CVE-2026-93373: Schwachstellen-Eintrag (NVD)
Use after free in Extensions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)
Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | 2026-08-30 | 2026-09-18 |
|---|---|---|
| ≥90 % | 0 | 0 |
| ≥50 % | 0 | 0 |
| ≥10 % | 0 | 0 |
| <10 % | 300 | 300 |
CVE-2025-27771 | uptrain-ai UpTrain up to 0.7.1 add_prompts checks/metadata code injection (EUVD-2025-210735)
A vulnerability labeled as critical has been found in uptrain-ai UpTrain up to 0.7.1. This affects an unknown part of the component add_prompts. The manipulation of the argument checks/metadata results in code injection. This vulnerability
CVE-2025-27770 | uptrain-ai UpTrain up to 0.7.1 checks/metadata code injection
A vulnerability identified as critical has been detected in uptrain-ai UpTrain up to 0.7.1. Affected by this issue is some unknown functionality. The manipulation of the argument checks/metadata leads to code injection. This vulnerability i
CVE-2026-45699 | Netatalk up to 4.4.2 copydir stack-based overflow
A vulnerability was found in Netatalk up to 4.4.2. It has been declared as critical. The impacted element is the function copydir. Such manipulation leads to stack-based buffer overflow. This vulnerability is referenced as CVE-2026-45699. T
CVE-2025-27621 | UpTrain AI up to 0.7.1 Backend uptrain-access-token cross-domain policy
A vulnerability categorized as problematic has been discovered in UpTrain AI UpTrain up to 0.7.1. Affected by this vulnerability is an unknown functionality of the component Backend. Executing a manipulation of the argument uptrain-access-t
CVE-2025-27772 | uptrain-ai UpTrain up to 0.7.1 checks/metadata code injection
A vulnerability classified as critical was found in uptrain-ai UpTrain up to 0.7.1. Affected by this vulnerability is an unknown functionality. The manipulation of the argument checks/metadata results in code injection. This vulnerability i
CVE-2026-73846 | ondata ckan-mcp-server up to 0.4.111 Cache src/utils/cache.ts canonicalizeParams data authenticity
A vulnerability described as critical has been identified in ondata ckan-mcp-server up to 0.4.111. This vulnerability affects the function canonicalizeParams of the file src/utils/cache.ts of the component Cache. Executing a manipulation ca
CVE-2026-49986 | cdeust Cortex up to 3.17.0 Root Validation visualize_bootstrap.py _is_cortex_root CLAUDE_PROJECT_DIR code injection
A vulnerability was found in cdeust Cortex up to 3.17.0. It has been rated as problematic. This impacts the function _is_cortex_root of the file mcp_server/server/visualize_bootstrap.py of the component Root Validation. The manipulation of
CVE-2026-49826 | Concourse up to 8.2.2 redirect
A vulnerability categorized as problematic has been discovered in Concourse up to 8.2.2. Affected is an unknown function. The manipulation results in open redirect. This vulnerability was named CVE-2026-49826. The attack may be performed fr
CVE-2026-46380 | compliance-trestle Remote Fetching Subsystem server-side request forgery
A vulnerability was found in compliance-trestle. It has been rated as critical. This affects an unknown function of the component Remote Fetching Subsystem. Performing a manipulation results in server-side request forgery. This vulnerabilit
CVE-2026-73664 | FreePBX up to 17.0.10 publicKeySave AJAX endpoint Backup.class.php improper authorization
A vulnerability categorized as very critical has been discovered in FreePBX up to 17.0.10. This affects an unknown part of the file Backup.class.php of the component publicKeySave AJAX endpoint. Executing a manipulation can lead to improper
CVE-2026-73428 | Basecamp Trix up to 2.1.17 HTMLParser/StringPiece StringPiece.fromJSON HTML injection
A vulnerability has been found in Basecamp Trix up to 2.1.17 and classified as problematic. The affected element is the function StringPiece.fromJSON of the component HTMLParser/StringPiece. The manipulation leads to HTML injection. This vu
CVE-2026-73489 | Eugeny Russh up to 0.62.3 Parser encrypted.rs out-of-bounds
A vulnerability, which was classified as problematic, has been found in Eugeny Russh up to 0.62.3. This issue affects some unknown processing of the file russh/src/server/encrypted.rs of the component Parser. Performing a manipulation resul
CVE-2026-73420 | NextAuth.js auth-core-next-auth Email Normalization defaultNormalizer improper authentication
A vulnerability classified as critical was found in NextAuth.js auth-core-next-auth. This vulnerability affects the function defaultNormalizer of the component Email Normalization. Such manipulation leads to improper authentication. This vu
