The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-114651: MongoDB C# Driver: A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from…4.0 Medium6.3 Medium0%Oct 22, 2026
CVE-2026-114650: MongoDB: A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data designated for client-side…5.9 Medium6.9 Medium0%Oct 22, 2026
CVE-2026-114649: MongoDB C# Driver: The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two…6.8 Medium7.6 High0%Oct 22, 2026
CVE-2026-114648: MongoDB C# Driver: The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter…7.6 High7.2 High0%Oct 22, 2026
CVE-2026-114647: MongoDB C# Driver: The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar sign in…4.3 Medium5.3 Medium0%Oct 22, 2026
CVE-2026-114646: MongoDB C# Driver: A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C# Driver6.5 Medium6.9 Medium0%Oct 22, 2026
CVE-2026-114645: MongoDB C Driver: A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an…5.2 Medium5.7 Medium0%Oct 22, 2026
CVE-2026-114644: MongoDB C# Driver: The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization…5.9 Medium8.2 High0%Oct 22, 2026
CVE-2026-114643: MongoDB C# Driver: The MongoDB C# Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON…5.4 Medium5.3 Medium0%Oct 22, 2026
CVE-2026-114613: msgpack msgpack-python: MessagePack is the serializer implementation for Python msgpack.org7.5 HighN/A0%Oct 22, 2026
CVE-2026-114612: BerriAI litellm: LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format9.9 CriticalN/A0%Oct 22, 2026
CVE-2026-114519: Roskus Prospero Flow CRM: Missing Authorization (CWE-862) in the user API of Roskus Prospero Flow CRM from 2.0.0 before 5.26.0 allows a user with…N/A8.6 High0%Oct 22, 2026
CVE-2026-113876: SmileCDR HAPI FHIR: SmileCDR HAPI FHIR does not correctly check authorization for conditional create actions4.3 Medium5.3 Medium0%Oct 22, 2026
CVE-2026-113875: SmileCDR HAPI FHIR: On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, if a user is granted subscription-creation…3.1 Low2.3 Low0%Oct 22, 2026
CVE-2025-69723: n/a: A reflected cross-site scripting (XSS) vulnerability in localstack v4.9.2 allows attackers to execute arbitrary…N/AN/A0%Oct 22, 2026
CVE-2025-65200: n/a: An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on…N/AN/A0%Oct 22, 2026
CVE-2022-51026: bytebase: Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to…9.8 Critical9.3 Critical1%Oct 22, 2026
CVE-2026-95721: Hewlett Packard Enterprise (HPE) ArubaOS (AOS): A memory corruption vulnerability exists in the web-based management interface of AOS-83.3 LowN/A0%Oct 22, 2026
CVE-2026-95720: Hewlett Packard Enterprise (HPE) ArubaOS (AOS): A buffer overflow vulnerability exists in AOS-8 that could allow an authenticated attacker with administrative access…4.4 MediumN/A0%Oct 22, 2026
CVE-2026-95719: Hewlett Packard Enterprise (HPE) ArubaOS (AOS): An arbitrary file deletion vulnerability exists in the command line interface of AOS-10 that could allow an…4.9 MediumN/A0%Oct 22, 2026
CVE-2026-95718: Hewlett Packard Enterprise (HPE) ArubaOS (AOS): An authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated remote attacker to…5.3 MediumN/A0%Oct 22, 2026
CVE-2026-95717: Hewlett Packard Enterprise (HPE) ArubaOS (AOS): A stored cross-site scripting (XSS) vulnerability exists in the web-based management interface of AOS that could allow…5.5 MediumN/A0%Oct 22, 2026
CVE-2026-95716: Hewlett Packard Enterprise (HPE) ArubaOS (AOS): An authentication bypass in the PAPI protocol of AOS-10 allows an unauthenticated adjacent attacker to circumvent…6.5 MediumN/A0%Oct 22, 2026
CVE-2026-95715: Hewlett Packard Enterprise (HPE) ArubaOS (AOS): An unauthenticated command injection vulnerability exists in the command line interface of AOS-106.8 MediumN/A0%Oct 22, 2026
CVE-2026-95714: Hewlett Packard Enterprise (HPE) ArubaOS (AOS): A buffer overflow vulnerability exists in the API of AOS-10 that could allow an authenticated adjacent attacker with…6.8 MediumN/A0%Oct 22, 2026
651-675 of 413119
‹›