Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 744 | 0,2 % |
| ≥50 % | 3.220 | 0,8 % |
| ≥10 % | 22.083 | 5,8 % |
| <10 % | 354.682 | 93,2 % |
CVE-2026-9268 | GitLab up to 19.2.7/19.3.4/19.4.1 CI/CD Deployment Rollback Settings privileges management (WID-SEC-2026-3858)
A vulnerability was found in GitLab up to 19.2.7/19.3.4/19.4.1. It has been classified as problematic. The impacted element is an unknown function of the component CI/CD Deployment Rollback Settings. This manipulation causes improper privil
CVE-2026-82632 | GitLab up to 19.2.7/19.3.4/19.4.1 Import improper authorization (WID-SEC-2026-3858)
A vulnerability, which was classified as problematic, was found in GitLab up to 19.2.7/19.3.4/19.4.1. This issue affects some unknown processing of the component Import. Executing a manipulation can lead to improper authorization. The ident
CVE-2025-34253 | D-Link Nuclias Connect up to 1.3.1.4 Network cross site scripting (EUVD-2025-34830)
A vulnerability identified as problematic has been detected in D-Link Nuclias Connect up to 1.3.1.4. Impacted is an unknown function. The manipulation of the argument Network leads to cross site scripting. This vulnerability is listed as CV
CVE-2025-34108 | Falconstor Disk Pulse Enterprise 9.0.34 HTTP POST Request /login username stack-based overflow (EDB-40452)
A vulnerability classified as critical has been found in Falconstor Disk Pulse Enterprise 9.0.34. The affected element is an unknown function in the library libspp.dll of the file /login of the component HTTP POST Request Handler. This mani
CVE-2024-58300 | Siklu MultiHaul TG 1.x Network Request missing authentication (Exploit 51932 / EDB-51932)
A vulnerability was found in Siklu MultiHaul TG 1.x. It has been declared as critical. This affects an unknown function of the component Network Request Handler. Executing a manipulation can lead to missing authentication. This vulnerabilit
CVE-2024-58296 | PhoenixCart CE Phoenix 1.0.8.20 Administration Panel title cross site scripting (Exploit 52015 / EDB-52015)
A vulnerability was found in PhoenixCart CE Phoenix 1.0.8.20. It has been declared as problematic. Affected by this issue is some unknown functionality of the component Administration Panel. Such manipulation of the argument Title leads to
CVE-2024-22047 | Audited up to 5.3.3 Audit Log race condition (ID 601 / EUVD-2023-1560)
A vulnerability categorized as problematic has been discovered in Audited up to 5.3.3. Affected by this issue is some unknown functionality of the component Audit Log Handler. Executing a manipulation can lead to race condition. This vulner
CVE-2023-53937 | Hubstaff 1.6.13/1.6.14 wow64log.dll uncontrolled search path (Exploit 51461 / EDB-51461)
A vulnerability labeled as problematic has been found in Hubstaff 1.6.13/1.6.14. Impacted is an unknown function in the library wow64log.dll. The manipulation results in uncontrolled search path. This vulnerability is reported as CVE-2023-5
CVE-2023-53907 | Bludit up to 3.13.0 path traversal (Exploit 51541 / EDB-51541)
A vulnerability marked as critical has been reported in Bludit up to 3.13.0. This vulnerability affects unknown code. Performing a manipulation results in path traversal. This vulnerability is identified as CVE-2023-53907. The attack can be
CVE-2026-25439 | fs-code Booknetic Plugin up to 4.8.5 on WordPress authentication bypass
