Rapid7 Vulnerability & Exploit Database

Emergent Threat6

CVE-2026-111357:Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)Blog ↗CVE details

CVE-2026-111357:Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)

Blog ↗CVE details

CVE-2026-111497:Critical out-of-bounds write in the Node.js Brotli decoder

Blog ↗CVE details

CVE-2026-109618:and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP

Blog ↗CVE details

CVE-2026-88771:Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779

Blog ↗CVE details

CVE-2026-102764:Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild

Blog ↗CVE details

CVE-2026-97229:Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)

Blog ↗CVE details

CVE-2026-111497:Critical out-of-bounds write in the Node.js Brotli decoderBlog ↗CVE details

CVE-2026-109618:and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHPBlog ↗CVE details

CVE-2026-88771:Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779Blog ↗CVE details

CVE-2026-102764:Critical BeyondTrust Remote Support Authentication Bypass Exploited in the WildBlog ↗CVE details

CVE-2026-97229:Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)Blog ↗CVE details

Title			EitW	Modules

Title
CVE-2026-121611: Red Hat: A flaw was found in GStreamer's gst-plugins-bad package	6.5 Medium	N/A	N/A	Nov 9, 2026
CVE-2026-119613: ash-project ash_ai: Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai allows a caller of an…	N/A	5.3 Medium	N/A	Nov 9, 2026
CVE-2026-119610: Red Hat: A flaw was found in GStreamer's gst-plugins-good, specifically in the H.264 RTP depayloader element	8.2 High	N/A	N/A	Nov 9, 2026
CVE-2026-118792: CompuGroup Medical Wingesfar: Default credentials permit access through AcuXDBC.	N/A	6.1 Medium	N/A	Nov 9, 2026
CVE-2026-118791: CompuGroup Medical Wingesfar: The application implements software update functionality without adequate authenticity and integrity validation,…	N/A	7.2 High	N/A	Nov 9, 2026
CVE-2026-118790: CompuGroup Medical Wingesfar: Multiple hardcoded credentials are embedded within product components and administrative functionalities	N/A	7.2 High	N/A	Nov 9, 2026
CVE-2026-112171: GALENO SISTEMI MAGISTRA: An attacker can inject malicious SQL statements through user-controlled input, allowing unauthorized access to,…	N/A	4.4 Medium	N/A	Nov 9, 2026
CVE-2026-112170: GALENO SISTEMI MAGISTRA: The software downloads upgrade files without performing integrity checks, allowing the installation of tampered updates.	N/A	6.3 Medium	N/A	Nov 9, 2026
CVE-2026-112169: GALENO SISTEMI MAGISTRA: Magistra software contains undocumented backdoor functionality that allows authentication bypass and the creation of a…	N/A	6.1 Medium	N/A	Nov 9, 2026
CVE-2026-112168: GALENO SISTEMI MAGISTRA: The Magistra software uses weak custom encryption, relies on an outdated compression algorithm to protect the database,…	N/A	6.0 Medium	N/A	Nov 9, 2026
CVE-2026-121601: Red Hat: A flaw was found in GStreamer's MXF demuxer plugin (gst-plugins-bad)	6.1 Medium	N/A	N/A	Nov 9, 2026
CVE-2026-122673: Wpmet ShopEngine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ShopEngine…	6.5 Medium	N/A	N/A	Nov 9, 2026
CVE-2026-112205: Fundacja Widzialni WidzialniCMS: WidzialniCMS is vulnerable to Bruteforce Protection Bypass in the login functionality	N/A	6.9 Medium	N/A	Nov 9, 2026
CVE-2026-112204: Fundacja Widzialni WidzialniCMS: WidzialniCMS is vulnerable to Reflected XSS in the /index.php endpoint	N/A	5.1 Medium	N/A	Nov 9, 2026
CVE-2026-110469: Fundacja Widzialni WidzialniCMS: WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint	N/A	10.0 Critical	N/A	Nov 9, 2026
CVE-2026-110468: Fundacja Widzialni WidzialniCMS: WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/save_photo.php endpoint	N/A	10.0 Critical	N/A	Nov 9, 2026
CVE-2026-124684: Samsung Open Source Escargot: Use after free vulnerability in Samsung Open Source Escargot allows Pointer Manipulation	5.1 Medium	N/A	N/A	Nov 9, 2026
CVE-2026-121629: Red Hat: A flaw was found in GStreamer's adaptive streaming demuxers (HLS, DASH, MSS)	7.5 High	N/A	N/A	Nov 9, 2026
CVE-2026-118468: CompuGroup Medical: XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled,…	N/A	7.2 High	N/A	Nov 9, 2026
CVE-2026-118467: CompuGroup Medical: Shared telemetry and logging components store or transmit patient and doctor identifiers, clinical information, and…	N/A	4.3 Medium	N/A	Nov 9, 2026
CVE-2026-118465: CompuGroup Medical: Shared components expose hard-coded Access, workgroup, CCBasic, DBISAM, and related database credentials that are…	N/A	5.8 Medium	N/A	Nov 9, 2026
CVE-2026-118464: CompuGroup Medical: Shared cryptographic services use fixed vendor-wide secrets, deterministic IVs, null salts, and reversible…	N/A	5.8 Medium	N/A	Nov 9, 2026
CVE-2026-118462: CompuGroup Medical: Update components download and execute code without proper authenticity verification, relying on ignored hashes or…	N/A	9.2 Critical	N/A	Nov 9, 2026
CVE-2026-118461: CompuGroup Medical: The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring…	N/A	8.0 High	N/A	Nov 9, 2026
CVE-2026-118460: CompuGroup Medical: Embedded private keys protected by a shared password can be used to sign practitioner assertions for arbitrary…	N/A	8.0 High	N/A	Nov 9, 2026

25 rows per page

76-100 of 427771

‹›

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business