CVE-2026-73417 | Jupyter JupyterLab up to 4.5.9/4.6.1 Notebook Extension index.ts code injection
A vulnerability labeled as problematic has been found in Jupyter JupyterLab up to 4.5.9/4.6.1. Affected is an unknown function of the file packages/notebook-extension/src/index.ts of the component Notebook Extension. Executing a manipulatio
CVE-2026-73660 | FreePBX prior 16.0.6/17.0.5.4 Text-To-Speech module agi-bin/propolys-tts.agi os command injection
A vulnerability has been found in FreePBX and classified as problematic. This affects an unknown function of the file agi-bin/propolys-tts.agi of the component Text-To-Speech module. The manipulation leads to os command injection. This vuln
CVE-2026-73416 | JupyterLab up to 4.5.9/4.6.1 PyPI Extension Manager manager.py privileges management
A vulnerability was found in JupyterLab up to 4.5.9/4.6.1 and classified as problematic. This issue affects some unknown processing of the file jupyterlab/extensions/manager.py of the component PyPI Extension Manager. Executing a manipulati
CVE-2026-73661 | FreePBX up to 16.0.46/17.0.29 Framework Restore.php runRestore improper authentication
A vulnerability classified as problematic was found in FreePBX up to 16.0.46/17.0.29. Impacted is the function runRestore of the file amp_conf/htdocs/admin/libraries/Builtin/Restore.php of the component Framework Module. Such manipulation l
CVE-2026-73663 | FreePBX up to 16.0.10/17.0.3 missedcall module missedcallnotify.php sql injection
A vulnerability, which was classified as critical, has been found in FreePBX up to 16.0.10/17.0.3. The affected element is an unknown function of the file agi-bin/missedcallnotify.php of the component missedcall module. Performing a manipul
CVE-2026-73656 | Triggerdotdev Trigger.dev up to 4.5.5 Background Worker Deployment Service createDeploymentBackgroundWorkerV4.server.ts CreateDeploymentBackgroundWorkerServiceV4.call privileges management
A vulnerability, which was classified as critical, has been found in Triggerdotdev Trigger.dev up to 4.5.5. Impacted is the function CreateDeploymentBackgroundWorkerServiceV4.call of the file apps/webapp/app/v3/services/createDeploymentBack
CVE-2026-73662 | FreePBX up to 17.0.6 Music on Hold Music.class.php validateCustomConfiguration os command injection
A vulnerability classified as problematic has been found in FreePBX up to 17.0.6. This issue affects the function validateCustomConfiguration of the file Music.class.php of the component Music on Hold. This manipulation causes os command in
CVE-2026-73421 | nextauthjs next-auth up to 5.0.0-beta.31 Session Parsing improper authorization
A vulnerability marked as critical has been reported in nextauthjs next-auth up to 5.0.0-beta.31. Affected by this vulnerability is the function auth of the component Session Parsing. The manipulation leads to improper authorization. This v
CVE-2026-20361 | Cisco Nexus Dashboard up to 4.2.1 sql injection (Nessus ID 348238)
A vulnerability has been found in Cisco Nexus Dashboard and classified as critical. The affected element is an unknown function. The manipulation leads to sql injection. This vulnerability is referenced as CVE-2026-20361. Remote exploitatio
CVE-2026-20326 | Cisco Nexus Dashboard up to 4.2.1 missing authentication (Nessus ID 348238)
A vulnerability classified as very critical was found in Cisco Nexus Dashboard. This vulnerability affects unknown code. Such manipulation leads to missing authentication. This vulnerability is uniquely identified as CVE-2026-20326. The att
CVE-2026-20325 | Cisco Nexus Dashboard up to 4.2.1 command injection (Nessus ID 348238)
A vulnerability classified as very critical has been found in Cisco Nexus Dashboard. This affects an unknown part. This manipulation causes command injection. This vulnerability is handled as CVE-2026-20325. The attack can be initiated remo
CVE-2026-20322 | Cisco Nexus Dashboard up to 4.2.1 access control (Nessus ID 348238)
A vulnerability described as very critical has been identified in Cisco Nexus Dashboard. Affected by this issue is some unknown functionality. The manipulation results in improper access controls. This vulnerability is known as CVE-2026-203
CVE-2024-1086: Celah Keamanan Kernel Linux Berisiko Tinggi Akses Root
Apa itu CVE-2024-1086? CVE-2024-1086 adalah kerentanan keamanan kritis pada kernel Linux. Kerentanan ini sangat serius, memungkinkan penyerang lokal meningkatkan hak akses hingga tingkat root, mengambil alih kendali penuh sistem terinfeksi.
