The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Rapid7

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
CVE-2026-63030:wp2shell a Critical Remote Code Execution Vulnerability in WordPress Core
Blog ↗CVE details
CVE-2026-58644:Microsoft SharePoint Server Unauthenticated Remote Code Execution Vulnerability Exploited in the Wild
Blog ↗CVE details
CVE-2026-15409:Rapid7 MDR Team Discovers New SonicWall SMA1000 Zero Days being Actively Exploited (CVE-2026-15409, CVE-2026-15410)
Blog ↗CVE details
CVE-2026-35273:Active Exploitation of Oracle PeopleSoft Zero-Day (CVE-2026-35273)
Blog ↗CVE details
CVE-2026-10520:, CVE-2026-10523 - Multiple critical vulnerabilities affecting Ivanti Sentry
Blog ↗CVE details
CVE-2026-50751:Critical Check Point VPN Zero-Day Exploited in the Wild (CVE-2026-50751)
Blog ↗CVE details
TitleEitWModules
CVE-2026-63767: Deserialization of Untrusted Data9.8 Critical9.3 CriticalN/AJul 20, 2026
CVE-2026-63766: OS Command Injection9.8 Critical9.3 CriticalN/AJul 20, 2026
CVE-2026-53593: Unrestricted Upload of File with Dangerous Type8.8 HighN/AN/AJul 20, 2026
CVE-2026-53592: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')4.6 MediumN/AN/AJul 20, 2026
CVE-2026-53591: Improper Authentication8.6 HighN/AN/AJul 20, 2026
CVE-2026-44231: RT is an open source, enterprise-grade issue and ticket tracking system9.1 CriticalN/AN/AJul 20, 2026
CVE-2026-44230: RT is an open source, enterprise-grade issue and ticket tracking system6.1 MediumN/AN/AJul 20, 2026
CVE-2026-44229: RT is an open source, enterprise-grade issue and ticket tracking system5.4 MediumN/AN/AJul 20, 2026
CVE-2026-16337: Improper Privilege ManagementN/A9.4 CriticalN/AJul 20, 2026
CVE-2026-15788: Improper Link Resolution Before File AccessN/A5.6 MediumN/AJul 20, 2026
CVE-2026-64619: Use of Less Trusted Source7.5 High8.7 HighN/AJul 20, 2026
CVE-2026-64194: Uncontrolled RecursionN/AN/AN/AJul 20, 2026
CVE-2026-64193: Eval InjectionN/AN/AN/AJul 20, 2026
CVE-2026-63771: HTTP Response Splitting7.1 High6.0 MediumN/AJul 20, 2026
CVE-2026-63770: Use of Less Trusted Source7.5 High8.2 HighN/AJul 20, 2026
CVE-2026-63769: Server-Side Request Forgery (SSRF)7.7 High6.3 MediumN/AJul 20, 2026
CVE-2026-63768: URL Redirection to Untrusted Site ('Open Redirect')4.3 Medium5.3 MediumN/AJul 20, 2026
CVE-2026-63731: Server-Side Request Forgery (SSRF)7.7 High6.3 MediumN/AJul 20, 2026
CVE-2026-63730: Server-Side Request Forgery (SSRF)5.0 Medium5.3 MediumN/AJul 20, 2026
CVE-2026-63108: Roo Code through 3.54.0 contains a command injection vulnerability in the auto-approve execute feature that allows…8.8 High7.7 HighN/AJul 20, 2026
CVE-2026-63107: Server-Side Request Forgery (SSRF)7.7 High6.3 MediumN/AJul 20, 2026
CVE-2026-62414: Improper Access ControlN/AN/AN/AJul 20, 2026
CVE-2026-61901: The Joomla extension Hikashop is vulnerable to an open redirect.N/AN/AN/AJul 20, 2026
CVE-2026-61900: Unrestricted Upload of File with Dangerous TypeN/A10.0 CriticalN/AJul 20, 2026
CVE-2026-61425: Authentication Bypass Using an Alternate Path or ChannelN/A9.4 CriticalN/AJul 20, 2026
1-25 of 367828