Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 785 | 0,2 % |
| ≥50 % | 3.559 | 0,9 % |
| ≥10 % | 13.139 | 3,2 % |
| <10 % | 396.072 | 95,8 % |
Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th)
Our honeypots use "Cowrie" to collect SSH data. With the emergence of the "sshole" vulnerability last week, we are now seeing an increase in attempts to exploit the vulnerability. Our data is a bit limited in this respec
Barracuda Patches Two Security Flaws That Could Let Attackers Take Over Email Security Gateways
Experts have shown how two vulnerabilities in Barracuda's Email Security Gateway can be chained to execute arbitrary commands with root privileges without requiring an attacker to log in. The vulnerabilities, tracked as CVE-2026-116606
CVE-2026-39810 | Fortinet FortiClientEMS up to 7.4.1/7.4.5 hard-coded key (FG-IR-26-107)
A vulnerability, which was classified as problematic, was found in Fortinet FortiClientEMS up to 7.4.1/7.4.5. Affected by this issue is some unknown functionality. Such manipulation leads to use of hard-coded cryptographic key . This vulner
CVE-2026-124498 | Convene Azeus Convene Board Management Portal 7.0.2.7_3 p72 dummy_launcher.jsp REDIRECT_URL cross site scripting
A vulnerability was found in Convene Azeus Convene Board Management Portal 7.0.2.7_3 p72. It has been declared as problematic. The impacted element is an unknown function of the file /jsp/ge/dummy_launcher.jsp. Executing a manipulation of t
CVE-2025-63622 | code-projects Online Complaint Site 1.0 subcategory.php category sql injection
A vulnerability described as critical has been identified in code-projects Online Complaint Site 1.0. This affects an unknown function of the file /cms/admin/subcategory.php. The manipulation of the argument Category results in sql injectio
CVE-2025-61429 | NCR Atleos Terminal Manager ConfigApp 3.4.0 privileges management
A vulnerability was found in NCR Atleos Terminal Manager ConfigApp 3.4.0. It has been rated as critical. This impacts an unknown function. The manipulation leads to improper privilege management. This vulnerability is traded as CVE-2025-614
CVE-2025-61161 | Evope Collector 1.1.6.9.0 Evope.Service.exe uncontrolled search path
A vulnerability described as problematic has been identified in Evope Collector 1.1.6.9.0. Impacted is an unknown function in the library wtsapi32.dll of the file Evope.Service.exe. Executing a manipulation can lead to uncontrolled search p
CVE-2025-61105 | FRRouting FRR up to 10.4.1 OSPF Packet ospf_ext.c show_vty_link_info null pointer dereference (ID 19471 / Nessus ID 271823)
A vulnerability classified as problematic has been found in FRRouting FRR up to 10.4.1. Affected is the function show_vty_link_info of the file ospf_ext.c of the component OSPF Packet Handler. This manipulation causes null pointer dereferen
CVE-2025-61102 | FRRouting FRR up to 10.4.1 OSPF Packet ospf_ext.c show_vty_ext_link_adj_sid null pointer dereference (ID 19471 / Nessus ID 271824)
A vulnerability classified as problematic was found in FRRouting FRR up to 10.4.1. Affected by this vulnerability is the function show_vty_ext_link_adj_sid of the file ospf_ext.c of the component OSPF Packet Handler. Such manipulation leads
CVE-2025-61101 | FRRouting FRR up to 10.4.1 OSPF Packet ospf_ext.c show_vty_ext_link_rmt_itf_addr null pointer dereference (ID 19471 / Nessus ID 271817)
A vulnerability described as problematic has been identified in FRRouting FRR up to 10.4.1. This impacts the function show_vty_ext_link_rmt_itf_addr of the file ospf_ext.c of the component OSPF Packet Handler. The manipulation results in nu
CVE-2025-60805 | BESSystem BES Application Server up to 9.5.x bes-web.xml information disclosure
A vulnerability marked as problematic has been reported in BESSystem BES Application Server up to 9.5.x. This affects an unknown function of the file bes-web.xml. Performing a manipulation results in information disclosure. This vulnerabili
CVE-2025-60800 | jshERP GET Request /jshERP-boot/user/info access control
A vulnerability was found in jshERP. It has been rated as critical. This issue affects some unknown processing of the file /jshERP-boot/user/info of the component GET Request Handler. The manipulation leads to improper access controls. This