CVE-2026-59714 | open-webui Open WebUI Chat Completion API improper authorization
A vulnerability marked as critical has been reported in open-webui Open WebUI. The affected element is an unknown function of the component Chat Completion API. The manipulation leads to improper authorization. This vulnerability is referen
CVE-2026-45725 | oscal-compass compliance-trestle up to 3.12.1/4.0.2 Remote Fetching Cache Mechanism path traversal
A vulnerability classified as problematic was found in oscal-compass compliance-trestle up to 3.12.1/4.0.2. This impacts an unknown function of the component Remote Fetching Cache Mechanism. Such manipulation leads to path traversal. This v
CVE-2026-73655 | Trigger.dev up to 4.5.1 Google Authentication googleAuth.server.ts addGoogleStrategy improper authentication
A vulnerability marked as critical has been reported in Trigger.dev up to 4.5.1. Affected by this issue is the function addGoogleStrategy of the file apps/webapp/app/services/googleAuth.server.ts of the component Google Authentication. Perf
CVE-2026-73649 | shepherdwind Velocity.js up to 2.1.6 Property-Read Expressions references.ts getReferences os command injection
A vulnerability, which was classified as critical, was found in shepherdwind Velocity.js up to 2.1.6. This issue affects the function getReferences of the file src/compile/references.ts of the component Property-Read Expressions. Executing
CVE-2026-73644 | OpenIdentityPlatform OpenDJ up to 5.1.1 SASL PlainSASLMechanismHandler.java improper authorization
A vulnerability was found in OpenIdentityPlatform OpenDJ up to 5.1.1. It has been classified as very critical. The impacted element is an unknown function of the file opendj-server-legacy/src/main/java/org/opends/server/extensions/PlainSASL
CVE-2026-45774 | oscal-compass compliance-trestle up to 3.12.1/4.0.2 Profile Import Mechanism resolve imports[].href path traversal
A vulnerability labeled as problematic has been found in oscal-compass compliance-trestle up to 3.12.1/4.0.2. Impacted is the function resolve of the component Profile Import Mechanism. Executing a manipulation of the argument imports[].hre
CVE-2026-73654 | triggerdotdev trigger.dev up to 4.5.5 Run Metadata operations.ts JSONHeroPath.set operation.key denial of service
A vulnerability has been found in triggerdotdev trigger.dev up to 4.5.5 and classified as problematic. This impacts the function JSONHeroPath.set of the file packages/core/src/v3/runMetadata/operations.ts of the component Run Metadata. Perf
CVE-2026-73650 | svg SVGO up to 2.8.2/3.3.3/4.0.1 removeScripts cross site scripting
A vulnerability was found in svg SVGO up to 2.8.2/3.3.3/4.0.1. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component removeScripts. Executing a manipulation can lead to cross site s
CVE-2026-73651 | TypeORM up to 0.3.30/1.0.x Migration Generate Command MigrationGenerateCommand.ts generate COMMENT/DEFAULT code injection
A vulnerability, which was classified as problematic, has been found in TypeORM up to 0.3.30/1.0.x. The affected element is the function Generate of the file src/commands/MigrationGenerateCommand.ts of the component Migration Generate Comma
CVE-2026-73652 | vantage6 up to 5.0.2 algorithm-store permission
A vulnerability, which was classified as critical, was found in vantage6 up to 5.0.2. The impacted element is an unknown function of the component algorithm-store. The manipulation results in permission issues. This vulnerability was named
CVE-2026-73643 | nodeca js-yaml up to 5.2.1 Parser src/parser/parser.ts readFlowCollection infinite loop (Nessus ID 335459)
A vulnerability categorized as problematic has been discovered in nodeca js-yaml up to 5.2.1. Affected is the function readFlowCollection of the file src/parser/parser.ts of the component Parser. Executing a manipulation can lead to infinit
CVE-2026-73648 | rails rails-html-sanitizer up to 1.7.0 PermitScrubber cross-domain policy
