The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-81808: Missing AuthorizationN/AN/AN/ANov 5, 2026
CVE-2026-81744: Missing AuthorizationN/AN/AN/ANov 5, 2026
CVE-2026-81734: Missing AuthorizationN/AN/AN/ANov 5, 2026
CVE-2026-76152: Path TraversalN/AN/AN/ANov 5, 2026
CVE-2026-76150: Path TraversalN/AN/AN/ANov 5, 2026
CVE-2026-74841: Uncontrolled Resource ConsumptionN/AN/AN/ANov 5, 2026
CVE-2026-73580: Exposure of Sensitive InformationN/AN/AN/ANov 5, 2026
CVE-2026-73578: Authentication Bypass Using an Alternate Path or ChannelN/AN/AN/ANov 5, 2026
CVE-2026-73577: Authentication Bypass Using an Alternate Path or ChannelN/AN/AN/ANov 5, 2026
CVE-2026-71901: Improper Control of Resource Identifiers ('Resource Injection') vulnerability in Apache OFBizN/AN/AN/ANov 5, 2026
CVE-2026-68524: Code InjectionN/AN/AN/ANov 5, 2026
CVE-2026-66903: Path Traversal: '../filedir'N/AN/AN/ANov 5, 2026
CVE-2026-106716: ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open…N/AN/AN/ANov 5, 2026
CVE-2026-106715: NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView JavaScript bridge origin…N/AN/AN/ANov 5, 2026
CVE-2026-106714: Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading…N/AN/AN/ANov 5, 2026
CVE-2026-106713: An issue in FreeReels for Android version 2.3.11 allows a remote attacker to obtain sensitive information via the…N/AN/AN/ANov 5, 2026
CVE-2026-107891: musl -libc musl: musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows,…8.1 HighN/AN/ANov 5, 2026
CVE-2026-115739: Trellix DLP on-prem extensions: Hard-coded Cryptographic Key vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows a…N/A6.0 MediumN/ANov 5, 2026
CVE-2026-123096: anacrolix torrent: anacrolix/torrent through 1.61.0 contains a memory exhaustion vulnerability in the tracker/http package that allows…6.5 Medium7.1 HighN/ANov 5, 2026
CVE-2026-123095: mpv-player mpv: mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdl_hook script that allows remote…7.5 High7.7 HighN/ANov 5, 2026
CVE-2026-123094: huginn: Huginn before 2026.11.05 contains a stored cross-site scripting vulnerability in the service_label helper that marks…5.4 Medium5.1 MediumN/ANov 5, 2026
CVE-2026-122330: Blosc c-blosc2: Blosc c-blosc2 before 3.5.0 contains a divide-by-zero vulnerability in blosc2_schunk_get_slice_buffer() in…5.5 Medium6.8 MediumN/ANov 5, 2026
CVE-2026-122329: libsdl-org SDL_mixer: SDL_mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow in FetchXLaw() in src/decoder_aiff.c due to…7.8 High8.5 HighN/ANov 5, 2026
CVE-2026-122328: libsdl-org SDL_mixer: SDL_mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow vulnerability in FetchXLaw() of src/decoder_wav.c…7.8 High8.5 HighN/ANov 5, 2026
CVE-2026-122327: Arthi-chaud Meelo: Meelo through 3.13.1 contains a missing authorization vulnerability that allows authenticated non-admin users to modify…4.3 Medium5.3 MediumN/ANov 5, 2026
126-150 of 423114
‹›