The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-115290: Elastic Elasticsearch: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested…7.5 HighN/AN/ANov 3, 2026
CVE-2026-115289: Elastic APM Server: Use of Multiple Resources with Duplicate Identifier (CWE-694) in APM Server can lead to information disclosure via a…4.3 MediumN/AN/ANov 3, 2026
CVE-2026-119495: WebberZone Better Search: Missing Authorization vulnerability in WebberZone Better Search better-search allows Exploiting Incorrectly Configured…5.3 MediumN/AN/ANov 3, 2026
CVE-2026-109594: SonicWall Global Management System (GMS): Post-authentication Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability…N/AN/AN/ANov 3, 2026
CVE-2026-121603: solanum-ircd solanum: Solanum before commit 2ea1382 contains a buffer overflow vulnerability in ms_kill() that allows malicious linked…6.5 Medium8.5 HighN/ANov 3, 2026
CVE-2026-109593: SonicWall Global Management System (GMS): An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read…N/AN/AN/ANov 3, 2026
CVE-2026-28336: SolarWinds Dameware: SolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the compromise of…9.9 CriticalN/AN/ANov 3, 2026
CVE-2026-28335: SolarWinds Dameware: SolarWinds Dameware was found to be affected by a buffer overflow vulnerability that can result in remote code execution8.4 HighN/AN/ANov 3, 2026
CVE-2026-119674: MongoDB Database Tools: MongoDB Database Tools mongorestore incorrectly URL-decodes an original collection name read from metadata when the…3.7 Low2.1 LowN/ANov 3, 2026
CVE-2026-28327: SolarWinds Dameware: SolarWinds Dameware was found to be affected by a DLL hijacking vulnerability8.2 HighN/AN/ANov 3, 2026
CVE-2026-103916: Docker Docker Sandboxes: Docker Sandboxes sbx cp does not safely confine host-side paths to a shared workspaceN/A8.4 HighN/ANov 3, 2026
CVE-2026-73328: volmarg personal-management-system: Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload vulnerability that allows…7.2 High8.6 HighN/ANov 3, 2026
CVE-2026-65168: NVIDIA Slurm: NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd socket handling code.7.0 HighN/AN/ANov 3, 2026
CVE-2026-65165: NVIDIA Slurm: NVIDIA Slurm contains a vulnerability where a user could deliberately alter the provided nodelist alongside the…5.3 MediumN/AN/ANov 3, 2026
CVE-2026-65140: NVIDIA Slurm: NVIDIA Slurm contains some inconsistent authorization checks against the Operator permission level in the SlurmDBD that…5.7 MediumN/AN/ANov 3, 2026
CVE-2026-65139: NVIDIA Slurm: NVIDIA Slurm contains an attacker-controlled SQL injection attack in certain SlurmDBD RPCs that can lead to arbitrary…6.3 MediumN/AN/ANov 3, 2026
CVE-2026-65138: NVIDIA Slurm: NVIDIA Slurm contains an attacker-controlled arbitrary-memory read in the slurmstepd socket API that could be used to…6.3 MediumN/AN/ANov 3, 2026
CVE-2026-65109: NVIDIA Slurm: NVIDIA Slurm is subject to a symlink resolution issue in the container cleanup code that could allow an attacker to…4.7 MediumN/AN/ANov 3, 2026
CVE-2026-65108: NVIDIA Slurm: NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd process while the slurmstepd…6.3 MediumN/AN/ANov 3, 2026
CVE-2026-65107: NVIDIA Slurm: NVIDIA Slurm contains a vulnerability where a user could alter the supplemental group list as part of an sbcast file…6.3 MediumN/AN/ANov 3, 2026
CVE-2026-121562: CTFd: CTFd 3.1.0 before 3.8.7 contains an information disclosure vulnerability in the /api/v1/teams list endpoint that…5.3 Medium6.9 MediumN/ANov 3, 2026
CVE-2026-121561: HumanSignal: Label Studio before 1.23.2 (label-studio-sdk before 2.1.2) contains a server-side request forgery vulnerability that…7.7 High6.3 MediumN/ANov 3, 2026
CVE-2026-121560: logchimp: LogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass vulnerability that allows authenticated post…7.1 High7.1 HighN/ANov 3, 2026
CVE-2026-121559: glpi-project GLPI: GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 contains a privilege escalation vulnerability that allows…7.2 High8.6 HighN/ANov 3, 2026
CVE-2026-121558: Ricky-7-Yan intelligent-audit-system: AuditPilot before commit 4669c93 contains an authorization bypass vulnerability in _metadata_allowed in…4.3 Medium2.3 LowN/ANov 3, 2026
76-100 of 528356
‹›