CVE-2025-60354 | blog-vue-springboot improper authorization
A vulnerability categorized as critical has been discovered in blog-vue-springboot. Impacted is an unknown function. The manipulation results in improper authorization. This vulnerability is cataloged as CVE-2025-60354. The attack must orig
CVE-2026-124502 | yungifez Skuul School Management System up to 2.6.3 Delete GraduationController.php resetGraduation student authorization
A vulnerability labeled as problematic has been found in yungifez Skuul School Management System up to 2.6.3. Affected by this vulnerability is the function GraduationController::resetGraduation of the file app/Http/Controllers/GraduationCo
CVE-2022-4191 | Google Chrome up to 107.0.5304.121 Sign-In use after free (EUVD-2022-51552)
A vulnerability was found in Google Chrome and classified as problematic. The impacted element is an unknown function of the component Sign-In. Executing a manipulation can lead to use after free. This vulnerability is registered as CVE-202
CVE-2022-4190 | Google Chrome up to 107.0.5304.121 Directory input validation (EUVD-2022-51551)
A vulnerability has been found in Google Chrome and classified as problematic. The affected element is an unknown function of the component Directory. Performing a manipulation results in improper input validation. This vulnerability is cat
CVE-2022-4189 | Google Chrome up to 107.0.5304.121 DevTools privilege escalation (EUVD-2022-51550)
A vulnerability, which was classified as problematic, was found in Google Chrome. Impacted is an unknown function of the component DevTools. Such manipulation leads to privilege escalation. This vulnerability is listed as CVE-2022-4189. The
CVE-2022-4188 | Google Chrome up to 107.0.5304.121 CORS cross-domain policy (EUVD-2022-51549)
A vulnerability, which was classified as critical, has been found in Google Chrome. This issue affects some unknown processing of the component CORS. This manipulation causes permissive cross-domain policy with untrusted domains. This vulne
CVE-2022-4187 | Google Chrome up to 107.0.5304.121 DevTools Remote Code Execution (EUVD-2022-51548)
A vulnerability classified as critical was found in Google Chrome. This vulnerability affects unknown code of the component DevTools. The manipulation results in Remote Code Execution. This vulnerability is identified as CVE-2022-4187. The
CVE-2022-4186 | Google Chrome up to 107.0.5304.121 Downloads input validation (EUVD-2022-51547)
A vulnerability classified as critical has been found in Google Chrome. This affects an unknown part of the component Downloads. The manipulation leads to improper input validation. This vulnerability is referenced as CVE-2022-4186. Remote
CVE-2022-4185 | Google Chrome up to 107.0.5304.121 Navigation Remote Code Execution (EUVD-2022-51546)
A vulnerability described as critical has been identified in Google Chrome. Affected by this issue is some unknown functionality of the component Navigation. Executing a manipulation can lead to Remote Code Execution. The identification of
CVE-2026-43598 | AMD ROCm Communication Collectives Library up to 7.13 null pointer dereference (Nessus ID 377567)
A vulnerability was found in AMD ROCm Communication Collectives Library up to 7.13. It has been declared as very critical. This issue affects some unknown processing. Executing a manipulation can lead to null pointer dereference. This vulne
CVE-2026-68498 | FasterXML jackson-core Name Parsing ReaderBasedJsonParser._parseName2 allocation of resources (Nessus ID 377568)
A vulnerability classified as problematic was found in FasterXML jackson-core. This vulnerability affects the function ReaderBasedJsonParser._parseName2 of the component Name Parsing. The manipulation results in allocation of resources. Thi
CVE-2026-119741 | RsyncProject rsync up to 3.5.1 Delta Transfer Sender match.c hash_search denial of service (Nessus ID 377571)
A vulnerability was found in RsyncProject rsync up to 3.5.1. It has been rated as problematic. This impacts the function hash_search of the file match.c of the component Delta Transfer Sender. Performing a manipulation results in denial of
