CVE-2026-80729: Schwachstellen-Eintrag (NVD)
In the Linux kernel, the following vulnerability has been resolved:
mm/huge_memory: initialise workingset state before folio split
xas_try_split() adds __GFP_ACCOUNT for page-cache xa_nodes, but
__folio_split() leaves the xa_state's xa_lru unset. That lets a live,
memcg-charged xa_node exist without being linked into the mapping's
shadow_nodes list_lru; when reclaim later walks the list_lru it trips
VM_WARN_ON(!css_is_dying()).
Use mapping_set_update() to install both the workingset update callback
and the shadow_nodes list_lru on the xa_state.
Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | 2026-08-29 | 2026-09-06 |
|---|---|---|
| ≥90 % | 4 | 0 |
| ≥50 % | 4 | 0 |
| ≥10 % | 3 | 0 |
| <10 % | 304 | 300 |
CVE-2026-59285 | VMware Spring for GraphQL up to 2.0.4 deserialization
A vulnerability was found in VMware Spring for GraphQL up to 2.0.4 and classified as critical. This impacts an unknown function. The manipulation results in deserialization. This vulnerability is reported as CVE-2026-59285. The attack can b
CVE-2026-59277 | VMware Spring Security 7.1.0 InetAddressMatchers matchInternal/matchExternal protection mechanism
A vulnerability was found in VMware Spring Security 7.1.0 and classified as critical. The affected element is the function matchInternal/matchExternal of the component InetAddressMatchers. Executing a manipulation can lead to protection mec
CVE-2026-37071 | Veno File Manager 4.4.9 File Rename Actions::renameFile privileges management
A vulnerability, which was classified as critical, was found in Veno File Manager 4.4.9. Affected by this issue is the function Actions::renameFile of the component File Rename. The manipulation results in improper privilege management. Thi
CVE-2026-37070 | Veno File Manager 4.4.9 streamvid.php access control
A vulnerability was found in Veno File Manager 4.4.9. It has been classified as problematic. Affected by this issue is some unknown functionality of the file /vfm-admin/ajax/streamvid.php. This manipulation causes improper access controls.
CVE-2026-37072 | Veno File Manager 4.4.9 admin-head-updates.php access control
A vulnerability identified as critical has been detected in Veno File Manager 4.4.9. Impacted is an unknown function of the file admin-head-updates.php. The manipulation leads to improper access controls. This vulnerability is referenced as
CVE-2026-37069 | Veno File Manager 4.4.9 zipstream RelativePath.Example1.php information disclosure
A vulnerability, which was classified as problematic, was found in Veno File Manager 4.4.9. This impacts an unknown function of the file /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php of the component zipstream. E
CVE-2026-37068 | Veno File Manager 4.4.9 Translation Update /vfm-admin/index.php action/section unrestricted upload
A vulnerability was found in Veno File Manager 4.4.9 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /vfm-admin/index.php of the component Translation Update. The manipulation of the arg
CVE-2026-37065 | Veno File Manager 4.4.9 Translation /vfm-admin/index.php remove path traversal
A vulnerability classified as problematic was found in Veno File Manager 4.4.9. This issue affects some unknown processing of the file /vfm-admin/index.php of the component Translation. The manipulation of the argument remove results in pat
CVE-2026-37066 | Veno File Manager 4.4.9 /vfm-admin/index.php path traversal
A vulnerability, which was classified as problematic, has been found in Veno File Manager 4.4.9. This affects an unknown function of the file /vfm-admin/index.php. Performing a manipulation results in path traversal. This vulnerability is r
CVE-2026-86273 | projeto-siga up to 11.1.1 HTML-to-PDF Endpoint ExUtilController.java DownloadExterno.getUrl html server-side request forgery (Issue 2492)
