Rapid7 Vulnerability & Exploit Database

Emergent Threat6

CVE-2026-111357:Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)Blog ↗CVE details

CVE-2026-111357:Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)

Blog ↗CVE details

CVE-2026-111497:Critical out-of-bounds write in the Node.js Brotli decoder

Blog ↗CVE details

CVE-2026-109618:and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP

Blog ↗CVE details

CVE-2026-88771:Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779

Blog ↗CVE details

CVE-2026-102764:Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild

Blog ↗CVE details

CVE-2026-97229:Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)

Blog ↗CVE details

CVE-2026-111497:Critical out-of-bounds write in the Node.js Brotli decoderBlog ↗CVE details

CVE-2026-109618:and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHPBlog ↗CVE details

CVE-2026-88771:Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779Blog ↗CVE details

CVE-2026-102764:Critical BeyondTrust Remote Support Authentication Bypass Exploited in the WildBlog ↗CVE details

CVE-2026-97229:Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)Blog ↗CVE details

Title			EitW	Modules

Title
CVE-2026-120954: MongoDB C Driver: A weakness in the BSON library's handling of a specialized binary vector data type allows an arithmetic wraparound when…	3.7 Low	6.3 Medium	N/A	Nov 3, 2026
CVE-2026-120953: MongoDB Atlas SQL JDBC Driver: A URI redirection weakness exists in the authentication component of the Atlas SQL JDBC Driver	4.3 Medium	5.1 Medium	N/A	Nov 3, 2026
CVE-2026-120684: MongoDB C Driver: A memory-initialization flaw in the legacy GridFS file handling of the MongoDB C Driver can cause uninitialized process…	6.5 Medium	6.0 Medium	N/A	Nov 3, 2026
CVE-2026-120678: MongoDB C Driver: A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to…	7.5 High	8.7 High	N/A	Nov 3, 2026
CVE-2026-120673: MongoDB Rust Driver: A component of the MongoDB Rust Driver that records diagnostic tracing data can capture command content before…	5.5 Medium	6.8 Medium	N/A	Nov 3, 2026
CVE-2026-119922: AWS babelfish-for-postgresql: Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8,…	8.8 High	8.7 High	N/A	Nov 3, 2026
CVE-2026-112917: Docker Docker Desktop: In Docker Desktop for Windows with the WSL2 backend, an unprivileged Linux container can use 32-bit socketcall to…	N/A	9.2 Critical	N/A	Nov 3, 2026
CVE-2026-39379: geonetwork core-geonetwork: GeoNetwork is a catalog application to manage spatially referenced resources	7.1 High	N/A	N/A	Nov 3, 2026
CVE-2026-63197: traPtitech traQ: traQ is a messenger application built for Digital Creators Club traP	7.3 High	N/A	N/A	Nov 3, 2026
CVE-2026-63499: zeroturnaround zt-zip: zt-zip is a Java library that provides convenience methods for ZIP archive manipulation	N/A	6.9 Medium	N/A	Nov 3, 2026
CVE-2026-44266: enspirit elo: Elo is a purely functional expression language for no-code tools	9.8 Critical	N/A	N/A	Nov 3, 2026
CVE-2026-116845: netbox-community netbox: NetBox from 2.9.0 before 4.7.4 contains a broken access control vulnerability in BulkComponentCreateView that allows…	5.4 Medium	5.3 Medium	N/A	Nov 3, 2026
CVE-2026-63418: monitoring-plugins: Monitoring Plugins is a suite of plugins for monitoring applications	7.0 High	N/A	N/A	Nov 3, 2026
CVE-2026-63436: zeroturnaround zt-zip: zt-zip is a Java library that provides convenience methods for ZIP archive manipulation	6.1 Medium	N/A	N/A	Nov 3, 2026
CVE-2026-44267: enspirit elo: Elo is a purely functional expression language for no-code tools	9.8 Critical	N/A	N/A	Nov 3, 2026
CVE-2026-44265: enspirit elo: Elo is a purely functional expression language for no-code tools	7.4 High	N/A	N/A	Nov 3, 2026
CVE-2026-39777: WC Lovers WCFM Membership: Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting…	4.3 Medium	N/A	N/A	Nov 3, 2026
CVE-2026-39743: WC Lovers WCFM Membership: Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting…	5.3 Medium	N/A	N/A	Nov 3, 2026
CVE-2026-38601: n/a: A hardcoded session secret key in codeskyblue gohttpserver through v1.3.0 allows attackers to impersonate any user,…	N/A	N/A	N/A	Nov 3, 2026
CVE-2026-38595: n/a: An issue in im3x Scriptables through v2-dev branch allows attackers to inject arbitrary OS commands via uploading a…	N/A	N/A	N/A	Nov 3, 2026
CVE-2026-28336: SolarWinds Dameware: SolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the compromise of…	9.9 Critical	N/A	N/A	Nov 3, 2026
CVE-2026-28335: SolarWinds Dameware: SolarWinds Dameware was found to be affected by a buffer overflow vulnerability that can result in remote code execution	8.4 High	N/A	N/A	Nov 3, 2026
CVE-2026-28327: SolarWinds Dameware: SolarWinds Dameware was found to be affected by a DLL hijacking vulnerability	8.2 High	N/A	N/A	Nov 3, 2026
CVE-2026-121604: wlroots: wlroots before 0.20.2 contains an out-of-bounds read vulnerability in read_surface_class() in xwayland/xwm.c that…	3.3 Low	4.8 Medium	N/A	Nov 3, 2026
CVE-2026-121602: solanum-ircd solanum: Solanum before commit 2ce64de contains a heap-based buffer overflow vulnerability that allows a malicious linked server…	6.5 Medium	8.5 High	N/A	Nov 3, 2026

25 rows per page

376-400 of 528356

‹›

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business