The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-105298: Cloudflare https://github.com/cloudflare/pingora: Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority…N/A6.3 MediumN/AOct 20, 2026
CVE-2026-105297: Cloudflare https://github.com/cloudflare/pingora: Summary Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits unless the application set its…7.5 HighN/AN/AOct 20, 2026
CVE-2026-86981: Apple macOS: An out-of-bounds write issue was addressed with improved bounds checkingN/AN/AN/AOct 20, 2026
CVE-2026-86979: Apple macOS: A privacy issue was addressed with improved checksN/AN/AN/AOct 20, 2026
CVE-2026-86976: Apple: An authorization issue was addressed with improved state managementN/AN/AN/AOct 20, 2026
CVE-2026-86975: Apple: An out-of-bounds read was addressed with improved bounds checkingN/AN/AN/AOct 20, 2026
CVE-2026-86963: Apple iOS and iPadOS: A denial-of-service issue was addressed with improved input validationN/AN/AN/AOct 20, 2026
CVE-2026-86962: Apple: A double free issue was addressed with improved memory managementN/AN/AN/AOct 20, 2026
CVE-2026-86957: Apple: An out-of-bounds read was addressed with improved bounds checkingN/AN/AN/AOct 20, 2026
CVE-2026-86955: Apple iOS and iPadOS: An authorization issue was addressed with improved state managementN/AN/AN/AOct 20, 2026
CVE-2026-86953: Apple: An out-of-bounds write issue was addressed with improved bounds checkingN/AN/AN/AOct 20, 2026
CVE-2026-86932: Apple macOS: An authorization issue was addressed with improved state managementN/AN/AN/AOct 20, 2026
CVE-2026-86928: Apple macOS: A path handling issue was addressed with improved validationN/AN/AN/AOct 20, 2026
CVE-2026-86922: Apple: A type confusion issue was addressed with improved state managementN/AN/AN/AOct 20, 2026
CVE-2026-86921: Apple: A permissions issue was addressed with improved validationN/AN/AN/AOct 20, 2026
CVE-2026-28853: Apple macOS: The issue was addressed with improved checksN/AN/AN/AOct 20, 2026
CVE-2026-8355: IBM ContextForge MCP Gateway: IBM ContextForge MCP Gateway 0.1.0 through 1.0.5 is vulnerable to a server-side request Forgery (SSRF) that allows…N/AN/AN/AOct 20, 2026
CVE-2026-112373: H3C Magic NX15: A security vulnerability has been detected in H3C Magic NX15 NX15V100R0176.5 Medium5.7 MediumN/AOct 20, 2026
CVE-2026-109126: IBM: IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a physically…8.8 HighN/AN/AOct 20, 2026
CVE-2026-107400: IBM TRIRIGA Application Platform: IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary…8.8 HighN/AN/AOct 20, 2026
CVE-2026-107366: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification8.3 HighN/AN/AOct 20, 2026
CVE-2026-105453: IBM Sterling Connect Direct for Unix: IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow a local attacker…8.4 HighN/AN/AOct 20, 2026
CVE-2026-77684: zephyrproject zephyr: The Bluetooth Classic Hands-Free Profile HF role in subsys/bluetooth/host/classic/hfp_hf.c does not release the AT…5.7 MediumN/AN/AOct 19, 2026
CVE-2026-19595: zephyrproject zephyr: The user-mode syscall verifier z_vrfy_rtio_cqe_get_mempool_buffer() in subsys/rtio/rtio_syscalls.c validated its two…6.1 MediumN/AN/AOct 19, 2026
CVE-2026-19178: IBM Storage TS4500 Library: IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 could allow a remote authenticated attacker to gain unauthorized…6.8 MediumN/AN/AOct 19, 2026
151-175 of 407346
‹›