Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 785 | 0,2 % |
| ≥50 % | 3.559 | 0,9 % |
| ≥10 % | 13.140 | 3,2 % |
| <10 % | 396.071 | 95,8 % |
CVE-2025-63601 | Snipe-IT up to 8.3.2 Backup File unrestricted upload (EUVD-2025-37899)
A vulnerability was found in Snipe-IT up to 8.3.2. It has been classified as critical. This affects an unknown function of the component Backup File Handler. This manipulation causes unrestricted upload. This vulnerability appears as CVE-20
CVE-2025-61304 | Dynatrace ActiveGate Ping Extension up to 1.016 IP Address os command injection
A vulnerability, which was classified as critical, has been found in Dynatrace ActiveGate Ping Extension up to 1.016. The impacted element is an unknown function of the component IP Address Handler. The manipulation leads to os command inje
CVE-2025-59716 | ownCloud Guests up to 0.12.4 Mail Address /apps/guests/register/ showPasswordForm response discrepancy (EUVD-2025-37881)
A vulnerability, which was classified as problematic, was found in ownCloud Guests up to 0.12.4. Affected by this vulnerability is the function showPasswordForm of the file /apps/guests/register/ of the component Mail Address Handler. Such
CVE-2025-54327 | Samsung Processor and Wearable Processor Exynos 1280/1380/2200 VTS input validation
A vulnerability was found in Samsung Processor and Wearable Processor Exynos 1280/1380/2200. It has been rated as critical. This vulnerability affects unknown code of the component VTS. Performing a manipulation results in improper input va
CVE-2025-27374 | Samsung Mobile Processor/Wearable Processor Exynos up to 9825 Secure Boot out-of-bounds write
A vulnerability, which was classified as critical, has been found in Samsung Mobile Processor and Wearable Processor Exynos up to 9825. The affected element is an unknown function of the component Secure Boot Component. Performing a manipul
Linux: Lange Passwörter öffnen gesperrte Konten
Über CVE-2026-123158 akzeptiert OpenSSH auf Alpine Linux ohne PAM jedes Passwort mit 257 bis 1.024 Zeichen. OpenSSH 10.6p2 und Alpine-Updates beheben das. Eine Schwachstelle in OpenSSH auf Linux-Systemen mit der C-Bibliothek musl erlaubt An
CVE-2024-8528 | Automated Logic WebCTRL up to 9.0 GET Parameter cross site scripting
A vulnerability classified as problematic was found in Automated Logic WebCTRL up to 9.0. This affects an unknown function of the component GET Parameter Handler. The manipulation results in cross site scripting. This vulnerability is catal
CVE-2024-8527 | Automated Logic WebCTRL up to 9.0 URL Parameter redirect
A vulnerability described as problematic has been identified in Automated Logic WebCTRL up to 9.0. The affected element is an unknown function of the component URL Parameter. Executing a manipulation can lead to open redirect. This vulnerab
CVE-2024-5539 | Automated Logic WebCTRL up to 8.5 authorization (EUVD-2024-55103 / CNNVD-202511-2982)
A vulnerability classified as problematic has been found in Automated Logic WebCTRL up to 8.5. Affected by this issue is some unknown functionality. Performing a manipulation results in incorrect authorization. This vulnerability is known a
CVE-2024-47856 | RSA Authentication Agent up to 7.4.6 unquoted search path
A vulnerability was found in RSA Authentication Agent up to 7.4.6. It has been declared as problematic. This impacts an unknown function. Executing a manipulation can lead to unquoted search path. This vulnerability is registered as CVE-202
CVE-2024-46335 | PHPGurukul Complaint Management System 2.0 between-date-userreport.php fromdate/todate cross site scripting
A vulnerability categorized as problematic has been discovered in PHPGurukul Complaint Management System 2.0. The affected element is an unknown function of the file between-date-userreport.php. Such manipulation of the argument fromdate/to
