The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-100203: Microsoft: Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally.7.0 HighN/A0%Oct 13, 2026
CVE-2026-100202: Microsoft: Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.9.8 CriticalN/A1%Oct 13, 2026
CVE-2026-100200: Microsoft: Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally.7.0 HighN/A0%Oct 13, 2026
CVE-2026-100133: Adobe: Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to…9.3 CriticalN/A1%Oct 13, 2026
CVE-2026-97781: Microsoft Microsoft 365 Apps for Enterprise: Improper neutralization of special elements used in a command ('command injection') in Microsoft Office OneNote allows…8.8 HighN/A1%Oct 13, 2026
CVE-2026-108131: Microsoft: No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform…7.5 HighN/A1%Oct 13, 2026
CVE-2026-105013: Microsoft Microsoft SharePoint Server Subscription Edition: Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a…7.4 HighN/A1%Oct 13, 2026
CVE-2026-105009: Microsoft: Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges…7.5 HighN/A0%Oct 13, 2026
CVE-2026-105008: Microsoft: No cwe for this issue in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.9.0 CriticalN/A1%Oct 13, 2026
CVE-2026-105007: Microsoft: An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails…8.8 HighN/A1%Oct 13, 2026
CVE-2026-105006: Microsoft: Use after free in HID class driver allows an unauthorized attacker to elevate privileges with a physical attack.6.4 MediumN/A0%Oct 13, 2026
CVE-2026-105005: Microsoft Windows 11 version 26H1: Out-of-bounds write in Windows Schannel allows an unauthorized attacker to execute code over a network.8.1 HighN/A1%Oct 13, 2026
CVE-2026-105004: Microsoft: Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.7.8 HighN/A0%Oct 13, 2026
CVE-2026-103578: Microsoft Windows 11 version 26H1: Untrusted pointer dereference in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical…6.8 MediumN/A0%Oct 13, 2026
CVE-2026-103575: Microsoft: Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.8.8 HighN/A1%Oct 13, 2026
CVE-2026-103568: Microsoft: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential…7.8 HighN/A0%Oct 13, 2026
CVE-2026-103567: Microsoft: Buffer over-read in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally.5.5 MediumN/A0%Oct 13, 2026
CVE-2026-103565: Microsoft: Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.7.0 HighN/A0%Oct 13, 2026
CVE-2026-103560: Microsoft: Improper authorization in DNS Server allows an authorized attacker to perform tampering locally.5.5 MediumN/A0%Oct 13, 2026
CVE-2026-103558: Microsoft: Deadlock in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a…7.5 HighN/A1%Oct 13, 2026
CVE-2026-103555: Microsoft: Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate…7.0 HighN/A0%Oct 13, 2026
CVE-2026-103554: Microsoft: Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.7.0 HighN/A0%Oct 13, 2026
CVE-2026-102225: Microsoft: Out-of-bounds read in Windows Text Shaping allows an unauthorized attacker to execute code over a network.8.8 HighN/A1%Oct 13, 2026
CVE-2026-100215: Microsoft: Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally.7.8 HighN/A0%Oct 13, 2026
CVE-2026-102217: Microsoft: Improper resolution of path equivalence in WebDAV allows an authorized attacker to elevate privileges over a network.8.8 HighN/A1%Oct 13, 2026
1176-1200 of 408302
‹›