Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 786 | 0,2 % |
| ≥50 % | 3.561 | 0,9 % |
| ≥10 % | 13.157 | 3,2 % |
| <10 % | 396.051 | 95,8 % |
🗂️ …
N-able releases security hotfixes for zero-day vulnerabilities
N-able released hotfixes to address zero-day bugs affecting its N-central remote monitoring and management (RMM) platform, which were publicly disclosed over the weekend and forced it to take vulnerable hosted environments offline. [...] We
Code-Analyse: Telekom braucht rund um die Uhr KI-Modelle gegen Zero-Day-Lücken
Der Chief Security Officer der Telekom räumt mit verbreiteten Mythen rund um KI auf. Ein besonderes Sicherheitsprobleme sieht er bei Open Source. (Softwareentwicklung, KI) Weiterlesen
USN-9040-1: Linux kernel (Low Latency NVIDIA) vulnerabilities
It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds con
CVE-2023-39062 | Spipu HTML2PDF up to 5.2.7 forms.php cross site scripting
A vulnerability described as problematic has been identified in Spipu HTML2PDF up to 5.2.7. The affected element is an unknown function of the file forms.php. Executing a manipulation can lead to cross site scripting. This vulnerability is
CVE-2023-34973 | QNAP QTS/QuTS Hero entropy (qsa-23-59)
A vulnerability has been found in QNAP QTS and QuTS Hero and classified as problematic. Affected by this vulnerability is an unknown functionality. This manipulation causes insufficient entropy. The identification of this vulnerability is C
CVE-2026-97034 | cmdgo up to 1.26.10/1.27.3 cgo libgomp.spec command injection (Nessus ID 378578)
A vulnerability labeled as problematic has been found in cmdgo up to 1.26.10/1.27.3. This vulnerability affects unknown code of the file libgomp.spec of the component cgo. Executing a manipulation can lead to command injection. This vulnera
CVE-2026-97041 | Google cmd compile link up to 1.26.10/1.27.3 cgo/linker argument injection (Nessus ID 378581)
A vulnerability categorized as critical has been discovered in Google cmd compile link up to 1.26.10/1.27.3. Affected by this issue is some unknown functionality of the component cgo/linker. Such manipulation leads to argument injection. Th
CVE-2026-109478 | Microsoft .NET/Visual Studio resource consumption (Nessus ID 378583)
A vulnerability, which was classified as problematic, has been found in Microsoft .NET and Visual Studio. Affected is an unknown function. The manipulation leads to resource consumption. This vulnerability is referenced as CVE-2026-109478.
CVE-2026-125332 | DigitalBazaar forge up to 1.4.2 TLS Client forge.tls tls.createConnectionState input validation (Nessus ID 378586)
A vulnerability identified as problematic has been detected in DigitalBazaar forge up to 1.4.2. This affects the function tls.createConnectionState of the file forge.tls of the component TLS Client. Performing a manipulation results in impr
CVE-2026-114155 | Microsoft .NET DotNet.HotReload.Watch.Aspire toctou (Nessus ID 378585)
A vulnerability labeled as problematic has been found in Microsoft .NET. Impacted is an unknown function of the component DotNet.HotReload.Watch.Aspire. Executing a manipulation can lead to time-of-check time-of-use. This vulnerability appe
CVE-2022-4233 | SourceCodester Event Registration System 1.0 list First Name/Last Name cross site scripting (EUVD-2022-51591)
A vulnerability described as problematic has been identified in SourceCodester Event Registration System 1.0. This affects an unknown part of the file /event/admin/?page=user/list. The manipulation of the argument First Name/Last Name resul
CVE-2022-4232 | SourceCodester Event Registration System 1.0 cmd unrestricted upload (EUVD-2022-51590)
A vulnerability marked as critical has been reported in SourceCodester Event Registration System 1.0. Affected by this issue is some unknown functionality. The manipulation of the argument cmd leads to unrestricted upload. This vulnerabilit
CVE-2022-4229 | SourceCodester Book Store Management System 1.0 /bsms_ci/index.php access control (EUVD-2022-51588)
