The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
CVE-2026-76461:Critical Cisco Secure Email Gateway Vulnerability Exploited in the Wild
Blog ↗CVE details
CVE-2026-85706:Critical GitLab Path Traversal Exploited in the Wild
Blog ↗CVE details
CVE-2026-83548:Critical SonicWall SMA1000 Vulnerabilities CVE-2026-83548, CVE-2026-83549 Exploited in the Wild
Blog ↗CVE details
CVE-2026-81578:PaperCut NG/MF Critical Zero-Day Exploited in the Wild
Blog ↗CVE details
CVE-2026-63520:Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520)
Blog ↗CVE details
CVE-2026-19490:Critical Vulnerability Affecting Citrix NetScaler ADC and NetScaler Gateway
Blog ↗CVE details
TitleEitWModules
CVE-2024-35164: Improper Validation of Array Index6.8 MediumN/A0%Jul 2, 2025
CVE-2025-27024: Improper Handling of Insufficient Permissions or Privileges6.5 MediumN/A0%Jul 2, 2025
CVE-2025-24332: Authentication Bypass Using an Alternate Path or Channel7.1 HighN/A0%Jul 2, 2025
CVE-2025-5318: Out-of-bounds Read5.4 MediumN/A2%Jun 24, 2025
CVE-2025-24288: Initialization of a Resource with an Insecure Default9.8 CriticalN/A0%Jun 19, 2025
CVE-2025-23170: Improper Neutralization of Special Elements used in a Command6.7 MediumN/A1%Jun 19, 2025
CVE-2025-5689: Improper Privilege Management8.5 HighN/A0%Jun 16, 2025
CVE-2025-49091: Always-Incorrect Control Flow Implementation8.2 HighN/A1%Jun 11, 2025
CVE-2023-29184: Incomplete Cleanup3.2 LowN/A0%Jun 10, 2025
CVE-2025-49013: Improper Control of Generation of Code9.9 CriticalN/A1%Jun 9, 2025
CVE-2025-49599: Incorrect Authorization4.1 MediumN/A0%Jun 6, 2025
CVE-2025-20277: Improper Limitation of a Pathname to a Restricted Directory3.4 LowN/A0%Jun 4, 2025
CVE-2025-20261: Improper Restriction of Communication Channel to Intended Endpoints8.8 HighN/A0%Jun 4, 2025
CVE-2025-20163: Key Exchange without Entity Authentication8.7 HighN/A0%Jun 4, 2025
CVE-2025-41438: Initialization of a Resource with an Insecure Default9.8 Critical9.3 Critical1%May 30, 2025
CVE-2025-41380: Use of Hard-coded CredentialsN/A6.1 Medium0%May 23, 2025
CVE-2025-48416: Hidden Functionality8.1 HighN/A1%May 21, 2025
CVE-2025-48415: Exposed Dangerous Method or Function6.2 MediumN/A0%May 21, 2025
CVE-2025-48413: Use of Hard-coded Credentials7.7 HighN/A0%May 21, 2025
CVE-2024-57273: Improper Neutralization of Input During Web Page GenerationN/AN/A1%May 14, 2025
CVE-2025-4658: Authentication Bypass by Primary Weakness9.8 Critical9.3 Critical0%May 13, 2025
CVE-2025-28202: Missing Authorization8.8 HighN/A1%May 9, 2025
CVE-2025-46712: Expected Behavior Violation3.7 LowN/A1%May 8, 2025
CVE-2025-36546: Incorrect Authorization8.1 High9.2 Critical0%May 7, 2025
CVE-2025-47203: Improper Neutralization of Special Elements used in an OS Command4.5 MediumN/A1%May 7, 2025
601-625 of 1961
‹›