The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-123849: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File…7.0 HighN/AN/ANov 6, 2026
CVE-2026-123847: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3 command execution was possible via control characters in terminal command…5.3 MediumN/AN/ANov 6, 2026
CVE-2026-123845: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via JSON Schema references in untrusted projects3.3 LowN/AN/ANov 6, 2026
CVE-2026-123844: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3 sSRF was possible via custom plugin repositories5.3 MediumN/AN/ANov 6, 2026
CVE-2026-123843: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent configuration3.3 LowN/AN/ANov 6, 2026
CVE-2026-123842: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3 arbitrary file write was possible via symlinks when extracting plugin archives7.1 HighN/AN/ANov 6, 2026
CVE-2026-123841: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings archive7.8 HighN/AN/ANov 6, 2026
CVE-2026-123839: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3 opening arbitrary URLs without confirmation was possible via the Remote…4.7 MediumN/AN/ANov 6, 2026
CVE-2026-123838: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer form file7.8 HighN/AN/ANov 6, 2026
CVE-2026-123837: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3, 2026.2.1 command injection was possible in untrusted projects via Tomcat run…7.8 HighN/AN/ANov 6, 2026
CVE-2026-123835: JetBrains Datalore: In JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init script upload…5.9 MediumN/AN/ANov 6, 2026
CVE-2026-123833: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3 database connections could be established in untrusted projects3.6 LowN/AN/ANov 6, 2026
CVE-2026-118515: sensiolabs symfony: The Symfony Serializer component DataUriNormalizer handles only the exact types SplFileInfo, SplFileObject, and File,…N/A8.4 HighN/ANov 6, 2026
CVE-2026-106144: Progress Software Kendo UI for Angular: Prototype Pollution in the Scheduler component (@progress/kendo-angular-scheduler and @progress/kendo-angular-common)…4.1 MediumN/AN/ANov 6, 2026
CVE-2026-106143: Progress Software Kendo UI for Vue: Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-vue-editor) in Progress Software Kendo UI for Vue…5.4 MediumN/AN/ANov 6, 2026
CVE-2026-106142: Progress Software KendoReact: Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-react-editor) in Progress Software KendoReact…5.4 MediumN/AN/ANov 6, 2026
CVE-2026-106141: Progress Software Kendo UI for Angular: Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-angular-editor) in Progress Software Kendo UI for…5.4 MediumN/AN/ANov 6, 2026
CVE-2026-106136: Progress Software KendoReact: Cross-Site Scripting (XSS) in the Chat component (@progress/kendo-react-conversational-ui) in Progress Software…5.4 MediumN/AN/ANov 6, 2026
CVE-2026-106135: Progress Software Kendo UI for Angular: Cross-Site Scripting (XSS) in the Chat component (@progress/kendo-angular-conversational-ui) in Progress Software Kendo…5.4 MediumN/AN/ANov 6, 2026
CVE-2026-106134: Progress Software KendoReact: Cross-Site Scripting (XSS) in the Menu component (@progress/kendo-react-layout) in Progress Software KendoReact…5.4 MediumN/AN/ANov 6, 2026
CVE-2026-106128: Progress Software Kendo UI for Vue: Prototype Pollution in @progress/kendo-vue-common in Progress Software Kendo UI for Vue versions 0.4.0 through 9.2.0…4.1 MediumN/AN/ANov 6, 2026
CVE-2026-106127: Progress Software KendoReact: Prototype Pollution in the setter utility (@progress/kendo-react-common) in Progress Software KendoReact versions 3.5.0…4.1 MediumN/AN/ANov 6, 2026
CVE-2026-104657: Progress Software Fiddler Download & Setup Skill: Missing integrity verification in the Progress Software Fiddler Download and Setup Skill on Linux, macOS, and Windows…7.5 HighN/AN/ANov 6, 2026
CVE-2026-104656: Progress Software Progress® Telerik® Fiddler® Everywhere: Improper neutralization of input in the sessions grid in Progress Telerik Fiddler Everywhere 8.3.0 and earlier allows…7.3 HighN/AN/ANov 6, 2026
CVE-2026-85742: freescout-help-desk freescout: FreeScout is a self-hosted help desk and shared mailbox7.5 HighN/AN/ANov 6, 2026
101-125 of 425038
‹›