CVE & Security Advisory Radar

Tier	CVEs	Anteil
≥90 %	786	0,2 %
≥50 %	3.572	0,9 %
≥10 %	23.059	5,7 %
<10 %	380.694	93,3 %

Tier

CVEs

Anteil

≥90 %

786

0,2 %

≥50 %

3.572

0,9 %

≥10 %

23.059

5,7 %

<10 %

380.694

93,3 %

5.3 MEDIUM

EPSS

0.2%

CVE-2026-116815 🌐 Netzwerk (Remote) 🔑 Geringe Nutzerrechte nötig

Openpanel-dev

CVE-2026-116815 | OpenPanel before 3.0.0 contains an improper escaping vulnerability in sankey.service.ts that allows authenticated project members to break ClickHouse string literals by supplying backslashes in event names. Attackers with read access can submit crafted events[].name values to the chart.sankey procedure, causing ClickHouse parse errors that disable the project's Sankey chart endpoint.

OpenPanel before 3.0.0 contains an improper escaping vulnerability in sankey.service.ts that allows authenticated project members to break ClickHouse string literals by supplying backslashes in event names. Attackers with read access can su

CWE-116 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

vor 10 Tagen

🛡️ Details ➔

4.7 MEDIUM

EPSS

0.2%

CVE-2026-116582 🌐 Netzwerk (Remote) 🔓 Keine Authentifizierung nötig

lxsmnsyc

CVE-2026-116582 | Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.0.0 and from 1.5.5 until 1.6.10, the JavaScript-output APIs serialize a RegExp source containing a less-than character without the escaping needed for an HTML script element. An application is affected when it builds regular expression syntax from untrusted input, serializes that RegExp through serialize, serializeAsync, crossSeri

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.0.0 and from 1.5.5 until 1.6.10, the JavaScript-output APIs serialize a RegExp source containing a less-than c

CWE-116 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

vor 10 Tagen

🛡️ Details ➔

5.3 MEDIUM

EPSS

0.3%

CVE-2026-55442 🌐 Netzwerk (Remote) 🔓 Keine Authentifizierung nötig

intranda

CVE-2026-55442 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 23.03 to before version 26.05, SolrTools.cleanUpQuery() strips Solr local-parameter syntax ({!...}) from user-supplied query strings before they reach Solr. Its regex can be bypassed by wrapping the local parameter in a second pair of curly braces ({{!...}}): the outer braces are stripped, the inner {!...} survives intact, and a valid Solr local

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 23.03 to before version 26.05, SolrTools.cleanUpQuery() strips Solr local-parameter syntax ({!...}) from user-supplied query

CWE-116 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

vor 13 Tagen

🛡️ Details ➔

7.0 HIGH

EPSS

0.3%

CVE-2026-57210 🌐 Netzwerk (Remote) 🔓 Keine Authentifizierung nötig

dadrus

CVE-2026-57210 | Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when the trusted_proxies option is configured, heimdall extracts client IP addresses from the Forwarded (for= parameter) and X-Forwarded-For headers and exposes them as Request.ClientIPAddresses to the rule pipeline. However, extracted values are not validated to be syntactically valid IP addresses. Arbitrary strings, malformed IP literals, and RFC 7

Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when the trusted_proxies option is configured, heimdall extracts client IP addresses from the Forwarded (for= parameter) and X-Fo

CWE-116 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

vor 13 Tagen

🛡️ Details ➔

Zero-Day & Vulnerability Intelligence Hub