Rapid7 Vulnerability & Exploit Database

Emergent Threat6

CVE-2026-111357:Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)Blog ↗CVE details

CVE-2026-111357:Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)

Blog ↗CVE details

CVE-2026-111497:Critical out-of-bounds write in the Node.js Brotli decoder

Blog ↗CVE details

CVE-2026-109618:and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP

Blog ↗CVE details

CVE-2026-88771:Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779

Blog ↗CVE details

CVE-2026-102764:Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild

Blog ↗CVE details

CVE-2026-97229:Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)

Blog ↗CVE details

CVE-2026-111497:Critical out-of-bounds write in the Node.js Brotli decoderBlog ↗CVE details

CVE-2026-109618:and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHPBlog ↗CVE details

CVE-2026-88771:Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779Blog ↗CVE details

CVE-2026-102764:Critical BeyondTrust Remote Support Authentication Bypass Exploited in the WildBlog ↗CVE details

CVE-2026-97229:Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)Blog ↗CVE details

Title			EitW	Modules

Title
CVE-2026-85036: zephyrproject zephyr: The Bluetooth Classic AVDTP layer defers releasing a session's stream endpoints: bt_avdtp_l2cap_disconnected() in…	5.7 Medium	N/A	N/A	Nov 4, 2026
CVE-2026-118983: Unknown VikWidgetsLoader: The VikWidgetsLoader WordPress plugin before 1.12.3 does not sanitise or escape several block attributes before…	N/A	N/A	N/A	Nov 4, 2026
CVE-2026-118783: Unknown All-in-One Video Gallery: The All-in-One Video Gallery WordPress plugin before 5.0.0 does not validate and escape some of its shortcode…	N/A	N/A	N/A	Nov 4, 2026
CVE-2026-118637: Unknown Simple Download Monitor: The Simple Download Monitor WordPress plugin before 4.1.3 does not properly check the visibility of the content…	N/A	N/A	N/A	Nov 4, 2026
CVE-2026-118523: Unknown EventPrime: The EventPrime WordPress plugin before 4.3.6.1 does not keep the built-in Pending Review post status non-public,…	N/A	N/A	N/A	Nov 4, 2026
CVE-2026-118422: Unknown Stape Conversion Tracking: The Stape Conversion Tracking WordPress plugin before 2.3.11 does not validate the sub-path appended to its same-origin…	N/A	N/A	N/A	Nov 4, 2026
CVE-2026-118407: Unknown Premium Packages: The Premium Packages WordPress plugin before 7.3.1 does not verify that a user claiming a guest order is the original…	N/A	N/A	N/A	Nov 4, 2026
CVE-2026-118404: Unknown Premium Packages: The Premium Packages WordPress plugin before 7.3.1 does not verify ownership or session binding when loading a…	N/A	N/A	N/A	Nov 4, 2026
CVE-2026-118403: Unknown Premium Packages: The Premium Packages WordPress plugin before 7.3.1 does not verify that the requester owns a guest order before…	N/A	N/A	N/A	Nov 4, 2026
CVE-2026-115426: Unknown: The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.138 does not properly validate a backup storage…	N/A	N/A	N/A	Nov 4, 2026
CVE-2026-115262: Unknown: The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not restrict its…	N/A	N/A	N/A	Nov 4, 2026
CVE-2026-115257: Unknown WP Roster: The WP Roster WordPress plugin before 2.36 does not perform any capability or nonce checks before writing its stored…	N/A	N/A	N/A	Nov 4, 2026
CVE-2026-115250: Unknown Text Typing: The Text Typing WordPress plugin before 2.2.2 does not properly sanitize and escape a block attribute before storing it…	N/A	N/A	N/A	Nov 4, 2026
CVE-2026-115243: Unknown: The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not validate the extension of the file…	N/A	N/A	N/A	Nov 4, 2026
CVE-2026-115242: Unknown: The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not sanitize the staging destination…	N/A	N/A	N/A	Nov 4, 2026
CVE-2026-115241: Unknown: The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not verify that a submitted snapshot…	N/A	N/A	N/A	Nov 4, 2026
CVE-2026-114431: Unknown Enable Media Replace: The Enable Media Replace WordPress plugin before 4.2.3 does not pass a replaced media file through the WordPress upload…	N/A	N/A	N/A	Nov 4, 2026
CVE-2026-112244: Unknown: The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not prevent direct…	N/A	N/A	N/A	Nov 4, 2026
CVE-2026-112243: Unknown: The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not sanitise and escape…	N/A	N/A	N/A	Nov 4, 2026
CVE-2026-111962: Unknown WP Remote Users Sync: The WP Remote Users Sync WordPress plugin before 2.2.0 does not adequately restrict access to the user export files it…	N/A	N/A	N/A	Nov 4, 2026
CVE-2026-111740: Unknown Post Duplicator: The Post Duplicator WordPress plugin before 3.0.17 does not check whether the requesting user may view each post before…	N/A	N/A	N/A	Nov 4, 2026
CVE-2026-110964: Unknown Essential Real Estate: The Essential Real Estate WordPress plugin before 5.3.5 does not verify that a media attachment belongs to the…	N/A	N/A	N/A	Nov 4, 2026
CVE-2026-110692: Unknown: The PowerPack Addons for Elementor: Widgets, Form Styler and Templates WordPress plugin before 3.1.3 does not validate…	N/A	N/A	N/A	Nov 4, 2026
CVE-2026-108068: Unknown FV Flowplayer Video Player: The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform proper authorization checks on one…	N/A	N/A	N/A	Nov 4, 2026
CVE-2026-108067: Unknown FV Flowplayer Video Player: The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not properly verify record ownership before…	N/A	N/A	N/A	Nov 4, 2026

25 rows per page

76-100 of 418074

‹›

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business