The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-104947: EnterpriseDB WarehousePG: WarehousePG (WHPG) 7.2.1 through 7.6.0 is affected by a missing authorization vulnerability (CWE-862) in the built-in…N/A5.3 Medium0%Oct 21, 2026
CVE-2025-60489: n/a: A NULL pointer dereference in the dasher_insert_timeline_entry function (/filters/dasher.c) of GPAC Project/MP4Box…N/AN/A0%Oct 21, 2026
CVE-2025-0326: WSO2: The system fails to invalidate existing access tokens associated with sub-organization users during sensitive account…N/AN/A0%Oct 21, 2026
CVE-2024-7478: WSO2: When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence…5.8 MediumN/A0%Oct 21, 2026
CVE-2024-6423: WSO2: The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data…4.0 MediumN/A0%Oct 21, 2026
CVE-2024-5563: WSO2 WSO2 Identity Server: Due to an incomplete implementation, reCaptcha is not applied to certain authentication flows even when the reCaptcha…4.8 MediumN/A0%Oct 21, 2026
CVE-2024-5139: WSO2: The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of…6.1 MediumN/A0%Oct 21, 2026
CVE-2024-4989: WSO2 WSO2 API Manager: The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by…5.4 MediumN/A0%Oct 21, 2026
PHP Vulnerability: CVE-2026-109619N/A9.2 Critical6%Oct 21, 2026
CVE-2026-97313: ISC BIND 9: A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0)…7.5 HighN/A0%Oct 21, 2026
CVE-2026-96888: ISC BIND 9: A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an…7.5 HighN/A0%Oct 21, 2026
CVE-2026-94300: ISC BIND 9: Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`"8.1 HighN/A1%Oct 21, 2026
CVE-2026-90484: Apache Software Foundation Apache bRPC: The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a…N/AN/A0%Oct 21, 2026
CVE-2026-87849: Apache Software Foundation Apache bRPC: The Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) calls RapidJSON object-only accessors…N/AN/A0%Oct 21, 2026
CVE-2026-86249: Apache Software Foundation Apache bRPC: On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internal_port, the HTTP built-in service…N/AN/A0%Oct 21, 2026
CVE-2026-86147: Apache Software Foundation Apache bRPC: External control of file name or path and uncontrolled resource consumption in Apache bRPC (version < 1.18.0) on all…N/AN/A0%Oct 21, 2026
CVE-2026-86146: Apache Software Foundation Apache bRPC: Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) in the bundled HTTP/1.1 parser of Apache…N/AN/A0%Oct 21, 2026
CVE-2026-84748: Apache Software Foundation Apache bRPC: Improper authorization in Apache bRPC (versions < 1.18.0) on all platforms allows remote attackers to access builtin…N/AN/A0%Oct 21, 2026
CVE-2026-84747: Apache Software Foundation Apache bRPC: Interpretation conflict in the HTTP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows…N/AN/A0%Oct 21, 2026
CVE-2026-84727: Apache Software Foundation Apache bRPC: Use-after-free in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows a…5.4 MediumN/A0%Oct 21, 2026
CVE-2026-82953: Apache Software Foundation Apache bRPC: NULL pointer dereference in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows…N/AN/A0%Oct 21, 2026
CVE-2026-82942: Apache Software Foundation Apache bRPC: A data race in the RDMA transport of Apache bRPC (versions < 1.18.0) allows a remote client to crash the server process…N/AN/A0%Oct 21, 2026
CVE-2026-82425: Apache Software Foundation Apache bRPC: A reachable assertion in Apache bRPC (version < 1.18.0) on all platforms allows a malicious remote peer to crash the…N/AN/A0%Oct 21, 2026
CVE-2026-82231: Apache Software Foundation Apache bRPC: A Thrift client in Apache bRPC (version < 1.18.0, built with WITH_THRIFT which is off by default) can be crashed by the…N/AN/A0%Oct 21, 2026
CVE-2026-82230: Apache Software Foundation Apache bRPC: Uncontrolled recursion in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote…7.5 HighN/A1%Oct 21, 2026
751-775 of 416054
‹›