A vulnerability classified as critical has been found in projeto-siga siga up to 11.1.1. Affected by this issue is the function DownloadExterno.getUrl of the file sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExUtilController.java of the co
Docker CVE-2026-34040: AuthZ-Bypass erlaubt Root-Container nach Größen-Check
LONDON (IT BOLTWISE) – Eine lang zurückliegende Schwachstelle im Docker Engine AuthZ-Middleware-Pfad ermöglicht nach aktueller Analyse einen Authentifizierungs-Umgehungsweg. Ein übergroßer API-Request wird vor dem Policy-Plugin abgeschnitte
CVE-2026-81683 | jahlives openssl-encrypt up to 1.4.8 Settings Screen information disclosure
A vulnerability categorized as problematic has been discovered in jahlives openssl-encrypt up to 1.4.8. This affects an unknown function of the component Settings Screen. Executing a manipulation can lead to information disclosure. This vul
CVE-2026-81680 | jahlives openssl_encrypt up to 1.4.8 improper authentication
A vulnerability labeled as problematic has been found in jahlives openssl_encrypt up to 1.4.8. This issue affects some unknown processing. Such manipulation leads to improper authentication. This vulnerability is traded as CVE-2026-81680. A
CVE-2026-47877 | Spring Security up to 7.1.0 Consent Page cross site scripting
A vulnerability described as problematic has been identified in Spring Security up to 7.1.0. Affected by this issue is some unknown functionality of the component Consent Page. Executing a manipulation can lead to cross site scripting. This
CVE-2026-80101 | Red Hat Enterprise Linux XWD Image bytes-per-line out-of-bounds
A vulnerability labeled as problematic has been found in Red Hat Enterprise Linux. Affected by this issue is some unknown functionality of the component XWD Image Handler. The manipulation of the argument bytes-per-line results in out-of-bo
CVE-2026-47864 | VMware Spring Integration up to 7.1.0 SerializingHttpMessageConverter readObject deserialization
A vulnerability, which was classified as critical, was found in VMware Spring Integration up to 5.5.21/6.4.12/6.5.10/7.0.5/7.1.0. Affected is the function readObject of the component SerializingHttpMessageConverter. Executing a manipulation
CVE-2026-47875 | VMware Spring Batch up to 5.2.6/6.0.4 Job Parameter Deserialization JobParameterDeserializer deserialization
A vulnerability has been found in VMware Spring Batch up to 5.2.6/6.0.4 and classified as critical. Affected by this vulnerability is the function JobParameterDeserializer of the component Job Parameter Deserialization. The manipulation lea
CVE-2026-74753 | Linux Kernel up to 6.18.45/7.1.9 perf perf_event_open toctou
A vulnerability marked as very critical has been reported in Linux Kernel up to 6.18.45/7.1.9. The affected element is the function perf_event_open of the component perf. The manipulation leads to time-of-check time-of-use. This vulnerabili
CVE-2026-26445 | songxpu stomper STOMP epoll_wait denial of service
A vulnerability was found in songxpu stomper. It has been rated as problematic. This affects the function epoll_wait of the component STOMP. The manipulation leads to denial of service. This vulnerability is traded as CVE-2026-26445. It is
CVE-2026-18260 | Drupal Disable Login Page Plugin excessive authentication
A vulnerability has been found in Drupal Disable Login Page Plugin and classified as critical. This affects an unknown part. This manipulation causes improper restriction of excessive authentication attempts. The identification of this vuln
ASUS Control Center Flaw Allows Attackers to Gain Full Admin Control of the System
ASUS has issued an urgent security update for ASUS Control Center Enterprise (ACC) after researchers uncovered a maximum-severity vulnerability that lets remote attackers seize complete administrative control over the platform and every dev
CVE-2026-56855 | Go x-crypto-ssh up to 0.55.x allocation of resources (Nessus ID 342721)
