Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 785 | 0,2 % |
| ≥50 % | 3.559 | 0,9 % |
| ≥10 % | 13.139 | 3,2 % |
| <10 % | 396.070 | 95,8 % |
VeloCloud Shows Why Integration Endpoint Trust Needs an Owner
Integration endpoint trust is the part of an orchestrator's exposure that an inbound-reachability review can miss. On November 2, 2026, Arista published Security Advisory 0202 for VeloCloud Orchestrator (VCO), the platform that configu
CVE-2026-104639 | Razorpay for WooCommerce Plugin up to 4.8.8 on WordPress sql injection (EUVD-2026-119473)
A vulnerability was found in Razorpay for WooCommerce Plugin up to 4.8.8 on WordPress. It has been classified as problematic. This vulnerability affects unknown code. This manipulation causes sql injection. This vulnerability is tracked as
CVE-2026-104338 | Razorpay for WooCommerce Plugin up to 4.8.8 on WordPress Rest Routes authorization (EUVD-2026-119472)
A vulnerability, which was classified as critical, was found in Razorpay for WooCommerce Plugin up to 4.8.8 on WordPress. Affected by this vulnerability is an unknown functionality of the component Rest Routes. Executing a manipulation can
CVE-2026-104337 | Razorpay for WooCommerce Plugin up to 4.8.8 on WordPress information disclosure (EUVD-2026-119471)
A vulnerability has been found in Razorpay for WooCommerce Plugin up to 4.8.8 on WordPress and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to information disclosure. This vulnerabi
CVE-2026-109925 | Productive Commerce Plugin up to 1.1.53 on WordPress sql injection (EUVD-2026-119476)
A vulnerability was found in Productive Commerce Plugin up to 1.1.53 on WordPress. It has been rated as critical. Impacted is an unknown function. Performing a manipulation results in sql injection. This vulnerability is cataloged as CVE-20
CVE-2026-106015 | Ecommerce Affiliate Plugin up to 1.0.0 on WordPress improper authentication (EUVD-2026-119475)
A vulnerability classified as critical was found in Ecommerce Affiliate Plugin up to 1.0.0 on WordPress. This impacts an unknown function. Such manipulation leads to improper authentication. This vulnerability is uniquely identified as CVE-
CVE-2026-105970 | Thanh Toan Quet Ma QR Code Tu Dong Plugin up to 2.0.1 on WordPress Payment Notifications access control (EUVD-2026-119474)
A vulnerability categorized as problematic has been discovered in Thanh Toan Quet Ma QR Code Tu Dong Plugin up to 2.0.1 on WordPress. The affected element is an unknown function of the component Payment Notifications. Executing a manipulati
CVE-2026-110132 | Sync Post With Other Site Plugin up to 1.9.3 on WordPress authorization (EUVD-2026-119477)
A vulnerability marked as critical has been reported in Sync Post With Other Site Plugin up to 1.9.3 on WordPress. This impacts an unknown function. This manipulation causes incorrect authorization. This vulnerability appears as CVE-2026-11
CVE-2026-110963 | Userplace Plugin up to 1.2.0 on WordPress privileges management (EUVD-2026-119478)
A vulnerability classified as critical has been found in Userplace Plugin up to 1.2.0 on WordPress. Affected by this vulnerability is an unknown functionality. Performing a manipulation results in improper privilege management. This vulnera
CVE-2024-44006 | WooCommerce Multilingual & Multicurrency Plugin up to 5.3.6 on WordPress authorization (EUVD-2024-40788)
A vulnerability has been found in WooCommerce Multilingual &amp; Multicurrency Plugin up to 5.3.6 on WordPress and classified as problematic. This affects an unknown function. The manipulation leads to missing authorization. This vulner
CVE-2026-124326 | DataLinkDC Dinky up to 1.2.5 Catalogue Upload CatalogueController.java file.getOriginalFilename filename path traversal (GHSA-2jp7-3h24-h6r7 / EUVD-2026-119501)
A vulnerability was found in DataLinkDC Dinky up to 1.2.5 and classified as problematic. Impacted is the function file.getOriginalFilename of the file CatalogueController.java of the component Catalogue Upload. Executing a manipulation of t
CVE-2026-124328 | FlowCI flow-core-x up to 1.23.49 Groovy Script Evaluation ConditionManagerImpl.java ConditionManagerImpl.run condition code injection (EUVD-2026-119503)