VeloCloud Shows Why Integration Endpoint Trust Needs an Owner
Integration endpoint trust is the part of an orchestrator's exposure that an inbound-reachability review can miss. On November 2, 2026, Arista published Security Advisory 0202 for VeloCloud Orchestrator (VCO), the platform that configu
CVE-2026-104639 | Razorpay for WooCommerce Plugin up to 4.8.8 on WordPress sql injection (EUVD-2026-119473)
A vulnerability was found in Razorpay for WooCommerce Plugin up to 4.8.8 on WordPress. It has been classified as problematic. This vulnerability affects unknown code. This manipulation causes sql injection. This vulnerability is tracked as
CVE-2026-104338 | Razorpay for WooCommerce Plugin up to 4.8.8 on WordPress Rest Routes authorization (EUVD-2026-119472)
A vulnerability, which was classified as critical, was found in Razorpay for WooCommerce Plugin up to 4.8.8 on WordPress. Affected by this vulnerability is an unknown functionality of the component Rest Routes. Executing a manipulation can
CVE-2026-104337 | Razorpay for WooCommerce Plugin up to 4.8.8 on WordPress information disclosure (EUVD-2026-119471)
A vulnerability has been found in Razorpay for WooCommerce Plugin up to 4.8.8 on WordPress and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to information disclosure. This vulnerabi
CVE-2026-109925 | Productive Commerce Plugin up to 1.1.53 on WordPress sql injection (EUVD-2026-119476)
A vulnerability was found in Productive Commerce Plugin up to 1.1.53 on WordPress. It has been rated as critical. Impacted is an unknown function. Performing a manipulation results in sql injection. This vulnerability is cataloged as CVE-20
CVE-2026-106015 | Ecommerce Affiliate Plugin up to 1.0.0 on WordPress improper authentication (EUVD-2026-119475)
A vulnerability classified as critical was found in Ecommerce Affiliate Plugin up to 1.0.0 on WordPress. This impacts an unknown function. Such manipulation leads to improper authentication. This vulnerability is uniquely identified as CVE-
CVE-2026-105970 | Thanh Toan Quet Ma QR Code Tu Dong Plugin up to 2.0.1 on WordPress Payment Notifications access control (EUVD-2026-119474)
A vulnerability categorized as problematic has been discovered in Thanh Toan Quet Ma QR Code Tu Dong Plugin up to 2.0.1 on WordPress. The affected element is an unknown function of the component Payment Notifications. Executing a manipulati
CVE-2026-110132 | Sync Post With Other Site Plugin up to 1.9.3 on WordPress authorization (EUVD-2026-119477)
A vulnerability marked as critical has been reported in Sync Post With Other Site Plugin up to 1.9.3 on WordPress. This impacts an unknown function. This manipulation causes incorrect authorization. This vulnerability appears as CVE-2026-11
CVE-2026-110963 | Userplace Plugin up to 1.2.0 on WordPress privileges management (EUVD-2026-119478)
A vulnerability classified as critical has been found in Userplace Plugin up to 1.2.0 on WordPress. Affected by this vulnerability is an unknown functionality. Performing a manipulation results in improper privilege management. This vulnera
CVE-2024-44006 | WooCommerce Multilingual & Multicurrency Plugin up to 5.3.6 on WordPress authorization (EUVD-2024-40788)
A vulnerability has been found in WooCommerce Multilingual &amp; Multicurrency Plugin up to 5.3.6 on WordPress and classified as problematic. This affects an unknown function. The manipulation leads to missing authorization. This vulner
CVE-2026-124326 | DataLinkDC Dinky up to 1.2.5 Catalogue Upload CatalogueController.java file.getOriginalFilename filename path traversal (GHSA-2jp7-3h24-h6r7 / EUVD-2026-119501)
A vulnerability was found in DataLinkDC Dinky up to 1.2.5 and classified as problematic. Impacted is the function file.getOriginalFilename of the file CatalogueController.java of the component Catalogue Upload. Executing a manipulation of t
CVE-2026-124328 | FlowCI flow-core-x up to 1.23.49 Groovy Script Evaluation ConditionManagerImpl.java ConditionManagerImpl.run condition code injection (EUVD-2026-119503)