A vulnerability labeled as problematic has been found in rails rails-html-sanitizer up to 1.7.0. Affected by this issue is some unknown functionality of the component PermitScrubber. The manipulation results in permissive cross-domain polic
CVE-2026-73645 | OpenZeppelin Confidential Contracts up to 0.3.0 ERC7984ERC20Wrapper ERC7984ERC20Wrapper.sol wrap/onTransferReceived integer overflow
A vulnerability was found in OpenZeppelin Confidential Contracts up to 0.3.0. It has been declared as problematic. This affects the function wrap/onTransferReceived of the file contracts/token/ERC7984/extensions/ERC7984ERC20Wrapper.sol of t
CVE-2026-73564 | fatedier frp up to 0.70.0 SSH Tunnel Gateway pkg/ssh/server.go TunnelServer.handleNewChannel integer overflow
A vulnerability labeled as problematic has been found in fatedier frp up to 0.70.0. This impacts the function TunnelServer.handleNewChannel of the file pkg/ssh/server.go of the component SSH Tunnel Gateway. Executing a manipulation can lead
CVE-2026-48702 | Sigstore Rekor up to 1.5.1 APK File pkg/types/alpine/apk.go Package.Unmarshal allocation of resources
A vulnerability labeled as problematic has been found in Sigstore Rekor up to 1.5.1. This affects the function Package.Unmarshal of the file pkg/types/alpine/apk.go of the component APK File Handler. The manipulation results in allocation o
CVE-2026-73569 | NaturalIntelligence fast-xml-parser up to 5.10.0 XML Parser OrderedObjParser.js addInputEntities resource consumption
A vulnerability was found in NaturalIntelligence fast-xml-parser up to 5.10.0 and classified as problematic. The affected element is the function addInputEntities of the file src/xmlparser/OrderedObjParser.js of the component XML Parser. Th
CVE-2026-73567 | JuneAndGreen sm-crypto up to 0.4.x SM2 src/sm2/utils.js sm2.generateKeyPairHex random values
A vulnerability classified as problematic was found in JuneAndGreen sm-crypto up to 0.4.x. This affects the function sm2.generateKeyPairHex of the file src/sm2/utils.js of the component SM2. Such manipulation leads to insufficiently random
CVE-2026-73562 | Automattic Mongoose up to 6.13.9/7.8.9/8.24.0/9.7.1 Update Casting body prototype pollution
A vulnerability classified as critical has been found in Automattic Mongoose up to 6.13.9/7.8.9/8.24.0/9.7.1. Affected by this issue is the function Schema.prototype.path/Schema.prototype._getPathType of the component Update Casting. This m
CVE-2026-73563 | Backstage up to 0.29.1 Dynamic Client Registration redirect
A vulnerability identified as problematic has been detected in Backstage up to 0.29.1. This affects an unknown function of the component Dynamic Client Registration. Performing a manipulation of the argument... Weiterlesen
CVE-2026-73568 | libp2p py-libp2p up to 0.7.0 yamux yamux.py handle_incoming infinite loop
A vulnerability was found in libp2p py-libp2p up to 0.7.0. It has been rated as problematic. The affected element is the function handle_incoming of the file libp2p/stream_muxer/yamux/yamux.py of the component yamux. This manipulation cause
CVE-2026-73509 | OpenListTeam OpenList up to 4.2.3 Path Normalization fsbatch.go api/fs/batch_rename src_name path traversal
A vulnerability was found in OpenListTeam OpenList up to 4.2.3. It has been rated as critical. Affected is the function api/fs/batch_rename of the file server/handles/fsbatch.go of the component Path Normalization. This manipulation of the
CVE-2026-49856 | vmoranv jshookmcp 0.3.1 server-side request forgery
A vulnerability has been found in vmoranv jshookmcp 0.3.1 and classified as problematic. Impacted is an unknown function. This manipulation causes server-side request forgery. This vulnerability is handled as CVE-2026-49856. The attack can
CVE-2026-49857 | ymw0407 auth-fetch-mcp up to 3.0.1 src/security.ts isPrivateV6 server-side request forgery
A vulnerability marked as critical has been reported in ymw0407 auth-fetch-mcp up to 3.0.1. Affected is the function isPrivateV6 of the file src/security.ts. This manipulation causes server-side request forgery. This vulnerability is regist