A vulnerability was found in FlowCI flow-core-x up to 1.23.49. It has been classified as critical. The affected element is the function ConditionManagerImpl.run of the file core/src/main/java/com/flowci/core/common/manager/ConditionManagerI
CVE-2025-61385 | tlocke pg8000 1.31.4 pg8000.native.literal sql injection
A vulnerability described as critical has been identified in tlocke pg8000 1.31.4. The affected element is the function pg8000.native.literal. Executing a manipulation can lead to sql injection. This vulnerability is registered as CVE-2025-
CVE-2025-61100 | FRRouting FRR up to 10.4.1 ospf_opaque.c ospf_opaque_lsa_dump null pointer dereference (ID 19471 / Nessus ID 271826)
A vulnerability labeled as problematic has been found in FRRouting FRR up to 10.4.1. The impacted element is the function ospf_opaque_lsa_dump of the file ospf_opaque.c. Executing a manipulation can lead to null pointer dereference. This vu
CVE-2025-61099 | FRRouting FRR up to 10.4.1 LS Update Packet ospf_opaque.c opaque_info_detail null pointer dereference (ID 19471 / Nessus ID 271827)
A vulnerability identified as problematic has been detected in FRRouting FRR up to 10.4.1. The affected element is the function opaque_info_detail of the file ospf_opaque.c of the component LS Update Packet Handler. Performing a manipulatio
CVE-2025-60983 | Rubikon Banking Solution 4.0.3 Search for Customers Information cross site scripting
A vulnerability, which was classified as problematic, was found in Rubikon Banking Solution 4.0.3. This affects an unknown function of the component Search for Customers Information. Such manipulation leads to cross site scripting. This vul
CVE-2025-60982 | Educare ERP 1.0 2025-04-22 Endpoint improper authorization
A vulnerability was found in Educare ERP 1.0 2025-04-22. It has been rated as critical. This issue affects some unknown processing of the component Endpoint. This manipulation causes improper authorization. The identification of this vulner
CVE-2025-54969 | BAE SOCET GXP prior 4.6.0.2 Job Status Service cross-site request forgery
A vulnerability categorized as problematic has been discovered in BAE SOCET GXP. This affects an unknown function of the component Job Status Service. Executing a manipulation can lead to cross-site request forgery. The identification of th
CVE-2025-54968 | BAE SOCET GXP prior 4.6.0.2 Job Service improper authentication
A vulnerability, which was classified as critical, has been found in BAE SOCET GXP. Affected by this issue is some unknown functionality of the component Job Service. Performing a manipulation results in improper authentication. This vulner
CVE-2025-54965 | BAE SOCET GXP prior 4.6.0.2 Job Status Service ID cross site scripting
A vulnerability classified as problematic was found in BAE SOCET GXP. This vulnerability affects unknown code of the component Job Status Service. Executing a manipulation of the argument ID can lead to cross site scripting. This vulnerabil
CVE-2026-39809 | Fortinet FortiClientEMS up to 7.4.1/7.4.4 sql injection (FG-IR-26-102)
A vulnerability, which was classified as critical, was found in Fortinet FortiClientEMS up to 7.4.1/7.4.4. This impacts an unknown function. The manipulation results in sql injection. This vulnerability is identified as CVE-2026-39809. The
CVE-2026-23708 | Fortinet FortiSOAR PaaS/FortiSOAR on-premise up to 7.5.2/7.6.3 improper authentication (FG-IR-26-101)
A vulnerability, which was classified as critical, was found in Fortinet FortiSOAR PaaS and FortiSOAR on-premise up to 7.5.2/7.6.3. The affected element is an unknown function. Executing a manipulation can lead to improper authentication. T
CVE-2026-22576 | Fortinet FortiSOAR PaaS/FortiSOAR on-premise up to 7.3.3/7.4.5/7.5.2/7.6.4 Connector Configuration password recoverable (FG-IR-26-104)
A vulnerability classified as problematic was found in Fortinet FortiSOAR PaaS and FortiSOAR on-premise up to 7.3.3/7.4.5/7.5.2/7.6.4. This issue affects some unknown processing of the component Connector Configuration Handler. Such manipul