A vulnerability was found in FlowCI flow-core-x up to 1.23.49. It has been classified as critical. The affected element is the function ConditionManagerImpl.run of the file core/src/main/java/com/flowci/core/common/manager/ConditionManagerI
CVE-2025-61385 | tlocke pg8000 1.31.4 pg8000.native.literal sql injection
A vulnerability described as critical has been identified in tlocke pg8000 1.31.4. The affected element is the function pg8000.native.literal. Executing a manipulation can lead to sql injection. This vulnerability is registered as CVE-2025-
CVE-2025-61100 | FRRouting FRR up to 10.4.1 ospf_opaque.c ospf_opaque_lsa_dump null pointer dereference (ID 19471 / Nessus ID 271826)
A vulnerability labeled as problematic has been found in FRRouting FRR up to 10.4.1. The impacted element is the function ospf_opaque_lsa_dump of the file ospf_opaque.c. Executing a manipulation can lead to null pointer dereference. This vu
CVE-2025-61099 | FRRouting FRR up to 10.4.1 LS Update Packet ospf_opaque.c opaque_info_detail null pointer dereference (ID 19471 / Nessus ID 271827)
A vulnerability identified as problematic has been detected in FRRouting FRR up to 10.4.1. The affected element is the function opaque_info_detail of the file ospf_opaque.c of the component LS Update Packet Handler. Performing a manipulatio
CVE-2025-60983 | Rubikon Banking Solution 4.0.3 Search for Customers Information cross site scripting
A vulnerability, which was classified as problematic, was found in Rubikon Banking Solution 4.0.3. This affects an unknown function of the component Search for Customers Information. Such manipulation leads to cross site scripting. This vul
CVE-2025-60982 | Educare ERP 1.0 2025-04-22 Endpoint improper authorization
A vulnerability was found in Educare ERP 1.0 2025-04-22. It has been rated as critical. This issue affects some unknown processing of the component Endpoint. This manipulation causes improper authorization. The identification of this vulner
CVE-2025-54969 | BAE SOCET GXP prior 4.6.0.2 Job Status Service cross-site request forgery
A vulnerability categorized as problematic has been discovered in BAE SOCET GXP. This affects an unknown function of the component Job Status Service. Executing a manipulation can lead to cross-site request forgery. The identification of th
CVE-2025-54968 | BAE SOCET GXP prior 4.6.0.2 Job Service improper authentication
A vulnerability, which was classified as critical, has been found in BAE SOCET GXP. Affected by this issue is some unknown functionality of the component Job Service. Performing a manipulation results in improper authentication. This vulner
CVE-2025-54965 | BAE SOCET GXP prior 4.6.0.2 Job Status Service ID cross site scripting
A vulnerability classified as problematic was found in BAE SOCET GXP. This vulnerability affects unknown code of the component Job Status Service. Executing a manipulation of the argument ID can lead to cross site scripting. This vulnerabil
CVE-2026-39809 | Fortinet FortiClientEMS up to 7.4.1/7.4.4 sql injection (FG-IR-26-102)
A vulnerability, which was classified as critical, was found in Fortinet FortiClientEMS up to 7.4.1/7.4.4. This impacts an unknown function. The manipulation results in sql injection. This vulnerability is identified as CVE-2026-39809. The
CVE-2026-23708 | Fortinet FortiSOAR PaaS/FortiSOAR on-premise up to 7.5.2/7.6.3 improper authentication (FG-IR-26-101)
A vulnerability, which was classified as critical, was found in Fortinet FortiSOAR PaaS and FortiSOAR on-premise up to 7.5.2/7.6.3. The affected element is an unknown function. Executing a manipulation can lead to improper authentication. T
CVE-2026-22576 | Fortinet FortiSOAR PaaS/FortiSOAR on-premise up to 7.3.3/7.4.5/7.5.2/7.6.4 Connector Configuration password recoverable (FG-IR-26-104)
A vulnerability classified as problematic was found in Fortinet FortiSOAR PaaS and FortiSOAR on-premise up to 7.3.3/7.4.5/7.5.2/7.6.4. This issue affects some unknown processing of the component Connector Configuration Handler. Such manipul
CVE-2026-22573 | Fortinet FortiSOAR on-premise/FortiSOAR PaaS up to 7.3.3/7.4.5/7.5.3/7.6.3 File Content path traversal (FG-IR-26-116)
