Rapid7 Vulnerability & Exploit Database

Emergent Threat6

CVE-2026-111357:Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)Blog ↗CVE details

CVE-2026-111357:Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)

Blog ↗CVE details

CVE-2026-111497:Critical out-of-bounds write in the Node.js Brotli decoder

Blog ↗CVE details

CVE-2026-109618:and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP

Blog ↗CVE details

CVE-2026-88771:Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779

Blog ↗CVE details

CVE-2026-102764:Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild

Blog ↗CVE details

CVE-2026-97229:Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)

Blog ↗CVE details

CVE-2026-111497:Critical out-of-bounds write in the Node.js Brotli decoderBlog ↗CVE details

CVE-2026-109618:and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHPBlog ↗CVE details

CVE-2026-88771:Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779Blog ↗CVE details

CVE-2026-102764:Critical BeyondTrust Remote Support Authentication Bypass Exploited in the WildBlog ↗CVE details

CVE-2026-97229:Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)Blog ↗CVE details

Title			EitW	Modules

Title
CVE-2026-123010: twilio-labs netlify-okta-auth: @twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim	7.2 High	N/A	N/A	Nov 5, 2026
CVE-2026-120553: ivole Customer Reviews for WooCommerce: The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…	6.4 Medium	N/A	N/A	Nov 5, 2026
CVE-2026-120533: davidanderson Redux Framework: The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via theme_opts Parameter via User…	6.4 Medium	N/A	N/A	Nov 5, 2026
CVE-2026-118193: stellarwp GiveWP – Donation Plugin and Fundraising Platform: The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Privilege Escalation in all…	8.8 High	N/A	N/A	Nov 5, 2026
CVE-2026-116617: stylemix Motors – Car Dealership & Classified Listings Plugin: The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to File Deletion in all…	8.1 High	N/A	N/A	Nov 5, 2026
CVE-2026-104812: davidanderson Redux Framework: The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'multi_media' Field Array Key…	6.4 Medium	N/A	N/A	Nov 5, 2026
CVE-2026-122236: n/a OpenHands: A vulnerability has been found in OpenHands up to 1.24.0	6.3 Medium	2.1 Low	N/A	Nov 5, 2026
CVE-2026-122191: itsourcecode Airline Reservation System: A vulnerability was determined in itsourcecode Airline Reservation System 1.0	6.3 Medium	2.1 Low	N/A	Nov 5, 2026
CVE-2026-122190: SourceCodester Online Food Ordering System: A vulnerability was found in SourceCodester Online Food Ordering System 1.0	2.4 Low	1.9 Low	N/A	Nov 5, 2026
CVE-2026-69068: Samsung Semiconductor: Insufficient length validation in the GNSS firmware loader may lead to corruption of kernel memory.	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-69066: Samsung Semiconductor: Memory corruption in GPU driver due to improper validation of VMID reservation.	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-69050: Samsung Semiconductor: Out-of-bounds memory access in a device driver due to improper resource state tracking.	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-69044: Samsung Semiconductor: In the Samsung GPU driver, improper reference count handling during command submission can lead to memory corruption.	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-69043: Samsung Semiconductor: In the Samsung Exynos GPU driver, improper synchronization during buffer object creation and closing can lead to memory…	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-69025: Samsung Semiconductor: In the Exynos NPU driver, improper validation of user input in the ioctl handler can lead to an out-of-bounds write,…	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-69006: Samsung Semiconductor: Insufficient validation of length fields in the GNSS firmware loader can result in kernel‑memory corruption.	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-69005: Samsung Semiconductor: Integer overflow in NPU driver parameter processing due to insufficient bounds checking.	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-69002: Samsung Semiconductor: Incorrect authorization in Samsung framework services due to missing permission checks	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-68994: Samsung Semiconductor: A double free vulnerability in NPU driver due to improper pointer management (941)	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-68993: Samsung Semiconductor: A double free vulnerability in NPU driver due to improper pointer management (940)	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-68991: Samsung Semiconductor: In the Samsung Exynos ENN NeuralNetworks HAL, improper input validation during request processing can cause memory…	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-68990: Samsung Semiconductor: In the Samsung Exynos H-Arx DRM plugin, improper input validation during buffer operations can cause memory corruption,…	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-68985: Samsung Semiconductor: In the Samsung Exynos NPU driver, improper validation of user input in the ioctl handler can lead to an out-of-bounds…	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-68984: Samsung Semiconductor: In the Samsung Exynos NPU kernel driver, an integer overflow allows an unprivileged application to trigger memory…	N/A	N/A	N/A	Nov 5, 2026
CVE-2026-48186: Samsung Semiconductor: Improper handling of messages before AS security activation can cause unexpected behavior	N/A	N/A	N/A	Nov 5, 2026

25 rows per page

101-125 of 420838

‹›

MDR Buyer's Guide

Global Threat Landscape Report