The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-113730: orphan-oss ognl: OGNL is an Object Graph Navigation Library for Java5.6 MediumN/AN/AOct 20, 2026
CVE-2026-90800: Apache Software Foundation Apache CouchDB: Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read…N/A8.1 HighN/AOct 20, 2026
CVE-2026-90799: Apache Software Foundation Apache CouchDB: Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user…N/A1.3 LowN/AOct 20, 2026
CVE-2026-90798: Apache Software Foundation Apache CouchDB: A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a…N/A0.6 LowN/AOct 20, 2026
CVE-2026-90797: Apache Software Foundation Apache CouchDB: An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote…N/A7.7 HighN/AOct 20, 2026
CVE-2026-86471: Apache Software Foundation Apache CouchDB: An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server…N/A9.3 CriticalN/AOct 20, 2026
CVE-2026-107755: Apache Software Foundation Apache CouchDB: Insufficient filtering of credentials in the _replicator database in Apache CouchDB 3.5.2 and below on all platforms…N/A6.0 MediumN/AOct 20, 2026
CVE-2026-93446: Apache Software Foundation Apache Tomcat: Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittentlyN/AN/AN/AOct 20, 2026
CVE-2026-88041: Apache Software Foundation Apache Tomcat: Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer information from a previous request to leak into a…N/AN/AN/AOct 20, 2026
CVE-2026-80353: Apache Software Foundation Apache Tomcat: Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for…N/AN/AN/AOct 20, 2026
CVE-2026-74049: Apache Software Foundation Apache Tomcat: Execution After Redirect (EAR) vulnerability in Apache TomcatN/AN/AN/AOct 20, 2026
CVE-2026-74048: Apache Software Foundation Apache Tomcat: Not Failing Securely ('Failing Open') vulnerability in Apache TomcatN/AN/AN/AOct 20, 2026
CVE-2026-103119: Apache Software Foundation Apache Tomcat: Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response…9.1 CriticalN/AN/AOct 20, 2026
CVE-2026-101356: Apache Software Foundation Apache Tomcat: Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous…9.1 CriticalN/AN/AOct 20, 2026
CVE-2026-101296: Apache Software Foundation Apache Tomcat: A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a…N/A9.1 CriticalN/AOct 20, 2026
CVE-2026-105941: Red Hat streams for Apache Kafka 3: The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes…8.1 HighN/AN/AOct 20, 2026
CVE-2026-105949: Red Hat: Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all…8.8 HighN/AN/AOct 20, 2026
CVE-2026-105312: Red Hat: A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an…9.9 CriticalN/AN/AOct 20, 2026
CVE-2026-105311: Red Hat: The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console…7.7 HighN/AN/AOct 20, 2026
CVE-2026-108089: Apache Software Foundation Apache Cocoon: ** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system information to an unauthorized control sphere…7.5 HighN/AN/AOct 20, 2026
CVE-2026-108088: Apache Software Foundation Apache Cocoon: ** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive information vulnerability in Apache CocoonN/AN/AN/AOct 20, 2026
CVE-2026-108087: Apache Software Foundation Apache Cocoon: ** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of special elements used in an SQL command ('SQL injection')…N/AN/AN/AOct 20, 2026
CVE-2026-108086: Apache Software Foundation Apache Cocoon: ** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion')…N/AN/AN/AOct 20, 2026
CVE-2026-92287: Apache Software Foundation: Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1N/AN/AN/AOct 20, 2026
CVE-2026-86467: Apache Software Foundation Apache Airflow Amazon provider: Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the…N/AN/AN/AOct 20, 2026
1-25 of 4390
›