Rapid7 Vulnerability & Exploit Database

Emergent Threat6

CVE-2026-111357:Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)Blog ↗CVE details

CVE-2026-111357:Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)

Blog ↗CVE details

CVE-2026-111497:Critical out-of-bounds write in the Node.js Brotli decoder

Blog ↗CVE details

CVE-2026-109618:and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP

Blog ↗CVE details

CVE-2026-88771:Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779

Blog ↗CVE details

CVE-2026-102764:Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild

Blog ↗CVE details

CVE-2026-97229:Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)

Blog ↗CVE details

CVE-2026-111497:Critical out-of-bounds write in the Node.js Brotli decoderBlog ↗CVE details

CVE-2026-109618:and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHPBlog ↗CVE details

CVE-2026-88771:Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779Blog ↗CVE details

CVE-2026-102764:Critical BeyondTrust Remote Support Authentication Bypass Exploited in the WildBlog ↗CVE details

CVE-2026-97229:Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)Blog ↗CVE details

Title			EitW	Modules

Title
CVE-2026-120463: sassanix Warracker: Warracker before 1.0.4 contains a missing authorization vulnerability in its Paperless-ngx integration that allows an…	6.5 Medium	6.0 Medium	N/A	Nov 2, 2026
CVE-2026-110535: Apache Software Foundation Apache Syncope: Improper Privilege Management vulnerability in Apache Syncope	N/A	N/A	N/A	Nov 2, 2026
CVE-2026-109083: Apache Software Foundation Apache Syncope: Improper isolation or compartmentalization vulnerability in Apache Syncope	N/A	N/A	N/A	Nov 2, 2026
CVE-2026-100140: qt: An integer overflow vulnerability in the Qt XML parsing (Qt5Compat / QXmlSimpleReader) functionality of Qt.	N/A	1.9 Low	N/A	Nov 2, 2026
CVE-2024-9517: WSO2: The refresh token grant type in WSO2 products fails to re-validate account status before issuing new access tokens	4.9 Medium	N/A	N/A	Nov 2, 2026
CVE-2026-8923: Zohocorp: Zohocorp ManageEngine Eventlog Analyzer and ManageEngine Log360 versions before 13062 are vulnerable to Authenticated…	8.7 High	N/A	N/A	Nov 2, 2026
CVE-2026-2613: WSO2: The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the…	8.7 High	N/A	N/A	Nov 2, 2026
CVE-2026-120216: fastify: fastify is a web framework for Node.js	5.9 Medium	N/A	N/A	Nov 2, 2026
CVE-2026-120215: @fastify/cors: @fastify/cors is the CORS plugin for the Fastify web framework	3.7 Low	N/A	N/A	Nov 2, 2026
CVE-2026-120214: @fastify/http-proxy: @fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix	5.9 Medium	N/A	N/A	Nov 2, 2026
CVE-2026-120213: @fastify/http-proxy: @fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix	9.1 Critical	N/A	N/A	Nov 2, 2026
CVE-2026-117549: @fastify/secure-session: @fastify/secure-session is a session plugin for Fastify that stores an encrypted session in a cookie	4.2 Medium	N/A	N/A	Nov 2, 2026
CVE-2026-117531: @fastify/multipart: @fastify/multipart is the multipart form-data and file upload plugin for the Fastify web framework	5.9 Medium	N/A	N/A	Nov 2, 2026
CVE-2026-117518: @fastify/reply-from: @fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP server	8.2 High	N/A	N/A	Nov 2, 2026
CVE-2025-12544: WSO2: The Publisher portal fails to enforce proper validation on uploaded SVG files, allowing users with the Publisher role…	4.8 Medium	N/A	N/A	Nov 2, 2026
CVE-2024-2372: WSO2: The affected components accept user-supplied input for constructing redirection URLs without enforcing expected…	5.4 Medium	N/A	N/A	Nov 2, 2026
CVE-2026-18800: WSO2: When an Event Publisher output adapter is configured with properties that are irrelevant to its function, the affected…	4.4 Medium	N/A	N/A	Nov 2, 2026
CVE-2026-118871: ZTE ElasticNet RNIA R18 NGI: SQL injection vulnerability classified as an internal threat level.Attackers can steal database information via SQL…	6.5 Medium	N/A	N/A	Nov 2, 2026
CVE-2025-13647: WSO2: The affected component fails to enforce expected validation constraints on the `content-type` header when processing…	5.8 Medium	N/A	N/A	Nov 2, 2026
CVE-2024-7075: WSO2: The user search function within the management console fails to properly encode user-supplied input before rendering it…	4.6 Medium	N/A	N/A	Nov 2, 2026
CVE-2026-107457: Qt: A memory corruption vulnerability in the QMqttClient class of the Qt MQTT module	N/A	2.3 Low	N/A	Nov 2, 2026
CVE-2026-18199: Zohocorp: Zohocorp ManageEngine Password Manager Pro versions before 13236 and PAM360 versions before 8601 are vulnerable to an…	8.8 High	N/A	N/A	Nov 2, 2026
CVE-2026-103310: Unknown PayHere Payment Gateway: The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment…	5.3 Medium	N/A	N/A	Nov 2, 2026
CVE-2026-101184: Huawei: Permission control vulnerability in the Bluetooth module	5.5 Medium	N/A	N/A	Nov 2, 2026
CVE-2026-101178: Huawei: Permission control vulnerability in the autofill service module	6.6 Medium	N/A	N/A	Nov 2, 2026

25 rows per page

26-50 of 422529

‹›

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business