Metasploit | Penetration Testing Software, Pen Testing Security

Knowledge is power, especially when it’s shared. A collaboration between the open source community and Rapid7, Metasploit helps security teams do more than just verify vulnerabilities, manage security assessments, and improve security awareness; it empowers and arms defenders to always stay one step (or two) ahead of the game.

Title	Date	Author
Land #21497, adds authenticated arbitrary OS command injection in Activemq jolokia (CVE-2026-34197) Activemq jolokia exploit (CVE-2026-34197)	May 29, 2026	msutovsky-r7
Land #21504, adds CVE numbers to modules add CVEs to modules	May 27, 2026	msutovsky-r7
Land #21506, adds guard for wsl_startup_folder persistence guard wsl startup_folder persistence	May 27, 2026	msutovsky-r7
Land #21434, adds Dirtyfrag privilege escalation modules (CVE-2026-43284, CVE-2026-43500) Dirty Frag Linux Local Privilege Escalation (CVE-2026-43284)(CVE-2026-43500)	May 21, 2026	msutovsky-r7
Land #21155, adds exploit module for Dompdf (CVE-2022-28368) Add exploit module for Dompdf RCE (CVE-2022-28368)	May 21, 2026	msutovsky-r7
Land #21035, adds module for arbitrary code execution in Barracuda ESG (CVE-2023-7102) Add Barracuda ESG Spreadsheet::ParseExcel RCE exploit (CVE-2023-7102)	May 19, 2026	msutovsky-r7

Title

Date

Author

Land #21497, adds authenticated arbitrary OS command injection in Activemq jolokia (CVE-2026-34197) Activemq jolokia exploit (CVE-2026-34197)

May 29, 2026

msutovsky-r7

Land #21504, adds CVE numbers to modules add CVEs to modules

May 27, 2026

msutovsky-r7

Land #21506, adds guard for wsl_startup_folder persistence guard wsl startup_folder persistence

May 27, 2026

msutovsky-r7

Land #21434, adds Dirtyfrag privilege escalation modules (CVE-2026-43284, CVE-2026-43500) Dirty Frag Linux Local Privilege Escalation (CVE-2026-43284)(CVE-2026-43500)

May 21, 2026

msutovsky-r7

Land #21155, adds exploit module for Dompdf (CVE-2022-28368) Add exploit module for Dompdf RCE (CVE-2022-28368)

May 21, 2026

msutovsky-r7

Land #21035, adds module for arbitrary code execution in Barracuda ESG (CVE-2023-7102) Add Barracuda ESG Spreadsheet::ParseExcel RCE exploit (CVE-2023-7102)

May 19, 2026

msutovsky-r7

Latest Pull Requests

Name	Labels	Author
Add Missing EDB References	rn-enhancement	h00die
IPMI Scanner Bug Fixes	rn-enhancement	zeroSteiner
Default to the most recent session	needs-more-information	u7k4rs6
Add ultimate Linux RC4 packer evasion module		manikantagoudgoud447
Fixes two bugs in the single shell riscv payloads	rn-payload-enhancement , riscv	bwatters-r7
Update the Attic label definition	docs , rn-no-release-notes	jheysel-r7

Name

Labels

Author

Add Missing EDB References

rn-enhancement

h00die

IPMI Scanner Bug Fixes

rn-enhancement

zeroSteiner

Default to the most recent session

needs-more-information

u7k4rs6

Add ultimate Linux RC4 packer evasion module

manikantagoudgoud447

Fixes two bugs in the single shell riscv payloads

rn-payload-enhancement , riscv

bwatters-r7

Update the Attic label definition

docs , rn-no-release-notes

jheysel-r7

Create a Pull Request

Recent Blog Posts

Fri Jun 05 2026

Weekly Metasploit Update: Apache ActiveMQ RCE, Gogs Rebase RCE, and Windows Kernel Pointer Enum

When Open Source is a bit too OpenSeveral fun modules landed this week, including an Apache RCE, Windows Kernel pointer collection, and Gogs RCE via naming. Leading off is Gogs' RCE that allows an attacker to execute commands...

Fri May 29 2026

Metasploit Wrap Up 05/29/2026

More Linux LPEsHark the age of the Linux LPE has arrived. This week’s release follows up on recent work bringing new Linux LPEs to Metasploit users. Copy Fail seemed to have kicked off a trend of similar bugs and hot on its h...

Fri May 22 2026

Metasploit Wrap Up 05/22/2026

Another week, another authentication bypassOur humble Metasploit weekly(ish) blog has been blessed with a new network component vulnerability. The dynamic duo of @sfewer-r7 and @jburgess-r7 have discovered and authored the ad...

View More Metasploit Blog Posts