The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-123290: JetBrains Datalore: In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public…5.3 MediumN/AN/ANov 6, 2026
CVE-2026-123289: JetBrains Datalore: In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files5.4 MediumN/AN/ANov 6, 2026
CVE-2026-123288: JetBrains Datalore: In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link5.4 MediumN/AN/ANov 6, 2026
CVE-2026-123287: JetBrains Datalore: In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published…5.9 MediumN/AN/ANov 6, 2026
CVE-2026-123286: JetBrains Datalore: In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session token5.9 MediumN/AN/ANov 6, 2026
CVE-2026-123285: JetBrains Datalore: In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options…6.3 MediumN/AN/ANov 6, 2026
CVE-2026-123284: JetBrains Datalore: In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only collaborators to modify…6.5 MediumN/AN/ANov 6, 2026
CVE-2026-123283: JetBrains Datalore: In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account6.8 MediumN/AN/ANov 6, 2026
CVE-2026-123282: JetBrains Datalore: In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session7.4 HighN/AN/ANov 6, 2026
CVE-2026-123281: JetBrains Datalore: In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container via the mount broker7.5 HighN/AN/ANov 6, 2026
CVE-2026-123280: JetBrains Datalore: In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports8.1 HighN/AN/ANov 6, 2026
CVE-2026-123279: JetBrains Datalore: In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators9.0 CriticalN/AN/ANov 6, 2026
CVE-2026-123278: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker RMI endpoint6.7 MediumN/AN/ANov 6, 2026
CVE-2026-123277: JetBrains CLion: In JetBrains CLion before 2026.3, 2026.2.4.1 missing authentication allowed local users to obtain the debug session…5.0 MediumN/AN/ANov 6, 2026
CVE-2026-123276: JetBrains CLion: In JetBrains CLion before 2026.3, 2026.2.4.1 code execution was possible in Safe Mode via a crafted GDB server debug…7.8 HighN/AN/ANov 6, 2026
CVE-2026-116630: undici: undici is an HTTP client for Node.js5.9 MediumN/AN/ANov 6, 2026
CVE-2026-84161: Ericsson CodeChecker: When an operator enables store.analysis_statistics_dir, a network client with PRODUCT_STORE permission for a product…4.9 MediumN/AN/ANov 6, 2026
CVE-2026-84164: Ericsson CodeChecker: The HTML report that plist-to-html, CodeChecker parse --export html and CodeChecker cmd diff --output html generate…N/A0.0 NoneN/ANov 6, 2026
CVE-2026-115701: ninenines cowboy: Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote…N/A8.2 HighN/ANov 6, 2026
CVE-2026-113431: ninenines cowlib: Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowlib allows an unauthenticated remote…N/A8.7 HighN/ANov 6, 2026
CVE-2026-84155: Ericsson CodeChecker: CodeChecker's web server fails to fully invalidate a session token on logout when the server runs with more than one…N/A5.3 MediumN/ANov 6, 2026
CVE-2026-66294: qcam saxy: XML injection in the Saxy XML encoderN/A2.1 LowN/ANov 6, 2026
CVE-2026-66295: qcam saxy: Saxy's XML encoder writes the target and the content of a processing instruction into the output document verbatim,…N/A2.1 LowN/ANov 6, 2026
CVE-2026-66293: qcam saxy: XML injection in the encoder of SaxyN/A2.1 LowN/ANov 6, 2026
CVE-2026-97642: man4toman Parsi Date | بسته فارسی ساز وردپرس و ووکامرس پارسی دیت: The Wp Parsidate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the calendar Gutenberg block's…6.4 MediumN/A0%Nov 6, 2026
801-825 of 425038
‹›