CVE-2019-5645High· 7.5▾ MidnightPoC availableBy sending a specially crafted HTTP GET request to a listening Rapid7 Metasploit HTTP handler, an attacker can register an arbitrary regular expression. When evaluated, this malicious handler can either prevent new HTTP handler sessions …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 9.8 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Oct 23.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
42%
42% → 49%
Metasploit ×1 (last check)
By sending a specially crafted HTTP GET request to a listening Rapid7 Metasploit HTTP handler, an attacker can register an arbitrary regular expression. When evaluated, this malicious handler can either prevent new HTTP handler sessions from being established, or cause a resource exhaustion on the Metasploit server.
metasploit_framework <= 5.0.27Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-87690High· 8.8The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relative path traversal vulnerability (CWE-22)
CVE-2026-109681Medium· 4.7Metasploit Framework FTP PASV Response SSRF
CVE-2026-109682Medium· 4.7Metasploit Framework HTTP Redirect Server-Side Request Forgery
CVE-2026-87689Critical· 9.8The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet
CVE-2023-32665Medium· 5.5A flaw was found in GLib
CVE-2023-35945High· 7.5Envoy is a cloud-native high-performance edge/middle/service proxy