Rapid7 Vulnerability & Exploit Database

Emergent Threat6

CVE-2026-111357:Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)Blog ↗CVE details

CVE-2026-111357:Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)

Blog ↗CVE details

CVE-2026-111497:Critical out-of-bounds write in the Node.js Brotli decoder

Blog ↗CVE details

CVE-2026-109618:and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP

Blog ↗CVE details

CVE-2026-88771:Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779

Blog ↗CVE details

CVE-2026-102764:Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild

Blog ↗CVE details

CVE-2026-97229:Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)

Blog ↗CVE details

CVE-2026-111497:Critical out-of-bounds write in the Node.js Brotli decoderBlog ↗CVE details

CVE-2026-109618:and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHPBlog ↗CVE details

CVE-2026-88771:Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779Blog ↗CVE details

CVE-2026-102764:Critical BeyondTrust Remote Support Authentication Bypass Exploited in the WildBlog ↗CVE details

CVE-2026-97229:Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)Blog ↗CVE details

Title			EitW	Modules

Title
CVE-2026-108041: Unknown SEOPress: The SEOPress WordPress plugin before 10.4 does not sanitise and escape some of its analytics tracking settings before…	N/A	N/A	N/A	Nov 4, 2026
CVE-2026-106649: Unknown Kali Forms — Contact Form & Drag-and-Drop Builder: The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.29 does not prevent users with…	N/A	N/A	N/A	Nov 4, 2026
CVE-2026-106000: Unknown Booking Package: The Booking Package WordPress plugin before 1.7.34 does not require payment to be completed before saving a booking on…	N/A	N/A	N/A	Nov 4, 2026
CVE-2026-105413: Unknown Form Maker by 10Web: The Form Maker by 10Web WordPress plugin before 1.15.51 does not consistently escape user-submitted field values before…	N/A	N/A	N/A	Nov 4, 2026
CVE-2026-105191: Unknown: The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce WordPress plugin before 1.17.11 does not perform a…	N/A	N/A	N/A	Nov 4, 2026
CVE-2026-104719: Unknown CookieYes: The CookieYes WordPress plugin before 3.5.8 does not correctly restrict who can write its cookie-category script…	N/A	N/A	N/A	Nov 4, 2026
CVE-2026-101166: Unknown Mollie Payments for WooCommerce: The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify a product's publication status before…	N/A	N/A	N/A	Nov 4, 2026
CVE-2026-101165: Unknown Mollie Payments for WooCommerce: The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify an order's payment state or the…	N/A	N/A	N/A	Nov 4, 2026
CVE-2026-11753: LY Corporation Armeria: A vulnerability has been identified in armeria-saml versions prior to 1.41.1, where attacker-controlled RelayState is…	N/A	5.1 Medium	N/A	Nov 4, 2026
CVE-2026-105296: Akeeba Ltd.: Multiple Akeeba products lack the anti-CSRF check on some actions	5.4 Medium	5.1 Medium	N/A	Nov 4, 2026
CVE-2026-11749: LY Corporation Armeria: A vulnerability has been identified in armeria-saml prior to 1.41.1, where bearer assertions are not enforced for…	N/A	7.6 High	N/A	Nov 4, 2026
CVE-2026-80335: Unisoc (Shanghai) Technologies Co., Ltd. Bootloader: In the bootloader download module, there is a possible out-of-bounds write due to a failure to reset a global offset…	7.6 High	N/A	N/A	Nov 4, 2026
CVE-2026-79405: Unisoc (Shanghai) Technologies Co., Ltd. Modem: In Modem Firmware, there is a possible system crash due to improper input validation of dedicated PUCCH configuration	7.5 High	N/A	N/A	Nov 4, 2026
CVE-2026-121803: Out-of-bounds Write	9.3 Critical	N/A	N/A	Nov 4, 2026
CVE-2026-121802: better-auth Better Auth: @better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any…	9.1 Critical	N/A	N/A	Nov 4, 2026
CVE-2026-121618: Linksys E5600: A weakness has been identified in Linksys E5600 1.1.0.26	5.3 Medium	5.5 Medium	N/A	Nov 4, 2026
CVE-2026-121617: Linksys E5600: A security flaw has been discovered in Linksys E5600 1.1.0.26	7.5 High	7.7 High	N/A	Nov 4, 2026
CVE-2026-121616: Linksys E5600: A vulnerability was identified in Linksys E5600 1.1.0.26	5.3 Medium	5.5 Medium	N/A	Nov 4, 2026
CVE-2026-121615: Linksys E5600: A vulnerability was determined in Linksys E5600 1.1.0.26	10.0 Critical	9.3 Critical	N/A	Nov 4, 2026
CVE-2026-121609: Qihoo 360 Whole Home Router M5: A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566	10.0 Critical	9.3 Critical	N/A	Nov 4, 2026
CVE-2026-121608: Qihoo 360: A vulnerability was determined in Qihoo 360 D603-2, D600-2 and D606-6 up to 6.3.2	7.3 High	5.5 Medium	N/A	Nov 4, 2026
CVE-2026-121607: Qihoo 360: A vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to 6.4.9	10.0 Critical	9.3 Critical	N/A	Nov 4, 2026
CVE-2026-84729: ASUS Router firmware: Out-of-bounds write in certain ASUS Router firmware allow an unauthenticated nearby attacker to write data beyond the…	N/A	7.2 High	N/A	Nov 4, 2026
CVE-2026-84730: ASUS Router firmware: Stack-based buffer overflow in certain ASUS Router firmware allows an unauthenticated nearby attacker to execute…	N/A	8.7 High	N/A	Nov 4, 2026
CVE-2026-112116: ASUS System Control Interface: An exposed IOCTL with insufficient access control in ASUS System Control Interface allows a local, low-privileged user…	N/A	8.5 High	N/A	Nov 4, 2026

25 rows per page

101-125 of 418074

‹›

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business