CVE-2024-44664 | PHPGurukul Online Shopping Portal 2.0 product-details.php name/summary/review/quality/price/value sql injection
A vulnerability classified as critical was found in PHPGurukul Online Shopping Portal 2.0. This impacts an unknown function of the file product-details.php. The manipulation of the argument name/summary/review/quality/price/value results in
CVE-2024-44663 | PHPGurukul Online Shopping Portal 2.0 search-result.php product sql injection
A vulnerability described as critical has been identified in PHPGurukul Online Shopping Portal 2.0. The impacted element is an unknown function of the file search-result.php. Executing a manipulation of the argument Product can lead to sql
CVE-2024-44661 | PHPGurukul Online Shopping Portal 2.0 my-cart.php quantity cross site scripting
A vulnerability identified as problematic has been detected in PHPGurukul Online Shopping Portal 2.0. The impacted element is an unknown function of the file my-cart.php. Performing a manipulation of the argument quantity results in cross s
CVE-2024-44660 | PHPGurukul Online Shopping Portal 2.0 login.php fullname/emailid/contactno sql injection
A vulnerability identified as critical has been detected in PHPGurukul Online Shopping Portal 2.0. This issue affects some unknown processing of the file login.php. This manipulation of the argument fullname/emailid/contactno causes sql inj
CVE-2024-44658 | PHPGurukul Complaint Management System 2.0 subcategory.php subcategory/category sql injection
A vulnerability marked as critical has been reported in PHPGurukul Complaint Management System 2.0. The affected element is an unknown function of the file subcategory.php. Performing a manipulation of the argument subcategory/category resu
CVE-2026-77063 | expressjs multer up to 2.2.x File Stream race condition (Nessus ID 377477)
A vulnerability was found in expressjs multer up to 2.2.x and classified as problematic. Affected by this vulnerability is an unknown functionality of the component File Stream Handler. Executing a manipulation can lead to race condition. T
CVE-2026-112910 | tox-dev filelock up to 4.2.0 WindowsFileLock src/filelock/_windows.py _open_non_reparse_fd mode permission assignment (Nessus ID 377478)
A vulnerability described as problematic has been identified in tox-dev filelock up to 4.2.0. This vulnerability affects the function _open_non_reparse_fd of the file src/filelock/_windows.py of the component WindowsFileLock. The manipulati
CVE-2026-123976 | Teunis van Beelen EDFbrowser up to 2.15 check_edf_file out-of-bounds write (Nessus ID 377480)
A vulnerability was found in Teunis van Beelen EDFbrowser up to 2.15. It has been declared as problematic. This affects the function check_edf_file. The manipulation results in out-of-bounds write. This vulnerability is known as CVE-2026-12
CVE-2026-122330 | Blosc c-blosc2 up to 3.4.x Chunk blosc/schunk.c blosc2_schunk_get_slice_buffer divide by zero (Nessus ID 377479)
A vulnerability marked as problematic has been reported in Blosc c-blosc2 up to 3.4.x. Impacted is the function blosc2_schunk_get_slice_buffer of the file blosc/schunk.c of the component Chunk Handler. This manipulation causes divide by zer
CVE-2026-123119 | Sensiolabs Symfony up to 5.4.55/6.4.49/7.4.22/8.1.10 HttpClient NoPrivateNetworkHttpClient dns rebinding (Nessus ID 377481)
A vulnerability classified as problematic was found in Sensiolabs Symfony up to 5.4.55/6.4.49/7.4.22/8.1.10. This issue affects the function NoPrivateNetworkHttpClient of the component HttpClient. The manipulation results in reliance on rev
CVE-2023-34969 | Freedesktop D-Bus up to 1.12.27/1.14.7/1.15.5 Monitor Message denial of service (Issue 457 / Nessus ID 377482)
