The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-109518: Debian, Ubuntu APT: On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic…N/A7.7 HighN/ANov 4, 2026
CVE-2026-119746: ProSoft Technology: ProSoft Technology ICX35 devices (X35-HWC-A and ICX35-HWC-E) contain a login lockout bypass in the integrated module…5.9 Medium8.2 HighN/ANov 4, 2026
CVE-2026-121967: coder: Coder 2.28.0 before 2.29.22, 2.30.0 before 2.34.13, 2.35.0 before 2.35.10, 2.36.0 before 2.36.8, 2.37.0 before 2.37.5,…4.9 Medium2.3 LowN/ANov 4, 2026
CVE-2026-121966: traefik: Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests (and, in 3.7, Ingress NGINX auth-url…8.7 High7.0 HighN/ANov 4, 2026
CVE-2026-121965: parse-community parse-server: Parse Server before 8.6.113 and 9.0.0 before 9.10.6-alpha.5 contains a prototype pollution vulnerability when building…5.3 Medium6.0 MediumN/ANov 4, 2026
CVE-2026-121964: FreeRDP: FreeRDP before 3.32.2 contains a heap-based buffer overflow in the RD Gateway RPC client, where…7.5 High8.7 HighN/ANov 4, 2026
CVE-2026-121963: FreeRDP: FreeRDP before 3.32.2 contains a use-after-free vulnerability in the asynchronous dynamic rdpsnd channel that allows…5.9 Medium8.2 HighN/ANov 4, 2026
CVE-2026-121962: FreeRDP: FreeRDP before 3.32.2 contains a heap buffer overflow in transport_default_read_pdu when handling partial Early User…8.1 High7.2 HighN/ANov 4, 2026
CVE-2026-121961: FreeRDP: FreeRDP before 3.32.2 contains a use-after-free vulnerability in the freerdp-proxy DRDYNVC tracker when intercepting…5.9 Medium8.2 HighN/ANov 4, 2026
CVE-2026-121960: FreeRDP: FreeRDP before 3.32.2 contains a denial of service vulnerability in the NLA-enabled shadow server when a CredSSP…7.5 High8.7 HighN/ANov 4, 2026
CVE-2026-121959: FreeRDP: FreeRDP before 3.32.2 contains an infinite loop vulnerability in websocket_context_read that fails to handle a zero BIO…6.5 Medium7.1 HighN/ANov 4, 2026
CVE-2026-121958: FreeRDP: FreeRDP through 3.32.1 has a heap out-of-bounds write in the RDPGFX client because the delete_surface callback…8.8 High8.7 HighN/ANov 4, 2026
CVE-2026-121957: FreeRDP: FreeRDP before 3.32.2 contains a use-after-free vulnerability that allows malicious RDP servers to corrupt client…7.5 High8.7 HighN/ANov 4, 2026
CVE-2026-121956: FreeRDP: FreeRDP before 3.32.2 contains a double free in the WinPR Kerberos SSPI retrieveSomeTgt function, which installs the…7.5 High8.7 HighN/ANov 4, 2026
CVE-2026-121955: FreeRDP: FreeRDP before 3.32.2 contains a use-after-free vulnerability in Emulate_SCardReleaseContext that frees the emulated…7.5 High8.7 HighN/ANov 4, 2026
CVE-2026-121954: FreeRDP: FreeRDP before 3.32.2 has a heap out-of-bounds write in the planar codec because freerdp_bitmap_planar_context_reset…6.5 Medium7.1 HighN/ANov 4, 2026
CVE-2026-121953: FreeRDP: FreeRDP before 3.32.2 has a use-after-free in the client's rdpgfx dynamic virtual channel: a duplicate-name channel…9.8 Critical9.3 CriticalN/ANov 4, 2026
CVE-2026-121952: FreeRDP: FreeRDP before 3.32.2 has an out-of-bounds write in the proxy because rdp_read_bitmap_cache_v2_capability_set rejects…9.8 Critical9.3 CriticalN/ANov 4, 2026
CVE-2026-121951: FreeRDP: FreeRDP 3.0.0 before 3.32.2 server-side RDP peer input parsing skips the six-byte body of a slow-path input event with…7.5 High8.7 HighN/ANov 4, 2026
CVE-2026-121950: FreeRDP: FreeRDP before 3.32.2 does not check the product of surface dimensions in gdi_CreateSurface when handling an RDPGFX…6.5 Medium7.1 HighN/ANov 4, 2026
CVE-2026-92704: sharpemu: SharpEmu is an experimental PlayStation 5 emulator for Windows and Linux8.3 HighN/AN/ANov 4, 2026
CVE-2026-91163: warp-tech warpgate: Warpgate is an open source SSH, HTTPS, and MySQL bastion host for Linux3.7 LowN/AN/ANov 4, 2026
CVE-2026-66736: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.N/AN/AN/ANov 4, 2026
CVE-2026-39431: n/a: On HP Poly EagleEye Cube USB 1.3.1-001267 devices, one of the API functions available on a management service…N/AN/AN/ANov 4, 2026
CVE-2026-39430: n/a: On HP Poly EagleEye Cube USB 1.3.1-001267 devices, the administrator authentication flow is broken: session management…N/AN/AN/ANov 4, 2026
1-25 of 426484
›