A vulnerability identified as critical has been detected in SourceCodester Book Store Management System 1.0. Affected is an unknown function of the file /bsms_ci/index.php. Performing a manipulation results in improper access controls. This
CVE-2026-97036 | Google Go up to 1.26.10/1.27.3 Cgo Directive Parser argument injection (Nessus ID 378587)
A vulnerability was found in Google Go up to 1.26.10/1.27.3 and classified as critical. This affects an unknown function of the component Cgo Directive Parser. Executing a manipulation can lead to argument injection. This vulnerability is h
CVE-2026-97054 | Google net/http up to 1.26.10/1.27.3 Synchronization MaxBytesReader missing synchronization (Nessus ID 378588)
A vulnerability classified as problematic has been found in Google net and http up to 1.26.10/1.27.3. The affected element is the function MaxBytesReader of the component Synchronization. This manipulation causes missing synchronization. Th
CVE-2026-97042 | Google cmd cgo compile link up to 1.26.10/1.27.3 cgo/link argument injection (Nessus ID 378589)
A vulnerability marked as critical has been reported in Google cmd cgo compile link up to 1.26.10/1.27.3. This issue affects some unknown processing of the component cgo/link. The manipulation leads to argument injection. This vulnerability
CVE-2023-40612 | OpenMNS Horizon/Meridian xml injection
A vulnerability was found in OpenMNS Horizon and Meridian. It has been classified as critical. This issue affects some unknown processing. Performing a manipulation results in xml injection. This vulnerability is cataloged as CVE-2023-40612
CVE-2023-34972 | QNAP QTS/QuTS Hero cleartext transmission (qsa-23-58)
A vulnerability classified as problematic has been found in QNAP QTS and QuTS Hero. This affects an unknown part. This manipulation causes cleartext transmission of sensitive information. This vulnerability appears as CVE-2023-34972. The at
CVE-2023-34971 | QNAP QTS/QuTS Hero inadequate encryption (qsa-23-60)
A vulnerability, which was classified as problematic, has been found in QNAP QTS and QuTS Hero. Affected by this issue is some unknown functionality. This manipulation causes inadequate encryption strength. This vulnerability is handled as
CVE-2022-46884 | Mozilla Firefox up to 105 SVG Image use after free
A vulnerability was found in Mozilla Firefox up to 105. It has been declared as critical. This vulnerability affects unknown code of the component SVG Image Handler. Executing a manipulation can lead to use after free. This vulnerability is
CVE-2022-3746 | Lenovo LCFC BIOS Embedded Controller Interface access control
A vulnerability, which was classified as critical, was found in Lenovo LCFC BIOS. This issue affects some unknown processing of the component Embedded Controller Interface. Such manipulation leads to improper access controls. This vulnerabi
CVE-2022-3745 | Lenovo LCFC BIOS SMI information disclosure
A vulnerability, which was classified as problematic, has been found in Lenovo LCFC BIOS. This vulnerability affects unknown code of the component SMI Handler. This manipulation causes information disclosure. The identification of this vuln
CVE-2022-3744 | Lenovo LCFC BIOS SMI hard-coded credentials
A vulnerability classified as critical was found in Lenovo LCFC BIOS. This affects an unknown part of the component SMI Handler. The manipulation results in hard-coded credentials. This vulnerability was named CVE-2022-3744. The attack need
CVE-2022-3743 | Lenovo LCFC BIOS Embedded Controller Command information disclosure
A vulnerability classified as problematic has been found in Lenovo LCFC BIOS. Affected by this issue is some unknown functionality of the component Embedded Controller Command Handler. The manipulation leads to information disclosure. This
CVE-2022-3742 | Lenovo LCFC BIOS buffer overflow
A vulnerability described as critical has been identified in Lenovo LCFC BIOS. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to buffer overflow. This vulnerability is handled as CVE-2022-3742.