A vulnerability was found in Go x-crypto-ssh up to 0.55.x and classified as problematic. This affects an unknown part. Executing a manipulation can lead to allocation of resources. This vulnerability is registered as CVE-2026-56855. It is p
CVE-2026-85187 | itsourcecode Online Medicine Delivery System 1.0 Order Status Update controller.php?action=edit&actions=confirm Order::pupdate ID sql injection
A vulnerability, which was classified as critical, has been found in itsourcecode Online Medicine Delivery System 1.0. Affected by this issue is the function Order::pupdate of the file /rider/orders/controller.php?action=edit&amp;action
CVE-2026-85186 | itsourcecode Online Medicine Delivery System 1.0 Customer Controller controller.php?action=photos doupdateimage photo unrestricted upload (EUVD-2026-70555)
A vulnerability classified as critical was found in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is the function doupdateimage of the file /customer/controller.php?action=photos of the component Customer
CVE-2026-85137 | SeaCMS up to 13.6 Locoy Collector seacms_locoy_news.php parseIf pwd code injection
A vulnerability was found in SeaCMS up to 13.6. It has been rated as critical. This impacts the function parseIf of the file seacms_locoy_news.php of the component Locoy Collector. The manipulation of the argument pwd leads to code injectio
CVE-2026-85106 | NousResearch hermes-agent 0.18.0 Link Title Fetch index.tsx fetchLinkTitle url server-side request forgery
A vulnerability described as critical has been identified in NousResearch hermes-agent 0.18.0. This affects the function fetchLinkTitle of the file apps/desktop/src/app/artifacts/index.tsx of the component Link Title Fetch. Such manipulatio
CVE-2026-84292 | fastify fast-uri up to 2.4.5/3.1.6/4.1.3 recomposeAuthority serialize/normalize/equal port escape output (EUVD-2026-70280)
A vulnerability labeled as problematic has been found in fastify fast-uri up to 2.4.5/3.1.6/4.1.3. This affects the function serialize/normalize/equal of the component recomposeAuthority. Executing a manipulation of the argument port can le
CVE-2026-78662 | Go x-crypto-ssh up to 0.55.x Channel handlePacket allocation of resources
A vulnerability was found in Go x-crypto-ssh up to 0.55.x. It has been classified as problematic. This vulnerability affects the function handlePacket of the component Channel. The manipulation leads to allocation of resources. This vulnera
CVE-2026-85030 | HKUDS AI-Trader up to d03ff6c056b32ced735adf7c19ed8175adb1c8df selfRegister API Endpoint routes_agent.py initial_balance logic error (Issue 241 / EUVD-2026-70311)
A vulnerability categorized as problematic has been discovered in HKUDS AI-Trader up to d03ff6c056b32ced735adf7c19ed8175adb1c8df. The affected element is an unknown function of the file service/server/routes_agent.py of the component selfRe
CVE-2026-84886 | simular-ai Agent-S up to 0.3.2 OCR HTTP API ocr_server.py ImageData img_bytes resource consumption (EUVD-2026-70284)
A vulnerability, which was classified as problematic, was found in simular-ai Agent-S up to 0.3.2. Affected by this vulnerability is the function ImageData of the file gui_agents/s1/utils/ocr_server.py of the component OCR HTTP API. Executi
ASUS Control Center Flaw Allows Attackers to Gain Full Admin Control of the System
ASUS has issued an urgent security update for ASUS Control Center Enterprise (ACC) after researchers uncovered a maximum-severity vulnerability that lets remote attackers seize complete administrative control over the platform and every dev
ASUS Control Center Flaw Allows Attackers to Gain Full Admin Control of the System
ASUS has issued an urgent security update for ASUS Control Center Enterprise (ACC) after researchers uncovered a maximum-severity vulnerability that lets remote attackers seize complete administrative control over the platform and every dev
Hackers Actively Exploiting Magento and Adobe Commerce 0-Day RCE Vulnerability
