The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-102860: Microsoft Microsoft SharePoint Server Subscription Edition: Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a…8.8 HighN/A1%Oct 13, 2026
CVE-2026-102859: Microsoft Microsoft SharePoint Server Subscription Edition: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint…4.6 MediumN/A0%Oct 13, 2026
CVE-2026-102858: Microsoft: Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.8.8 HighN/A1%Oct 13, 2026
CVE-2026-102857: Microsoft: Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.8.8 HighN/A1%Oct 13, 2026
CVE-2026-102856: Microsoft: Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.8.8 HighN/A1%Oct 13, 2026
CVE-2026-102850: Microsoft: Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.8.8 HighN/A1%Oct 13, 2026
CVE-2026-102849: Microsoft: Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.8.8 HighN/A1%Oct 13, 2026
CVE-2026-102599: socketio socket.io: Socket.IO enables bidirectional and low-latency communication for every platform7.5 HighN/A1%Oct 13, 2026
CVE-2026-102232: Microsoft Visual Studio Code: Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.7.0 HighN/A0%Oct 13, 2026
CVE-2026-102229: Microsoft Visual Studio Code: Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an…6.8 MediumN/A1%Oct 13, 2026
CVE-2026-102227: Microsoft: Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code…7.8 HighN/A0%Oct 13, 2026
CVE-2026-102226: Microsoft Microsoft Dynamics NAV 2018: Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an…8.8 HighN/A1%Oct 13, 2026
CVE-2026-102218: Microsoft: Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to…7.8 HighN/A0%Oct 13, 2026
CVE-2026-102215: Microsoft: Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to…7.8 HighN/A0%Oct 13, 2026
CVE-2026-102211: Microsoft: Use after free in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate…7.0 HighN/A0%Oct 13, 2026
CVE-2026-102208: Microsoft: Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.7.0 HighN/A0%Oct 13, 2026
CVE-2026-102205: Microsoft: Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to…7.8 HighN/A0%Oct 13, 2026
CVE-2026-102204: Microsoft Microsoft Defender for Endpoint for Linux: Improper link resolution before file access ('link following') in Microsoft Defender for Endpoint allows an authorized…7.8 HighN/A0%Oct 13, 2026
CVE-2026-102191: Microsoft: Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.7.0 HighN/A0%Oct 13, 2026
CVE-2026-102189: Microsoft: Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.7.0 HighN/A0%Oct 13, 2026
CVE-2026-100225: Microsoft: Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.7.0 HighN/A0%Oct 13, 2026
CVE-2026-100219: Microsoft: Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.9.8 CriticalN/A1%Oct 13, 2026
CVE-2026-100216: Microsoft: Stack-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.7.0 HighN/A0%Oct 13, 2026
CVE-2026-100214: Microsoft: Deserialization of untrusted data in Dynamics Business Central allows an authorized attacker to execute code over a…8.8 HighN/A2%Oct 13, 2026
CVE-2026-100207: Microsoft: Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows…7.3 HighN/A0%Oct 13, 2026
1151-1175 of 415224
‹›