The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-110207: WuKongOpenSource Wukong AICRM: Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call…8.8 High8.7 High0%Oct 13, 2026
CVE-2026-110206: RooCodeInc Roo-Code: Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that allows attackers to…8.8 High7.7 High0%Oct 13, 2026
CVE-2026-110205: RooCodeInc Roo-Code: Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that discards command…8.8 High7.7 High0%Oct 13, 2026
CVE-2026-110204: RooCodeInc Roo-Code: Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to run denied shell…8.8 High7.7 High0%Oct 13, 2026
CVE-2026-110203: RooCodeInc Roo-Code: Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to auto-approve denied…8.8 High7.7 High0%Oct 13, 2026
CVE-2026-110202: RooCodeInc Roo-Code: Roo Code through 3.54.0 contains a command approval bypass vulnerability in getCommandDecision() that allows attackers…8.8 High7.7 High0%Oct 13, 2026
CVE-2026-110130: Finsys dockhand: Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any…10.0 Critical10.0 Critical1%Oct 13, 2026
CVE-2026-110112: Finsys dockhand: Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain…8.1 High9.2 Critical0%Oct 13, 2026
CVE-2026-110111: vatesfr xen-orchestra: Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to…7.5 High7.7 High1%Oct 13, 2026
CVE-2026-110036: Red Hat: A flaw was found in device-mapper-persistent-data3.3 LowN/A0%Oct 13, 2026
CVE-2026-109453: Microsoft: Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate…7.0 HighN/A0%Oct 13, 2026
CVE-2026-109429: mistralai mistral-vibe: Mistral Vibe before 2.25.4 contains a command permission gate bypass vulnerability that allows attackers to execute…8.8 High8.7 High1%Oct 13, 2026
CVE-2026-109428: mistralai mistral-vibe: Mistral Vibe before 2.25.5 contains a permission validation bypass vulnerability that allows attackers to execute…8.8 High8.7 High1%Oct 13, 2026
CVE-2026-108471: Microsoft: Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to…8.8 HighN/A0%Oct 13, 2026
CVE-2026-108468: Microsoft: Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.7.0 HighN/A0%Oct 13, 2026
CVE-2026-108467: Microsoft: Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an authorized attacker to execute code over a…8.8 HighN/A1%Oct 13, 2026
CVE-2026-108466: Microsoft: Out-of-bounds read in Windows Kernel allows an unauthorized attacker to deny service over a network.5.3 MediumN/A1%Oct 13, 2026
CVE-2026-108465: Microsoft: Use after free in Windows Update Delivery Optimization allows an authorized attacker to elevate privileges locally.7.0 HighN/A0%Oct 13, 2026
CVE-2026-108464: Microsoft: Use after free in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally.7.0 HighN/A0%Oct 13, 2026
CVE-2026-108463: Microsoft: Improper resolution of path equivalence in Windows SmartScreen allows an unauthorized attacker to bypass a security…8.8 HighN/A1%Oct 13, 2026
CVE-2026-108462: Microsoft: Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized…5.5 MediumN/A0%Oct 13, 2026
CVE-2026-108461: Microsoft: Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.7.0 HighN/A0%Oct 13, 2026
CVE-2026-108460: Microsoft: Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.8.1 HighN/A1%Oct 13, 2026
CVE-2026-108458: Microsoft: Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.8.8 HighN/A1%Oct 13, 2026
CVE-2026-108457: Microsoft: Out-of-bounds write in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network.8.1 HighN/A1%Oct 13, 2026
1051-1075 of 404453
‹›