The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-105822: TP-Link Systems Inc. Tapo Cloud Service: The Tapo Cloud MQTT proxy contains a server-side request forgery (SSRF) vulnerability because it accepts a…N/A8.3 HighN/ANov 3, 2026
CVE-2026-105821: TP-Link Systems Inc. Tapo Cloud Service: The Tapo Cloud MQTT broker contains a broken access control vulnerability in a proxy topic used by authenticated Tapo…N/A8.3 HighN/ANov 3, 2026
CVE-2026-63478: isomorphic-git: isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers5.3 MediumN/AN/ANov 3, 2026
CVE-2026-63500: yeti-platform yeti: Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline7.1 HighN/AN/ANov 3, 2026
CVE-2026-120567: MongoDB Entity Framework Core Provider: The MongoDB Entity Framework Core provider does not neutralize special elements when it places a caller-supplied value…5.4 Medium2.3 LowN/ANov 3, 2026
CVE-2026-63502: yeti-platform yeti: Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline8.3 HighN/AN/ANov 3, 2026
CVE-2026-93325: Docker Docker Buildx: Buildx bake requires the user to grant entitlements with --allow or an interactive prompt before a build reaches…N/A7.3 HighN/ANov 3, 2026
CVE-2026-63482: yeti-platform yeti: Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline7.5 HighN/AN/ANov 3, 2026
CVE-2026-63489: yeti-platform yeti: Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline7.6 HighN/AN/ANov 3, 2026
CVE-2026-63501: Agamnentzar ag-psd: ag-psd is a JavaScript library for reading and writing Photoshop Document files7.5 HighN/AN/ANov 3, 2026
CVE-2026-110826: team-alembic ash_authentication: Improper Session Invalidation after Authentication Credential Change vulnerability in team-alembic ash_authentication…N/A6.3 MediumN/ANov 3, 2026
CVE-2026-63471: koxudaxi fastapi-code-generator: fastapi-code-generator creates FastAPI applications from OpenAPI filesN/A9.3 CriticalN/ANov 3, 2026
CVE-2026-82976: Red Hat: A flaw was found in the image-customization-controller used in OpenShift's bare metal provisioning stack7.1 HighN/AN/ANov 3, 2026
CVE-2026-63417: armurox loggingredactor: Logging Redactor is a Python library designed to redact sensitive data in logs based on regex patterns and / or…N/A8.2 HighN/ANov 3, 2026
CVE-2026-63197: traPtitech traQ: traQ is a messenger application built for Digital Creators Club traP7.3 HighN/AN/ANov 3, 2026
CVE-2026-57154: opnsense core: OPNsense is a FreeBSD based firewall and routing platform8.1 HighN/AN/ANov 3, 2026
CVE-2026-46487: geonetwork core-geonetwork: GeoNetwork is a catalog application to manage spatially referenced resources7.5 HighN/AN/ANov 3, 2026
CVE-2026-39379: geonetwork core-geonetwork: GeoNetwork is a catalog application to manage spatially referenced resources7.1 HighN/AN/ANov 3, 2026
CVE-2026-121652: AWS maplibre-gl-js-amplify: Cross-site scripting (XSS) issue in AWS Amplify maplibre-gl-js-amplify before 4.0.3 might allow remote authenticated…5.4 Medium4.8 MediumN/ANov 3, 2026
CVE-2026-121501: mathurvishal CloudClassroom-PHP-Project: A vulnerability was determined in mathurvishal CloudClassroom-PHP-Project6.3 Medium2.1 LowN/ANov 3, 2026
CVE-2026-120956: MongoDB C Driver: The MongoDB C Driver does not validate the type or format of a namespace field returned by the server in a query…7.1 High7.1 HighN/ANov 3, 2026
CVE-2026-120955: MongoDB C Driver: The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain…7.5 High8.7 HighN/ANov 3, 2026
CVE-2026-120684: MongoDB C Driver: A memory-initialization flaw in the legacy GridFS file handling of the MongoDB C Driver can cause uninitialized process…6.5 Medium6.0 MediumN/ANov 3, 2026
CVE-2026-120678: MongoDB C Driver: A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to…7.5 High8.7 HighN/ANov 3, 2026
CVE-2026-120673: MongoDB Rust Driver: A component of the MongoDB Rust Driver that records diagnostic tracing data can capture command content before…5.5 Medium6.8 MediumN/ANov 3, 2026
1-25 of 528356
›