Rapid7 Vulnerability & Exploit Database

Emergent Threat6

CVE-2026-111357:Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)Blog ↗CVE details

CVE-2026-111357:Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)

Blog ↗CVE details

CVE-2026-111497:Critical out-of-bounds write in the Node.js Brotli decoder

Blog ↗CVE details

CVE-2026-109618:and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP

Blog ↗CVE details

CVE-2026-88771:Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779

Blog ↗CVE details

CVE-2026-102764:Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild

Blog ↗CVE details

CVE-2026-97229:Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)

Blog ↗CVE details

CVE-2026-111497:Critical out-of-bounds write in the Node.js Brotli decoderBlog ↗CVE details

CVE-2026-109618:and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHPBlog ↗CVE details

CVE-2026-88771:Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779Blog ↗CVE details

CVE-2026-102764:Critical BeyondTrust Remote Support Authentication Bypass Exploited in the WildBlog ↗CVE details

CVE-2026-97229:Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)Blog ↗CVE details

Title			EitW	Modules

Title
CVE-2026-73577: Authentication Bypass Using an Alternate Path or Channel	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-71901: Improper Control of Resource Identifiers ('Resource Injection') vulnerability in Apache OFBiz	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-68524: Code Injection	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-66903: Path Traversal: '../filedir'	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-123032: Improper Authentication	7.3 High	5.5 Medium	N/A	Nov 5, 2026
CVE-2026-119744: Authentication Bypass by Spoofing	8.8 High	7.7 High	N/A	Nov 5, 2026
CVE-2026-115738: SQL Injection	6.5 Medium	7.1 High	N/A	Nov 5, 2026
CVE-2026-106716: ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open…	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-106715: NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView JavaScript bridge origin…	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-106714: Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading…	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-106713: An issue in FreeReels for Android version 2.3.11 allows a remote attacker to obtain sensitive information via the…	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-97356: Apache Software Foundation Apache OFBiz: External Control of File Name or Path vulnerability in the ViewFile component of Label Manager in Apache OFBiz 24.09.07…	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-97355: Apache Software Foundation Apache OFBiz: Use of Hard-coded Password vulnerability in the AdminServer component in Apache OFBiz 24.09.07 on all platforms allows…	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-92887: Apache Software Foundation Apache OFBiz: Incorrect default value in the REST API framework's .rest.xml definition parser (ModelApiReader) in Apache OFBiz…	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-85627: Apache Software Foundation Apache OFBiz: Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in Apache…	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-84728: Apache Software Foundation Apache OFBiz: Incorrect Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms, when documented multitenancy is…	5.4 Medium	N/A	N/A	Nov 5, 2026
CVE-2026-84183: Incorrect Authorization	8.8 High	N/A	N/A	Nov 5, 2026
CVE-2026-83542: Code Injection	9.8 Critical	N/A	N/A	Nov 5, 2026
CVE-2026-83538: Missing Authorization	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-82960: Code Injection	8.8 High	N/A	N/A	Nov 5, 2026
CVE-2026-82916: External Control of File Name or Path	7.1 High	N/A	N/A	Nov 5, 2026
CVE-2026-82912: Improper Neutralization of Special Elements used in an Expression Language Statement	8.8 High	N/A	N/A	Nov 5, 2026
CVE-2026-82910: Improper Neutralization of Special Elements Used in a Template Engine	8.8 High	N/A	N/A	Nov 5, 2026
CVE-2026-82907: Authentication Bypass by Capture-replay	9.8 Critical	N/A	N/A	Nov 5, 2026
CVE-2026-82904: Missing Authorization	7.5 High	N/A	N/A	Nov 5, 2026

25 rows per page

326-350 of 523236

‹›

MDR Buyer's Guide

Global Threat Landscape Report