A vulnerability has been found in fs-code Booknetic Plugin up to 4.8.5 on WordPress and classified as critical. Affected by this vulnerability is an unknown functionality. This manipulation causes authentication bypass using alternate chann
CVE-2023-31317 | AMD Instinct MI210 memory corruption
A vulnerability classified as critical was found in AMD Radeon RX 6000 Graphics Products, Radeon RX 7000 Graphics Products, Radeon PRO W7000 Graphics Products, Radeon PRO W6000 Graphics Products, Instinct MI250 and Instinct MI210. Affected
CVE-2023-31316 | AMD Radeon PRO V620 Configuration hardware configuration state
A vulnerability, which was classified as problematic, has been found in AMD Ryzen 5000 Mobile Processors with Radeon Graphics, Ryzen 7000 Desktop Processors, Ryzen 4000 Desktop Processors, Ryzen 5000 Desktop Processors with Radeon Graphics,
CVE-2023-31309 | AMD Radeon PRO V620 Power Management Firmware array index
A vulnerability was found in AMD Radeon RX 6000 Graphics Products, Radeon PRO W6000 Graphics Products, Radeon PRO V520 and Radeon PRO V620 and classified as problematic. Impacted is an unknown function of the component Power Management Firm
CVE-2023-30059 | MK-Auth up to 23.01K4.9 GET chamado resource injection
A vulnerability, which was classified as critical, was found in MK-Auth up to 23.01K4.9. Affected by this issue is some unknown functionality of the component GET Handler. The manipulation of the argument chamado results in improper control
CVE-2026-115415 – Secret masking bypass in the environment tool in Strands Agents Tools
Bulletin ID: 2026-154-AWS Publication Date: 10/28/2026 12:30 PM PDT Description: We identified CVE-2026-115415, an issue where the environment tool accepted a masking parameter from the large language model (LLM) through its tool schema. A
CVE-2026-81839 | GitLab up to 19.2.7/19.3.4/19.4.1 Pipeline Execution Policy privileges management (WID-SEC-2026-3858)
A vulnerability classified as critical was found in GitLab up to 19.2.7/19.3.4/19.4.1. This affects an unknown part of the component Pipeline Execution Policy. Such manipulation leads to improper privilege management. This vulnerability is
CVE-2026-78335 | GitLab up to 19.2.7/19.3.4/19.4.1 Integrations improper authorization (WID-SEC-2026-3858)
A vulnerability classified as critical has been found in GitLab up to 19.2.7/19.3.4/19.4.1. Affected by this issue is some unknown functionality of the component Integrations. This manipulation causes improper authorization. This vulnerabil
CVE-2026-7767 | GitLab up to 19.2.7/19.3.4/19.4.1 Kubernetes Proxy redirect (WID-SEC-2026-3858)
A vulnerability described as problematic has been identified in GitLab up to 19.2.7/19.3.4/19.4.1. Affected by this vulnerability is an unknown functionality of the component Kubernetes Proxy. The manipulation results in open redirect. This
CVE-2026-6567 | GitLab up to 19.2.7/19.3.4/19.4.1 improper authorization (WID-SEC-2026-3858)
A vulnerability marked as problematic has been reported in GitLab up to 19.2.7/19.3.4/19.4.1. Affected is an unknown function. The manipulation leads to improper authorization. This vulnerability is traded as CVE-2026-6567. It is possible t
CVE-2026-5954 | GitLab 15.1/19.2.7/19.3.4/19.4.1 improper authorization (WID-SEC-2026-3858)
A vulnerability identified as problematic has been detected in GitLab 15.1/19.2.7/19.3.4/19.4.1. This affects an unknown function. Performing a manipulation results in improper authorization. This vulnerability is reported as CVE-2026-5954.