A vulnerability was found in Freedesktop D-Bus up to 1.12.27/1.14.7/1.15.5 and classified as problematic. Impacted is an unknown function of the component Monitor Message Handler. The manipulation results in denial of service. This vulnerab
CVE-2026-120749 | Red Hat Enterprise Linux/Hardened Images denial of service (Nessus ID 377482)
A vulnerability identified as critical has been detected in Red Hat Enterprise Linux and Hardened Images. Impacted is an unknown function. This manipulation causes denial of service. This vulnerability is registered as CVE-2026-120749. The
CVE-2026-123785 | Fluxbox up to 1.3.7 Menu Update src/FbTk/Menu.cc Menu::updateMenu infinite loop (Nessus ID 377483)
A vulnerability identified as problematic has been detected in Fluxbox up to 1.3.7. The affected element is the function Menu::updateMenu of the file src/FbTk/Menu.cc of the component Menu Update. This manipulation causes infinite loop. Thi
CVE-2026-124584 | wummel patool 4.1.0 Gzip Extraction patoolib/fileutil.py extract_gzip symlink (GHSA-p24m-wf3f-3mf5)
A vulnerability, which was classified as critical, has been found in wummel patool 4.1.0. This vulnerability affects the function extract_gzip of the file patoolib/fileutil.py of the component Gzip Extraction Handler. The manipulation leads
Hackers Exploit SonicWall SonicOS Vulnerability to Bypass SAML Authentication
SonicWall has warned that an authentication enforcement flaw in SonicOS SSLVPN could let attackers bypass SAML authentication and associated multifactor authentication protections. Tracked as CVE-2026-19868, the issue affects deployments th
CVE-2026-82830 | IBM Guardium Data Protection 12.2.4 neutralization (EUVD-2026-119729)
A vulnerability marked as very critical has been reported in IBM Guardium Data Protection 12.2.4. The impacted element is an unknown function. The manipulation leads to improper neutralization. This vulnerability is traded as CVE-2026-82830
CVE-2026-8639 | IBM Security Verify Directory up to 10.0.4/11.0.0 session fixiation (EUVD-2026-119734)
A vulnerability categorized as very critical has been discovered in IBM Security Verify Directory up to 10.0.4/11.0.0. This issue affects some unknown processing. Such manipulation leads to session fixiation. This vulnerability is documente
CVE-2026-124568 | fushengqian fuintCatering up to 6d054f5788ac8645eb491f79242bb8a625efc133 Refund Agreement RefundServiceImpl.agreeRefund access control (EUVD-2026-119809)
A vulnerability was found in fushengqian fuintCatering up to 6d054f5788ac8645eb491f79242bb8a625efc133. It has been classified as problematic. Impacted is the function RefundServiceImpl.agreeRefund of the component Refund Agreement. The mani
CVE-2026-124569 | fushengqian fuintCatering up to 6d054f5788ac8645eb491f79242bb8a625efc133 CommissionCashServiceImpl.java updateCommissionCash status access control (EUVD-2026-119810)
A vulnerability was found in fushengqian fuintCatering up to 6d054f5788ac8645eb491f79242bb8a625efc133. It has been declared as problematic. The affected element is the function updateCommissionCash of the file CommissionCashServiceImpl.java
CVE-2026-124570 | SourceCodester Online Leave Management System 1.0 Employee Avatar Upload Extension app/classes/Master.php employee avatar filename cross site scripting (EUVD-2026-119811)
A vulnerability was found in SourceCodester Online Leave Management System 1.0. It has been rated as problematic. Affected is an unknown function of the file app/classes/Master.php of the component Employee Avatar Upload Extension. Performi
CVE-2025-54334 | Samsung Mobile Processor Exynos up to 2500 NPU Driver __npu_vertex_bootup null pointer dereference
A vulnerability classified as problematic has been found in Samsung Mobile Processor Exynos up to 2500. The affected element is the function __npu_vertex_bootup of the component NPU Driver. This manipulation causes null pointer dereference.
