Metasploit | Penetration Testing Software, Pen Testing Security

Knowledge is power, especially when it’s shared. A collaboration between the open source community and Rapid7, Metasploit helps security teams do more than just verify vulnerabilities, manage security assessments, and improve security awareness; it empowers and arms defenders to always stay one step (or two) ahead of the game.

Title	Date	Author
Land #21434, adds Dirtyfrag privilege escalation modules (CVE-2026-43284, CVE-2026-43500) Dirty Frag Linux Local Privilege Escalation (CVE-2026-43284)(CVE-2026-43500)	May 21, 2026	msutovsky-r7
Land #21155, adds exploit module for Dompdf (CVE-2022-28368) Add exploit module for Dompdf RCE (CVE-2022-28368)	May 21, 2026	msutovsky-r7
Land #21035, adds module for arbitrary code execution in Barracuda ESG (CVE-2023-7102) Add Barracuda ESG Spreadsheet::ParseExcel RCE exploit (CVE-2023-7102)	May 19, 2026	msutovsky-r7
Land #21362, adds module for Dolibarr ERP/CRM authenticated RCE (CVE-2023-30253) Add Dolibarr ERP/CRM authenticated RCE module (CVE-2023-30253)	May 14, 2026	msutovsky-r7
Land #21041, adds module for Gestioip RCE (CVE 2024-48760) Add exploit module for Gestioip3.5.7 RCE (CVE 2024-48760)	May 14, 2026	msutovsky-r7

Title

Date

Author

Land #21434, adds Dirtyfrag privilege escalation modules (CVE-2026-43284, CVE-2026-43500) Dirty Frag Linux Local Privilege Escalation (CVE-2026-43284)(CVE-2026-43500)

May 21, 2026

msutovsky-r7

Land #21155, adds exploit module for Dompdf (CVE-2022-28368) Add exploit module for Dompdf RCE (CVE-2022-28368)

May 21, 2026

msutovsky-r7

Land #21035, adds module for arbitrary code execution in Barracuda ESG (CVE-2023-7102) Add Barracuda ESG Spreadsheet::ParseExcel RCE exploit (CVE-2023-7102)

May 19, 2026

msutovsky-r7

Land #21362, adds module for Dolibarr ERP/CRM authenticated RCE (CVE-2023-30253) Add Dolibarr ERP/CRM authenticated RCE module (CVE-2023-30253)

May 14, 2026

msutovsky-r7

Land #21041, adds module for Gestioip RCE (CVE 2024-48760) Add exploit module for Gestioip3.5.7 RCE (CVE 2024-48760)

May 14, 2026

msutovsky-r7

Latest Pull Requests

Name	Labels	Author
Remove LDAP monkey patches	rn-no-release-notes , additional-testing-required	adfoster-r7
Fix mcp server test failure	rn-fix	adfoster-r7
Unix mixin: Add user_from_home_subdir()		g0tmi1k
Fix msfdb installation error on windows	rn-fix	adfoster-r7
Fix msfdb crash on windows	rn-fix	adfoster-r7
Fix FTP anonymous login detection when ANONYMOUS_LOGIN option is enabled		kuro-toji

Name

Labels

Author

Remove LDAP monkey patches

rn-no-release-notes , additional-testing-required

adfoster-r7

Fix mcp server test failure

rn-fix

adfoster-r7

Unix mixin: Add user_from_home_subdir()

g0tmi1k

Fix msfdb installation error on windows

rn-fix

adfoster-r7

Fix msfdb crash on windows

rn-fix

adfoster-r7

Fix FTP anonymous login detection when ANONYMOUS_LOGIN option is enabled

kuro-toji

Create a Pull Request

Recent Blog Posts

Fri May 22 2026

Metasploit Wrap Up 05/22/2026

Another week, another authentication bypassOur humble Metasploit weekly(ish) blog has been blessed with a new network component vulnerability. The dynamic duo of @sfewer-r7 and @jburgess-r7 have discovered and authored the ad...

Fri May 15 2026

Metasploit Wrap-Up 05/15/2026

Weaponizing a text editor for fun and profitGather round, dear readers, because today, we (by we, we mean @h00die) dropped the ultimate persistence mechanism: Vim plugin persistence. And honestly, calling it "persistence" fee...

Fri May 08 2026

Metasploit Wrap-Up 05/08/2026

Spring cleanupThis week’s Metasploit updates focused on foundational improvements and expanded target reach. Key enhancements were made to the recently released Copy Fail exploit module, which now benefits from payload fixes ...

View More Metasploit Blog Posts