Rapid7 Vulnerability & Exploit Database

Emergent Threat6

CVE-2026-111357:Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)Blog ↗CVE details

CVE-2026-111357:Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)

Blog ↗CVE details

CVE-2026-111497:Critical out-of-bounds write in the Node.js Brotli decoder

Blog ↗CVE details

CVE-2026-109618:and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP

Blog ↗CVE details

CVE-2026-88771:Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779

Blog ↗CVE details

CVE-2026-102764:Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild

Blog ↗CVE details

CVE-2026-97229:Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)

Blog ↗CVE details

CVE-2026-111497:Critical out-of-bounds write in the Node.js Brotli decoderBlog ↗CVE details

CVE-2026-109618:and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHPBlog ↗CVE details

CVE-2026-88771:Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779Blog ↗CVE details

CVE-2026-102764:Critical BeyondTrust Remote Support Authentication Bypass Exploited in the WildBlog ↗CVE details

CVE-2026-97229:Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)Blog ↗CVE details

Title			EitW	Modules

Title
CVE-2026-19256: Unknown All In One Login: The All In One Login WordPress plugin before 2.5.0 does not adequately restrict the number of attempts that can be made…	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-16304: Unknown WP Event Manager: The WP Event Manager WordPress plugin before 3.4.2 does not properly validate ownership or the type of the…	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-123014: iTerm2: iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler, allowing an attacker…	N/A	8.7 High	N/A	Nov 5, 2026
CVE-2026-93389: litespeedtech LiteSpeed Cache: The LiteSpeed Cache plugin for WordPress is vulnerable to unauthenticated disclosure of sensitive WooCommerce customer…	8.2 High	N/A	N/A	Nov 5, 2026
CVE-2026-123012: Gogs: In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read…	N/A	7.1 High	N/A	Nov 5, 2026
CVE-2026-123011: STMicroelectronics st-mems-android-linux-sensors-hal: STMicroelectronics st-mems-android-linux-sensors-hal before 7bdf334 does not check whether the allowed number of…	4.2 Medium	N/A	N/A	Nov 5, 2026
CVE-2026-123010: twilio-labs netlify-okta-auth: @twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim	7.2 High	N/A	N/A	Nov 5, 2026
CVE-2026-120553: ivole Customer Reviews for WooCommerce: The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…	6.4 Medium	N/A	N/A	Nov 5, 2026
CVE-2026-120533: davidanderson Redux Framework: The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via theme_opts Parameter via User…	6.4 Medium	N/A	N/A	Nov 5, 2026
CVE-2026-118193: stellarwp GiveWP – Donation Plugin and Fundraising Platform: The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Privilege Escalation in all…	8.8 High	N/A	N/A	Nov 5, 2026
CVE-2026-116617: stylemix Motors – Car Dealership & Classified Listings Plugin: The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to File Deletion in all…	8.1 High	N/A	N/A	Nov 5, 2026
CVE-2026-104812: davidanderson Redux Framework: The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'multi_media' Field Array Key…	6.4 Medium	N/A	N/A	Nov 5, 2026
CVE-2026-122236: n/a OpenHands: A vulnerability has been found in OpenHands up to 1.24.0	6.3 Medium	2.1 Low	N/A	Nov 5, 2026
CVE-2026-122191: itsourcecode Airline Reservation System: A vulnerability was determined in itsourcecode Airline Reservation System 1.0	6.3 Medium	2.1 Low	N/A	Nov 5, 2026
CVE-2026-122190: SourceCodester Online Food Ordering System: A vulnerability was found in SourceCodester Online Food Ordering System 1.0	2.4 Low	1.9 Low	N/A	Nov 5, 2026
CVE-2026-69068: Samsung Semiconductor: Insufficient length validation in the GNSS firmware loader may lead to corruption of kernel memory.	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-69066: Samsung Semiconductor: Memory corruption in GPU driver due to improper validation of VMID reservation.	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-69050: Samsung Semiconductor: Out-of-bounds memory access in a device driver due to improper resource state tracking.	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-69044: Samsung Semiconductor: In the Samsung GPU driver, improper reference count handling during command submission can lead to memory corruption.	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-69043: Samsung Semiconductor: In the Samsung Exynos GPU driver, improper synchronization during buffer object creation and closing can lead to memory…	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-69025: Samsung Semiconductor: In the Exynos NPU driver, improper validation of user input in the ioctl handler can lead to an out-of-bounds write,…	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-69006: Samsung Semiconductor: Insufficient validation of length fields in the GNSS firmware loader can result in kernel‑memory corruption.	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-69005: Samsung Semiconductor: Integer overflow in NPU driver parameter processing due to insufficient bounds checking.	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-69002: Samsung Semiconductor: Incorrect authorization in Samsung framework services due to missing permission checks	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-68994: Samsung Semiconductor: A double free vulnerability in NPU driver due to improper pointer management (941)	N/A	N/A	N/A	Nov 5, 2026

25 rows per page

26-50 of 418286

‹›

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business