Rapid7 Vulnerability & Exploit Database

Emergent Threat6

CVE-2026-111357:Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)Blog ↗CVE details

CVE-2026-111357:Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)

Blog ↗CVE details

CVE-2026-111497:Critical out-of-bounds write in the Node.js Brotli decoder

Blog ↗CVE details

CVE-2026-109618:and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP

Blog ↗CVE details

CVE-2026-88771:Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779

Blog ↗CVE details

CVE-2026-102764:Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild

Blog ↗CVE details

CVE-2026-97229:Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)

Blog ↗CVE details

CVE-2026-111497:Critical out-of-bounds write in the Node.js Brotli decoderBlog ↗CVE details

CVE-2026-109618:and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHPBlog ↗CVE details

CVE-2026-88771:Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779Blog ↗CVE details

CVE-2026-102764:Critical BeyondTrust Remote Support Authentication Bypass Exploited in the WildBlog ↗CVE details

CVE-2026-97229:Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)Blog ↗CVE details

Title			EitW	Modules

Title
CVE-2026-122038: krupalshah EmployeeRecruitmentSystem: A vulnerability was identified in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe	7.3 High	5.5 Medium	N/A	Nov 4, 2026
CVE-2026-122028: NST Labs Tech Nstbrowser: A vulnerability has been found in NST Labs Tech Nstbrowser 1.21.0	4.3 Medium	2.1 Low	N/A	Nov 4, 2026
CVE-2026-115770: pocket-id: Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services	9.6 Critical	N/A	N/A	Nov 4, 2026
CVE-2026-108387: radareorg radare2: radare2 is a UNIX-like reverse engineering framework and command-line toolset	N/A	8.5 High	N/A	Nov 4, 2026
CVE-2026-102337: webmin: Webmin is a web-based system administration tool for Unix-like servers	N/A	4.9 Medium	N/A	Nov 4, 2026
CVE-2026-97693: xerrors Yuxi: Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform	9.9 Critical	N/A	N/A	Nov 4, 2026
CVE-2026-76893: tsparticles, @tsparticles: tsParticles is a TypeScript library for creating highly customizable particle animations	N/A	6.9 Medium	N/A	Nov 4, 2026
CVE-2026-63655: tsparticles, @tsparticles: tsParticles is a TypeScript library for creating highly customizable particle animations	7.5 High	N/A	N/A	Nov 4, 2026
CVE-2026-58128: Alan Health Alan: Health Insurance: Alan: Health Insurance for Android (com.alanmobile) 1.450.0 contains a path traversal vulnerability that allows a…	6.2 Medium	6.9 Medium	N/A	Nov 4, 2026
CVE-2026-57567: readest: Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading…	8.6 High	N/A	N/A	Nov 4, 2026
CVE-2026-57566: readest: Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading…	9.3 Critical	N/A	N/A	Nov 4, 2026
CVE-2026-57565: readest: Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading…	6.5 Medium	N/A	N/A	Nov 4, 2026
CVE-2026-57562: readest: Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading…	6.5 Medium	N/A	N/A	Nov 4, 2026
CVE-2026-55368: h2o: h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3	8.1 High	N/A	N/A	Nov 4, 2026
CVE-2026-55367: h2o: h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3	7.5 High	N/A	N/A	Nov 4, 2026
CVE-2026-54380: Shenzhen Shine Industrial Co., Ltd. VitaFit: VitaFit cloud API before 2026-10-30 contained a stored cross-site scripting vulnerability that allows authenticated…	5.4 Medium	5.1 Medium	N/A	Nov 4, 2026
CVE-2026-54379: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.	N/A	N/A	N/A	Nov 4, 2026
CVE-2026-54378: Shenzhen Shine Industrial Co., Ltd. VitaFit: VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user…	9.6 Critical	9.3 Critical	N/A	Nov 4, 2026
CVE-2026-54377: Shenzhen Shine Industrial Co., Ltd. VitaFit: VitaFit cloud API before 2026-10-30 contained an insecure direct object reference vulnerability that allows…	6.5 Medium	6.9 Medium	N/A	Nov 4, 2026
CVE-2026-54376: Shenzhen Shine Industrial Co., Ltd. VitaFit: VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure custom URI scheme vulnerability that…	8.2 High	8.2 High	N/A	Nov 4, 2026
CVE-2026-54375: Shenzhen Shine Industrial Co., Ltd. VitaFit: VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure session management vulnerability that…	8.4 High	8.6 High	N/A	Nov 4, 2026
CVE-2026-54374: Shenzhen Shine Industrial Co., Ltd. VitaFit: VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains a hardcoded credentials vulnerability that allows…	7.5 High	8.7 High	N/A	Nov 4, 2026
CVE-2026-54373: Shenzhen Shine Industrial Co., Ltd. VitaFit: VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains a cleartext traffic vulnerability that allows…	3.5 Low	5.1 Medium	N/A	Nov 4, 2026
CVE-2026-54372: Shenzhen Shine Industrial Co., Ltd. VitaFit: VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure TLS/SSL certificate validation…	8.8 High	8.7 High	N/A	Nov 4, 2026
CVE-2026-122266: AWS: Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS Network Policy Agent before 1.3.7 (VPC…	8.7 High	6.3 Medium	N/A	Nov 4, 2026

25 rows per page

201-225 of 419275

‹›

MDR Buyer's Guide

Global Threat Landscape Report