A vulnerability was found in Fortinet FortiSOAR on-premise and FortiSOAR PaaS up to 7.3.3/7.4.5/7.5.3/7.6.3. It has been declared as critical. The impacted element is an unknown function of the component File Content Handler. The manipulati
CVE-2026-22154 | Fortinet FortiSOAR PaaS/FortiSOAR on-premise up to 7.3.3/7.4.5/7.5.2/7.6.3 HTTP cross site scripting (FG-IR-26-117)
A vulnerability, which was classified as problematic, has been found in Fortinet FortiSOAR PaaS and FortiSOAR on-premise up to 7.3.3/7.4.5/7.5.2/7.6.3. Affected by this vulnerability is an unknown functionality of the component HTTP Handler
CVE-2026-21741 | Fortinet FortiNAC-F up to 7.2.9/7.4.3/7.6.5 CSV File Parser redirect (FG-IR-26-118)
A vulnerability marked as problematic has been reported in Fortinet FortiNAC-F up to 7.2.9/7.4.3/7.6.5. Affected by this issue is some unknown functionality of the component CSV File Parser. The manipulation leads to open redirect. This vul
CVE-2026-0049 | Google Android 14/15/16/16-qpr2 LocalImageResolver.java onHeaderDecoded resource consumption
A vulnerability has been found in Google Android 14/15/16/16-qpr2 and classified as problematic. Affected by this issue is the function onHeaderDecoded of the file LocalImageResolver.java. The manipulation leads to resource consumption. Thi
CVE-2026-28295 | Red Hat Enterprise Linux up to 10 gvfs server-side request forgery (Nessus ID 300158)
A vulnerability was found in Red Hat Enterprise Linux 6/7/8/9/10. It has been declared as critical. This affects an unknown function of the component gvfs. Executing a manipulation can lead to server-side request forgery. The identification
CVE-2026-22629 | Fortinet FortiAnalyzer up to 7.6.4 excessive authentication (FG-IR-26-079)
A vulnerability was found in Fortinet FortiAnalyzer, FortiAnalyzer Cloud, FortiManager and FortiManager Cloud up to 6.4.15/7.0.16/7.2.12/7.4.10/7.6.4. It has been classified as problematic. The affected element is an unknown function. Perfo
CVE-2026-0047 | Google Android 16-qpr2 ActivityManagerService.java dumpBitmapsProto permission (EUVD-2026-9251 / WID-SEC-2026-0569)
A vulnerability has been found in Google Android 16-qpr2 and classified as critical. This vulnerability affects the function dumpBitmapsProto of the file ActivityManagerService.java. This manipulation causes permission issues. This vulnerab
CVE-2025-65826 | Meatmeet App on Android improper authorization
A vulnerability has been found in Meatmeet App on Android and classified as critical. Impacted is an unknown function. Performing a manipulation results in improper authorization. This vulnerability is known as CVE-2025-65826. Access to the
CVE-2025-63785 | Onlook Web Application 0.2.32 Text Editor cross site scripting
A vulnerability, which was classified as problematic, was found in Onlook Web Application 0.2.32. Affected is an unknown function of the component Text Editor. Such manipulation leads to cross site scripting. This vulnerability is reference
CVE-2025-63603 | reading-plus-ai mcp-server-data-exploration 0.1.6 server.py safe_eval command injection (Issue 12)
A vulnerability labeled as critical has been found in reading-plus-ai mcp-server-data-exploration 0.1.6. Affected is the function safe_eval of the file src/mcp_server_ds/server.py. Such manipulation leads to command injection. This vulnerab
CVE-2025-63363 | Waveshare RS232-485 to WIFI ETH 3.1.1.0 Deauthentication access control (EUVD-2025-201245)
A vulnerability, which was classified as critical, has been found in Waveshare RS232-485 to WIFI ETH 3.1.1.0. This affects an unknown part of the component Deauthentication Handler. The manipulation leads to improper access controls. This v
CVE-2025-63362 | Waveshare RS232-485 to WIFI ETH 3.1.1.0 Administrator Password improper authentication
A vulnerability, which was classified as critical, was found in Waveshare RS232-485 to WIFI ETH 3.1.1.0. This vulnerability affects unknown code of the component Administrator Password Handler. The manipulation results in improper authentic
CVE-2026-4629 | Keycloak on Red Hat privileges assignment (WID-SEC-2026-2145)
A vulnerability has been found in Keycloak on Red Hat and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to incorrect privilege assignment. This vulnerability is referenced as C