CVE-2026-22573 | Fortinet FortiSOAR on-premise/FortiSOAR PaaS up to 7.3.3/7.4.5/7.5.3/7.6.3 File Content path traversal (FG-IR-26-116)
A vulnerability was found in Fortinet FortiSOAR on-premise and FortiSOAR PaaS up to 7.3.3/7.4.5/7.5.3/7.6.3. It has been declared as critical. The impacted element is an unknown function of the component File Content Handler. The manipulati
CVE-2026-22154 | Fortinet FortiSOAR PaaS/FortiSOAR on-premise up to 7.3.3/7.4.5/7.5.2/7.6.3 HTTP cross site scripting (FG-IR-26-117)
A vulnerability, which was classified as problematic, has been found in Fortinet FortiSOAR PaaS and FortiSOAR on-premise up to 7.3.3/7.4.5/7.5.2/7.6.3. Affected by this vulnerability is an unknown functionality of the component HTTP Handler
CVE-2026-21741 | Fortinet FortiNAC-F up to 7.2.9/7.4.3/7.6.5 CSV File Parser redirect (FG-IR-26-118)
A vulnerability marked as problematic has been reported in Fortinet FortiNAC-F up to 7.2.9/7.4.3/7.6.5. Affected by this issue is some unknown functionality of the component CSV File Parser. The manipulation leads to open redirect. This vul
CVE-2026-0049 | Google Android 14/15/16/16-qpr2 LocalImageResolver.java onHeaderDecoded resource consumption
A vulnerability has been found in Google Android 14/15/16/16-qpr2 and classified as problematic. Affected by this issue is the function onHeaderDecoded of the file LocalImageResolver.java. The manipulation leads to resource consumption. Thi
CVE-2026-28295 | Red Hat Enterprise Linux up to 10 gvfs server-side request forgery (Nessus ID 300158)
A vulnerability was found in Red Hat Enterprise Linux 6/7/8/9/10. It has been declared as critical. This affects an unknown function of the component gvfs. Executing a manipulation can lead to server-side request forgery. The identification
CVE-2026-22629 | Fortinet FortiAnalyzer up to 7.6.4 excessive authentication (FG-IR-26-079)
A vulnerability was found in Fortinet FortiAnalyzer, FortiAnalyzer Cloud, FortiManager and FortiManager Cloud up to 6.4.15/7.0.16/7.2.12/7.4.10/7.6.4. It has been classified as problematic. The affected element is an unknown function. Perfo
CVE-2026-0047 | Google Android 16-qpr2 ActivityManagerService.java dumpBitmapsProto permission (EUVD-2026-9251 / WID-SEC-2026-0569)
A vulnerability has been found in Google Android 16-qpr2 and classified as critical. This vulnerability affects the function dumpBitmapsProto of the file ActivityManagerService.java. This manipulation causes permission issues. This vulnerab
CVE-2025-65826 | Meatmeet App on Android improper authorization
A vulnerability has been found in Meatmeet App on Android and classified as critical. Impacted is an unknown function. Performing a manipulation results in improper authorization. This vulnerability is known as CVE-2025-65826. Access to the
CVE-2025-63785 | Onlook Web Application 0.2.32 Text Editor cross site scripting
A vulnerability, which was classified as problematic, was found in Onlook Web Application 0.2.32. Affected is an unknown function of the component Text Editor. Such manipulation leads to cross site scripting. This vulnerability is reference
CVE-2025-63603 | reading-plus-ai mcp-server-data-exploration 0.1.6 server.py safe_eval command injection (Issue 12)
A vulnerability labeled as critical has been found in reading-plus-ai mcp-server-data-exploration 0.1.6. Affected is the function safe_eval of the file src/mcp_server_ds/server.py. Such manipulation leads to command injection. This vulnerab
CVE-2025-63363 | Waveshare RS232-485 to WIFI ETH 3.1.1.0 Deauthentication access control (EUVD-2025-201245)
A vulnerability, which was classified as critical, has been found in Waveshare RS232-485 to WIFI ETH 3.1.1.0. This affects an unknown part of the component Deauthentication Handler. The manipulation leads to improper access controls. This v
CVE-2025-63362 | Waveshare RS232-485 to WIFI ETH 3.1.1.0 Administrator Password improper authentication
A vulnerability, which was classified as critical, was found in Waveshare RS232-485 to WIFI ETH 3.1.1.0. This vulnerability affects unknown code of the component Administrator Password Handler. The manipulation results in improper authentic
