Rapid7 Vulnerability & Exploit Database

Emergent Threat6

CVE-2026-109618:and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHPBlog ↗CVE details

CVE-2026-109618:and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP

Blog ↗CVE details

CVE-2026-88771:Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779

Blog ↗CVE details

CVE-2026-102764:Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild

Blog ↗CVE details

CVE-2026-97229:Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)

Blog ↗CVE details

CVE-2026-104935:Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)

Blog ↗CVE details

CVE-2026-97229:Critical Unauthenticated Remote Code Execution in GitLab

Blog ↗CVE details

CVE-2026-88771:Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779Blog ↗CVE details

CVE-2026-102764:Critical BeyondTrust Remote Support Authentication Bypass Exploited in the WildBlog ↗CVE details

CVE-2026-97229:Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)Blog ↗CVE details

CVE-2026-104935:Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)Blog ↗CVE details

CVE-2026-97229:Critical Unauthenticated Remote Code Execution in GitLabBlog ↗CVE details

Title			EitW	Modules

Title
CVE-2026-116067: ananthakumaran paisa: Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and…	8.2 High	8.8 High	N/A	Oct 25, 2026
CVE-2026-116066: Firecrawl: Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy…	6.8 Medium	7.0 High	N/A	Oct 25, 2026
CVE-2026-116050: krupalshah Employee Recruitment System: A vulnerability has been found in krupalshah Employee Recruitment System up to 922ff6d208278282e7c8e36d70d9ae356adec9fe	7.3 High	5.5 Medium	N/A	Oct 25, 2026
CVE-2026-116049: krupalshah EmployeeRecruitmentSystem: A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe	7.3 High	5.5 Medium	N/A	Oct 25, 2026
CVE-2026-116048: krupalshah EmployeeRecruitmentSystem: A vulnerability was detected in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe	7.3 High	5.5 Medium	N/A	Oct 25, 2026
CVE-2026-116047: Privoce Vocechat: A vulnerability has been found in Privoce Vocechat up to 0.9.121	4.3 Medium	2.1 Low	N/A	Oct 25, 2026
CVE-2026-116046: eventcatalog sdk: A flaw has been found in eventcatalog sdk up to 2.29.0	5.3 Medium	4.8 Medium	N/A	Oct 25, 2026
CVE-2026-116045: 1999AZZAR designer-mcp: A vulnerability was detected in 1999AZZAR designer-mcp up to 2.1.0	4.3 Medium	2.1 Low	N/A	Oct 25, 2026
CVE-2026-94295: Unknown Chikkili- Google Pay India for Woocommerce: The Chikkili- Google Pay India for Woocommerce WordPress plugin through 1.0.6 does not verify that a payment…	N/A	N/A	N/A	Oct 25, 2026
CVE-2026-116044: prasathmani TinyFileManager: A security vulnerability has been detected in prasathmani TinyFileManager up to 2.6	6.3 Medium	2.1 Low	N/A	Oct 25, 2026
CVE-2026-115251: Unknown Duplicator: The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to…	N/A	N/A	N/A	Oct 25, 2026
CVE-2026-115214: Unknown Datawiza Proxy Auth Plugin: The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP…	N/A	N/A	N/A	Oct 25, 2026
CVE-2026-115183: Unknown Qi Addons For Elementor: The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after…	N/A	N/A	N/A	Oct 25, 2026
CVE-2026-114743: Unknown InstaWP Connect: The InstaWP Connect WordPress plugin before 0.1.4.2 does not perform a capability check on its InstaWP Connect…	N/A	N/A	N/A	Oct 25, 2026
CVE-2026-114742: Unknown WPVR: The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours,…	N/A	N/A	N/A	Oct 25, 2026
CVE-2026-114741: Unknown WPVR: The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating…	N/A	N/A	N/A	Oct 25, 2026
CVE-2026-114740: Unknown WPVR: The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its…	N/A	N/A	N/A	Oct 25, 2026
CVE-2026-111981: Unknown GiveWP: The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes,…	N/A	N/A	N/A	Oct 25, 2026
CVE-2026-111980: Unknown GiveWP: The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capability request applies…	N/A	N/A	N/A	Oct 25, 2026
CVE-2026-111979: Unknown GiveWP: The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form template…	N/A	N/A	N/A	Oct 25, 2026
CVE-2026-111978: Unknown GiveWP: The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-supplied filename before reading it from…	N/A	N/A	N/A	Oct 25, 2026
CVE-2026-111976: Unknown GiveWP: The GiveWP WordPress plugin before 4.19.0.1 does not perform any status or capability check when rendering a donation…	N/A	N/A	N/A	Oct 25, 2026
CVE-2026-110285: Unknown WP Stripe Checkout: The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the Stripe webhook signature when no signing…	N/A	N/A	N/A	Oct 25, 2026
CVE-2025-15705: Unknown Contact Form by Supsystic: The Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise and escape a form name, allowing users…	N/A	N/A	N/A	Oct 25, 2026
CVE-2026-116007: YunaiV, zhijiantianya ruoyi-vue-pro: A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09	3.7 Low	2.9 Low	N/A	Oct 25, 2026

Rows per page

101-125 of 537999

‹›

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business