Rapid7 Vulnerability & Exploit Database

Emergent Threat6

CVE-2026-111357:Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)Blog ↗CVE details

CVE-2026-111357:Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)

Blog ↗CVE details

CVE-2026-111497:Critical out-of-bounds write in the Node.js Brotli decoder

Blog ↗CVE details

CVE-2026-109618:and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP

Blog ↗CVE details

CVE-2026-88771:Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779

Blog ↗CVE details

CVE-2026-102764:Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild

Blog ↗CVE details

CVE-2026-97229:Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)

Blog ↗CVE details

CVE-2026-111497:Critical out-of-bounds write in the Node.js Brotli decoderBlog ↗CVE details

CVE-2026-109618:and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHPBlog ↗CVE details

CVE-2026-88771:Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779Blog ↗CVE details

CVE-2026-102764:Critical BeyondTrust Remote Support Authentication Bypass Exploited in the WildBlog ↗CVE details

CVE-2026-97229:Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)Blog ↗CVE details

Title			EitW	Modules

Title
CVE-2026-125112: djust-org djust: djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance	N/A	2.3 Low	N/A	Nov 9, 2026
CVE-2026-90591: zephyrproject zephyr: The NXP ENET-QOS Ethernet driver's receive work handler eth_nxp_enet_qos_rx() in drivers/ethernet/eth_nxp_enet_qos…	7.5 High	N/A	N/A	Nov 9, 2026
CVE-2026-90590: zephyrproject zephyr: The NXP ENET QoS Ethernet driver in drivers/ethernet/eth_nxp_enet_qos serialises transmission with a binary semaphore,…	6.5 Medium	N/A	N/A	Nov 9, 2026
CVE-2026-90589: zephyrproject zephyr: When CONFIG_THREAD_STACK_MEM_MAPPED is enabled, each thread stack is mapped into the kernel virtual address space with…	5.5 Medium	N/A	N/A	Nov 9, 2026
CVE-2026-90588: zephyrproject zephyr: The HTTP client's debug helper print_header_field() in subsys/net/lib/http/http_client.c formatted an http_parser…	3.7 Low	N/A	N/A	Nov 9, 2026
CVE-2026-90587: zephyrproject zephyr: usbh_device_init() in subsys/usb/host/usbh_device.c rejects a device whose device descriptor advertises…	4.6 Medium	N/A	N/A	Nov 9, 2026
CVE-2026-90586: zephyrproject zephyr: The Xtensa MMU userspace port never initialized the per-thread page-table pointer thread->arch.ptables during thread…	7.8 High	N/A	N/A	Nov 9, 2026
CVE-2026-90585: zephyrproject zephyr: The Renesas RA SCI UART driver's receive-error ISR, uart_ra_sci_eri_isr() in drivers/serial/uart_renesas_ra_sci.c,…	4.6 Medium	N/A	N/A	Nov 9, 2026
CVE-2026-125111: rack: Rack is a modular Ruby web server interface	7.5 High	N/A	N/A	Nov 9, 2026
CVE-2026-125110: rack: Rack is a modular Ruby web server interface	5.3 Medium	N/A	N/A	Nov 9, 2026
CVE-2026-124999: n/a braindecode: A security vulnerability has been detected in braindecode up to 1.8.2	6.3 Medium	5.3 Medium	N/A	Nov 9, 2026
CVE-2026-125109: rack: Rack is a modular Ruby web server interface	4.8 Medium	N/A	N/A	Nov 9, 2026
CVE-2026-125108: rack: Rack is a modular Ruby web server interface	3.7 Low	N/A	N/A	Nov 9, 2026
CVE-2026-77473: ronf asyncssh: AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on…	6.5 Medium	N/A	N/A	Nov 9, 2026
CVE-2026-102643: ronf asyncssh: AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on…	8.8 High	N/A	N/A	Nov 9, 2026
CVE-2026-124996: Turboderp-org ExLlamaV3: A weakness has been identified in Turboderp-org ExLlamaV3 up to 1.6.3	6.3 Medium	5.3 Medium	N/A	Nov 9, 2026
CVE-2026-102289: zizmorcore zizmor: zizmor is a static analysis tool for CI/CD systems	N/A	7.0 High	N/A	Nov 9, 2026
CVE-2026-61812: owasp-modsecurity ModSecurity: ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx	N/A	6.3 Medium	N/A	Nov 9, 2026
CVE-2026-73857: owasp-modsecurity ModSecurity: ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx	7.5 High	N/A	N/A	Nov 9, 2026
CVE-2026-104259: owasp-modsecurity ModSecurity: ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx	5.4 Medium	N/A	N/A	Nov 9, 2026
CVE-2026-114032: Illumio Core Ven: The OpenSSL library bundled with the Illumio VEN for Windows is affected by an uncontrolled search path vulnerability	7.8 High	N/A	N/A	Nov 9, 2026
CVE-2026-114031: Illumio Core Ven: Incorrect permission assignment allows local privilege escalation to SYSTEM on affected releases of the Illumio VEN for…	7.8 High	N/A	N/A	Nov 9, 2026
CVE-2026-125107: julianhille MuhammaraJS: Muhammara is a node module with c/cpp bindings to modify PDF with JavaScript for node or electron	7.5 High	N/A	N/A	Nov 9, 2026
CVE-2026-125106: wagtail: Wagtail is an open source content management system built on Django	6.5 Medium	N/A	N/A	Nov 9, 2026
CVE-2026-125105: wagtail: Wagtail is an open source content management system built on Django	3.7 Low	N/A	N/A	Nov 9, 2026

25 rows per page

176-200 of 427771

‹›

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business