The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-69850: Microsoft: Untrusted pointer dereference in Windows Certificates allows an authorized attacker to elevate privileges locally.7.8 HighN/AN/AOct 13, 2026
CVE-2026-69840: Microsoft: Use after free in Windows Certificates allows an authorized attacker to elevate privileges locally.7.0 HighN/AN/AOct 13, 2026
CVE-2026-69795: Microsoft: Null pointer dereference in Windows Clipboard Server allows an authorized attacker to elevate privileges locally.7.0 HighN/AN/AOct 13, 2026
CVE-2026-69766: Microsoft: Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.7.0 HighN/AN/AOct 13, 2026
CVE-2026-69763: Microsoft: Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.7.0 HighN/AN/AOct 13, 2026
CVE-2026-69705: Microsoft: Out-of-bounds write in Windows iSCSI allows an unauthorized attacker to execute code over a network.9.8 CriticalN/AN/AOct 13, 2026
CVE-2026-69639: Microsoft: Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execute code over a network.9.8 CriticalN/AN/AOct 13, 2026
CVE-2026-69634: Microsoft: Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute code over a network.9.8 CriticalN/AN/AOct 13, 2026
CVE-2026-69577: Microsoft: Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized…7.5 HighN/AN/AOct 13, 2026
CVE-2026-69454: Microsoft: Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized…7.5 HighN/AN/AOct 13, 2026
CVE-2026-69370: Microsoft Visual Studio Code: Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an…8.8 HighN/AN/AOct 13, 2026
CVE-2026-69363: Microsoft: Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges over a…8.0 HighN/AN/AOct 13, 2026
CVE-2026-61931: Microsoft: Use after free in Windows Perception Simulation Service allows an authorized attacker to elevate privileges locally.7.8 HighN/AN/AOct 13, 2026
CVE-2026-59116: Microsoft: Use of a broken or risky cryptographic algorithm in Windows Remote Desktop allows an unauthorized attacker to bypass a…6.8 MediumN/AN/AOct 13, 2026
CVE-2026-54086: esa sleapi-j: SLE API for Java is an implementation of CCSDS Space Link Extension Services5.3 MediumN/AN/AOct 13, 2026
CVE-2026-49785: Microsoft: Improper resource shutdown or release in Windows UEFI allows an authorized attacker to bypass a security feature…7.8 HighN/AN/AOct 13, 2026
CVE-2026-110256: Finsys dockhand: Finsys Dockhand through 1.0.18 contains an LDAP injection vulnerability in the tryLdapAuth function in…3.7 Low6.3 MediumN/AOct 13, 2026
CVE-2026-110255: Finsys dockhand: Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerability that allows…8.5 High8.4 HighN/AOct 13, 2026
CVE-2026-110254: Finsys dockhand: Finsys Dockhand before 1.0.45 contains a server-side request forgery vulnerability in the ipCategory() function in…4.3 Medium5.3 MediumN/AOct 13, 2026
CVE-2026-110249: Mozilla Thunderbird: A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing…N/AN/AN/AOct 13, 2026
CVE-2026-110247: Mozilla Thunderbird: Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checksN/AN/AN/AOct 13, 2026
CVE-2026-110240: duke-git lancet: Lancet through 2.3.9 contains an SSRF protection bypass vulnerability in netutil.IsInternalIP that misclassifies IPv6…4.8 Medium6.3 MediumN/AOct 13, 2026
CVE-2026-110239: zofe rapyd-admin: Rapyd Admin before 9.20.0 contains a stored cross-site scripting vulnerability in the x-rpd::rich-text Blade component…4.4 Medium2.1 LowN/AOct 13, 2026
CVE-2026-110238: zofe rapyd-admin: Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company…8.8 High8.7 HighN/AOct 13, 2026
CVE-2026-110237: vifm: Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking…7.3 High7.0 HighN/AOct 13, 2026
801-825 of 406601
‹›