The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-123318: JetBrains Ktor: In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine4.8 MediumN/AN/ANov 6, 2026
CVE-2026-123317: JetBrains Ktor: In JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookies8.1 HighN/AN/ANov 6, 2026
CVE-2026-123315: JetBrains Junie CLI: In JetBrains Junie CLI before 26.8.24 command execution was possible via the Allow Similar Commands option7.0 HighN/AN/ANov 6, 2026
CVE-2026-123313: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3 improper checks could enable disabled plugins via external dependency settings3.3 LowN/AN/ANov 6, 2026
CVE-2026-123312: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 sSRF was possible via annotations.xml files during indexing3.3 LowN/AN/ANov 6, 2026
CVE-2026-123310: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3 kotlin scripts could trigger dependency downloads from arbitrary repositories…5.4 MediumN/AN/ANov 6, 2026
CVE-2026-123307: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 unauthenticated connection to an arbitrary host via run…6.8 MediumN/AN/ANov 6, 2026
CVE-2026-123306: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3 improper checks allowed server certificates to be added to the trust store…7.4 HighN/AN/ANov 6, 2026
CVE-2026-123301: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3 dOM-based XSS in the OpenAPI preview error view was possible8.2 HighN/AN/ANov 6, 2026
CVE-2026-123297: JetBrains Hub: In JetBrains Hub before 2026.2.52519 two-factor authentication bypass was possible via the password reset flow6.8 MediumN/AN/ANov 6, 2026
CVE-2026-123295: JetBrains Hub: In JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the profile update…8.1 HighN/AN/ANov 6, 2026
CVE-2026-123287: JetBrains Datalore: In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published…5.9 MediumN/AN/ANov 6, 2026
CVE-2026-123286: JetBrains Datalore: In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session token5.9 MediumN/AN/ANov 6, 2026
CVE-2026-123285: JetBrains Datalore: In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options…6.3 MediumN/AN/ANov 6, 2026
CVE-2026-123284: JetBrains Datalore: In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only collaborators to modify…6.5 MediumN/AN/ANov 6, 2026
CVE-2026-123283: JetBrains Datalore: In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account6.8 MediumN/AN/ANov 6, 2026
CVE-2026-123282: JetBrains Datalore: In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session7.4 HighN/AN/ANov 6, 2026
CVE-2026-123281: JetBrains Datalore: In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container via the mount broker7.5 HighN/AN/ANov 6, 2026
CVE-2026-123280: JetBrains Datalore: In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports8.1 HighN/AN/ANov 6, 2026
CVE-2026-123279: JetBrains Datalore: In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators9.0 CriticalN/AN/ANov 6, 2026
CVE-2026-84155: Ericsson CodeChecker: CodeChecker's web server fails to fully invalidate a session token on logout when the server runs with more than one…N/A5.3 MediumN/ANov 6, 2026
CVE-2026-66294: qcam saxy: XML injection in the Saxy XML encoderN/A2.1 LowN/ANov 6, 2026
CVE-2026-66295: qcam saxy: Saxy's XML encoder writes the target and the content of a processing instruction into the output document verbatim,…N/A2.1 LowN/ANov 6, 2026
CVE-2026-66293: qcam saxy: XML injection in the encoder of SaxyN/A2.1 LowN/ANov 6, 2026
CVE-2026-97642: man4toman Parsi Date | بسته فارسی ساز وردپرس و ووکامرس پارسی دیت: The Wp Parsidate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the calendar Gutenberg block's…6.4 MediumN/A0%Nov 6, 2026
301-325 of 425038
‹›