The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-85736: chartbrew: Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create…8.1 HighN/AN/ANov 6, 2026
CVE-2026-71863: freedomofpress securedrop: SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept…2.6 LowN/AN/ANov 6, 2026
CVE-2026-118670: OHIF Viewers: OHIF Viewers is a zero-footprint DICOM viewer with shared extension packages8.8 HighN/AN/ANov 6, 2026
CVE-2026-123836: JetBrains Datalore: In JetBrains Datalore before 2026.4 workspace collaborators could obtain the owner's SSH private key via Git backup8.8 HighN/AN/ANov 6, 2026
CVE-2026-53980: charmbracelet wish: Charmbracelet wish before 2.0.5 contains a path traversal vulnerability in the git middleware (charm.land/wish/v2) that…8.1 High8.6 HighN/ANov 6, 2026
CVE-2026-123037: Red Hat: A flaw was found in the ansible-core user module6.7 MediumN/A0%Nov 6, 2026
CVE-2026-111062: Eugeny russh: russh is a Rust SSH client and server libraryN/A2.3 Low0%Nov 5, 2026
CVE-2026-123158: OpenBSD OpenSSH: sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password…8.1 HighN/A1%Nov 5, 2026
CVE-2026-121746: nvm-sh nvm: Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions5.5 Medium6.7 Medium0%Nov 4, 2026
CVE-2026-122235: janhq jan: Jan from 0.8.5 before 0.8.8 contains a workspace guard bypass vulnerability in the agent-tools gate.rs that allows…4.7 Medium5.7 Medium0%Nov 4, 2026
CVE-2026-91168: Authorization Bypass Through User-Controlled Key6.8 MediumN/A0%Nov 4, 2026
CVE-2026-91163: Generation of Error Message Containing Sensitive Information3.7 LowN/A0%Nov 4, 2026
CVE-2026-87043: Use of Insufficiently Random Values4.8 MediumN/A0%Nov 4, 2026
CVE-2026-118237: Out-of-bounds ReadN/A5.3 Medium0%Nov 3, 2026
CVE-2026-104608: Use After FreeN/A7.7 High0%Nov 3, 2026
CVE-2026-121621: Improper Neutralization of Special Elements used in an OS Command8.8 HighN/A2%Nov 3, 2026
CVE-2026-95747: Undefined Security Weakness7.5 HighN/A0%Nov 3, 2026
CVE-2026-82976: Exposure of Information Through Directory Listing7.1 HighN/A0%Nov 3, 2026
CVE-2026-120461: Authorization Bypass Through User-Controlled Key8.8 High8.7 High0%Nov 2, 2026
CVE-2026-120322: Improper Limitation of a Pathname to a Restricted Directory9.9 Critical8.6 High1%Nov 2, 2026
CVE-2026-120200: Authorization Bypass Through User-Controlled Key5.4 Medium5.3 Medium0%Oct 31, 2026
CVE-2026-63201: Use of Externally-Controlled Format StringN/A7.1 High0%Oct 30, 2026
CVE-2026-116249: Improper Limitation of a Pathname to a Restricted Directory8.4 High7.2 High0%Oct 30, 2026
CVE-2026-116242: Insufficiently Protected Credentials9.6 Critical7.1 High0%Oct 30, 2026
CVE-2026-84243: Improper Limitation of a Pathname to a Restricted Directory7.0 HighN/A0%Oct 30, 2026
1-25 of 2138
›