The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-115353: lepture mistune: Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read…8.6 High9.2 Critical0%Oct 22, 2026
CVE-2026-115352: lepture mistune: Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows…7.5 High8.7 High0%Oct 22, 2026
CVE-2026-115351: lepture mistune: Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input…4.7 Medium5.3 Medium0%Oct 22, 2026
CVE-2026-115350: lepture mistune: Mistune before 3.3.0 contains a cross-site scripting vulnerability in the Include directive that emits included .html,…6.1 Medium5.3 Medium0%Oct 22, 2026
CVE-2026-115349: lepture mistune: Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the…7.5 High8.7 High0%Oct 22, 2026
CVE-2026-115348: lepture mistune: Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's…7.5 High8.7 High0%Oct 22, 2026
CVE-2026-115347: lepture mistune: Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote…7.5 High8.7 High0%Oct 22, 2026
CVE-2026-114655: MongoDB libmongocrypt: libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key…5.9 Medium6.0 Medium0%Oct 22, 2026
CVE-2026-114654: MongoDB C# Driver: A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range binary…6.5 Medium6.9 Medium0%Oct 22, 2026
CVE-2026-114653: MongoDB C# Driver: A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field…6.5 Medium7.1 High0%Oct 22, 2026
CVE-2026-114652: MongoDB C# Driver: A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can…6.5 Medium7.1 High0%Oct 22, 2026
CVE-2026-114651: MongoDB C# Driver: A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from…4.0 Medium6.3 Medium0%Oct 22, 2026
CVE-2026-114650: MongoDB: A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data designated for client-side…5.9 Medium6.9 Medium0%Oct 22, 2026
CVE-2026-114649: MongoDB C# Driver: The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two…6.8 Medium7.6 High0%Oct 22, 2026
CVE-2026-114648: MongoDB C# Driver: The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter…7.6 High7.2 High0%Oct 22, 2026
CVE-2026-114647: MongoDB C# Driver: The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar sign in…4.3 Medium5.3 Medium0%Oct 22, 2026
CVE-2026-114646: MongoDB C# Driver: A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C# Driver6.5 Medium6.9 Medium0%Oct 22, 2026
CVE-2026-114645: MongoDB C Driver: A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an…5.2 Medium5.7 Medium0%Oct 22, 2026
CVE-2026-114644: MongoDB C# Driver: The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization…5.9 Medium8.2 High0%Oct 22, 2026
CVE-2026-114643: MongoDB C# Driver: The MongoDB C# Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON…5.4 Medium5.3 Medium0%Oct 22, 2026
CVE-2026-114613: msgpack msgpack-python: MessagePack is the serializer implementation for Python msgpack.org7.5 HighN/A0%Oct 22, 2026
CVE-2026-114612: BerriAI litellm: LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format9.9 CriticalN/A0%Oct 22, 2026
CVE-2026-114519: Roskus Prospero Flow CRM: Missing Authorization (CWE-862) in the user API of Roskus Prospero Flow CRM from 2.0.0 before 5.26.0 allows a user with…N/A8.6 High0%Oct 22, 2026
CVE-2026-113876: SmileCDR HAPI FHIR: SmileCDR HAPI FHIR does not correctly check authorization for conditional create actions4.3 Medium5.3 Medium0%Oct 22, 2026
CVE-2026-113875: SmileCDR HAPI FHIR: On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, if a user is granted subscription-creation…3.1 Low2.3 Low0%Oct 22, 2026
626-650 of 412045
‹›