The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-113874: SmileCDR HAPI FHIR: SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted…8.1 High8.6 HighN/AOct 22, 2026
CVE-2026-113873: SmileCDR HAPI FHIR: SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send…7.5 High8.7 HighN/AOct 22, 2026
CVE-2026-97635: Agent Zero: The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads8.1 High8.6 HighN/AOct 22, 2026
CVE-2026-115516: KNIME KNIME Business Hub SaaS: An incorrect authorization issue exposes basic account information to unauthorized remote users in KNIME Business Hub…N/A6.9 MediumN/AOct 22, 2026
CVE-2026-77156: Checkmarx github.com/checkmarx/ast-cli: Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS (used when…6.4 Medium6.3 MediumN/AOct 22, 2026
CVE-2026-108357: PHPOffice PhpSpreadsheet: PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet filesN/A8.8 HighN/AOct 22, 2026
CVE-2026-13599: ABB Ability Edgenius: Missing authentication for critical function vulnerability in ABB Ability Edgenius7.8 High5.8 MediumN/AOct 22, 2026
CVE-2026-114611: schorschii OCO-Server: OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile…9.1 CriticalN/AN/AOct 22, 2026
CVE-2026-108359: PHPOffice PhpSpreadsheet: PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet filesN/A8.7 HighN/AOct 22, 2026
CVE-2026-93336: Canonical Juju: Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a…N/A7.1 HighN/AOct 22, 2026
CVE-2026-108358: PHPOffice PhpSpreadsheet: PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet filesN/A8.8 HighN/AOct 22, 2026
CVE-2026-108360: PHPOffice PhpSpreadsheet: PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files6.4 MediumN/AN/AOct 22, 2026
CVE-2026-54238: supabase realtime: Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets3.1 LowN/AN/AOct 22, 2026
CVE-2026-114610: py-pdf fpdf2: fpdf2 is a PDF creation library for Python6.5 MediumN/AN/AOct 22, 2026
CVE-2026-114609: py-pdf fpdf2: fpdf2 is a PDF creation library for Python5.8 MediumN/AN/AOct 22, 2026
CVE-2026-97631: TianoCore EDK2: EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and…N/A9.5 CriticalN/AOct 22, 2026
CVE-2026-75508: graphql-python graphql-core: GraphQL-core is a Python port of the GraphQL.js reference implementation7.5 HighN/AN/AOct 22, 2026
CVE-2026-75507: graphql-python graphql-core: GraphQL-core is a Python port of the GraphQL.js reference implementation7.5 HighN/AN/AOct 22, 2026
CVE-2026-67597: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.N/AN/AN/AOct 22, 2026
CVE-2026-115513: OpenCATS: OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated…8.7 High6.3 MediumN/AOct 22, 2026
CVE-2026-115502: KNIME KNIME Business Hub: A missing authorization check allows anyone having access to a "link without login" for a DataApp to list and…N/A6.3 MediumN/AOct 22, 2026
CVE-2026-115416: AWS Amazon Athena: Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated…7.7 High6.3 MediumN/AOct 22, 2026
CVE-2026-114608: pylint-dev pylint: Pylint is a static code analyser for PythonN/A5.4 MediumN/AOct 22, 2026
CVE-2026-114607: better-auth: Better Auth is an authentication and authorization library for TypeScript9.1 CriticalN/AN/AOct 22, 2026
CVE-2026-114606: jgraph drawio-desktop: draw.io Desktop is the official Electron build of draw.ioN/A5.6 MediumN/AOct 22, 2026
1-25 of 416054
›