CVE-2026-58785 | Google Android main.rs update_user_consent uninitialized pointer (EUVD-2026-122776)
A vulnerability was found in Google Android. It has been declared as critical. The affected element is the function update_user_consent of the file main.rs. Executing a manipulation can lead to uninitialized pointer. This vulnerability is r
CVE-2026-95404 | Google Android privileges management (EUVD-2026-122681)
A vulnerability classified as very critical was found in Google Android. The impacted element is an unknown function. Executing a manipulation can lead to improper privilege management. This vulnerability appears as CVE-2026-95404. The atta
CVE-2026-57013 | Google Android Secure Coprocessor access_control_enable access control (EUVD-2026-122747)
A vulnerability, which was classified as very critical, was found in Google Android. Affected is the function access_control_enable of the component Secure Coprocessor. Executing a manipulation can lead to improper access controls. This vul
CVE-2026-58813 | Google Android Memory Mapping mman.c mmap memory corruption (EUVD-2026-122628)
A vulnerability was found in Google Android and classified as very critical. Impacted is the function mmap of the file mman.c of the component Memory Mapping. Executing a manipulation can lead to memory corruption. The identification of thi
CVE-2026-58696 | Google Android heap-based overflow (EUVD-2026-122758)
A vulnerability categorized as very critical has been discovered in Google Android. Impacted is an unknown function. Executing a manipulation can lead to heap-based buffer overflow. This vulnerability appears as CVE-2026-58696. The attack m
CVE-2026-116081 | Fenrir Sleipnir Mobile up to 4.15.1 certificate validation (EUVD-2026-123153)
A vulnerability classified as problematic was found in Fenrir Sleipnir Mobile up to 4.15.1. Affected is an unknown function. Executing a manipulation can lead to improper certificate validation. This vulnerability is registered as CVE-2026-
CVE-2023-37369 | Qt qtbase QXmlStreamReader buffer overflow (DLA 3539-1 / EUVD-2023-41271)
A vulnerability classified as critical has been found in Qt qtbase. This impacts the function QXmlStreamReader. The manipulation leads to buffer overflow. This vulnerability is uniquely identified as CVE-2023-37369. The attack can only be i
CVE-2022-46751 | Oracle Business Intelligence Enterprise Edition 6.4.0.0.0 Visual Analyzer xml injection (Nessus ID 210929)
A vulnerability marked as critical has been reported in Oracle Business Intelligence Enterprise Edition 6.4.0.0.0. This vulnerability affects unknown code of the component Visual Analyzer. Performing a manipulation results in xml injection.
CVE-2022-44729 | Oracle Business Process Management Suite 12.2.1.4.0 BPM Composer server-side request forgery (Nessus ID 233387)
A vulnerability was found in Oracle Business Process Management Suite 12.2.1.4.0. It has been declared as critical. The affected element is an unknown function of the component BPM Composer. Such manipulation leads to server-side request fo
CVE-2022-4228 | SourceCodester Book Store Management System 1.0 edit_user password information disclosure (EUVD-2022-51587)
A vulnerability categorized as problematic has been discovered in SourceCodester Book Store Management System 1.0. This impacts an unknown function of the file /bsms_ci/index.php/user/edit_user/. Such manipulation of the argument Password l
CVE-2022-4222 | SourceCodester Canteen Management System POST Request ajax_invoice.php query search sql injection (EUVD-2022-51582)
A vulnerability classified as critical was found in SourceCodester Canteen Management System. Affected by this vulnerability is the function Query of the file ajax_invoice.php of the component POST Request Handler. Executing a manipulation
CVE-2022-4206 | GitLab DAST API Scanner prior 2.0.102 information disclosure (Issue 383083 / EUVD-2022-51566)
A vulnerability categorized as problematic has been discovered in GitLab DAST API Scanner. This affects an unknown function. Such manipulation leads to information disclosure. This vulnerability is referenced as CVE-2022-4206. It is possibl
CVE-2022-4205 | GitLab Enterprise Edition up to 15.4.5/15.5.4/15.6.0 Branch Name type confusion (Issue 374082 / EUVD-2022-51565)
A vulnerability categorized as problematic has been discovered in GitLab Enterprise Edition up to 15.4.5/15.5.4/15.6.0. This issue affects some unknown processing of the component Branch Name Handler. The manipulation results in type confus
CVE-2022-4202 | GPAC 2.1-DEV-rev490-g68064e101-master laser/lsr_dec.c lsr_translate_coords integer overflow (EUVD-2022-51563)
