The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-18275: Authorization Bypass Through User-Controlled Key6.5 MediumN/A0%Aug 6, 2026
CVE-2026-18258: Authorization Bypass Through User-Controlled Key8.8 HighN/A1%Aug 6, 2026
CVE-2026-70646: Uncontrolled Resource Consumption7.5 HighN/A1%Aug 6, 2026
CVE-2026-70637: Missing Synchronization5.9 Medium8.2 High0%Aug 6, 2026
CVE-2026-67261: Improper Neutralization of Special Elements used in an OS Command9.8 CriticalN/A2%Aug 6, 2026
CVE-2026-66712: Missing Authorization7.5 HighN/A0%Aug 6, 2026
CVE-2026-66711: Improper Neutralization of Input During Web Page Generation7.1 HighN/A0%Aug 6, 2026
CVE-2026-66710: Improper Control of Filename for Include/Require Statement in PHP Program8.1 HighN/A0%Aug 6, 2026
CVE-2026-66709: Improper Control of Generation of Code9.1 CriticalN/A1%Aug 6, 2026
CVE-2026-66708: Missing Authorization8.2 HighN/A0%Aug 6, 2026
CVE-2026-66707: Improper Neutralization of Input During Web Page Generation7.1 HighN/A0%Aug 6, 2026
CVE-2026-66706: Improper Neutralization of Input During Web Page Generation5.9 MediumN/A0%Aug 6, 2026
CVE-2026-66705: Improper Neutralization of Input During Web Page Generation7.1 HighN/A0%Aug 6, 2026
CVE-2026-66703: Improper Neutralization of Input During Web Page Generation6.5 MediumN/A0%Aug 6, 2026
CVE-2026-66702: Improper Neutralization of Input During Web Page Generation7.1 HighN/A0%Aug 6, 2026
CVE-2026-66701: Missing Authorization5.3 MediumN/A0%Aug 6, 2026
CVE-2026-66699: Missing Authorization5.3 MediumN/A0%Aug 6, 2026
CVE-2026-66696: Insertion of Sensitive Information Into Sent Data4.3 MediumN/A0%Aug 6, 2026
CVE-2026-66695: Path Traversal: '.../...//'6.5 MediumN/A0%Aug 6, 2026
CVE-2026-66694: Improper Neutralization of Input During Web Page Generation7.1 HighN/A0%Aug 6, 2026
CVE-2026-66692: Authorization Bypass Through User-Controlled Key4.3 MediumN/A0%Aug 6, 2026
CVE-2026-66690: Improper Neutralization of Input During Web Page Generation7.1 HighN/A0%Aug 6, 2026
CVE-2026-66688: Improper Neutralization of Input During Web Page Generation6.5 MediumN/A0%Aug 6, 2026
CVE-2026-66686: Cross-Site Request Forgery (CSRF)6.5 MediumN/A0%Aug 6, 2026
CVE-2026-66685: Insertion of Sensitive Information Into Sent Data5.3 MediumN/A0%Aug 6, 2026
24701-24725 of 576436