The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-88249: Microsoft: Use after free in Windows Client for NFS allows an unauthorized attacker to execute code over a network.8.8 HighN/AN/ANov 10, 2026
CVE-2026-88247: Microsoft: Use of uninitialized resource in Windows Program Compatibility Assistant Service allows an authorized attacker to…5.5 MediumN/AN/ANov 10, 2026
CVE-2026-88245: Microsoft: Missing authentication for critical function in Windows Brokering File System allows an authorized attacker to elevate…7.8 HighN/AN/ANov 10, 2026
CVE-2026-88244: Microsoft: Use after free in Windows Link Layer Topology Discovery Protocol allows an unauthorized attacker to execute code over…7.5 HighN/AN/ANov 10, 2026
CVE-2026-88243: Microsoft: Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to execute code over a network.9.8 CriticalN/AN/ANov 10, 2026
CVE-2026-88242: Microsoft: Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges…7.0 HighN/AN/ANov 10, 2026
CVE-2026-88241: Microsoft: Heap-based buffer overflow in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.7.8 HighN/AN/ANov 10, 2026
CVE-2026-88240: Microsoft: Heap-based buffer overflow in Windows DHCP Client allows an authorized attacker to elevate privileges over an adjacent…8.0 HighN/AN/ANov 10, 2026
CVE-2026-88239: Microsoft: Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.7.8 HighN/AN/ANov 10, 2026
CVE-2026-88238: Microsoft: Heap-based buffer overflow in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges…7.8 HighN/AN/ANov 10, 2026
CVE-2026-88237: Microsoft: Use after free in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.7.0 HighN/AN/ANov 10, 2026
CVE-2026-88236: Microsoft: Null pointer dereference in Microsoft QUIC allows an unauthorized attacker to deny service over a network.7.5 HighN/AN/ANov 10, 2026
CVE-2026-88235: Microsoft: Unintended proxy or intermediary ('confused deputy') in Servicing Stack Updates allows an authorized attacker to…7.8 HighN/AN/ANov 10, 2026
CVE-2026-88234: Microsoft: Release of invalid pointer or reference in Windows iSCSI allows an unauthorized attacker to execute code over a network.9.8 CriticalN/AN/ANov 10, 2026
CVE-2026-88233: Microsoft: Improper authorization in Windows Task Scheduler allows an authorized attacker to elevate privileges locally.7.8 HighN/AN/ANov 10, 2026
CVE-2026-88232: Microsoft: Use after free in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges locally.7.8 HighN/AN/ANov 10, 2026
CVE-2026-88231: Microsoft: Out-of-bounds read in Windows iSCSI allows an authorized attacker to disclose information over a network.5.7 MediumN/AN/ANov 10, 2026
CVE-2026-88230: Microsoft: Heap-based buffer overflow in Windows LUAFV allows an authorized attacker to elevate privileges locally.7.8 HighN/AN/ANov 10, 2026
CVE-2026-88229: Microsoft: Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network.8.8 HighN/AN/ANov 10, 2026
CVE-2026-88228: Microsoft: Heap-based buffer overflow in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker…7.0 HighN/AN/ANov 10, 2026
CVE-2026-88227: Microsoft: Heap-based buffer overflow in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker…7.8 HighN/AN/ANov 10, 2026
CVE-2026-88224: Microsoft: Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized…7.0 HighN/AN/ANov 10, 2026
CVE-2026-88222: Microsoft: Heap-based buffer overflow in Microsoft WDAC OLE DB provider for SQL allows an unauthorized attacker to execute code…8.8 HighN/AN/ANov 10, 2026
CVE-2026-88221: Microsoft: Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.7.0 HighN/AN/ANov 10, 2026
CVE-2026-88220: Microsoft: Buffer over-read in Windows Performance Counters allows an authorized attacker to disclose information locally.5.5 MediumN/AN/ANov 10, 2026
651-675 of 557027