The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-70285: Microsoft: Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges…7.8 HighN/AN/AOct 13, 2026
CVE-2026-70279: Microsoft: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server…9.3 CriticalN/AN/AOct 13, 2026
CVE-2026-70273: Microsoft: Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.7.0 HighN/AN/AOct 13, 2026
CVE-2026-70271: Microsoft: Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.7.0 HighN/AN/AOct 13, 2026
CVE-2026-70255: Microsoft: Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.7.8 HighN/AN/AOct 13, 2026
CVE-2026-70253: Microsoft: Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.7.0 HighN/AN/AOct 13, 2026
CVE-2026-70249: Microsoft: Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.7.0 HighN/AN/AOct 13, 2026
CVE-2026-70247: Microsoft: Out-of-bounds read in Windows HTTP.sys allows an authorized attacker to execute code locally.7.8 HighN/AN/AOct 13, 2026
CVE-2026-70242: Microsoft: Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.9.8 CriticalN/AN/AOct 13, 2026
CVE-2026-70238: Microsoft: Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges…7.8 HighN/AN/AOct 13, 2026
CVE-2026-70236: Microsoft: Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.7.0 HighN/AN/AOct 13, 2026
CVE-2026-70235: Microsoft: Improper authentication in Windows Event Tracing allows an authorized attacker to perform spoofing locally.5.5 MediumN/AN/AOct 13, 2026
CVE-2026-70228: Microsoft: Out-of-bounds read in Desktop Window Manager allows an authorized attacker to elevate privileges locally.7.8 HighN/AN/AOct 13, 2026
CVE-2026-70209: Microsoft: Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.7.0 HighN/AN/AOct 13, 2026
CVE-2026-70197: Microsoft: Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.8.1 HighN/AN/AOct 13, 2026
CVE-2026-70196: Microsoft: Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.5.9 MediumN/AN/AOct 13, 2026
CVE-2026-70190: Microsoft: Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate…7.3 HighN/AN/AOct 13, 2026
CVE-2026-70188: Microsoft: Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized…9.1 CriticalN/AN/AOct 13, 2026
CVE-2026-70186: Microsoft: Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.7.5 HighN/AN/AOct 13, 2026
CVE-2026-70185: Microsoft: Protection mechanism failure in Windows PowerShell allows an authorized attacker to bypass a security feature locally.8.8 HighN/AN/AOct 13, 2026
CVE-2026-70183: Microsoft: Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an…7.5 HighN/AN/AOct 13, 2026
CVE-2026-70181: Microsoft: Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service…7.5 HighN/AN/AOct 13, 2026
CVE-2026-70179: Microsoft: Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network.7.5 HighN/AN/AOct 13, 2026
CVE-2026-70176: Microsoft: Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.7.0 HighN/AN/AOct 13, 2026
CVE-2026-70175: Microsoft: Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.8.1 HighN/AN/AOct 13, 2026
651-675 of 417606
‹›