The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-69766: Microsoft: Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.7.0 HighN/A0%Oct 13, 2026
CVE-2026-69763: Microsoft: Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.7.0 HighN/A0%Oct 13, 2026
CVE-2026-69705: Microsoft: Out-of-bounds write in Windows iSCSI allows an unauthorized attacker to execute code over a network.9.8 CriticalN/A1%Oct 13, 2026
CVE-2026-69639: Microsoft: Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execute code over a network.9.8 CriticalN/A1%Oct 13, 2026
CVE-2026-69634: Microsoft: Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute code over a network.9.8 CriticalN/A1%Oct 13, 2026
CVE-2026-69577: Microsoft: Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized…7.5 HighN/A1%Oct 13, 2026
CVE-2026-69454: Microsoft: Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized…7.5 HighN/A1%Oct 13, 2026
CVE-2026-69370: Microsoft Visual Studio Code: Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an…8.8 HighN/A1%Oct 13, 2026
CVE-2026-69363: Microsoft: Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges over a…8.0 HighN/A1%Oct 13, 2026
CVE-2026-61931: Microsoft: Use after free in Windows Perception Simulation Service allows an authorized attacker to elevate privileges locally.7.8 HighN/A0%Oct 13, 2026
CVE-2026-59116: Microsoft: Use of a broken or risky cryptographic algorithm in Windows Remote Desktop allows an unauthorized attacker to bypass a…6.8 MediumN/A0%Oct 13, 2026
CVE-2026-54086: esa sleapi-j: SLE API for Java is an implementation of CCSDS Space Link Extension Services5.3 MediumN/A0%Oct 13, 2026
CVE-2026-49785: Microsoft: Improper resource shutdown or release in Windows UEFI allows an authorized attacker to bypass a security feature…7.8 HighN/A0%Oct 13, 2026
CVE-2026-110256: Finsys dockhand: Finsys Dockhand through 1.0.18 contains an LDAP injection vulnerability in the tryLdapAuth function in…3.7 Low6.3 Medium0%Oct 13, 2026
CVE-2026-110255: Finsys dockhand: Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerability that allows…8.5 High8.4 High0%Oct 13, 2026
CVE-2026-110254: Finsys dockhand: Finsys Dockhand before 1.0.45 contains a server-side request forgery vulnerability in the ipCategory() function in…4.3 Medium5.3 Medium0%Oct 13, 2026
CVE-2026-110249: Mozilla Thunderbird: A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing…N/AN/A0%Oct 13, 2026
CVE-2026-110247: Mozilla Thunderbird: Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checksN/AN/A0%Oct 13, 2026
CVE-2026-110240: duke-git lancet: Lancet through 2.3.9 contains an SSRF protection bypass vulnerability in netutil.IsInternalIP that misclassifies IPv6…4.8 Medium6.3 Medium0%Oct 13, 2026
CVE-2026-110239: zofe rapyd-admin: Rapyd Admin before 9.20.0 contains a stored cross-site scripting vulnerability in the x-rpd::rich-text Blade component…4.4 Medium2.1 Low0%Oct 13, 2026
CVE-2026-110238: zofe rapyd-admin: Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company…8.8 High8.7 High0%Oct 13, 2026
CVE-2026-110237: vifm: Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking…7.3 High7.0 High0%Oct 13, 2026
CVE-2026-110236: KDE Dolphin: KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute…7.0 High7.1 High1%Oct 13, 2026
CVE-2026-110235: Abdurazaaq Mohammed MP Manager: MP Manager through 1.1.0 contains a path traversal vulnerability that allows attackers to write files outside the…5.5 Medium6.7 Medium0%Oct 13, 2026
CVE-2026-110234: elio-fm elio: Elio through 1.13.0 contains an insecure temporary file vulnerability that allows local users to overwrite another…4.4 Medium4.1 Medium0%Oct 13, 2026
1001-1025 of 404453
‹›