CVE-2026-4629 | Keycloak on Red Hat privileges assignment (WID-SEC-2026-2145)
A vulnerability has been found in Keycloak on Red Hat and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to incorrect privilege assignment. This vulnerability is referenced as C
CVE-2026-12388 | Keycloak on Red Hat privileges assignment (WID-SEC-2026-2145)
A vulnerability classified as problematic has been found in Keycloak on Red Hat. The impacted element is an unknown function. This manipulation causes incorrect privilege assignment. This vulnerability is handled as CVE-2026-12388. The atta
CVE-2025-61482 | NetKnights privacyIDEA Authenticator 4.3.0 on Android OTP/TOTP/HOTP improper authentication
A vulnerability marked as critical has been reported in NetKnights privacyIDEA Authenticator 4.3.0 on Android. This affects an unknown part of the component OTP/TOTP/HOTP. This manipulation causes improper authentication. This vulnerability
CVE-2025-61247 | indieka900 online-shopping-system-php 1.0 login.php password sql injection (EUVD-2025-36203)
A vulnerability was found in indieka900 online-shopping-system-php 1.0. It has been classified as critical. The impacted element is an unknown function of the file login.php. This manipulation of the argument Password causes sql injection.
CVE-2025-52268 | StarCharge Artemis AC Charger 7-22 kW 1.0.4 AES Key hard-coded key
A vulnerability, which was classified as problematic, has been found in StarCharge Artemis AC Charger 7-22 kW 1.0.4. The affected element is an unknown function of the component AES Key Handler. The manipulation leads to use of hard-coded c
CVE-2025-52264 | StarCharge Artemis AC Charger 7-22 kW 1.0.4 download.cgi cgiMain stack-based overflow
A vulnerability classified as critical was found in StarCharge Artemis AC Charger 7-22 kW 1.0.4. Impacted is the function cgiMain of the file download.cgi. Executing a manipulation can lead to stack-based buffer overflow. This vulnerability
AI Found 948 Linux Kernel Bugs — Here's How OpenAI's Models Did It
Tags: #security #openai #linux #ai OpenAI's o3 and o4-mini reasoning models just changed what we thought AI could do in security research. Working alongside researchers, they surfaced 948 CVE-grade vulnerabilities in the Linux kernel —
CVE-2025-27225 | Rocket TRUfusion Enterprise up to 7.10.4.0 Endpoint internal_admin_contact_login.jsp information disclosure
A vulnerability was found in Rocket TRUfusion Enterprise up to 7.10.4.0. It has been declared as problematic. This vulnerability affects unknown code of the file /trufusionPortal/jsp/internal_admin_contact_login.jsp of the component Endpoin
CVE-2025-27222 | Rocket TRUfusion Enterprise up to 7.10.4.0 getCobrandingData path traversal
A vulnerability labeled as critical has been found in Rocket TRUfusion Enterprise up to 7.10.4.0. Affected is an unknown function of the file /trufusionPortal/getCobrandingData. The manipulation results in path traversal. This vulnerability
CVE-2025-60954 | Microweber CMS 2.0 Password Length password recovery
A vulnerability was found in Microweber CMS 2.0. It has been rated as problematic. This issue affects some unknown processing of the component Password Length Handler. The manipulation leads to weak password recovery. This vulnerability is
CVE-2025-60803 | Antabot White-Jotter up to 9bcadc /api/aaa;/../register os command injection (Issue 162 / EUVD-2025-35863)
A vulnerability classified as critical has been found in Antabot White-Jotter up to 9bcadc. The affected element is an unknown function of the file /api/aaa;/../register. This manipulation causes os command injection. This vulnerability is
CVE-2025-60730 | PerfreeBlog 4.0.11 unInstallTheme cleanup
A vulnerability was found in PerfreeBlog 4.0.11. It has been rated as problematic. The affected element is the function unInstallTheme. The manipulation leads to incomplete cleanup. This vulnerability is traded as CVE-2025-60730. It is poss
CVE-2025-60564 | D-Link DIR600L 116WWb01 formSetLog curTime buffer overflow
