The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-31464: Out-of-bounds Read8.1 HighN/A0%Apr 22, 2026
CVE-2026-40031: Uncontrolled Search Path Element7.8 High8.5 High0%Apr 8, 2026
CVE-2026-4788: Insertion of Sensitive Information into Log File5.5 MediumN/A0%Apr 8, 2026
CVE-2026-3357: Deserialization of Untrusted Data8.8 HighN/A0%Apr 8, 2026
CVE-2026-1346: Execution with Unnecessary Privileges7.8 HighN/A0%Apr 8, 2026
CVE-2026-1343: Server-Side Request Forgery (SSRF)7.2 HighN/A0%Apr 8, 2026
CVE-2026-1342: Inclusion of Functionality from Untrusted Control Sphere7.9 HighN/A0%Apr 8, 2026
CVE-2025-13044: Generation of Predictable Numbers or Identifiers6.2 MediumN/A0%Apr 7, 2026
CVE-2026-1243: Improper Neutralization of Input During Web Page Generation5.4 MediumN/A0%Apr 2, 2026
CVE-2025-66487: Allocation of Resources Without Limits or Throttling6.5 MediumN/A0%Apr 1, 2026
CVE-2025-66486: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)6.1 MediumN/A0%Apr 1, 2026
CVE-2025-66485: Improper Neutralization of HTTP Headers for Scripting Syntax5.4 MediumN/A0%Apr 1, 2026
CVE-2025-66484: Improper Neutralization of Input During Web Page Generation5.4 MediumN/A0%Apr 1, 2026
CVE-2025-66483: Insufficient Session Expiration6.5 MediumN/A0%Apr 1, 2026
CVE-2025-36375: Cross-Site Request Forgery (CSRF)8.8 HighN/A0%Apr 1, 2026
CVE-2026-4820: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute4.3 MediumN/A0%Apr 1, 2026
CVE-2026-4364: Improper Neutralization of Input During Web Page Generation5.4 MediumN/A0%Apr 1, 2026
CVE-2026-4101: Improper Authentication8.1 HighN/A1%Apr 1, 2026
CVE-2026-2862: Inconsistent Interpretation of HTTP Requests5.3 MediumN/A0%Apr 1, 2026
CVE-2026-2475: URL Redirection to Untrusted Site3.1 LowN/A0%Apr 1, 2026
CVE-2026-1491: Inconsistent Interpretation of HTTP Requests5.3 MediumN/A0%Apr 1, 2026
CVE-2026-1345: Improper Neutralization of Special Elements used in an OS Command7.3 HighN/A0%Apr 1, 2026
CVE-2025-36373: Exposure of Sensitive System Information to an Unauthorized Control Sphere6.8 MediumN/A0%Apr 1, 2026
CVE-2025-13916: Use of a Broken or Risky Cryptographic Algorithm7.5 HighN/A0%Apr 1, 2026
CVE-2025-13855: Improper Neutralization of Special Elements used in an SQL Command7.6 HighN/A0%Apr 1, 2026
1376-1400 of 9771
‹›