The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
CVE-2026-55040:Rapid7 Analysis: Microsoft SharePoint JWT Token Authentication Bypass (CVE-2026-55040)
Blog ↗CVE details
CVE-2026-63520:Microsoft SharePoint Remote Code Execution (FIXED)
Blog ↗CVE details
CVE-2026-63077:Rapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077)
Blog ↗CVE details
CVE-2026-18577:N-able N-central Authentication Bypass Exploited in the Wild
Blog ↗CVE details
CVE-2026-66066:Rapid7 Analysis: KindaRails2Shell (CVE-2026-66066)
Blog ↗CVE details
CVE-2026-66066:KindaRails2Shell: CVE-2026-66066, Critical Arbitrary File Read and Possible Remote Code Execution in Ruby on Rails
Blog ↗CVE details
TitleEitWModules
CVE-2026-12949: Wishlist Member: The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data…9.8 CriticalN/AN/AAug 14, 2026
CVE-2026-73659: triggerdotdev trigger.dev: Trigger.dev is the open-source platform for building AI workflows in TypeScript8.1 HighN/AN/AAug 13, 2026
CVE-2026-73658: triggerdotdev trigger.dev: Trigger.dev is a platform for building and deploying fully managed AI agents and workflows8.2 HighN/AN/AAug 13, 2026
CVE-2026-73657: triggerdotdev trigger.dev: Trigger.dev is a platform for building and deploying fully managed AI agents and workflows4.2 MediumN/AN/AAug 13, 2026
CVE-2026-73428: basecamp trix: Trix is a what-you-see-is-what-you-get rich text editor for everyday writing4.6 MediumN/AN/AAug 13, 2026
CVE-2026-72851: budibase server: Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with…10.0 Critical9.0 CriticalN/AAug 13, 2026
CVE-2026-72841: openwrt luci: luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload, allowing authenticated…9.9 Critical9.4 CriticalN/AAug 13, 2026
CVE-2026-18741: Froiden Worksuite SaaS: Worksuite SaaS versions prior to 6.0.14 contains a stored cross-site scripting vulnerability in the Asset Management…4.8 Medium4.6 MediumN/AAug 13, 2026
CVE-2026-72659: Elastic Kibana: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive…6.5 MediumN/AN/AAug 13, 2026
CVE-2026-72653: Elastic Kibana: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive…6.5 MediumN/AN/AAug 13, 2026
CVE-2026-72651: Elastic Kibana: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive…6.5 MediumN/AN/AAug 13, 2026
CVE-2026-72647: Elastic Elasticsearch: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested…6.5 MediumN/AN/AAug 13, 2026
CVE-2026-73651: typeorm: TypeORM is a TypeScript and JavaScript ORM for Node.js that supports PostgreSQL, MySQL, MariaDB, SQLite, SQL Server,…5.7 MediumN/AN/AAug 13, 2026
CVE-2026-73564: fatedier frp: frp is a fast reverse proxyN/A8.7 HighN/AAug 13, 2026
CVE-2024-58374: Hongjing Century e-HR: Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet endpoint that allows…7.5 High8.7 HighN/AAug 13, 2026
Amazon Linux AMI 2: CVE-2026-48702: Security patch for runfinch-finch (ALAS2DOCKER-2026-137)7.5 HighN/AN/AAug 13, 2026
CVE-2026-73628: s9y Serendipity: Serendipity versions >= 2.3.5 and <= 2.6.0 contain a reflected cross-site scripting vulnerability in the search…6.1 Medium5.3 MediumN/AAug 13, 2026
CVE-2026-18727: Red Hat: A flaw was found in open-iscsi's iscsiuio component6.5 MediumN/A0%Aug 12, 2026
CVE-2026-18726: Red Hat: A flaw was found in open-iscsi6.5 MediumN/A0%Aug 12, 2026
CVE-2026-73427: Improper Neutralization of Input During Web Page GenerationN/A2.1 Low0%Aug 12, 2026
CVE-2026-73433: Integer Underflow (Wrap or Wraparound)6.6 MediumN/A0%Aug 12, 2026
CVE-2026-73332: Improper Neutralization of Special Elements used in an SQL Command8.7 High9.2 Critical0%Aug 12, 2026
CVE-2026-73331: Improper Neutralization of Special Elements used in an SQL Command7.1 High7.1 High0%Aug 12, 2026
CVE-2026-73329: Improper Neutralization of Input During Web Page Generation8.7 High9.2 Critical0%Aug 12, 2026
CVE-2026-49466: Improper Neutralization of Input During Web Page Generation6.5 MediumN/A0%Aug 12, 2026
1-25 of 5810