Rapid7 Vulnerability & Exploit Database

Emergent Threat6

CVE-2026-111357:Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)Blog ↗CVE details

CVE-2026-111357:Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)

Blog ↗CVE details

CVE-2026-111497:Critical out-of-bounds write in the Node.js Brotli decoder

Blog ↗CVE details

CVE-2026-109618:and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP

Blog ↗CVE details

CVE-2026-88771:Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779

Blog ↗CVE details

CVE-2026-102764:Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild

Blog ↗CVE details

CVE-2026-97229:Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)

Blog ↗CVE details

CVE-2026-111497:Critical out-of-bounds write in the Node.js Brotli decoderBlog ↗CVE details

CVE-2026-109618:and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHPBlog ↗CVE details

CVE-2026-88771:Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779Blog ↗CVE details

CVE-2026-102764:Critical BeyondTrust Remote Support Authentication Bypass Exploited in the WildBlog ↗CVE details

CVE-2026-97229:Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)Blog ↗CVE details

Title			EitW	Modules

Title
CVE-2026-115770: pocket-id: Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services	9.6 Critical	N/A	N/A	Nov 4, 2026
CVE-2026-122038: krupalshah EmployeeRecruitmentSystem: A vulnerability was identified in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe	7.3 High	6.9 Medium	N/A	Nov 4, 2026
CVE-2026-62662: pocket-id: Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services	7.7 High	N/A	N/A	Nov 4, 2026
CVE-2026-108387: radareorg radare2: radare2 is a UNIX-like reverse engineering framework and command-line toolset	N/A	8.5 High	N/A	Nov 4, 2026
CVE-2026-53631: glpi-project glpi: GLPI is a free asset and IT management software package	N/A	5.3 Medium	N/A	Nov 4, 2026
CVE-2026-47678: glpi-project glpi: GLPI is a free asset and IT management software package	N/A	8.7 High	N/A	Nov 4, 2026
CVE-2026-54384: Shenzhen Shine Industrial Co., Ltd. VitaFit: VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to…	9.8 Critical	9.3 Critical	N/A	Nov 4, 2026
CVE-2026-52848: glpi-project glpi: GLPI is a free asset and IT management software package	N/A	9.2 Critical	N/A	Nov 4, 2026
CVE-2026-54383: Shenzhen Shine Industrial Co., Ltd. VitaFit: VitaFit cloud API before 2026-10-30 contained an excessive data exposure vulnerability that allows any authenticated…	6.5 Medium	7.1 High	N/A	Nov 4, 2026
CVE-2026-57152: glpi-project glpi: GLPI is a free asset and IT management software package	N/A	7.1 High	N/A	Nov 4, 2026
CVE-2026-54382: Shenzhen Shine Industrial Co., Ltd. VitaFit: VitaFit cloud API before 2026-10-30 contained an improper access control vulnerability in its Cognito-issued AWS role…	7.7 High	6.3 Medium	N/A	Nov 4, 2026
CVE-2026-97693: xerrors Yuxi: Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform	9.9 Critical	N/A	N/A	Nov 4, 2026
CVE-2026-76893: tsparticles, @tsparticles: tsParticles is a TypeScript library for creating highly customizable particle animations	N/A	6.9 Medium	N/A	Nov 4, 2026
CVE-2026-63655: tsparticles, @tsparticles: tsParticles is a TypeScript library for creating highly customizable particle animations	7.5 High	N/A	N/A	Nov 4, 2026
CVE-2026-58128: Alan Health Alan: Health Insurance: Alan: Health Insurance for Android (com.alanmobile) 1.450.0 contains a path traversal vulnerability that allows a…	6.2 Medium	6.9 Medium	N/A	Nov 4, 2026
CVE-2026-57567: readest: Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading…	8.6 High	N/A	N/A	Nov 4, 2026
CVE-2026-57566: readest: Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading…	9.3 Critical	N/A	N/A	Nov 4, 2026
CVE-2026-57565: readest: Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading…	6.5 Medium	N/A	N/A	Nov 4, 2026
CVE-2026-57562: readest: Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading…	6.5 Medium	N/A	N/A	Nov 4, 2026
CVE-2026-55368: h2o: h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3	8.1 High	N/A	N/A	Nov 4, 2026
CVE-2026-55367: h2o: h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3	7.5 High	N/A	N/A	Nov 4, 2026
CVE-2026-54380: Shenzhen Shine Industrial Co., Ltd. VitaFit: VitaFit cloud API before 2026-10-30 contained a stored cross-site scripting vulnerability that allows authenticated…	5.4 Medium	5.1 Medium	N/A	Nov 4, 2026
CVE-2026-54379: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.	N/A	N/A	N/A	Nov 4, 2026
CVE-2026-54378: Shenzhen Shine Industrial Co., Ltd. VitaFit: VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user…	9.6 Critical	9.3 Critical	N/A	Nov 4, 2026
CVE-2026-54377: Shenzhen Shine Industrial Co., Ltd. VitaFit: VitaFit cloud API before 2026-10-30 contained an insecure direct object reference vulnerability that allows…	6.5 Medium	6.9 Medium	N/A	Nov 4, 2026

25 rows per page

1-25 of 418286

›

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business