Rapid7 Vulnerability & Exploit Database

Emergent Threat6

CVE-2026-111357:Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)Blog ↗CVE details

CVE-2026-111357:Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)

Blog ↗CVE details

CVE-2026-111497:Critical out-of-bounds write in the Node.js Brotli decoder

Blog ↗CVE details

CVE-2026-109618:and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP

Blog ↗CVE details

CVE-2026-88771:Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779

Blog ↗CVE details

CVE-2026-102764:Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild

Blog ↗CVE details

CVE-2026-97229:Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)

Blog ↗CVE details

CVE-2026-111497:Critical out-of-bounds write in the Node.js Brotli decoderBlog ↗CVE details

CVE-2026-109618:and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHPBlog ↗CVE details

CVE-2026-88771:Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779Blog ↗CVE details

CVE-2026-102764:Critical BeyondTrust Remote Support Authentication Bypass Exploited in the WildBlog ↗CVE details

CVE-2026-97229:Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)Blog ↗CVE details

Title			EitW	Modules

Title
CVE-2026-118529: Unknown: The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify…	N/A	N/A	N/A	Nov 7, 2026
CVE-2026-118528: Unknown: The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not…	N/A	N/A	N/A	Nov 7, 2026
CVE-2026-117588: Unknown WP Google Review Slider: The WP Google Review Slider WordPress plugin before 18.11 does not perform nonce validation when updating its active…	N/A	N/A	N/A	Nov 7, 2026
CVE-2026-117525: Unknown FV Flowplayer Video Player: The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not escape shortcode attribute values embedded…	N/A	N/A	N/A	Nov 7, 2026
CVE-2025-15708: Unknown Live Composer: The Live Composer WordPress plugin before 2.1.23 does not sanitise and escape some of its custom post type slug…	N/A	N/A	N/A	Nov 7, 2026
CVE-2026-9601: bfintal Stackable – Page Builder Gutenberg Blocks: The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…	6.4 Medium	N/A	N/A	Nov 7, 2026
CVE-2026-93902: pencidesign Soledad: The Soledad theme for WordPress is vulnerable to Stored Cross-Site Scripting via Social Profile Fields in all versions…	6.4 Medium	N/A	N/A	Nov 7, 2026
CVE-2026-93779: themeum Tutor LMS – eLearning and online course solution: The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object…	6.5 Medium	N/A	N/A	Nov 7, 2026
CVE-2026-75590: IBM API Connect: IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access internal network resources and obtain…	7.2 High	N/A	N/A	Nov 7, 2026
CVE-2026-19131: IBM API Connect: IBM API Connect 12.1.0.0 through 12.1.1.2 could allow low-privileged users to query arbitrary indices and read…	6.5 Medium	N/A	N/A	Nov 7, 2026
CVE-2026-19129: IBM API Connect: IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a network-positioned attacker to…	6.8 Medium	N/A	N/A	Nov 7, 2026
CVE-2026-19128: IBM API Connect: IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to send unauthorized requests from the…	7.5 High	N/A	N/A	Nov 7, 2026
CVE-2026-19126: IBM API Connect: IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 uses weaker than expected cryptographic…	5.9 Medium	N/A	N/A	Nov 7, 2026
CVE-2026-19124: IBM API Connect: IBM API Connect 10.0.8.0 through 10.0.8.12 could allow an attacker with access to stored data to decrypt sensitive…	6.8 Medium	N/A	N/A	Nov 7, 2026
CVE-2026-19122: IBM API Connect: IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated privileged attacker to send unauthorized…	3.8 Low	N/A	N/A	Nov 7, 2026
CVE-2026-19121: IBM API Connect: IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to gain unauthorized access due to…	8.3 High	N/A	N/A	Nov 7, 2026
CVE-2026-18838: IBM API Connect: IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information and modify API…	9.4 Critical	N/A	N/A	Nov 7, 2026
CVE-2026-18836: IBM API Connect: IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain…	9.3 Critical	N/A	N/A	Nov 7, 2026
CVE-2026-18689: IBM API Connect: IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain…	4.3 Medium	N/A	N/A	Nov 7, 2026
CVE-2026-18535: IBM API Connect: IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a Regular Expression Denial…	9.6 Critical	N/A	N/A	Nov 7, 2026
CVE-2026-17428: IBM API Connect: IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to…	5.0 Medium	N/A	N/A	Nov 7, 2026
CVE-2026-17411: IBM API Connect: IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view,…	7.6 High	N/A	N/A	Nov 7, 2026
CVE-2026-17410: IBM API Connect: IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to…	9.9 Critical	N/A	N/A	Nov 7, 2026
CVE-2026-17409: IBM API Connect: IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute…	9.4 Critical	N/A	N/A	Nov 7, 2026
CVE-2026-17408: IBM API Connect: IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute…	9.8 Critical	N/A	N/A	Nov 7, 2026

25 rows per page

151-175 of 425038

‹›

MDR Buyer's Guide

Global Threat Landscape Report