A vulnerability identified as problematic has been detected in GPAC 2.1-DEV-rev490-g68064e101-master. The affected element is the function lsr_translate_coords of the file laser/lsr_dec.c. The manipulation leads to integer overflow. This vu
CVE-2026-64678 | Nitrite up to 4.4.0 NitriteDataType.deserialize deserialization (EUVD-2026-123135)
A vulnerability marked as critical has been reported in Nitrite up to 4.4.0. The impacted element is the function NitriteDataType.deserialize. This manipulation causes deserialization. This vulnerability is tracked as CVE-2026-64678. The at
CVE-2026-123503 | go-vikunja Vikunja up to 2.7.0 Bucket canDoBucket improper authorization (EUVD-2026-119388)
A vulnerability has been found in go-vikunja Vikunja up to 2.7.0 and classified as problematic. Affected is the function canDoBucket of the component Bucket. This manipulation causes improper authorization. This vulnerability appears as CVE
CVE-2026-64686 | OpenSearch Project OpenSearch Dashboards up to 2.19.5/3.6.x fetchDataSourceMetaData isValidURL server-side request forgery (EUVD-2026-123136)
A vulnerability described as problematic has been identified in OpenSearch Project OpenSearch Dashboards up to 2.19.5/3.6.x. This affects the function isValidURL of the component fetchDataSourceMetaData. Such manipulation leads to server-si
CVE-2026-61810 | DMTF libspdm 1.4.0 Handshake integrity check (EUVD-2026-123137)
A vulnerability identified as problematic has been detected in DMTF libspdm 1.4.0. Impacted is an unknown function of the component Handshake. The manipulation leads to improper validation of integrity check value. This vulnerability is ref
CVE-2026-59192 | CakePHP TwigView Plugin up to 1.3.2/2.1.1 Unserialize Filter unserialize deserialization (EUVD-2026-123138)
A vulnerability categorized as critical has been discovered in CakePHP TwigView Plugin up to 1.3.2/2.1.1. This issue affects the function unserialize of the component Unserialize Filter. Executing a manipulation can lead to deserialization.
CVE-2026-59191 | CakePHP TwigView up to 1.3.2/2.1.1 FileLoader FileLoader::findTemplate path traversal (EUVD-2026-123139)
A vulnerability labeled as problematic has been found in CakePHP TwigView up to 1.3.2/2.1.1. The affected element is the function FileLoader::findTemplate of the component FileLoader. The manipulation results in path traversal. This vulnera
CVE-2026-18836 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinations and return the response to the attacker.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended des
CVE-2026-18689 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accepted where it should not be, which could reveal the names of other organizations.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accep
CVE-2026-17428 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization decisions without sufficient verification, which could allow access to information belonging to others.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization
CVE-2026-17411 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized before it is used in database queries.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized befo
CVE-2026-17410 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.
CVE-2026-17409 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of a request, which could allow restricted operations to be reached.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access c
CVE-2026-17408 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.
CVE-2026-17407 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before being used in a database query, which could allow SQL commands to run.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before
CVE-2026-17406 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Address checks can be bypassed, which could allow the server to reach destinations that should be blocked.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Address checks can be bypassed, which could allow the s
CVE-2026-17405 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm that the requesting user is permitted to read them, which could expose keystore information.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm
CVE-2026-17404 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17403 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.
CVE-2026-17402 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is passed to the operating system, which could allow commands to run on the underlying host.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is pas
CVE-2026-17401 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.
CVE-2026-17400 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.