The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-113788: Improper Neutralization of Special Elements used in an OS CommandN/A9.4 Critical0%Oct 21, 2026
CVE-2026-60819: Exposure of Sensitive Information to an Unauthorized Actor3.7 LowN/A0%Oct 20, 2026
CVE-2026-87865: Improper Certificate Validation7.4 HighN/A1%Oct 20, 2026
CVE-2026-86410: Improper Validation of Certificate with Host Mismatch8.1 HighN/A1%Oct 20, 2026
CVE-2026-113610: vatesfr xen-orchestra: Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that…5.4 Medium5.3 Medium0%Oct 20, 2026
CVE-2026-34485: Improper Access Control7.8 HighN/A0%Oct 20, 2026
CVE-2026-113354: Incorrect Authorization6.5 Medium7.1 High0%Oct 20, 2026
CVE-2026-111061: Allocation of Resources Without Limits or Throttling4.3 MediumN/A0%Oct 19, 2026
CVE-2026-112305: Improperly Controlled Modification of Dynamically-Determined Object Attributes8.8 High8.7 High1%Oct 19, 2026
CVE-2026-111915: Improper Limitation of a Pathname to a Restricted Directory5.9 Medium8.2 High0%Oct 19, 2026
CVE-2026-97859: Missing Authorization6.5 MediumN/A0%Oct 18, 2026
CVE-2026-109553: Improper Authentication7.5 HighN/A0%Oct 18, 2026
CVE-2026-111987: Improper Neutralization of Input During Web Page Generation4.3 Medium2.1 Low0%Oct 18, 2026
CVE-2026-111657: Authorization Bypass Through User-Controlled Key4.3 Medium5.3 Medium0%Oct 16, 2026
CVE-2026-111638: Missing Authorization7.7 High8.3 High0%Oct 16, 2026
CVE-2026-111605: Authorization Bypass Through User-Controlled Key8.1 High8.6 High0%Oct 16, 2026
CVE-2026-68908: Free of Memory not on the Heap5.3 MediumN/A0%Oct 16, 2026
CVE-2026-111451: Improper Neutralization of Special Elements used in an OS Command7.8 HighN/A0%Oct 16, 2026
CVE-2026-94135: Key Exchange without Entity Authentication4.3 MediumN/A0%Oct 15, 2026
CVE-2026-94134: Key Exchange without Entity Authentication9.1 CriticalN/A1%Oct 15, 2026
CVE-2026-105033: Use of Hard-coded Credentials8.8 HighN/A0%Oct 15, 2026
CVE-2026-111226: Improper Neutralization of Special Elements used in an OS Command7.2 High8.6 High7%Oct 15, 2026
CVE-2026-102631: Improper AuthenticationN/A5.9 Medium0%Oct 15, 2026
CVE-2026-63442: Improper Output Neutralization for Logs8.1 HighN/A0%Oct 15, 2026
SUSE: CVE-2025-23390: SUSE Linux Security Advisory6.3 MediumN/A0%Oct 15, 2026
51-75 of 2138
‹›