CVE-2026-16301 | GitLab up to 19.2.7/19.3.4/19.4.1 Downstream Pipeline Creation Service improper authorization (WID-SEC-2026-3858)
A vulnerability labeled as critical has been found in GitLab up to 19.2.7/19.3.4/19.4.1. This impacts an unknown function of the component Downstream Pipeline Creation Service. Executing a manipulation can lead to improper authorization. Th
CVE-2026-97229 | GitLab up to 19.2.7/19.3.4/19.4.1 Regular Expression Validation incorrect regex
A vulnerability categorized as critical has been discovered in GitLab up to 19.2.7/19.3.4/19.4.1. Affected is an unknown function of the component Regular Expression Validation. Executing a manipulation can lead to incorrect regular express
CVE-2026-76418 | Cisco Secure Firewall Adaptive Security Appliance Remote Access SSL VPN service denial of service
A vulnerability described as critical has been identified in Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense. Impacted is an unknown function of the component Remote Access SSL VPN service. The manipulat
CVE-2026-16275 | GitLab up to 19.2.7/19.3.4/19.4.1 improper authorization (WID-SEC-2026-3858)
A vulnerability categorized as problematic has been discovered in GitLab up to 19.2.7/19.3.4/19.4.1. The impacted element is an unknown function. Such manipulation leads to improper authorization. This vulnerability is documented as CVE-202
CVE-2026-14814 | GitLab up to 19.2.7/19.3.4/19.4.1 CI/CD Pipeline input validation (WID-SEC-2026-3858)
A vulnerability was found in GitLab up to 19.2.7/19.3.4/19.4.1. It has been declared as problematic. Impacted is an unknown function of the component CI/CD Pipeline. The manipulation results in improper input validation. This vulnerability
CVE-2026-14552 | GitLab up to 19.2.7/19.3.4/19.4.1 Epic improper authorization (WID-SEC-2026-3858)
A vulnerability was found in GitLab up to 19.2.7/19.3.4/19.4.1. It has been rated as problematic. The affected element is an unknown function of the component Epic. This manipulation causes improper authorization. This vulnerability is regi
CVE-2026-105458 | GitLab up to 19.2.7/19.3.4/19.4.1 Duo Agent Platform permission (WID-SEC-2026-3858)
A vulnerability was found in GitLab up to 19.2.7/19.3.4/19.4.1 and classified as problematic. This vulnerability affects unknown code of the component Duo Agent Platform. Executing a manipulation can lead to permission issues. This vulnerab
CVE-2026-104661 | GitLab up to 19.2.7/19.3.4/19.4.1 Compliance Pipeline permission (WID-SEC-2026-3858)
A vulnerability, which was classified as problematic, was found in GitLab up to 19.2.7/19.3.4/19.4.1. Affected by this issue is some unknown functionality of the component Compliance Pipeline. Such manipulation leads to permission issues. T
CVE-2026-100104 | GitLab up to 19.2.7/19.3.4/19.4.1 URL Validation race condition (WID-SEC-2026-3858)
A vulnerability has been found in GitLab up to 19.2.7/19.3.4/19.4.1 and classified as critical. This affects an unknown part of the component URL Validation. Performing a manipulation results in race condition. This vulnerability is identif
HTTP2Shell - Brotli-Sicherheitslücke geht über Node.js hinaus - Netzpalaver
Cybersecurity-Gefahr - anfälliger Brotli-Code könnte auch in anderen Laufzeiten, Paketen, HTTP2Shell tauchte kurz nach PHP2Shell auf, doch die ... Weiterlesen
CVE-2024-53326 | LINQPad up to 5.52.0 PopulateFromCache deserialization
A vulnerability labeled as problematic has been found in LINQPad up to 5.52.0. This issue affects the function LINQPad.AutoRefManager::PopulateFromCache. Such manipulation leads to deserialization. This vulnerability is documented as CVE-20
CVE-2024-51092 | LibreNMS up to 24.9.x AboutController.php index os command injection
A vulnerability, which was classified as critical, has been found in LibreNMS up to 24.9.x. The affected element is the function index of the file AboutController.php. The manipulation leads to os command injection. This vulnerability is un
CVE-2024-46508 | yeti-platform yeti up to 2.1.11 hard-coded key
A vulnerability identified as problematic has been detected in yeti-platform yeti up to 2.1.11. This vulnerability affects unknown code. This manipulation causes use of hard-coded cryptographic key . This vulnerability is registered as CVE-
CVE-2024-46507 | yeti-platform yeti up to 2.1.11 special elements in template engine
A vulnerability was found in yeti-platform yeti up to 2.1.11. It has been rated as critical. Affected by this issue is some unknown functionality. The manipulation leads to improper neutralization of special elements used in a template engi
CVE-2024-45257 | BYOB 2.0 Payload Build Page core/generators.py build command injection
A vulnerability was found in BYOB 2.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file core/generators.py of the component Payload Build Page. Executing a manipulation of the argument
CVE-2024-33724 | SOPlanning 1.52.00 process/groupe_save.php groupe_id cross site scripting
A vulnerability categorized as problematic has been discovered in SOPlanning 1.52.00. This affects an unknown part of the file process/groupe_save.php. The manipulation of the argument groupe_id results in cross site scripting. This vulnera
CVE-2024-33722 | SOPlanning 1.52.00 projets.php statut[] sql injection
A vulnerability was found in SOPlanning 1.52.00 and classified as critical. This impacts an unknown function of the file projets.php. Such manipulation of the argument statut[] leads to sql injection. This vulnerability is referenced as CVE
CVE-2024-33288 | Prison Management System 1.0 Admin Login Page username sql injection
A vulnerability, which was classified as critical, was found in Prison Management System 1.0. The impacted element is an unknown function of the component Admin Login Page. The manipulation of the argument Username results in sql injection.
