The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-108460: Microsoft: Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.8.1 HighN/AN/AOct 13, 2026
CVE-2026-108458: Microsoft: Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.8.8 HighN/AN/AOct 13, 2026
CVE-2026-108457: Microsoft: Out-of-bounds write in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network.8.1 HighN/AN/AOct 13, 2026
CVE-2026-108400: Microsoft: Integer overflow or wraparound in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over…8.8 HighN/AN/AOct 13, 2026
CVE-2026-108399: Microsoft: Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally.7.2 HighN/AN/AOct 13, 2026
CVE-2026-108398: Microsoft: Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.8.8 HighN/AN/AOct 13, 2026
CVE-2026-108396: Microsoft: Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized…7.0 HighN/AN/AOct 13, 2026
CVE-2026-108136: Microsoft: Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.7.8 HighN/AN/AOct 13, 2026
CVE-2026-108135: Microsoft: Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker…7.0 HighN/AN/AOct 13, 2026
CVE-2026-108134: Microsoft: Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.7.0 HighN/AN/AOct 13, 2026
CVE-2026-108133: Microsoft Windows Server 2022: Release of invalid pointer or reference in Windows Modern Device Management (MDM) allows an authorized attacker to…7.8 HighN/AN/AOct 13, 2026
CVE-2026-108132: Microsoft: Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally.7.0 HighN/AN/AOct 13, 2026
CVE-2026-108130: Microsoft: Heap-based buffer overflow in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to…7.8 HighN/AN/AOct 13, 2026
CVE-2026-108129: Microsoft: Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.6.5 MediumN/AN/AOct 13, 2026
CVE-2026-108128: Microsoft: Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.6.5 MediumN/AN/AOct 13, 2026
CVE-2026-108127: Microsoft: Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.6.5 MediumN/AN/AOct 13, 2026
CVE-2026-107607: Swann Communications SWIFI-SE2KIC: SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function…6.2 Medium6.9 MediumN/AOct 13, 2026
CVE-2026-107606: Swann Communications SWIFI-SE2KIC: SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function…6.2 Medium6.9 MediumN/AOct 13, 2026
CVE-2026-107605: Swann Communications SWIFI-SE2KIC: SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function…6.2 Medium5.9 MediumN/AOct 13, 2026
CVE-2026-106625: Adobe: Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in…7.8 HighN/AN/AOct 13, 2026
CVE-2026-105733: Microsoft: Improper access control in Windows Hyper-V allows an authorized attacker to execute code locally.8.8 HighN/AN/AOct 13, 2026
CVE-2026-105732: Microsoft Sysinternals Suite: Stack-based buffer overflow in SysInternals allows an authorized attacker to elevate privileges locally.7.3 HighN/AN/AOct 13, 2026
CVE-2026-105731: Microsoft Microsoft Office for Android: Use of uninitialized resource in Microsoft Graphics Component allows an authorized attacker to disclose information…5.5 MediumN/AN/AOct 13, 2026
CVE-2026-105728: Microsoft Microsoft Dynamics NAV 2018: Improper authentication in Dynamics Business Central allows an unauthorized attacker to disclose information over a…7.5 HighN/AN/AOct 13, 2026
CVE-2026-105727: Microsoft Microsoft Dynamics NAV 2018: Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an…8.8 HighN/AN/AOct 13, 2026
876-900 of 407728
‹›