Rapid7 Vulnerability & Exploit Database

Emergent Threat6

CVE-2026-111357:Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)Blog ↗CVE details

CVE-2026-111357:Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)

Blog ↗CVE details

CVE-2026-111497:Critical out-of-bounds write in the Node.js Brotli decoder

Blog ↗CVE details

CVE-2026-109618:and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP

Blog ↗CVE details

CVE-2026-88771:Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779

Blog ↗CVE details

CVE-2026-102764:Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild

Blog ↗CVE details

CVE-2026-97229:Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)

Blog ↗CVE details

CVE-2026-111497:Critical out-of-bounds write in the Node.js Brotli decoderBlog ↗CVE details

CVE-2026-109618:and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHPBlog ↗CVE details

CVE-2026-88771:Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779Blog ↗CVE details

CVE-2026-102764:Critical BeyondTrust Remote Support Authentication Bypass Exploited in the WildBlog ↗CVE details

CVE-2026-97229:Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)Blog ↗CVE details

Title			EitW	Modules

Title
CVE-2026-121688: FrodoBots FrodoBots EarthRover Mini+ firmware: FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains an insecure STM32 firmware update mechanism	N/A	N/A	N/A	Nov 9, 2026
CVE-2026-121687: FrodoBots FrodoBots EarthRover Mini+ firmware: FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains several local interfaces that are exposed…	N/A	N/A	N/A	Nov 9, 2026
CVE-2026-121686: FrodoBots FrodoBots EarthRover Mini+ firmware: FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) is vulnerable to unauthenticated, remote code…	N/A	N/A	N/A	Nov 9, 2026
CVE-2026-121685: FrodoBots FrodoBots EarthRover Mini+ firmware: FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains multiple sets of hard-coded credentials	N/A	N/A	N/A	Nov 9, 2026
CVE-2026-114594: Sandisk Sandisk Dashboard: A time-of-check to time-of-use (TOCTOU) race condition in the Sandisk Dashboard installer allows a local, authenticated…	N/A	5.4 Medium	N/A	Nov 9, 2026
CVE-2026-112164: laservideo lasergest: The LaserGest mobile application encrypts stored assistance portal credentials with a hardcoded AES key and IV,…	N/A	6.6 Medium	N/A	Nov 9, 2026
CVE-2026-103906: am_automatic_machines am_club: Use of hard-coded MQTT credentials in the AM CLUB mobile application allows an authenticated attacker to connect to the…	N/A	7.8 High	N/A	Nov 9, 2026
CVE-2026-124683: Eclipse Foundation Eclipse Langium: Eclipse Langium versions 3.2.0 through 4.4.0 contain an inefficient algorithmic complexity issue (CWE-407) in the…	N/A	8.7 High	N/A	Nov 9, 2026
CVE-2026-118492: Eclipse Foundation Eclipse Langium: In Eclipse Langium versions 3.0.0 and later, the langium-sprotty package does not HTML-escape diagnostic messages…	N/A	2.0 Low	N/A	Nov 9, 2026
CVE-2025-10248: OpenText Filr: XSS Vulnerability in OpenText Filr Appliance versions upto 25.1.2 could allow an authenticated user to upload a…	N/A	7.2 High	N/A	Nov 9, 2026
CVE-2026-19552: Python Software Foundation CPython: When ca_certs parameter was supplied to ssl.get_server_certificate() function, the identity of the certificate is not…	N/A	0.0 None	N/A	Nov 9, 2026
CVE-2026-124249: Python Software Foundation CPython: http.cookiejar.CookieJar deleted a stored cookie when a response carried an already expired Set-Cookie header for it,…	N/A	6.3 Medium	N/A	Nov 9, 2026
CVE-2026-119474: HAVELSAN Inc. Liman Render Engine: Incorrect Permission Assignment for Critical Resource vulnerability in HAVELSAN Inc	7.8 High	N/A	N/A	Nov 9, 2026
CVE-2026-104620: PackageKit: A path traversal attack in simulation of actions in the Zypp backend of PackageKit before 1.4.1 could be used by local…	N/A	8.5 High	N/A	Nov 9, 2026
CVE-2026-124959: Spotify, hnswlib: The loadIndex function in nmslib hnswlib and Spotify Voyager does not verify that the element count in a serialized…	N/A	N/A	N/A	Nov 9, 2026
CVE-2026-124916: PrestaShop: PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode…	N/A	N/A	N/A	Nov 9, 2026
CVE-2026-124850: flowintel: A SQL injection vulnerability exists in a database migration script in flowintel	N/A	7.3 High	N/A	Nov 9, 2026
CVE-2026-16283: Osbil Technology Ltd.Osbil Technology Ltd. oPanel: Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Osbil…	8.8 High	N/A	N/A	Nov 9, 2026
CVE-2026-124635: kevquirk PureBlog: A vulnerability was identified in kevquirk PureBlog up to 3.7.2	4.7 Medium	5.1 Medium	N/A	Nov 9, 2026
CVE-2026-124625: n/a PipraPay: A security vulnerability has been detected in PipraPay 3.0.0	6.3 Medium	2.1 Low	N/A	Nov 9, 2026
CVE-2026-124624: n/a PipraPay: A weakness has been identified in PipraPay 3.0.0	5.3 Medium	5.5 Medium	N/A	Nov 9, 2026
CVE-2026-121843: Mozilla Firefox for iOS: Privilege escalation in Firefox for iOS	8.8 High	N/A	N/A	Nov 9, 2026
CVE-2026-121842: Mozilla Firefox for iOS: Privilege escalation in the Reader View component in Firefox for iOS	8.8 High	N/A	N/A	Nov 9, 2026
CVE-2026-121841: Mozilla Firefox for iOS: Other issue in Firefox for iOS	N/A	N/A	N/A	Nov 9, 2026
CVE-2026-119743: bpampuch pdfmake: pdfmake before 0.3.14 contains a shared resource caching vulnerability that allows attackers to access cross-document…	4.8 Medium	6.3 Medium	N/A	Nov 9, 2026

25 rows per page

451-475 of 427771

‹›

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business