The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-0574: Improper Authorization6.3 Medium2.1 Low0%Jan 4, 2026
CVE-2025-3660: Improper Authorization of Index Containing Sensitive Information8.2 High6.9 Medium0%Jan 4, 2026
CVE-2025-3654: Improper Authorization of Index Containing Sensitive Information9.8 Critical6.9 Medium0%Jan 4, 2026
CVE-2025-3653: Improper Authorization of Index Containing Sensitive Information9.8 Critical6.9 Medium0%Jan 4, 2026
CVE-2025-3652: Authentication Bypass Using an Alternate Path or Channel5.3 Medium6.9 Medium0%Jan 4, 2026
CVE-2025-3646: Missing Authentication for Critical Function8.2 High6.9 Medium0%Jan 4, 2026
CVE-2025-15115: Missing Authorization9.8 Critical6.9 Medium0%Jan 4, 2026
CVE-2026-21652: Undefined Security WeaknessN/AN/AN/AJan 3, 2026
CVE-2026-21651: Undefined Security WeaknessN/AN/AN/AJan 3, 2026
CVE-2026-21650: Undefined Security WeaknessN/AN/AN/AJan 3, 2026
CVE-2026-21649: Undefined Security WeaknessN/AN/AN/AJan 3, 2026
CVE-2026-21648: Undefined Security WeaknessN/AN/AN/AJan 3, 2026
CVE-2026-21647: Undefined Security WeaknessN/AN/AN/AJan 3, 2026
CVE-2026-21646: Undefined Security WeaknessN/AN/AN/AJan 3, 2026
CVE-2026-21645: Undefined Security WeaknessN/AN/AN/AJan 3, 2026
CVE-2026-21644: Undefined Security WeaknessN/AN/AN/AJan 3, 2026
CVE-2026-21484: Observable Discrepancy5.3 MediumN/A1%Jan 3, 2026
CVE-2025-64125: Unintended Proxy or IntermediaryN/A9.4 Critical0%Jan 3, 2026
CVE-2025-64124: Improper Neutralization of Special Elements used in an OS Command8.8 High8.7 High1%Jan 3, 2026
CVE-2025-64123: Unintended Proxy or Intermediary9.8 Critical7.9 High0%Jan 2, 2026
CVE-2025-64122: Insufficiently Protected Credentials5.5 Medium7.2 High0%Jan 2, 2026
CVE-2025-64121: Authentication Bypass Using an Alternate Path or Channel9.8 Critical10.0 Critical0%Jan 2, 2026
CVE-2025-64120: Improper Neutralization of Special Elements used in an OS Command8.8 High9.4 Critical1%Jan 2, 2026
CVE-2025-64119: Use of Client-Side AuthenticationN/A9.3 Critical0%Jan 2, 2026
CVE-2026-21483: Improper Neutralization of Input During Web Page Generation5.4 Medium5.4 Medium0%Jan 2, 2026
89526-89550 of 522616