A newly discovered zero-day vulnerability in Magento Open Source and Adobe Commerce is being actively exploited by attackers to seize full control of online stores, and there is still no official patch available. Dutch e-commerce security f
Hackers Actively Exploiting Magento and Adobe Commerce 0-Day RCE Vulnerability
A newly discovered zero-day vulnerability in Magento Open Source and Adobe Commerce is being actively exploited by attackers to seize full control of online stores, and there is still no official patch available. Dutch e-commerce security f
Hackers Actively Exploiting Magento and Adobe Commerce 0-Day RCE Vulnerability
A newly discovered zero-day vulnerability in Magento Open Source and Adobe Commerce is being actively exploited by attackers to seize full control of online stores, and there is still no official patch available. Dutch e-commerce security f
Magento-Backdoor „StyleSmuggler“: Ungepatchte Zero-Day trifft Adobe Commerce
LONDON (IT BOLTWISE) – Eine ungesicherte Zero-Day-Lücke in Magento Open Source und Adobe Commerce wird offenbar aktiv ausgenutzt. Die Sicherheitsfirma Sansec nennt die Schwachstelle „StyleSmuggler“ und beschreibt eine Kette, die ohne Login
Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores
Attackers are exploiting a new unpatched vulnerability in Magento Open Source and Adobe Commerce that lets them run malicious code on an online store's server without logging in, Dutch e-commerce security company Sansec said in an advi
PaperCut Flaws Exploited in Attacks on U.S. and European Schools
Attackers are exploiting two new PaperCut flaws to steal credentials and gain privileged access in education-sector attacks across the U.S. and Europe. Attackers are exploiting two recelty disclosed PaperCut flaws, CVE-2026-81578 and CVE-20
PaperCut Flaws Exploited in Attacks on U.S. and European Schools
Attackers are exploiting two new PaperCut flaws to steal credentials and gain privileged access in education-sector attacks across the U.S. and Europe. Attackers are exploiting two recelty disclosed PaperCut flaws, CVE-2026-81578 and CVE-20
Broadcom schließt kritische Lücke in VMware Workstation und Fusion (CVE-2026-59346)
LONDON (IT BOLTWISE) – Broadcom hat Sicherheitsupdates für VMware Workstation und VMware Fusion veröffentlicht und schließt dabei zwei Lücken, darunter einen kritischen Integer-Overflow mit CVSS 9,3. Unter bestimmten Bedingungen kann ein An
Elementor Pro WordPress Plugin Vulnerability Exploited to Hack Sites
Tracked as CVE-2026-32475 (CVSS score of 9.8), the bug described as an arbitrary file upload issue in the function that handles form submissions. The post Elementor Pro WordPress Plugin Vulnerability Exploited to Hack Sites appeared first o
PaperCut-Schwachstellen: Angreifer stehlen Anmeldedaten an Schulen und Universitäten
LONDON (IT BOLTWISE) – Angreifer nutzen neu gemeldete PaperCut-Schwachstellen, um an Schulen und Universitäten in den USA und Europa Zugangsdaten auszuspähen. In den Beobachtungen wurden CVE-2026-81578 und CVE-2026-82078 für Authentifizieru
12-Year-Old PostgreSQL Flaw Lets Attackers Execute Code and Take Over Database Servers
A critical PostgreSQL vulnerability dubbed PostGREShell could allow low-privileged replication accounts to execute attacker-controlled code, escalate to database superuser, and establish persistent backdoors on affected servers. Tracked as
12-Year-Old PostgreSQL Flaw Lets Attackers Execute Code and Take Over Database Servers
A critical PostgreSQL vulnerability dubbed PostGREShell could allow low-privileged replication accounts to execute attacker-controlled code, escalate to database superuser, and establish persistent backdoors on affected servers. Tracked as
12-Year-Old PostgreSQL Flaw Lets Backup Accounts Execute Code and Take Over Databases
A critical PostgreSQL vulnerability dubbed PostGREShell could allow low-privileged backup and replication accounts to execute arbitrary code, escalate to database superuser privileges, and establish persistent access on vulnerable servers.
