Rapid7 Vulnerability & Exploit Database

Emergent Threat6

CVE-2026-111357:Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)Blog ↗CVE details

CVE-2026-111357:Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)

Blog ↗CVE details

CVE-2026-111497:Critical out-of-bounds write in the Node.js Brotli decoder

Blog ↗CVE details

CVE-2026-109618:and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP

Blog ↗CVE details

CVE-2026-88771:Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779

Blog ↗CVE details

CVE-2026-102764:Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild

Blog ↗CVE details

CVE-2026-97229:Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)

Blog ↗CVE details

CVE-2026-111497:Critical out-of-bounds write in the Node.js Brotli decoderBlog ↗CVE details

CVE-2026-109618:and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHPBlog ↗CVE details

CVE-2026-88771:Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779Blog ↗CVE details

CVE-2026-102764:Critical BeyondTrust Remote Support Authentication Bypass Exploited in the WildBlog ↗CVE details

CVE-2026-97229:Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)Blog ↗CVE details

Title			EitW	Modules

Title
CVE-2026-100109: Unknown Security For WooCommerce: The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating…	9.8 Critical	N/A	N/A	Nov 5, 2026
CVE-2026-123033: iXsystems TrueNAS SCALE: Authentication bypass in the HA heartbeat origin check in middlewared in TrueNAS SCALE before 25.10.8 (and in release…	8.3 High	N/A	N/A	Nov 5, 2026
CVE-2026-123029: Wowza Streaming Engine: Wowza Streaming Engine before 4.12.2 processes XML external entities, which allows remote attackers to read local files…	7.5 High	N/A	N/A	Nov 5, 2026
CVE-2026-123025: OPNsense os-acme-client: An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense…	N/A	9.4 Critical	N/A	Nov 5, 2026
CVE-2026-123017: GodotSteam: GodotSteam 4.17 through 4.23.2 trusts the peer value of 1 to mean that a player is the server	6.5 Medium	N/A	N/A	Nov 5, 2026
CVE-2026-91049: Unknown EWWW Image Optimizer: The EWWW Image Optimizer WordPress plugin before 8.9.1 does not properly sanitize and restrict a value in post content…	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-90967: Unknown Essential Real Estate: The Essential Real Estate WordPress plugin before 5.3.5 does not verify ownership of an invoice before rendering it in…	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-90966: Unknown Essential Real Estate: The Essential Real Estate WordPress plugin before 5.3.5 does not verify, in one of its AJAX actions, that a listing…	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-90965: Unknown Essential Real Estate: The Essential Real Estate WordPress plugin before 5.3.5 does not perform a publication-status or authorization check in…	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-90964: Unknown Essential Real Estate: The Essential Real Estate WordPress plugin before 5.3.5 does not restrict the recipient of one of its contact email…	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-90963: Unknown Essential Real Estate: The Essential Real Estate WordPress plugin before 5.3.5 does not perform any authorization or publication-status check…	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-88814: Unknown YITH WooCommerce Gift Cards: The YITH WooCommerce Gift Cards WordPress plugin before 4.38.1 does not lock or atomically update a gift card's balance…	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-87856: Unknown Subscriptions for WooCommerce: The Subscriptions for WooCommerce WordPress plugin before 2.1.1 only enforces its membership content restrictions on…	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-86795: Unknown Community Events: The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks in one of its AJAX…	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-86442: Unknown WP Event Manager: The WP Event Manager WordPress plugin before 3.4.2 does not verify the ownership or the post type of a user supplied…	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-85570: Unknown Tutor LMS: The Tutor LMS WordPress plugin before 4.2.0 does not prevent the correct answers to quiz questions from being included…	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-85351: Unknown FV Flowplayer Video Player: The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not validate a user-supplied URL before…	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-85347: Unknown FV Flowplayer Video Player: The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not sanitize and escape a user-supplied value…	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-85346: Unknown FV Flowplayer Video Player: The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform authorization or CSRF checks on…	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-19256: Unknown All In One Login: The All In One Login WordPress plugin before 2.5.0 does not adequately restrict the number of attempts that can be made…	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-16304: Unknown WP Event Manager: The WP Event Manager WordPress plugin before 3.4.2 does not properly validate ownership or the type of the…	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-123014: iTerm2: iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler, allowing an attacker…	N/A	8.7 High	N/A	Nov 5, 2026
CVE-2026-109150: Unknown WP PageNavi Style: The WP PageNavi Style WordPress plugin through 1.4 does not sanitise and escape some of its settings, and has no CSRF…	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-107787: Unknown CatFolders: The CatFolders WordPress plugin before 2.5.7 does not have authorisation checks on a folder maintenance action,…	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-107786: Unknown CatFolders: The CatFolders WordPress plugin before 2.5.7 does not properly sanitize and escape a user-controlled sort setting…	N/A	N/A	N/A	Nov 5, 2026

25 rows per page

51-75 of 418286

‹›

MDR Buyer's Guide

Global Threat Landscape Report