Rapid7 Vulnerability & Exploit Database

Emergent Threat6

CVE-2026-111357:Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)Blog ↗CVE details

CVE-2026-111357:Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)

Blog ↗CVE details

CVE-2026-111497:Critical out-of-bounds write in the Node.js Brotli decoder

Blog ↗CVE details

CVE-2026-109618:and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP

Blog ↗CVE details

CVE-2026-88771:Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779

Blog ↗CVE details

CVE-2026-102764:Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild

Blog ↗CVE details

CVE-2026-97229:Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)

Blog ↗CVE details

CVE-2026-111497:Critical out-of-bounds write in the Node.js Brotli decoderBlog ↗CVE details

CVE-2026-109618:and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHPBlog ↗CVE details

CVE-2026-88771:Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779Blog ↗CVE details

CVE-2026-102764:Critical BeyondTrust Remote Support Authentication Bypass Exploited in the WildBlog ↗CVE details

CVE-2026-97229:Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)Blog ↗CVE details

Title			EitW	Modules

Title
CVE-2026-63470: koxudaxi fastapi-code-generator: fastapi-code-generator creates FastAPI applications from OpenAPI files	N/A	9.3 Critical	N/A	Nov 3, 2026
CVE-2026-63418: monitoring-plugins: Monitoring Plugins is a suite of plugins for monitoring applications	7.0 High	N/A	N/A	Nov 3, 2026
CVE-2026-63499: zeroturnaround zt-zip: zt-zip is a Java library that provides convenience methods for ZIP archive manipulation	N/A	6.9 Medium	N/A	Nov 3, 2026
CVE-2026-63436: zeroturnaround zt-zip: zt-zip is a Java library that provides convenience methods for ZIP archive manipulation	6.1 Medium	N/A	N/A	Nov 3, 2026
CVE-2026-44267: enspirit elo: Elo is a purely functional expression language for no-code tools	9.8 Critical	N/A	N/A	Nov 3, 2026
CVE-2026-44266: enspirit elo: Elo is a purely functional expression language for no-code tools	9.8 Critical	N/A	N/A	Nov 3, 2026
CVE-2026-116845: netbox-community netbox: NetBox from 2.9.0 before 4.7.4 contains a broken access control vulnerability in BulkComponentCreateView that allows…	5.4 Medium	5.3 Medium	N/A	Nov 3, 2026
CVE-2026-44265: enspirit elo: Elo is a purely functional expression language for no-code tools	7.4 High	N/A	N/A	Nov 3, 2026
CVE-2026-39777: WC Lovers WCFM Membership: Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting…	4.3 Medium	N/A	N/A	Nov 3, 2026
CVE-2026-39743: WC Lovers WCFM Membership: Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting…	5.3 Medium	N/A	N/A	Nov 3, 2026
CVE-2026-38601: n/a: A hardcoded session secret key in codeskyblue gohttpserver through v1.3.0 allows attackers to impersonate any user,…	N/A	N/A	N/A	Nov 3, 2026
CVE-2026-38600: n/a: A Zip Slip vulnerability in the /upload endpoint of codeskyblue gohttpserver through v1.3.0 allows attackers to write…	N/A	N/A	N/A	Nov 3, 2026
CVE-2026-38595: n/a: An issue in im3x Scriptables through v2-dev branch allows attackers to inject arbitrary OS commands via uploading a…	N/A	N/A	N/A	Nov 3, 2026
CVE-2026-121604: wlroots: wlroots before 0.20.2 contains an out-of-bounds read vulnerability in read_surface_class() in xwayland/xwm.c that…	3.3 Low	4.8 Medium	N/A	Nov 3, 2026
CVE-2026-121602: solanum-ircd solanum: Solanum before commit 2ce64de contains a heap-based buffer overflow vulnerability that allows a malicious linked server…	6.5 Medium	8.5 High	N/A	Nov 3, 2026
CVE-2026-121588: texlyre: TeXlyre from 0.11.0 before 0.13.5 contains a stored cross-site scripting vulnerability that allows attackers to execute…	6.1 Medium	5.3 Medium	N/A	Nov 3, 2026
CVE-2026-121587: coollabsio coolify: Coolify before 4.1.1 contains an information disclosure vulnerability that allows unauthenticated attackers to…	5.3 Medium	6.9 Medium	N/A	Nov 3, 2026
CVE-2026-121262: phpMyAdmin SQL-Parser: A vulnerability was found in phpMyAdmin SQL-Parser 6.0.0/6.0.1	5.3 Medium	5.5 Medium	N/A	Nov 3, 2026
CVE-2026-121261: phpMyAdmin ShapeFile: A vulnerability has been found in phpMyAdmin ShapeFile up to 4.0.1	4.3 Medium	2.1 Low	N/A	Nov 3, 2026
CVE-2026-121259: Red Hat: A flaw was found in the GStreamer JPEG 2000 decimator in gst-plugins-bad	6.5 Medium	N/A	N/A	Nov 3, 2026
CVE-2026-120846: Uncanny Owl Uncanny Automator: Missing Authorization vulnerability in Uncanny Owl Uncanny Automator uncanny-automator allows Exploiting Incorrectly…	5.3 Medium	N/A	N/A	Nov 3, 2026
CVE-2026-120843: Barn2 Plugins Posts Table with Search & Sort: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Barn2 Plugins…	6.5 Medium	N/A	N/A	Nov 3, 2026
CVE-2026-119521: Cozmoslabs Paid Member Subscriptions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs Paid…	6.5 Medium	N/A	N/A	Nov 3, 2026
CVE-2026-119485: weDevs Dokan: Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrectly Configured Access Control…	5.3 Medium	N/A	N/A	Nov 3, 2026
CVE-2026-116859: WPMU DEV Forminator: Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access…	5.3 Medium	N/A	N/A	Nov 3, 2026

25 rows per page

26-50 of 528356

‹›

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business