U.S. CISA adds Google Chromium V8 flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Google Chromium V8 flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Google Chromium V8 flaw, trac
Google’s Chrome Update Patches Sixth Zero-Day Exploited in 2026
Chrome users have another actively exploited zero-day to worry about, and this one sits inside the engine that powers much of the modern web. Google has patched CVE-2026-85046, a high-severity type confusion vulnerability in Chrome’s V8 Jav
CVE-2026-19949 Leaves Millions of WordPress Sites Running Vulnerable Plugin Versions
A WordPress backup tool designed to help sites recover from trouble can instead become the trigger for an attack. Researchers disclosed a high-severity SQL injection vulnerability in the All-in-One WP Migration and Backup plugin that affect
PostgreSQL stoppt Codeausführung via Logical Decoding: neuer Whitelist-Parameter
LONDON (IT BOLTWISE) – PostgreSQL schließt eine seit 2014 bekannte Schwachstelle (CVE-2026-6471), die mit dem REPLICATION-Attribut beliebigen Code im Backend-Prozess ausführen konnte. Die Absicherung erfolgt über einen neuen Parameter outpu
PostgreSQL fixiert CVE-2026-6471: REPLICATION-Benutzer können Code als DB-User ausführen
LONDON (IT BOLTWISE) – PostgreSQL hat ein Sicherheitsproblem mit der logischen Replikation geschlossen, das einem Konto mit REPLICATION-Attribut die Ausführung beliebigen Codes als OS-User des Datenbankservers ermöglicht. Betroffen sind Ver
HPE Patches Critical RCE Vulnerabilities in AOS-CX
Nearly two dozen issues, tracked collectively as CVE-2026-73749 (CVSS score of 9.8), were addressed with the updates. The post HPE Patches Critical RCE Vulnerabilities in AOS-CX appeared first on SecurityWeek. Weiterlesen
Nightmare Eclipse drops a CrowdStrike zero-day.
Extortion group leaks alleged Manchester Airports Group data. France's CNIL fines hospital over 2025 data breach. Weiterlesen
PostgreSQL Hit by 12-Year-Old Vulnerability Allowing Server Takeover
PostGREShell (CVE-2026-6471) is a 12-year-old PostgreSQL flaw that lets low-privileged attackers execute code and take over servers. Cyera researchers found a severe PostgreSQL vulnerability, dubbed PostGREShell and tracked as CVE-2026-6471
PostgreSQL Hit by 12-Year-Old Vulnerability Allowing Server Takeover
PostGREShell (CVE-2026-6471) is a 12-year-old PostgreSQL flaw that lets low-privileged attackers execute code and take over servers. Cyera researchers found a severe PostgreSQL vulnerability, dubbed PostGREShell and tracked as CVE-2026-6471
Sangoma Switchvox Vulnerabilities Exploited in the Wild
Tracked as CVE-2026-9586, the unauthenticated SQL injection flaw can be exploited remotely for arbitrary code execution. The post Sangoma Switchvox Vulnerabilities Exploited in the Wild appeared first on SecurityWeek. Weiterlesen
[NEU] [niedrig] Checkmk: Schwachstelle ermöglicht Denial of Service
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Checkmk Agent Receiver ausnutzen, um einen Denial of Service Angriff durchzuführen. Weiterlesen
[NEU] [UNGEPATCHT] [mittel] xpdf: Schwachstelle ermöglicht Denial of Service
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in xpdf ausnutzen, um einen Denial of Service Angriff durchzuführen. Weiterlesen
[NEU] [mittel] Dell integrated Dell Remote Access Controller: Schwachstelle ermöglicht Codeausführung
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Dell integrated Dell Remote Access Controller ausnutzen, um beliebigen Programmcode auszuführen. Weiterlesen
[NEU] [mittel] Ollama: Schwachstelle ermöglicht Offenlegung von Informationen
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Ollama ausnutzen, um Informationen offenzulegen. Weiterlesen
[NEU] [hoch] util-linux: Schwachstelle ermöglicht Privilegieneskalation
Ein lokaler Angreifer kann eine Schwachstelle in util-linux ausnutzen, um seine Privilegien zu erhöhen. Weiterlesen