CVE-2024-27686 | MikroTik RouterOS 5.0/6.44/6.49.10 SMB Request denial of service (ID 177811)
A vulnerability described as problematic has been identified in MikroTik RouterOS 5.0/6.44/6.49.10. Affected by this issue is some unknown functionality of the component SMB Request Handler. The manipulation results in denial of service. Th
CVE-2023-46453 | GL.iNet Device 4.3.7 incorrect regex (Exploit 51865)
A vulnerability, which was classified as very critical, was found in GL.iNet Device 4.3.7. Affected is an unknown function. Such manipulation leads to incorrect regular expression. This vulnerability is uniquely identified as CVE-2023-46453
CVE-2023-27753 | MK-Auth 23.01K4.9 PHP File unrestricted upload
A vulnerability classified as critical was found in MK-Auth 23.01K4.9. Affected is an unknown function of the component PHP File Handler. Executing a manipulation can lead to unrestricted upload. This vulnerability is handled as CVE-2023-27
CVE-2026-39814 | Fortinet FortiWeb up to 7.4.12/7.6.6/8.0.2 path traversal (FG-IR-26-114)
A vulnerability classified as problematic was found in Fortinet FortiWeb up to 7.4.12/7.6.6/8.0.2. The impacted element is an unknown function. Executing a manipulation can lead to relative path traversal. The identification of this vulnera
CVE-2023-54349 | Spondonit AmazCart CMS 3.4 Search History cross site scripting (Exploit 51219)
A vulnerability classified as problematic has been found in Spondonit AmazCart CMS 3.4. This affects an unknown part of the component Search History Handler. Performing a manipulation results in cross site scripting. This vulnerability was
CVE-2023-54347 | OpenEMR 7.0.1 Main Login Endpoint authUser/clearPass excessive authentication (Exploit 51413)
A vulnerability categorized as problematic has been discovered in OpenEMR 7.0.1. This affects an unknown function of the component Main Login Endpoint. Executing a manipulation of the argument authUser/clearPass can lead to improper restric
CVE-2023-54346 | Backupbliss WordPress Plugin Backup Migration 1.2.8 on WordPress Configuration File file information disclosure (Exploit 51445)
A vulnerability was found in Backupbliss WordPress Plugin Backup Migration 1.2.8 on WordPress. It has been classified as problematic. Impacted is an unknown function of the component Configuration File Handler. This manipulation causes file
CVE-2023-54345 | Frappe ERPNext 13.4.0 call /app/server-script gi_frame code injection (Exploit 51580)
A vulnerability was found in Frappe ERPNext 13.4.0 and classified as critical. This issue affects some unknown processing of the file /app/server-script of the component call Handler. The manipulation of the argument gi_frame results in cod
CVE-2023-54344 | Eclipse equinox OSGi up to 3.7.2 Console Interface missing authentication (Exploit 51879)
A vulnerability was found in Eclipse equinox OSGi up to 3.7.2. It has been rated as critical. The impacted element is an unknown function of the component Console Interface. Performing a manipulation results in missing authentication. This
CVE-2023-54342 | Eclipse equinox OSGi up to 3.18 Console Interface missing authentication (Exploit 51878)
A vulnerability was found in Eclipse equinox OSGi up to 3.18. It has been declared as critical. The affected element is an unknown function of the component Console Interface. Such manipulation leads to missing authentication. This vulnerab
CVE-2026-117870 | Mozilla Firefox up to 115.43/153.5/158 JavaScript Engine use after free (Nessus ID 373648)
A vulnerability marked as critical has been reported in Mozilla Firefox up to 115.43/153.5/158. The affected element is an unknown function of the component JavaScript Engine. The manipulation leads to use after free. This vulnerability is
