Issues

• CVE-2026-3180 - WordPress Contest Gallery <= 28.1.4 Unauthenticated Blind SQLi

  suggestion-module
  rapid7/metasploit-framework#21972 · Filter by author 4ravind-b opened on Oct 4, 2026

• Add Support for ESC_CES: NTLM Relay to Certificate Enrollment Services

  suggestion-module
  rapid7/metasploit-framework#21958 · Filter by author jheysel-r7 opened on Sep 30, 2026
  

• gemtek_cpe7000 (EDB-39726) — payload.encoded_exe returns nil on current framework

  question
  rapid7/metasploit-framework#21952 · Filter by author twomack-star opened on Sep 28, 2026

• Add HTTPS support to the streamable HTTP MCP transport

  suggestion-feature
  rapid7/metasploit-framework#21950 · Filter by author cdelafuente-r7 opened on Sep 28, 2026
  3

  

• ExploitDarlenePRO Error: invalid format: dat

  question
  rapid7/metasploit-framework#21945 · Filter by author He1pMee opened on Sep 24, 2026

• ENH: Auxiliary module for Langflow Authentication Bypass vulnerability CVE-2026-93680

  suggestion-module
  rapid7/metasploit-framework#21941 · Filter by author rmhowe425 opened on Sep 22, 2026

• New module suggestion: Arista VeloCloud Orchestrator CVE-2026-93952 (CVSS 10.0) detection + tracking

  rapid7/metasploit-framework#21940 · Filter by author Pushpenderrathore opened on Sep 22, 2026
  1

• ENH: Exploit module for Langflow authenticated Blind Command Injection vulnerability CVE-2026-93674

  suggestion-module
  rapid7/metasploit-framework#21938 · Filter by author rmhowe425 opened on Sep 22, 2026

• RPC module.execute swallows option-validation failures for exploit/evasion, returning a 200 {job_id: nil, uuid: nil} with no structured error (unlike the auxiliary branch)

  bug
  rapid7/metasploit-framework#21927 · Filter by author Panchal-Sahil opened on Sep 20, 2026

• NTLM relay: identity strings keep embedded null bytes when the client negotiates UNICODE

  rapid7/metasploit-framework#21919 · Filter by author Pushpenderrathore opened on Sep 19, 2026

• Add Windows AARCH64 support to fetch payloads

  suggestion-feature
  rapid7/metasploit-framework#21889 · Filter by author bwatters-r7 opened on Sep 8, 2026
  1

  

• ENH: Exploit module for Langflow authenticated Remote Code Execution vulnerability CVE-2026-7873

  suggestion-module
  rapid7/metasploit-framework#21876 · Filter by author rmhowe425 opened on Sep 5, 2026

• ENH: Exploit module for Langflow Unauthenticated Remote Code Execution vulnerability CVE-2026-10134

  suggestion-module
  rapid7/metasploit-framework#21874 · Filter by author rmhowe425 opened on Sep 4, 2026

• Add msftidy_docs to autorun

  rapid7/metasploit-framework#21872 · Filter by author bwatters-r7 opened on Sep 3, 2026
  3

  

• Add DeFangedMode documentation check

  rapid7/metasploit-framework#21871 · Filter by author bwatters-r7 opened on Sep 3, 2026

• ENH: Exploit module for Langflow Unauthenticated Remote Code Execution vulnerability CVE-2026-0769

  suggestion-module
  rapid7/metasploit-framework#21866 · Filter by author rmhowe425 opened on Sep 3, 2026

• ENH: Exploit module for Langflow Unauthenticated Remote Code Execution vulnerability CVE-2026-0768

  suggestion-module
  rapid7/metasploit-framework#21863 · Filter by author rmhowe425 opened on Sep 2, 2026

• ENH: Exploit module for Langflow Authenticated Remote Code Execution vulnerability CVE-2026-5027

  suggestion-feature
  rapid7/metasploit-framework#21855 · Filter by author rmhowe425 opened on Sep 1, 2026

• ENH: Exploit module for Langflow Authenticated Remote Code Execution vulnerability CVE-2026-19286

  suggestion-module
  rapid7/metasploit-framework#21844 · Filter by author rmhowe425 opened on Aug 29, 2026

• weblogic_deserialize_marshalledobject.rb Payload Compatibility Error

  bugStale
  rapid7/metasploit-framework#21821 · Filter by author joeblack6 opened on Aug 25, 2026
  1

• TFTP Fetch Fileless issues

  bugStale
  rapid7/metasploit-framework#21801 · Filter by author bwatters-r7 opened on Aug 21, 2026
  5

• Socket#sendto removed in newer Ruby — affects dozens of call sites in lib/ and modules/

  Stale
  rapid7/metasploit-framework#21777 · Filter by author bandrel opened on Aug 12, 2026
  2

• Should we support socketx0 convention for AARCH Windows/osx/Linux stagers?

  suggestion-feature
  rapid7/metasploit-framework#21774 · Filter by author bwatters-r7 opened on Aug 11, 2026
  4

• Error: No such file or directory @ rb_sysopen - /tmp/d20260809-114545-33t3v9/original/AndroidManifest.xml

  questionStale
  rapid7/metasploit-framework#21764 · Filter by author aakashkumer527-ai opened on Aug 9, 2026
  1

• Error: No such file or directory @ rb_sysopen - /tmp/d20260809-114545-33t3v9/original/AndroidManifest.xml

  bugStale
  rapid7/metasploit-framework#21763 · Filter by author aakashkumer527-ai opened on Aug 9, 2026
  1