The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-115509: jitsucom jitsu: Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that…4.2 Medium2.3 LowN/AOct 22, 2026
CVE-2026-115508: unclecode crawl4ai: Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API…6.5 Medium7.1 HighN/AOct 22, 2026
CVE-2026-115507: go-vikunja vikunja: Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in…3.5 Low5.1 MediumN/AOct 22, 2026
CVE-2026-115506: libexpat: libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in…7.5 High8.7 HighN/AOct 22, 2026
CVE-2026-115505: sahlberg libsmb2: libsmb2 before 6.3 contains integer overflow vulnerabilities in the DCE/RPC NDR decoder in lib/dcerpc.c that allow heap…7.6 High7.2 HighN/AOct 22, 2026
CVE-2026-115504: HEASARC cfitsio: CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts…7.8 High8.5 HighN/AOct 22, 2026
CVE-2026-115503: NationalSecurityAgency ghidra: Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in…5.5 Medium6.8 MediumN/AOct 22, 2026
CVE-2026-115398: NationalSecurityAgency ghidra: Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSystemIndexHelper used by…5.5 Medium6.8 MediumN/AOct 22, 2026
CVE-2026-115397: NationalSecurityAgency ghidra: Ghidra before 12.2 contains a resource allocation without limits vulnerability in…5.5 Medium6.8 MediumN/AOct 22, 2026
CVE-2026-115396: NationalSecurityAgency ghidra: Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data vulnerability in…5.5 Medium6.8 MediumN/AOct 22, 2026
CVE-2026-115395: NationalSecurityAgency ghidra: Ghidra 10.3 before 12.2 contains a resource allocation without limits vulnerability in ThemeReader.readZipTheme() that…5.5 Medium6.8 MediumN/AOct 22, 2026
CVE-2026-114655: MongoDB libmongocrypt: libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key…5.9 Medium6.0 MediumN/AOct 22, 2026
CVE-2026-115394: NationalSecurityAgency ghidra: Ghidra through 12.2 contains an uncontrolled memory allocation vulnerability in BinaryField.read() that allows…5.5 Medium6.8 MediumN/AOct 22, 2026
CVE-2026-114654: MongoDB C# Driver: A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range binary…6.5 Medium6.9 MediumN/AOct 22, 2026
CVE-2026-115393: bytecodealliance wasmtime: Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 contains a type…3.8 Low1.0 LowN/AOct 22, 2026
CVE-2026-115392: bytecodealliance wasmtime: Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem…7.9 High8.8 HighN/AOct 22, 2026
CVE-2026-114653: MongoDB C# Driver: A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field…6.5 Medium7.1 HighN/AOct 22, 2026
CVE-2026-115391: bytecodealliance wasmtime: Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 contains an uncontrolled resource allocation vulnerability in…5.8 Medium6.9 MediumN/AOct 22, 2026
CVE-2026-114652: MongoDB C# Driver: A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can…6.5 Medium7.1 HighN/AOct 22, 2026
CVE-2026-114651: MongoDB C# Driver: A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from…4.0 Medium6.3 MediumN/AOct 22, 2026
CVE-2026-115390: bytecodealliance wasmtime: Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 contains a fuel accounting flaw in Cranelift-compiled call_ref…5.7 Medium6.9 MediumN/AOct 22, 2026
CVE-2026-115389: bytecodealliance wasmtime: Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not adequately account for host…2.3 Low1.0 LowN/AOct 22, 2026
CVE-2026-114650: MongoDB: A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data designated for client-side…5.9 Medium6.9 MediumN/AOct 22, 2026
CVE-2026-115388: bytecodealliance wasmtime: wasmtime-wasi-http in Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not enforce the…6.2 Medium6.9 MediumN/AOct 22, 2026
CVE-2026-114649: MongoDB C# Driver: The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two…6.8 Medium7.6 HighN/AOct 22, 2026
126-150 of 545063
‹›