The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-109469: Microsoft Entra Device Registration: Authorization bypass through user-controlled key in Entra Device Registration allows an unauthorized attacker to…10.0 CriticalN/AN/ANov 6, 2026
CVE-2026-59105: Jumis Pro SIA Jumis: Jumis (formerly Tildes Jumis) creates and uses a Microsoft SQL Server login named ##Tilde_JumisAdmin## whose password…9.8 Critical9.3 CriticalN/ANov 6, 2026
CVE-2026-112337: wazuh: Wazuh from 3.7.0 before 4.14.9 contains a server-side request forgery vulnerability in the Azure wodle…3.7 Low6.3 MediumN/ANov 6, 2026
CVE-2026-110930: OpenAI: Codex Desktop for Windows does not correctly check quotation marks in project paths from Windows Explorer8.0 HighN/A0%Nov 5, 2026
CVE-2026-122220: Authentication Bypass by Capture-replay7.4 High9.1 Critical0%Nov 4, 2026
CVE-2026-59268: Out-of-bounds Write7.3 HighN/A0%Nov 4, 2026
CVE-2026-110288: Cross-Site Request Forgery (CSRF)N/A5.3 Medium0%Nov 3, 2026
CVE-2026-77691: Improper Neutralization of Special Elements used in an OS Command8.1 HighN/A1%Nov 3, 2026
CVE-2026-105769: Origin Validation Error9.3 CriticalN/A0%Nov 2, 2026
CVE-2026-118147: Improper Certificate Validation7.4 HighN/A1%Oct 31, 2026
CVE-2026-107759: Improper Neutralization of Input During Web Page Generation7.2 HighN/A0%Oct 31, 2026
CVE-2026-69446: Incorrect Authorization4.4 MediumN/A0%Oct 30, 2026
CVE-2026-107239: Relative Path TraversalN/A8.8 High1%Oct 29, 2026
CVE-2026-107238: Deserialization of Untrusted DataN/A8.7 High0%Oct 29, 2026
CVE-2023-22793: Deserialization of Untrusted DataN/A9.3 Critical1%Oct 29, 2026
CVE-2026-96203: Use After Free8.8 HighN/A1%Oct 29, 2026
CVE-2026-96199: Heap-based Buffer Overflow8.8 HighN/A1%Oct 29, 2026
CVE-2026-96198: Heap-based Buffer Overflow8.8 HighN/A1%Oct 29, 2026
CVE-2026-96196: Incomplete List of Disallowed Inputs8.8 HighN/A1%Oct 29, 2026
CVE-2026-96192: Use After Free8.8 HighN/A1%Oct 29, 2026
CVE-2026-96187: Access of Resource Using Incompatible Type7.4 HighN/A1%Oct 29, 2026
CVE-2026-88090: Access of Resource Using Incompatible Type5.4 MediumN/A0%Oct 29, 2026
CVE-2026-88078: Improper Verification of Cryptographic Signature4.3 MediumN/A0%Oct 29, 2026
CVE-2026-88077: Integer Overflow or Wraparound8.8 HighN/A1%Oct 29, 2026
CVE-2026-85899: Use After Free8.1 HighN/A1%Oct 29, 2026
1-25 of 16881
›