rapid7

CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLab

On October 12, 2026, GitLab published a critical patch release for CVE-2026-97229, an integer overflow or wraparound (CWE-190) in the CI/CD regular expression compiler affecting GitLab Community ...
rapid7

Unauthenticated SQL Injection In Channel Software WebAlliance eCommerce

While performing continuous red teaming exercises through Rapid7’s Vector Command service, Rapid7 discovered CVE-2026-108065, an SQL Injection vulnerability (CWE-89) in Channel Software WebAlliance ...
rapid7

Four compliance frameworks, one security team: Why fragmented university security raises regulatory risk

In Part 1 of this series, we looked at the security challenges created by fragmented, campus-by-campus environments. Higher education also faces a second pressure that makes that fragmentation harder ...
rapid7

CVE-2026-76183: Authentication Bypass by Alternate Name

Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 ...
rapid7

CVE-2026-88771: Improper Input Validation

Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before ...
rapid7

CVE-2026-96891: Out-of-bounds Write

A vulnerability was identified in D-Link DIR-825 3.00b32. Affected is the function tunnel_set_params of the file tunnel.c of the component rp-l2tp. The manipulation of the argument peer_hostname leads ...
rapid7

CVE-2026-95386: Loop with Unreachable Exit Condition

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
rapid7

CVE-2026-70125: Heap-based Buffer Overflow

CVSS 3.1 Base Score: 8.8 CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) With curated Threat Intelligence, you can see which vulnerabilities truly put ...
rapid7

CVE-2026-94127: Critical Unauthenticated RCE in F5 BIG-IP APM

On September 22, 2026, F5 published a security advisory for CVE-2026-94127, a critical heap-based buffer overflow vulnerability affecting F5 BIG-IP Access Policy Manager (APM). The vulnerability has a ...
rapid7

CVE-2026-88624: Improper Limitation of a Pathname to a Restricted Directory

Missing path validation in the Worktree.remove component of openCode v1.18.26 allows attackers to execute arbitrary recursive directory deletion via a crafted payload ...
rapid7

CVE-2026-86056: NULL Pointer Dereference

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the NPPM_SAVESESSION handler in PowerEditor/src/NppBigSwitch.cpp converts lParam to a ...
rapid7

CVE-2026-97730: Path Traversal: '../filedir'

In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) widget sequence data handling allows an authenticated attacker ...