Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
8 results
Sep 7, 2026In JetBrains GoLand before 2026.2.2.1 missing authentication on the GoLand profiler's injected pprof server exposed profiling dataCVE-2026-86506 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.9
In JetBrains GoLand before 2026.2.2.1 missing authentication on the GoLand profiler's injected pprof server exposed profiling data
- Product
- GoLand
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust via the configured Go SDKCVE-2026-64803 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.8
In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust via the configured Go SDK
- Product
- GoLand
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integrationCVE-2026-64802 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.8
In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration
- Product
- GoLand
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by defaultCVE-2026-64800 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.5
In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default
- Product
- GoLand
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2026In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project configurationCVE-2026-53915 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.1
In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project configuration
- Product
- GoLand
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2025In JetBrains GoLand before 2025.1 an XXE during debugging was possibleCVE-2025-29932 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.1
In JetBrains GoLand before 2025.1 an XXE during debugging was possible
- Product
- GoLand
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2022JetBrains IntelliJ IDEA 2021.3.1 Preview, IntelliJ IDEA 2021.3.1 RC, PyCharm Professional 2021.3.1 RC, GoLand 2021.3.1, PhpStorm 2021.3.1 Preview, PhpStorm 2021CVE-2021-45977 · Other software · Jetbrains · reported by MITRECritical 9.8
JetBrains IntelliJ IDEA 2021.3.1 Preview, IntelliJ IDEA 2021.3.1 RC, PyCharm Professional 2021.3.1 RC, GoLand 2021.3.1, PhpStorm 2021.3.1 Preview, PhpStorm 2021.3.1 RC, RubyMine 2021.3.1 Preview, RubyMine 2021.3.1 RC, CLion 2021.3.1, WebStorm 2021.3.1 Preview, and WebStorm 2021.3.1 RC (used as Remote Development backend IDEs) bind to the 0.0.0.0 IP address. The fixed versions are: IntelliJ IDEA 2021.3.1, PyCharm Professional 2021.3.1, GoLand 2021.3.2, PhpStorm 2021.3.1 (213.6461.83), RubyMine 2021.3.1, CLion 2021.3.2, and WebStorm 2021.3.1.
- Product
- Clion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comjetbrains.com
Apr 22, 2020In JetBrains GoLand before 2019.3.2, the plugin repository was accessed via HTTP instead of HTTPS.CVE-2020-11685 · Other software · Jetbrains · reported by MITREHigh 7.5
In JetBrains GoLand before 2019.3.2, the plugin repository was accessed via HTTP instead of HTTPS.
- Product
- Goland
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.