A vulnerability was found in D-Link DIR600L 116WWb01. It has been classified as critical. Affected by this issue is the function formSetLog. This manipulation of the argument curTime causes buffer overflow. This vulnerability appears as CVE
CVE-2025-60419 | Realtek NDIS Usermode I/O Driver RtkIOAC60.sys denial of service (EUVD-2025-35892)
A vulnerability described as problematic has been identified in Realtek NDIS Usermode IO Driver. The affected element is an unknown function in the library RtkIOAC60.sys. Such manipulation leads to denial of service. This vulnerability is u
CVE-2025-60291 | eTimeTrackLite Web up to 12.0 permission
A vulnerability marked as critical has been reported in eTimeTrackLite Web up to 12.0. Affected is an unknown function. The manipulation leads to permission issues. This vulnerability is documented as CVE-2025-60291. The attack requires bei
CVE-2025-52263 | StarCharge Artemis AC Charger 7-22 kW 1.0.4 Web Configuration code download
A vulnerability was found in StarCharge Artemis AC Charger 7-22 kW 1.0.4. It has been declared as critical. This affects an unknown function of the component Web Configuration Module. Such manipulation leads to download of code without inte
CVE-2025-60563 | D-Link DIR600L 116WWb01 formSetPortTr curTime buffer overflow
A vulnerability was found in D-Link DIR600L 116WWb01 and classified as critical. Affected by this vulnerability is the function formSetPortTr. The manipulation of the argument curTime results in buffer overflow. This vulnerability is report
CVE-2025-60562 | D-Link DIR600L 116WWb01 formWlSiteSurvey curTime buffer overflow
A vulnerability has been found in D-Link DIR600L 116WWb01 and classified as critical. Affected is the function formWlSiteSurvey. The manipulation of the argument curTime leads to buffer overflow. This vulnerability is documented as CVE-2025
CVE-2025-60561 | D-Link DIR600L formSetEmail curTime buffer overflow
A vulnerability, which was classified as critical, was found in D-Link DIR600L. This impacts the function formSetEmail. Executing a manipulation of the argument curTime can lead to buffer overflow. This vulnerability is registered as CVE-20
CVE-2025-60559 | D-Link DIR600L 116WWb01 formSetDomainFilter curTime buffer overflow
A vulnerability, which was classified as critical, has been found in D-Link DIR600L 116WWb01. This affects the function formSetDomainFilter. Performing a manipulation of the argument curTime results in buffer overflow. This vulnerability is
CVE-2025-60558 | D-Link DIR600L 116WWb01 formVirtualServ curTime buffer overflow
A vulnerability, which was classified as critical, was found in D-Link DIR600L 116WWb01. Affected by this issue is the function formVirtualServ. The manipulation of the argument curTime results in buffer overflow. This vulnerability is cata
CVE-2025-60557 | D-Link DIR600L 116WWb01 formSetEasy_Wizard curTime buffer overflow
A vulnerability, which was classified as critical, has been found in D-Link DIR600L 116WWb01. Affected by this vulnerability is the function formSetEasy_Wizard. The manipulation of the argument curTime leads to buffer overflow. This vulnera
CVE-2025-60556 | D-Link DIR600L 116WWb01 formSetWizard1 curTime buffer overflow
A vulnerability classified as critical has been found in D-Link DIR600L 116WWb01. This impacts the function formSetWizard1. Performing a manipulation of the argument curTime results in buffer overflow. This vulnerability is identified as CV
CVE-2025-60555 | D-Link DIR600L 116WWb01 formSetWizardSelectMode curTime buffer overflow
A vulnerability categorized as critical has been discovered in D-Link DIR600L 116WWb01. The impacted element is the function formSetWizardSelectMode. The manipulation of the argument curTime results in buffer overflow. This vulnerability is
CVE-2025-60554 | D-Link DIR600L 116WWb01 formSetEnableWizard curTime buffer overflow
A vulnerability described as critical has been identified in D-Link DIR600L 116WWb01. This affects the function formSetEnableWizard. Such manipulation of the argument curTime leads to buffer overflow. This vulnerability is referenced as CVE