CVE-2025-54329 | Samsung Modem Exynos/Modem up to 5400 NAS heap-based overflow
A vulnerability identified as critical has been detected in Samsung Modem Exynos and Modem up to 5400. This affects an unknown part of the component NAS. Performing a manipulation results in heap-based buffer overflow. This vulnerability is
CVE-2025-54325 | Samsung Processor and Wearable Processor Exynos up to 2500 VTS Driver Results out-of-bounds
A vulnerability marked as problematic has been reported in Samsung Processor and Wearable Processor Exynos up to 2500. This issue affects some unknown processing of the component VTS Driver Results. The manipulation leads to out-of-bounds r
CVE-2025-54323 | Samsung Mobile Processor Exynos up to 2400 camera information disclosure
A vulnerability labeled as problematic has been found in Samsung Mobile Processor Exynos up to 2400. This vulnerability affects unknown code of the component camera. Executing a manipulation can lead to information disclosure. This vulnerab
CVE-2025-52513 | Samsung Mobile Processor Exynos 1580/2400/2500 HTS Driver Results out-of-bounds write
A vulnerability, which was classified as critical, has been found in Samsung Mobile Processor Exynos 1580/2400/2500. Affected by this vulnerability is an unknown functionality of the component HTS Driver Results. The manipulation leads to o
CVE-2025-52512 | Samsung Mobile Processor Exynos 1580/2400/2500 HTS Driver Results denial of service
A vulnerability, which was classified as problematic, was found in Samsung Mobile Processor Exynos 1580/2400/2500. Affected by this issue is some unknown functionality of the component HTS Driver Results. The manipulation results in denial
Node-RED Sicherheitslücke CVE-2026-58115: CVSS 10,0 [2026] - Tech Insider
Node-RED CVE-2026-58115: CVSS 10,0, Fix seit 11.8. [2026]. Elias Virtanen; November 9, 2026; Cybersicherheit. Weiterlesen
Sophos Firewall: Hotfix für Schwachstelle (CVE-2026-98432)
Auch die Firewalls von Sophos sind von der kritischen Schwachstelle CVE-2026-98432 im Linux-Kernel betroffen. Über diese kritische (CVSS Score of 9.8) Schwachstelle im Linux Kernel IPv4 TCP-Networking Stack hatte ich berichtet. Sophos hat E
CVE-2026-18836 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinations and return the response to the attacker.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended des
CVE-2026-18689 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accepted where it should not be, which could reveal the names of other organizations.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accep
CVE-2026-17428 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization decisions without sufficient verification, which could allow access to information belonging to others.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization
CVE-2026-17411 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized before it is used in database queries.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized befo
CVE-2026-17410 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.
CVE-2026-17409 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of a request, which could allow restricted operations to be reached.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access c
CVE-2026-17408 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.
CVE-2026-17407 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before being used in a database query, which could allow SQL commands to run.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before
CVE-2026-17406 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Address checks can be bypassed, which could allow the server to reach destinations that should be blocked.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Address checks can be bypassed, which could allow the s
CVE-2026-17405 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm that the requesting user is permitted to read them, which could expose keystore information.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm
CVE-2026-17404 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17403 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.
CVE-2026-17402 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is passed to the operating system, which could allow commands to run on the underlying host.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is pas
CVE-2026-17401 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.
CVE-2026-17400 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
CVE-2026-17399 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to insufficient validation of uploaded content. Content uploaded to the product is not sufficiently checked before it is processed, which could allow code to run on the server.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to insufficient validation of uploaded content. Content uploaded to the product is not suffic
CVE-2026-17398 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17397 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17396 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
CVE-2026-17395 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access internal network resources due to improper validation of a user-supplied URL. Destinations are not sufficiently restricted, which could allow the server to be made to contact internal systems.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access internal network resources due to improper validation of a user-supplied URL. Destinations are not sufficiently r
CVE-2026-17394 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improperly controlled modification of object attributes. A user-supplied value could change an access-related setting that should be controlled by the system, which could expose sensitive information.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improperly controlled modification of object attributes. A user-supplied value could