Rapid7 Vulnerability & Exploit Database

Emergent Threat6

CVE-2026-109618:and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHPBlog ↗CVE details

CVE-2026-109618:and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP

Blog ↗CVE details

CVE-2026-88771:Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779

Blog ↗CVE details

CVE-2026-102764:Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild

Blog ↗CVE details

CVE-2026-97229:Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)

Blog ↗CVE details

CVE-2026-104935:Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)

Blog ↗CVE details

CVE-2026-97229:Critical Unauthenticated Remote Code Execution in GitLab

Blog ↗CVE details

CVE-2026-88771:Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779Blog ↗CVE details

CVE-2026-102764:Critical BeyondTrust Remote Support Authentication Bypass Exploited in the WildBlog ↗CVE details

CVE-2026-97229:Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)Blog ↗CVE details

CVE-2026-104935:Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)Blog ↗CVE details

CVE-2026-97229:Critical Unauthenticated Remote Code Execution in GitLabBlog ↗CVE details

Title			EitW	Modules

Title
CVE-2026-97353: Unknown News Kit Addons For Elementor: The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before…	5.4 Medium	N/A	N/A	Oct 24, 2026
CVE-2026-97352: Unknown News Kit Addons For Elementor: The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check on one of its AJAX…	4.3 Medium	N/A	N/A	Oct 24, 2026
CVE-2026-87835: Unknown Front End Users: The Front End Users WordPress plugin through 3.2.35 does not restrict which account attributes a visitor may set when…	6.5 Medium	N/A	N/A	Oct 24, 2026
CVE-2026-114429: Unknown WPVR: The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before…	6.8 Medium	N/A	N/A	Oct 24, 2026
CVE-2026-113674: Unknown GeoDirectory: The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by…	3.7 Low	N/A	N/A	Oct 24, 2026
CVE-2026-113673: Unknown GeoDirectory: The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it…	7.2 High	N/A	N/A	Oct 24, 2026
CVE-2026-113493: Unknown GeoDirectory: The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes…	6.8 Medium	N/A	N/A	Oct 24, 2026
CVE-2026-113492: Unknown GeoDirectory: The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading…	5.3 Medium	N/A	N/A	Oct 24, 2026
CVE-2026-113491: Unknown GeoDirectory: The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local…	6.4 Medium	N/A	N/A	Oct 24, 2026
CVE-2026-113490: Unknown GeoDirectory: The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a…	5.3 Medium	N/A	N/A	Oct 24, 2026
CVE-2026-113489: Unknown GeoDirectory: The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing…	4.3 Medium	N/A	N/A	Oct 24, 2026
CVE-2026-112207: Unknown Download Monitor: The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site…	7.1 High	N/A	N/A	Oct 24, 2026
CVE-2026-110956: Unknown asVereinbase: The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before…	9.8 Critical	N/A	N/A	Oct 24, 2026
CVE-2026-107907: Unknown MAS Videos: The MAS Videos WordPress plugin through 1.3.4 does not perform any capability or ownership check when handling its…	6.5 Medium	N/A	N/A	Oct 24, 2026
CVE-2026-107887: Unknown Advanced Twenty Seventeen: The Advanced Twenty Seventeen WordPress plugin through 1.3.1 does not perform any capability or nonce check on the…	5.4 Medium	N/A	N/A	Oct 24, 2026
CVE-2026-105199: Unknown Pixel Tag Manager for WooCommerce: The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not perform a capability check in one of its…	6.8 Medium	N/A	N/A	Oct 24, 2026
CVE-2026-115807: cozmoslabs: The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is…	7.1 High	N/A	N/A	Oct 24, 2026
CVE-2026-115806: codexonics Prime Mover – Backup and Migration: The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up…	9.8 Critical	N/A	N/A	Oct 24, 2026
CVE-2026-115929: MongoDB, Inc. Compass: MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store	6.8 Medium	7.6 High	N/A	Oct 24, 2026
CVE-2026-115931: GitroomHQ postiz-app: Postiz lets a signed-in user ask the backend to run a function on one of their connected channels	9.9 Critical	N/A	N/A	Oct 23, 2026
CVE-2026-110814: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.	N/A	N/A	N/A	Oct 23, 2026
CVE-2026-108793: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.	N/A	N/A	N/A	Oct 23, 2026
CVE-2026-108537: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.	N/A	N/A	N/A	Oct 23, 2026
CVE-2026-115938: craftcms cms: Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is…	8.8 High	8.7 High	N/A	Oct 23, 2026
CVE-2026-115937: craftcms commerce-mollie: The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong…	7.5 High	8.7 High	N/A	Oct 23, 2026

Rows per page

51-75 of 530113

‹›

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business