The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-94127: Heap-based Buffer Overflow9.8 Critical9.3 Critical1%Sep 22, 2026
CVE-2026-93344: Missing Authorization6.5 Medium7.1 High0%Sep 22, 2026
CVE-2026-93088: Deserialization of Untrusted Data9.8 CriticalN/A1%Sep 22, 2026
CVE-2026-89407: Inefficient Regular Expression Complexity7.5 HighN/A1%Sep 22, 2026
CVE-2026-84388: Fortinet FortiPAM Chrome Extension: A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all…9.6 CriticalN/A0%Sep 22, 2026
CVE-2026-79315: n/a: A reflected cross-site scripting vulnerability exists in x-ui 0.3.24.7 MediumN/A0%Sep 22, 2026
CVE-2026-79314: n/a: A horizontal privilege escalation vulnerability exists in x-ui 0.3.2N/AN/A0%Sep 22, 2026
CVE-2026-79313: n/a: webpy web.py 0.76 is vulnerable to Insufficient Session Expiration9.8 CriticalN/A1%Sep 22, 2026
CVE-2026-65179: Deserialization of Untrusted Data8.8 HighN/A1%Sep 22, 2026
CVE-2026-65130: Improper Neutralization of Special Elements used in an OS Command8.0 HighN/A2%Sep 22, 2026
CVE-2026-65129: Improper Certificate Validation6.7 MediumN/A0%Sep 22, 2026
CVE-2026-65128: Improper Neutralization of Special Elements used in an SQL Command8.8 HighN/A1%Sep 22, 2026
CVE-2026-65127: Exposure of Sensitive System Information Due to Uncleared Debug Information4.1 MediumN/A0%Sep 22, 2026
CVE-2026-65126: Improper Enforcement of Behavioral Workflow5.0 MediumN/A0%Sep 22, 2026
CVE-2026-65125: External Control of File Name or Path6.6 MediumN/A1%Sep 22, 2026
CVE-2026-65124: XML Injection (aka Blind XPath Injection)5.9 MediumN/A1%Sep 22, 2026
CVE-2026-65121: Improper Authentication8.2 HighN/A0%Sep 22, 2026
CVE-2026-65118: Improper Certificate Validation7.5 HighN/A0%Sep 22, 2026
CVE-2026-65117: Use of Hard-coded Password5.0 MediumN/A0%Sep 22, 2026
CVE-2026-65115: Uncontrolled Resource Consumption6.5 MediumN/A1%Sep 22, 2026
CVE-2026-65114: Missing Authentication for Critical Function8.3 HighN/A0%Sep 22, 2026
CVE-2026-65113: Use of Hard-coded Credentials9.8 CriticalN/A1%Sep 22, 2026
CVE-2026-65112: Uncontrolled Resource Consumption6.5 MediumN/A1%Sep 22, 2026
CVE-2026-65111: Improper Neutralization of Special Elements used in a Command7.8 HighN/A0%Sep 22, 2026
CVE-2026-24267: Deserialization of Untrusted Data7.8 HighN/A1%Sep 22, 2026
776-800 of 395809