CVE-2026-49820 | GetProbo up to 0.193.0 saferedirect path.Clean continue
A vulnerability categorized as problematic has been discovered in GetProbo Probo up to 0.193.0. The impacted element is the function path.Clean of the component saferedirect. Executing a manipulation of the argument continue can lead to ope
CVE-2026-49481 | seriousm4x UpSnap up to 5.3.x Device Management ip/mac os command injection
A vulnerability, which was classified as critical, has been found in seriousm4x UpSnap up to 5.3.x. Affected by this issue is some unknown functionality of the component Device Management. Performing a manipulation of the argument ip/mac re
CVE-2026-49827 | SMEWebify WebErpMesv2 up to 1.19 File Upload scan_file input validation
A vulnerability was found in SMEWebify WebErpMesv2 up to 1.19. It has been rated as critical. This impacts an unknown function of the component File Upload. This manipulation of the argument scan_file causes improper input validation. This
CVE-2026-73291 | seerr-team Seerr up to 3.3.x ImageProxy server/lib/imageproxy.ts path.join path traversal
A vulnerability has been found in seerr-team Seerr up to 3.3.x and classified as critical. Affected by this issue is the function path.join of the file server/lib/imageproxy.ts of the component ImageProxy. Performing a manipulation results
CVE-2026-73296 | Microsoft UFO up to 3.0.7 Mobile MCP Server mobile_mcp_server.py information disclosure (EUVD-2026-57323)
A vulnerability was found in Microsoft UFO up to 3.0.7. It has been declared as problematic. This affects the function create_mobile_data_collection_server/create_mobile_action_server of the file ufo/client/mcp/http_servers/mobile_mcp_serve
CVE-2026-73500 | etcd-io etcd up to 3.5.32/3.6.13/3.7.0 TLS Listener listener_tls.go tls.Conn.Handshake infinite loop
A vulnerability was found in etcd-io etcd up to 3.5.32/3.6.13/3.7.0. It has been classified as problematic. This affects the function tls.Conn.Handshake of the file client/pkg/transport/listener_tls.go of the component TLS Listener. The man
CVE-2026-73501 | getkin kin-openapi up to 0.143.x ValidationHandler validation_handler.go ValidationHandler.Load improper authentication
A vulnerability was found in getkin kin-openapi up to 0.143.x and classified as critical. Affected by this issue is the function ValidationHandler.Load of the file openapi3filter/validation_handler.go of the component ValidationHandler. Exe
CVE-2026-73499 | etcd-io etcd up to 3.5.32/3.6.13/3.7.0 Range Permission Cache range_perm_cache.go isRangeOpPermitted permission
A vulnerability has been found in etcd-io etcd up to 3.5.32/3.6.13/3.7.0 and classified as problematic. Affected by this vulnerability is the function isRangeOpPermitted of the file server/auth/range_perm_cache.go of the component Range Per
CVE-2026-73298 | Microsoft Container Migration Solution Accelerator up to 2.1.2 resource injection
A vulnerability labeled as critical has been found in Microsoft Container Migration Solution Accelerator up to 2.1.2. Affected by this issue is some unknown functionality. Such manipulation leads to improper control of resource identifiers.
CVE-2026-73498 | sooperset mcp-atlassian up to 0.21.x Attachments attachments.py _upload_attachment_direct file_path path traversal
A vulnerability identified as problematic has been detected in sooperset mcp-atlassian up to 0.21.x. This vulnerability affects the function _upload_attachment_direct of the file src/mcp_atlassian/confluence/attachments.py of the component
CVE-2026-73297 | Microsoft UFO up to 3.0.7 url_security.py _is_blocked_ip server-side request forgery (EUVD-2026-57325)
A vulnerability was found in Microsoft UFO up to 3.0.7. It has been rated as critical. This vulnerability affects the function _is_blocked_ip of the file ufo/utils/url_security.py. This manipulation causes server-side request forgery. This