Rapid7 Vulnerability & Exploit Database

Emergent Threat6

CVE-2026-111357:Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)Blog ↗CVE details

CVE-2026-111357:Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)

Blog ↗CVE details

CVE-2026-111497:Critical out-of-bounds write in the Node.js Brotli decoder

Blog ↗CVE details

CVE-2026-109618:and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP

Blog ↗CVE details

CVE-2026-88771:Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779

Blog ↗CVE details

CVE-2026-102764:Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild

Blog ↗CVE details

CVE-2026-97229:Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)

Blog ↗CVE details

CVE-2026-111497:Critical out-of-bounds write in the Node.js Brotli decoderBlog ↗CVE details

CVE-2026-109618:and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHPBlog ↗CVE details

CVE-2026-88771:Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779Blog ↗CVE details

CVE-2026-102764:Critical BeyondTrust Remote Support Authentication Bypass Exploited in the WildBlog ↗CVE details

CVE-2026-97229:Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)Blog ↗CVE details

Title			EitW	Modules

Title
CVE-2026-121857: Unknown Event Tickets with Ticket Scanner: The Event Tickets with Ticket Scanner WordPress plugin before 3.1.14 does not check that a user may manage WooCommerce…	N/A	N/A	N/A	Nov 7, 2026
CVE-2026-121848: Unknown Magic Link: The Magic Link WordPress plugin before 2.2.6 does not check that the user requesting a login link is authorised to…	N/A	N/A	N/A	Nov 7, 2026
CVE-2026-121796: Unknown Add From Server Lite: The Add From Server Lite WordPress plugin before 6.0.0 does not restrict SVG uploads to users allowed to post…	N/A	N/A	N/A	Nov 7, 2026
CVE-2026-121492: Unknown Fiber Admin: The Fiber Admin WordPress plugin before 4.0.1 does not have authorisation checks in some of its AJAX actions, allowing…	N/A	N/A	N/A	Nov 7, 2026
CVE-2026-121491: Unknown Fiber Admin: The Fiber Admin WordPress plugin before 4.0.1 does not validate or escape a request header before writing it into a PHP…	N/A	N/A	N/A	Nov 7, 2026
CVE-2026-121380: Unknown Tournamatch: The Tournamatch WordPress plugin before 4.7.1 does not restrict access to its team invitation listing, allowing…	N/A	N/A	N/A	Nov 7, 2026
CVE-2026-121379: Unknown Tournamatch: The Tournamatch WordPress plugin before 4.7.1 does not validate or restrict the path of a previously stored profile or…	N/A	N/A	N/A	Nov 7, 2026
CVE-2026-119073: Unknown Live Composer: The Live Composer WordPress plugin before 2.1.23 does not escape a pagination setting supplied through its post-listing…	N/A	N/A	N/A	Nov 7, 2026
CVE-2026-118534: Unknown: The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify…	N/A	N/A	N/A	Nov 7, 2026
CVE-2026-118533: Unknown: The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify…	N/A	N/A	N/A	Nov 7, 2026
CVE-2026-118532: Unknown: The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify…	N/A	N/A	N/A	Nov 7, 2026
CVE-2026-118530: Unknown: The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not check…	N/A	N/A	N/A	Nov 7, 2026
CVE-2026-118529: Unknown: The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify…	N/A	N/A	N/A	Nov 7, 2026
CVE-2026-118528: Unknown: The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not…	N/A	N/A	N/A	Nov 7, 2026
CVE-2026-117588: Unknown WP Google Review Slider: The WP Google Review Slider WordPress plugin before 18.11 does not perform nonce validation when updating its active…	N/A	N/A	N/A	Nov 7, 2026
CVE-2026-117525: Unknown FV Flowplayer Video Player: The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not escape shortcode attribute values embedded…	N/A	N/A	N/A	Nov 7, 2026
CVE-2025-15708: Unknown Live Composer: The Live Composer WordPress plugin before 2.1.23 does not sanitise and escape some of its custom post type slug…	N/A	N/A	N/A	Nov 7, 2026
CVE-2026-97191: Unknown Advanced Custom Fields (ACF®): The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not re-apply its field-group location rules when…	N/A	N/A	N/A	Nov 7, 2026
CVE-2026-97190: Unknown Advanced Custom Fields (ACF®): The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not verify that a user is allowed to edit the…	N/A	N/A	N/A	Nov 7, 2026
CVE-2026-97189: Unknown Advanced Custom Fields (ACF®): The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not perform a read-permission check when it…	N/A	N/A	N/A	Nov 7, 2026
CVE-2026-93779: themeum Tutor LMS – eLearning and online course solution: The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object…	6.5 Medium	N/A	N/A	Nov 7, 2026
CVE-2026-75590: IBM API Connect: IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access internal network resources and obtain…	7.2 High	N/A	N/A	Nov 7, 2026
CVE-2026-19131: IBM API Connect: IBM API Connect 12.1.0.0 through 12.1.1.2 could allow low-privileged users to query arbitrary indices and read…	6.5 Medium	N/A	N/A	Nov 7, 2026
CVE-2026-19129: IBM API Connect: IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a network-positioned attacker to…	6.8 Medium	N/A	N/A	Nov 7, 2026
CVE-2026-19128: IBM API Connect: IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to send unauthorized requests from the…	7.5 High	N/A	N/A	Nov 7, 2026

25 rows per page

201-225 of 422263

‹›

MDR Buyer's Guide

Global Threat Landscape Report