The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
CVE-2026-66066:KindaRails2Shell: CVE-2026-66066, Critical Arbitrary File Read and Possible Remote Code Execution in Ruby on Rails
Blog ↗CVE details
CVE-2026-59309:Critical VMware vCenter Vulnerabilities Allow Authentication Bypass and Remote Code Execution (CVE-2026-59309, CVE-2026-59310)
Blog ↗CVE details
CVE-2026-63077:Critical unauthenticated remote code execution in JetBrains TeamCity
Blog ↗CVE details
CVE-2026-16232:Critical Check Point SmartConsole Authentication Bypass Exploited in the Wild
Blog ↗CVE details
CVE-2026-63030:wp2shell a Critical Remote Code Execution Vulnerability in WordPress Core
Blog ↗CVE details
CVE-2026-58644:Microsoft SharePoint Server Unauthenticated Remote Code Execution Vulnerability Exploited in the Wild
Blog ↗CVE details
TitleEitWModules
CVE-2026-13425: Improper Neutralization of Input During Web Page Generation7.2 HighN/A0%Jul 29, 2026
CVE-2026-47406: Authorization Bypass Through User-Controlled Key8.1 HighN/A0%Jul 21, 2026
CVE-2026-61440: Missing Authorization6.5 Medium7.1 High0%Jul 15, 2026
CVE-2026-13253: Improper Neutralization of Input During Web Page Generation6.4 MediumN/A0%Jul 9, 2026
CVE-2026-54164: Access of Resource Using Incompatible Type6.5 MediumN/A0%Jul 1, 2026
CVE-2026-9179: Improper Neutralization of Special Elements used in an SQL Command7.5 HighN/A0%Jun 24, 2026
CVE-2026-2470: Incorrect Authorization4.3 MediumN/A0%Jun 13, 2026
CVE-2026-49756: Improper Neutralization of CRLF SequencesN/A2.1 Low0%Jun 8, 2026
CVE-2026-42359: Deserialization of Untrusted Data8.8 HighN/A0%Jun 1, 2026
CVE-2026-9757: Improper Neutralization of Special Elements used in an SQL Command7.5 HighN/A0%May 30, 2026
CVE-2026-34358: Improper Access Control8.1 HighN/A0%May 19, 2026
CVE-2026-42461: Missing Authorization7.5 High8.7 High0%May 9, 2026
CVE-2026-42202: Improper Authorization6.5 MediumN/A0%May 8, 2026
CVE-2026-41271: Server-Side Request Forgery (SSRF)8.3 HighN/A0%Apr 23, 2026
CVE-2026-4812: Missing Authorization5.3 MediumN/A0%Apr 15, 2026
CVE-2026-4896: Authorization Bypass Through User-Controlled Key8.1 HighN/A0%Apr 4, 2026
CVE-2026-30868: Cross-Site Request Forgery (CSRF)6.3 MediumN/A0%Mar 11, 2026
CVE-2026-1273: Server-Side Request Forgery (SSRF)7.2 HighN/A0%Mar 4, 2026
CVE-2026-27482: Declaration of Catch for Generic Exception5.9 MediumN/A0%Feb 21, 2026
CVE-2026-26317: Cross-Site Request Forgery (CSRF)7.1 HighN/A0%Feb 19, 2026
CVE-2025-12356: Missing Authorization4.3 MediumN/A0%Feb 18, 2026
CVE-2025-12346: Unrestricted Upload of File with Dangerous Type6.3 Medium2.1 Low0%Oct 28, 2025
CVE-2025-9432: Improper Neutralization of Input During Web Page Generation4.3 Medium2.1 Low0%Aug 26, 2025
CVE-2025-9429: Improper Neutralization of Input During Web Page Generation3.5 Low2.0 Low0%Aug 26, 2025
CVE-2025-53631: Improper Neutralization of Input During Web Page Generation5.4 Medium5.3 Medium0%Aug 14, 2025
1-25 of 77