE-2026-86249: Apache Software Foundation Apache bRPC: On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internal_port, the HTTP built-in service…N/AN/AN/AOct 21, 2026
CVE-2026-86147: Apache Software Foundation Apache bRPC: External control of file name or path and uncontrolled resource consumption in Apache bRPC (version < 1.18.0) on all…N/AN/AN/AOct 21, 2026
CVE-2026-86146: Apache Software Foundation Apache bRPC: Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) in the bundled HTTP/1.1 parser of Apache…N/AN/AN/AOct 21, 2026
CVE-2026-84748: Apache Software Foundation Apache bRPC: Improper authorization in Apache bRPC (versions < 1.18.0) on all platforms allows remote attackers to access builtin…N/AN/AN/AOct 21, 2026
CVE-2026-84747: Apache Software Foundation Apache bRPC: Interpretation conflict in the HTTP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows…N/AN/AN/AOct 21, 2026
CVE-2026-84727: Apache Software Foundation Apache bRPC: Use-after-free in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows a…5.4 MediumN/AN/AOct 21, 2026
CVE-2026-82953: Apache Software Foundation Apache bRPC: NULL pointer dereference in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows…N/AN/AN/AOct 21, 2026
CVE-2026-82942: Apache Software Foundation Apache bRPC: A data race in the RDMA transport of Apache bRPC (versions < 1.18.0) allows a remote client to crash the server process…N/AN/AN/AOct 21, 2026
CVE-2026-82425: Apache Software Foundation Apache bRPC: A reachable assertion in Apache bRPC (version < 1.18.0) on all platforms allows a malicious remote peer to crash the…N/AN/AN/AOct 21, 2026
CVE-2026-82231: Apache Software Foundation Apache bRPC: A Thrift client in Apache bRPC (version < 1.18.0, built with WITH_THRIFT which is off by default) can be crashed by the…N/AN/AN/AOct 21, 2026
CVE-2026-82230: Apache Software Foundation Apache bRPC: Uncontrolled recursion in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote…7.5 HighN/AN/AOct 21, 2026
CVE-2026-82210: Apache Software Foundation Apache bRPC: Enforceable assertion in the streaming feature of Apache bRPC (version < 1.18.0) on all platforms allows a remote…N/AN/AN/AOct 21, 2026
CVE-2026-19630: ISC BIND 9: In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing,…7.5 HighN/AN/AOct 21, 2026
CVE-2026-114407: e107inc e107: e107 CMS before 2.3.13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to…6.1 Medium5.1 MediumN/AOct 21, 2026
CVE-2026-114405: Velneo vServer: Improper validation of array index vulnerability in Velneo vServerN/A8.7 HighN/AOct 21, 2026
CVE-2026-114404: PHPOffice PHPPresentation: PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers…6.1 Medium5.3 MediumN/AOct 21, 2026
CVE-2026-114403: PHPOffice PHPPresentation: PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to…8.1 High9.2 CriticalN/AOct 21, 2026
CVE-2026-114402: polonel trudesk: Trudesk through 1.2.11 contains a path traversal and authorization bypass vulnerability in…4.3 Medium5.3 MediumN/AOct 21, 2026
CVE-2026-114401: polonel trudesk: Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to…5.3 Medium6.9 MediumN/AOct 21, 2026
576-600 of 564809
‹›