The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-111494: TPC Software Matchpoint: Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any…N/A9.1 Critical0%Nov 5, 2026
CVE-2026-111493: TPC Software Matchpoint: Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile photos to be…N/A8.7 High0%Nov 5, 2026
CVE-2026-111492: TPC Software Matchpoint: SQL injection in the push notification handler of the MatchPoint Android app, which processes messages from Firebase…N/A8.6 High0%Nov 5, 2026
CVE-2026-111491: TPC Software Matchpoint: Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferencesN/A6.9 Medium0%Nov 5, 2026
CVE-2026-111490: TPC Software Matchpoint: Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the `actingasuser` HTTP…N/A9.9 Critical0%Nov 5, 2026
CVE-2026-111489: TPC Software Matchpoint: A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint…N/A9.9 Critical0%Nov 5, 2026
CVE-2026-122267: Chainguard MinIO: MinIO Signature V4 verification before RELEASE.2026-09-22T19-25-18Z accepts unsigned x-amz-* headers, letting a…N/A8.8 High0%Nov 5, 2026
CVE-2026-58273: rucio: Rucio is a scientific data management framework8.1 HighN/A1%Nov 5, 2026
CVE-2026-100395: lxc: LXC is a userspace interface for the Linux kernel containment features used to create and manage system containersN/A6.8 Medium0%Nov 5, 2026
CVE-2026-119757: BTCPay Server: BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that…9.8 Critical9.3 Critical1%Nov 5, 2026
CVE-2026-33944: dolibarr: Dolibarr is an open-source enterprise resource planning and customer relationship management application8.8 HighN/A1%Nov 5, 2026
CVE-2026-111770: modelcontextprotocol, @modelcontextprotocol: The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context…7.7 HighN/A0%Nov 5, 2026
CVE-2026-111768: modelcontextprotocol, @modelcontextprotocol: The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context…7.5 HighN/A1%Nov 5, 2026
CVE-2026-111769: modelcontextprotocol, @modelcontextprotocol: The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context…6.5 MediumN/A0%Nov 5, 2026
CVE-2026-87008: vitali87 code-graph-rag: Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing…7.1 HighN/A0%Nov 5, 2026
CVE-2026-85076: jhuckaby Cronicle: Cronicle is a multi-server task scheduler and runner, with a web based front-end UIN/A9.0 Critical0%Nov 5, 2026
CVE-2026-81190: kurrent-io KurrentDB: KurrentDB is a database engineered for modern software applications and event-driven architecturesN/A6.9 Medium0%Nov 5, 2026
CVE-2026-77622: BishopFox sliver: Sliver is a command and control frameworkN/A8.2 High1%Nov 5, 2026
CVE-2026-77463: umputun remark42: Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments6.5 MediumN/A0%Nov 5, 2026
CVE-2026-69143: Rejected reason: This CVE is a duplicate of another CVE.N/AN/AN/ANov 5, 2026
CVE-2026-62268: borgbackup borg: borgbackup is an opensource, deduplicating archiver with compression and authenticated encryptionN/A5.3 Medium0%Nov 5, 2026
CVE-2026-55458: caddyserver caddy: Caddy is an extensible server platform that uses TLS by defaultN/A2.9 Low0%Nov 5, 2026
CVE-2026-54442: NationalSecurityAgency emissary: Emissary is a P2P based data-driven workflow engine4.8 MediumN/A0%Nov 5, 2026
CVE-2026-49272: oauthlib: OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+8.5 HighN/A0%Nov 5, 2026
CVE-2026-48705: Project-MONAI MONAI: MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging9.3 CriticalN/A1%Nov 5, 2026
951-975 of 425038
‹›