Rapid7 Vulnerability & Exploit Database

Emergent Threat6

CVE-2026-109618:and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHPBlog ↗CVE details

CVE-2026-109618:and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP

Blog ↗CVE details

CVE-2026-88771:Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779

Blog ↗CVE details

CVE-2026-102764:Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild

Blog ↗CVE details

CVE-2026-97229:Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)

Blog ↗CVE details

CVE-2026-104935:Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)

Blog ↗CVE details

CVE-2026-97229:Critical Unauthenticated Remote Code Execution in GitLab

Blog ↗CVE details

CVE-2026-88771:Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779Blog ↗CVE details

CVE-2026-102764:Critical BeyondTrust Remote Support Authentication Bypass Exploited in the WildBlog ↗CVE details

CVE-2026-97229:Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)Blog ↗CVE details

CVE-2026-104935:Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)Blog ↗CVE details

CVE-2026-97229:Critical Unauthenticated Remote Code Execution in GitLabBlog ↗CVE details

Title			EitW	Modules

Title
CVE-2026-114191: Knit Pay UPI QR Code Payment Gateway for WooCommerce: Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce…	7.5 High	N/A	N/A	Oct 24, 2026
CVE-2026-114192: Magepeople inc. WpEvently: Missing Authorization vulnerability in Magepeople inc	6.5 Medium	N/A	N/A	Oct 24, 2026
CVE-2026-116020: BookStackApp BookStack: BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows…	5.4 Medium	5.3 Medium	N/A	Oct 24, 2026
CVE-2026-116016: YunaiV yudao-cloud: yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade…	7.1 High	7.1 High	N/A	Oct 24, 2026
CVE-2026-116010: francoisjacquet RosarioSIS: RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write…	4.3 Medium	5.3 Medium	N/A	Oct 24, 2026
CVE-2026-116008: Bottelet DaybydayCRM: DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in ProjectsController::updateAssign() that…	4.3 Medium	5.3 Medium	N/A	Oct 24, 2026
CVE-2026-115994: CervantesSec cervantes: BOLA Allows Cross-Project Target Tampering in Cervantes version v1.3-beta could allow an attacker modify or delete…	5.4 Medium	N/A	N/A	Oct 24, 2026
CVE-2026-114705: quadlayers WP Social Feed Gallery: Missing Authorization vulnerability in quadlayers WP Social Feed Gallery insta-gallery allows Exploiting Incorrectly…	6.5 Medium	N/A	N/A	Oct 24, 2026
CVE-2026-110892: Brainstorm Force SureDash: Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured…	6.5 Medium	N/A	N/A	Oct 24, 2026
CVE-2026-115803: n/a Scada-LTS: A flaw has been found in Scada-LTS 2.8.0	4.3 Medium	2.1 Low	N/A	Oct 24, 2026
CVE-2026-115807: cozmoslabs: The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is…	7.1 High	N/A	N/A	Oct 24, 2026
CVE-2026-115887: graphql-hive graphql-scalars: GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas	7.5 High	N/A	N/A	Oct 23, 2026
CVE-2026-55486: intranda goobi-viewer-core: The Goobi viewer is a web application that allows digitised material to be displayed in a web browser	9.3 Critical	N/A	N/A	Oct 23, 2026
CVE-2026-55457: intranda goobi-viewer-core: The Goobi viewer is a web application that allows digitised material to be displayed in a web browser	7.4 High	N/A	N/A	Oct 23, 2026
CVE-2026-93639: Zimbra Zimbra Collaboration Suite: A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no…	8.7 High	N/A	N/A	Oct 23, 2026
CVE-2026-93634: Zimbra Zimbra Collaboration Suite: A cross-account authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to insert…	4.3 Medium	N/A	N/A	Oct 23, 2026
CVE-2026-93631: Zimbra Zimbra Collaboration Suite: A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition…	7.1 High	N/A	N/A	Oct 23, 2026
CVE-2026-93628: Zimbra Zimbra Collaboration Suite: An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an…	5.3 Medium	N/A	N/A	Oct 23, 2026
CVE-2026-114623: baserproject basercms: baserCMS is a website development framework	6.5 Medium	N/A	N/A	Oct 23, 2026
CVE-2026-114357: DJI CrystalSky ZS600C: Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C…	N/A	9.3 Critical	N/A	Oct 23, 2026
CVE-2026-114356: DJI CrystalSky ZS600C: Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7…	N/A	7.0 High	N/A	Oct 23, 2026
CVE-2026-114354: DJI CrystalSky ZS600C: Missing authorization in the native binder service 'android.dji.server' (transaction code 1018) in DJI CrystalSky…	N/A	8.6 High	N/A	Oct 23, 2026
CVE-2026-115750: agentfront mcp-from-openapi: mcp-from-openapi from 2.5.0 before 2.9.0 contains a credential exposure vulnerability that allows attackers to capture…	3.7 Low	6.3 Medium	N/A	Oct 23, 2026
CVE-2026-115725: chatwoot: Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access…	4.2 Medium	2.3 Low	N/A	Oct 23, 2026
CVE-2026-107685: agentjido req_llm: Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an on-path…	N/A	9.1 Critical	N/A	Oct 23, 2026

Rows per page

1-25 of 12127

›

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business