CVE-2026-117869 | Mozilla Firefox up to 115.43/153.5/158 DOM Core/HTML use after free (Nessus ID 373648)
A vulnerability described as critical has been identified in Mozilla Firefox up to 115.43/153.5/158. The impacted element is an unknown function of the component DOM Core/HTML. The manipulation results in use after free. This vulnerability
CVE-2026-117868 | Mozilla Firefox up to 115.43/153.5/158 Networking sandbox (Nessus ID 373648)
A vulnerability identified as critical has been detected in Mozilla Firefox up to 115.43/153.5/158. This issue affects some unknown processing of the component Networking. Performing a manipulation results in sandbox issue. This vulnerabili
CVE-2026-117867 | Mozilla Firefox up to 115.43/153.5/158 Layout use after free (Nessus ID 373648)
A vulnerability categorized as critical has been discovered in Mozilla Firefox up to 115.43/153.5/158. This vulnerability affects unknown code of the component Layout. Such manipulation leads to use after free. This vulnerability is uniquel
CVE-2026-117865 | Mozilla Firefox GC use after free (Nessus ID 373648)
A vulnerability was found in Mozilla Firefox. It has been rated as critical. This affects an unknown part of the component GC. This manipulation causes use after free. This vulnerability is handled as CVE-2026-117865. The attack can be init
CVE-2026-74049 | Apache Tomcat up to 11.0.26 redirect (EUVD-2026-105005)
A vulnerability classified as problematic has been found in Apache Tomcat up to 7.0.109/8.5.100/9.0.122/10.1.60/11.0.26. This vulnerability affects unknown code. Performing a manipulation results in open redirect. This vulnerability is cata
CVE-2026-89009 | WAVLINK WN535M1/WN535M3 up to M35M1_V250922 sync_server daemon filename path traversal (EUVD-2026-76129)
A vulnerability was found in WAVLINK WN535M1 and WN535M3 up to M35M1_V250922. It has been rated as critical. Impacted is an unknown function of the component sync_server daemon. This manipulation of the argument filename causes path travers
CVE-2026-80353 | Apache Tomcat up to 9.0.122 APR-Native connector toctou (EUVD-2026-105006)
A vulnerability, which was classified as problematic, has been found in Apache Tomcat up to 9.0.122. Impacted is an unknown function of the component APR-Native connector. The manipulation leads to time-of-check time-of-use. This vulnerabil
CVE-2026-46651 | intranda goobi-viewer-core up to 26.04 Download Task Endpoint monitor.socket DownloadTaskEndpoint missing authentication (EUVD-2026-109059)
A vulnerability described as critical has been identified in intranda goobi-viewer-core up to 26.04. This impacts the function DownloadTaskEndpoint of the file /tasks/download/monitor.socket of the component Download Task Endpoint. Executin
CVE-2026-115477 | -40-Thieves obsidian-tc up to 1.31.3 Handler privileges management (EUVD-2026-109082)
A vulnerability was found in -40-Thieves obsidian-tc up to 1.31.3. It has been declared as problematic. This vulnerability affects unknown code of the component Handler. Executing a manipulation can lead to improper privilege management. Th
CVE-2026-51851 | agent0ai Agent-Zero 1.7/1.8/1.9/1.10 FileBrowser file_browser.py save_text_file path traversal (EUVD-2026-113288)
A vulnerability described as critical has been identified in agent0ai Agent-Zero 1.7/1.8/1.9/1.10. This vulnerability affects the function save_text_file of the file python/helpers/file_browser.py of the component FileBrowser. The manipulat
CVE-2022-48123 | TOTOLINK A7100RU 7.4cu.2313_B20191024 Setting delStaticDhcpRules servername command injection (EUVD-2022-50835)
A vulnerability described as critical has been identified in TOTOLINK A7100RU 7.4cu.2313_B20191024. Affected is the function delStaticDhcpRules of the component Setting Handler. The manipulation of the argument servername results in command