How many CVEs have a located fix in rapid7/metasploit-framework?

58 published CVEs have a fix traced to functions in rapid7/metasploit-framework, touching 82 functions across 62 files.

Which function in rapid7/metasploit-framework has been patched by the most CVEs?

initialize in modules/post/apple_ios/gather/ios_image_gather.rb has been changed by 1 CVE fixes, from 2026 to 2026.

How large is a typical CVE fix in rapid7/metasploit-framework?

The median fix changes 143 lines. 3% of fixes change 20 lines or fewer, and 84% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

ruby

#65 of 500 repositories

rapid7/metasploit-framework

Name: rapid7/metasploit-framework: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix October 12, 2026

58

CVE fixes located

Published CVEs

82

Functions patched

Distinct function sites

62

Files patched

Distinct source files

2013–2026

Years covered

By CVE publication date

Overview

58 published CVEs have a fix traced to functions in rapid7/metasploit-framework, the earliest published in 2013. Those fixes changed 82 distinct functions across 62 files, in 95 patch hunks.

Among the 500 repositories tracked here, rapid7/metasploit-framework ranks #65 by the number of CVEs with a located fix.

Most patched functions

Functions in rapid7/metasploit-framework changed by the most CVE fixes.

Most patched files

Files in rapid7/metasploit-framework changed by the most CVE fixes.

1modules/auxiliary/scanner/http/vicidial_multiple_sqli.rb3 CVEs · 1 functions
2modules/exploits/linux/http/cayin_cms_ntp.rb2 CVEs · 1 functions
3modules/exploits/linux/http/denyall_waf_exec.rb2 CVEs · 1 functions
4modules/exploits/multi/http/navigate_cms_rce.rb2 CVEs · 1 functions
5modules/exploits/multi/http/trendmicro_threat_discovery_admin_sys_time_cmdi.rb2 CVEs · 1 functions
6modules/exploits/windows/http/cayin_xpost_sql_rce.rb2 CVEs · 1 functions
7modules/exploits/linux/misc/tplink_archer_a7_c7_lan_rce.rb1 CVEs · 7 functions
8lib/rex/proto/rfb/client.rb1 CVEs · 4 functions
9modules/exploits/linux/misc/drb_remote_codeexec.rb1 CVEs · 4 functions
10lib/msf/core/payload/apk.rb1 CVEs · 3 functions

Fix size

How much code a CVE fix in rapid7/metasploit-framework changes, with backports counted once.

143

Median lines changed

Added plus removed, per CVE

3%

Fixes of 20 lines or fewer

Share of CVE fixes

84%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in rapid7/metasploit-framework, and the functions each fix changed.

Metasploit Framework ios_image_gather Path Traversal Leading to Arbitrary File Write and Code Execution
CVE-2026-87690initialize
High · CVSS 8.8
EPSS 0.4%2026-10-12
Authentication Bypass in Metasploit JSON-RPC Service When DB Health Check Fails
CVE-2026-16895BootError Msf self
Medium · CVSS 5.1
EPSS 0.2%2026-08-27
CVE-2026-77806
CVE-2026-77806MetasploitModule
Critical · CVSS 9.8
EPSS 4.5%2026-08-21
Argument Injection in PHP-CGI
CISA KEV
CVE-2024-4577MetasploitModule
Critical · CVSS 10.0
EPSS 100.0%2024-06-09
Rejetto HTTP File Server 2.3m Unauthenticated RCE
CISA KEV
CVE-2024-23692MetasploitModule
Critical · CVSS 10.0
EPSS 99.5%2024-05-31
Authentication bypass using an alternate path or channel
CISA KEV
CVE-2024-1709MetasploitModule
Critical · CVSS 10.0
EPSS 100.0%2024-02-21
CVE-2022-3229
CVE-2022-3229MetasploitModule
Critical · CVSS 9.8
EPSS 66.4%2023-02-06
CVE-2020-6627
CVE-2020-6627MetasploitModule
Critical · CVSS 9.8
EPSS 12.7%2022-12-06
CVE-2021-43258
CVE-2021-43258MetasploitModule
High · CVSS 8.8
EPSS 11.6%2022-11-23
CVE-2022-3569
CVE-2022-3569MetasploitModule
High · CVSS 7.8
EPSS 0.8%2022-10-17
CVE-2022-3218
CVE-2022-3218MetasploitModule
Critical · CVSS 9.8
EPSS 74.2%2022-09-19
CVE-2022-37393
CVE-2022-37393MetasploitModule
High · CVSS 7.8
EPSS 1.7%2022-08-16

Get an alert for each new rapid7/metasploit-framework CVE, with the patched functions and AI-written analysis.

Monitor metasploit-framework CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

erlang/otp58 CVEs PrestaShop/PrestaShop58 CVEs backstage/backstage59 CVEs roundcube/roundcubemail57 CVEs mlflow/mlflow60 CVEs libexpat/libexpat56 CVEs wekan/wekan56 CVEs ansible/ansible55 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in rapid7/metasploit-framework.

How many CVEs have a located fix in rapid7/metasploit-framework?: 58 published CVEs have a fix traced to functions in rapid7/metasploit-framework, touching 82 functions across 62 files.
Which function in rapid7/metasploit-framework has been patched by the most CVEs?: initialize in modules/post/apple_ios/gather/ios_image_gather.rb has been changed by 1 CVE fixes, from 2026 to 2026.
How large is a typical CVE fix in rapid7/metasploit-framework?: The median fix changes 143 lines. 3% of fixes change 20 lines or fewer, and 84% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track rapid7/metasploit-framework CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing