The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-8862: Insufficiently Protected Credentials7.5 HighN/A0%Sep 3, 2026
CVE-2026-19795: Deserialization of Untrusted Data6.2 MediumN/A0%Sep 3, 2026
CVE-2026-84962: Improper Neutralization of CRLF Sequences4.2 Medium5.7 Medium0%Sep 3, 2026
CVE-2026-84971: Reachable Assertion6.5 Medium7.1 High0%Sep 3, 2026
CVE-2026-3686: Allocation of Resources Without Limits or Throttling6.2 MediumN/A0%Aug 28, 2026
CVE-2026-3627: Improper Neutralization of Special Elements used in an SQL Command9.1 CriticalN/A1%Aug 28, 2026
CVE-2026-19295: Improper Neutralization of Directives in Dynamically Evaluated Code9.9 CriticalN/A3%Aug 28, 2026
CVE-2026-19294: Authorization Bypass Through User-Controlled Key6.5 MediumN/A0%Aug 28, 2026
CVE-2026-19286: Improper Control of Generation of Code9.8 CriticalN/A1%Aug 28, 2026
CVE-2026-18904: Authorization Bypass Through User-Controlled Key8.2 HighN/A0%Aug 28, 2026
CVE-2026-18899: Improper Limitation of a Pathname to a Restricted Directory7.5 HighN/A1%Aug 28, 2026
CVE-2026-18891: Improper Authentication8.2 HighN/A0%Aug 28, 2026
CVE-2026-18729: Improper Control of Generation of Code8.8 HighN/A2%Aug 28, 2026
CVE-2026-18545: Server-Side Request Forgery (SSRF)4.3 MediumN/A0%Aug 28, 2026
CVE-2026-18527: Session Fixation9.9 CriticalN/A0%Aug 28, 2026
CVE-2026-17203: Improper Authentication7.5 HighN/A0%Aug 28, 2026
CVE-2026-16821: Use of Externally-Controlled Format String7.8 HighN/A0%Aug 28, 2026
CVE-2025-64649: Improper Certificate Validation5.9 MediumN/A0%Aug 28, 2026
CVE-2025-36290: Improper Certificate Validation5.9 MediumN/A0%Aug 28, 2026
CVE-2025-36271: Use of a One-Way Hash without a Salt5.9 MediumN/A0%Aug 28, 2026
CVE-2026-81523: Improper Neutralization of Special Elements in Output Used by a Downstream Component4.4 Medium2.0 Low0%Aug 27, 2026
CVE-2026-79780: Exposure of Sensitive Information to an Unauthorized Actor5.3 Medium6.0 Medium0%Aug 25, 2026
CVE-2026-19783: Out-of-bounds Write7.8 HighN/A0%Aug 20, 2026
CVE-2026-19449: Improper Privilege Management8.8 HighN/A0%Aug 20, 2026
CVE-2026-19448: Use of Uninitialized Resource7.5 HighN/A0%Aug 20, 2026
701-725 of 9771
‹›