Rapid7 Vulnerability & Exploit Database

Emergent Threat6

CVE-2026-111357:Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)Blog ↗CVE details

CVE-2026-111357:Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)

Blog ↗CVE details

CVE-2026-111497:Critical out-of-bounds write in the Node.js Brotli decoder

Blog ↗CVE details

CVE-2026-109618:and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP

Blog ↗CVE details

CVE-2026-88771:Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779

Blog ↗CVE details

CVE-2026-102764:Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild

Blog ↗CVE details

CVE-2026-97229:Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)

Blog ↗CVE details

CVE-2026-111497:Critical out-of-bounds write in the Node.js Brotli decoderBlog ↗CVE details

CVE-2026-109618:and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHPBlog ↗CVE details

CVE-2026-88771:Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779Blog ↗CVE details

CVE-2026-102764:Critical BeyondTrust Remote Support Authentication Bypass Exploited in the WildBlog ↗CVE details

CVE-2026-97229:Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)Blog ↗CVE details

Title			EitW	Modules

Title
WordPress Plugin: feedzy-rss-feeds: CVE-2026-120035: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	5.4 Medium	N/A	N/A	Nov 6, 2026
WordPress Plugin: aaa-option-optimizer: CVE-2026-119211: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	4.9 Medium	N/A	N/A	Nov 6, 2026
CVE-2026-119178: shark986 Smart Cookie Kit: The Smart Cookie Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in…	5.4 Medium	N/A	N/A	Nov 6, 2026
WordPress Plugin: advanced-members: CVE-2026-116624: Improper Privilege Management	8.8 High	N/A	N/A	Nov 6, 2026
WordPress Plugin: customer-area: CVE-2026-116551: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	6.4 Medium	N/A	N/A	Nov 6, 2026
WordPress Plugin: all-in-one-video-gallery: CVE-2026-116545: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	6.4 Medium	N/A	N/A	Nov 6, 2026
WordPress Plugin: buddyforms: CVE-2026-107658: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	5.4 Medium	N/A	N/A	Nov 6, 2026
WordPress Plugin: buddyforms: CVE-2026-107622: Improper Privilege Management	9.8 Critical	N/A	N/A	Nov 6, 2026
WordPress Plugin: contactsheets-lite: CVE-2026-104010: Deserialization of Untrusted Data	7.5 High	N/A	N/A	Nov 6, 2026
WordPress Plugin: accelerated-mobile-pages: CVE-2026-103908: Improper Control of Generation of Code ('Code Injection')	5.4 Medium	N/A	N/A	Nov 6, 2026
CVE-2025-66621: Apache Software Foundation Apache James: Apache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1 fails to validate correctly AUD claim of JWT payloads when…	N/A	N/A	N/A	Nov 6, 2026
CVE-2026-109884: Elementor Elementor Website Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor…	7.1 High	N/A	N/A	Nov 6, 2026
WordPress Plugin: elex-helpdesk-customer-support-ticket-system: CVE-2026-114630: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')	9.1 Critical	N/A	N/A	Nov 6, 2026
CVE-2026-103479: pubjet Pubjet \| پاب‌جت: The Pubjet \| پاب‌جت plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including,…	7.6 High	N/A	N/A	Nov 6, 2026
CVE-2026-123337: JetBrains YouTrack: In JetBrains YouTrack before 2026.2.19656 users without update permission could change issue visibility	3.1 Low	N/A	N/A	Nov 6, 2026
CVE-2026-123336: JetBrains YouTrack: In JetBrains YouTrack before 2026.2.19728 the attachment size limit could be bypassed via AI assistant thread conversion	3.1 Low	N/A	N/A	Nov 6, 2026
CVE-2026-123335: JetBrains YouTrack: In JetBrains YouTrack before 2026.2.19562, 2026.1.14137, 2025.3.169041 missing authorization allowed attaching tags to…	3.5 Low	N/A	N/A	Nov 6, 2026
CVE-2026-123334: JetBrains YouTrack: In JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS integrations owned by…	3.8 Low	N/A	N/A	Nov 6, 2026
CVE-2026-123333: JetBrains YouTrack: In JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible projects between…	3.8 Low	N/A	N/A	Nov 6, 2026
CVE-2026-123332: JetBrains YouTrack: In JetBrains YouTrack before 2026.2.19562 missing authorization allowed Project Admin to manage VCS hosting server…	4.7 Medium	N/A	N/A	Nov 6, 2026
CVE-2026-123331: JetBrains YouTrack: In JetBrains YouTrack before 2026.2.19197 article editors could change visibility of restricted child articles	5.4 Medium	N/A	N/A	Nov 6, 2026
CVE-2026-123330: JetBrains YouTrack: In JetBrains YouTrack before 2026.2.19562 missing authorization allowed users with read-only access to change issue…	5.4 Medium	N/A	N/A	Nov 6, 2026
CVE-2026-123329: JetBrains YouTrack: In JetBrains YouTrack before 2026.2.19562 missing authorization in TeamCity integration allowed disclosure of other…	5.4 Medium	N/A	N/A	Nov 6, 2026
CVE-2026-123328: JetBrains YouTrack: In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via project tab	6.4 Medium	N/A	N/A	Nov 6, 2026
CVE-2026-123327: JetBrains YouTrack: In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint allowed disclosure of issue…	7.5 High	N/A	N/A	Nov 6, 2026

25 rows per page

751-775 of 415724

‹›

MDR Buyer's Guide

Global Threat Landscape Report