Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 785 | 0,2 % |
| ≥50 % | 3.572 | 0,9 % |
| ≥10 % | 23.058 | 5,6 % |
| <10 % | 380.696 | 93,3 % |
CVE-2025-61188 | JeecgBoot up to 3.8.2 /opt path traversal (Issue 8826)
A vulnerability described as critical has been identified in JeecgBoot up to 3.8.2. Affected is an unknown function of the file /opt. The manipulation results in path traversal. This vulnerability was named CVE-2025-61188. The attack needs
CVE-2025-57444 | Radware AlteonOS Web UI Management 33.0.4.50 Administrative Interface Description cross site scripting
A vulnerability, which was classified as problematic, has been found in Radware AlteonOS Web UI Management 33.0.4.50. Impacted is an unknown function of the component Administrative Interface. The manipulation of the argument Description le
CVE-2025-57443 | FrostWire 6.14.0 Build 326 Environment Variable DYLD_INSERT_LIBRARIES code injection
A vulnerability marked as critical has been reported in FrostWire 6.14.0 Build 326. This affects an unknown part of the component Environment Variable Handler. Performing a manipulation of the argument DYLD_INSERT_LIBRARIES results in code
CVE-2025-57389 | Luci OpenWRT 18.06.2 /admin/system/packages cross site scripting
A vulnerability categorized as problematic has been discovered in Luci OpenWRT 18.06.2. This impacts an unknown function of the file /admin/system/packages. Executing a manipulation can lead to cross site scripting. This vulnerability appea
CVE-2023-6121 | Linux Kernel TCP Subsystem fabrics-cmd.c out-of-bounds (EUVD-2023-58376 / Nessus ID 240010)
A vulnerability described as problematic has been identified in Linux Kernel. Affected by this issue is the function nvmet_execute_admin_connect/nvmet_execute_io_connect of the file drivers/nvme/target/fabrics-cmd.c of the component TCP Sub
Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a medium-severity security flaw impacting multiple Apple operating systems to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active
Hackers Launch 240,000 Exploit Attempts WordPress Core Flaw Enabling Remote Code Execution
Hackers have launched more than 240,000 exploit attempts against a WordPress Core vulnerability that can allow attackers to run malicious code without logging in. According to the supplied Wordfence report, attacks began on October 28, 2026
CVE-2026-107479 | Qt up to 4.x/6.8.8/6.11.2 QTextCodec QTextCodec conversion functions integer overflow (Nessus ID 376791)
A vulnerability marked as problematic has been reported in Qt up to 4.x/6.8.8/6.11.2. Affected by this vulnerability is the function QTextCodec conversion functions of the component QTextCodec. The manipulation leads to integer overflow. Th
CVE-2026-100302 | Apache ZooKeeper denial of service (Nessus ID 376792)
A vulnerability described as problematic has been identified in Apache ZooKeeper. Impacted is an unknown function. The manipulation results in denial of service. This vulnerability is reported as CVE-2026-100302. The attack can be launched
CVE-2026-108500 | Apache ActiveMQ LDAPAuthorizationMap authorization (Nessus ID 376793)
A vulnerability identified as critical has been detected in Apache ActiveMQ. Affected is an unknown function of the component LDAPAuthorizationMap. This manipulation causes authorization bypass. This vulnerability is registered as CVE-2026-
CVE-2025-61045 | TOTOLINK X18 9.1.0cu.2053_B20230309 setEasyMeshAgentCfg mac command injection (EUVD-2025-32018)
A vulnerability identified as critical has been detected in TOTOLINK X18 9.1.0cu.2053_B20230309. Affected by this issue is the function setEasyMeshAgentCfg. The manipulation of the argument mac leads to command injection. This vulnerability
CVE-2025-61044 | TOTOLINK X18 9.1.0cu.2053_B20230309 setEasyMeshAgentCfg agentName command injection (EUVD-2025-32015)
A vulnerability labeled as critical has been found in TOTOLINK X18 9.1.0cu.2053_B20230309. This affects the function setEasyMeshAgentCfg. The manipulation of the argument agentName results in command injection. This vulnerability was named
CVE-2025-60991 | Codazon Magento Themes up to 2.4.7 cat cross site scripting
A vulnerability identified as problematic has been detected in Codazon Magento Themes up to 2.4.7. Affected is an unknown function. The manipulation of the argument cat leads to cross site scripting. This vulnerability is traded as CVE-2025
CVE-2025-59687 | IMPAQTR Aurora up to 1.35 resource injection
A vulnerability, which was classified as problematic, has been found in IMPAQTR Aurora up to 1.35. The impacted element is an unknown function. The manipulation leads to improper control of resource identifiers. This vulnerability is listed
CVE-2025-59686 | Kazaar 1.25.12 documents order-id improper authorization (EUVD-2025-32727)
A vulnerability classified as critical has been found in Kazaar 1.25.12. Impacted is an unknown function of the file /api/v1/org-id/orders/order-id/documents. Performing a manipulation of the argument order-id results in improper authorizat
CVE-2025-57393 | Kissflow Work Platform Kissflow Application up to 4.2 cross site scripting
A vulnerability classified as problematic has been found in Kissflow Work Platform Kissflow Application up to 4.2. This vulnerability affects unknown code. Performing a manipulation results in cross site scripting. This vulnerability was na
CVE-2025-56588 | Dolibarr CRM 21.0.1 User computed field code injection
A vulnerability was found in Dolibarr CRM 21.0.1. It has been classified as critical. The affected element is an unknown function of the component User Module. This manipulation of the argument computed field causes code injection. This vul
CVE-2025-56515 | Fiora Chat Application up to 1.0.0 SVG File Parser cross site scripting
A vulnerability, which was classified as problematic, has been found in Fiora Chat Application up to 1.0.0. This issue affects some unknown processing of the component SVG File Parser. Performing a manipulation results in cross site scripti
CVE-2025-46205 | PoDoFo up to 0.10.5 PDF File Parser ReadDictionary denial of service (EUVD-2025-32700)
A vulnerability classified as problematic was found in PoDoFo up to 0.10.5. This issue affects the function PdfTokenizer::ReadDictionary of the component PDF File Parser. Executing a manipulation can lead to denial of service. The identific
CVE-2025-28357 | Neto CMS 6.313.x/6.314.0 HTTP Request crlf injection
A vulnerability was found in Neto CMS 6.313.x/6.314.0. It has been declared as problematic. Affected is an unknown function of the component HTTP Request Handler. Executing a manipulation can lead to crlf injection. This vulnerability is re
CVE-2026-122006 | Ruby on Rails Active Storage prior 8.0.5.2/8.1.4.1 Analyzer information disclosure (Nessus ID 376794)
A vulnerability, which was classified as problematic, has been found in Ruby on Rails Active Storage. The impacted element is an unknown function of the component Analyzer. The manipulation leads to information disclosure. This vulnerabilit
CVE-2026-122052 | laspy up to 2.7.0 LAS File laspy/lasreader.py memory allocation (Issue 378 / Nessus ID 376795)
A vulnerability was found in laspy up to 2.7.0. It has been classified as problematic. Affected by this issue is some unknown functionality of the file laspy/lasreader.py of the component LAS File Handler. The manipulation leads to uncontro
CVE-2026-121968 | quozl Netrek-client-cow up to 3.3.3 Message short.c handleSMessage m_recpt out-of-bounds (Nessus ID 376796)
A vulnerability was found in quozl Netrek-client-cow up to 3.3.3. It has been classified as problematic. Impacted is the function handleSMessage of the file short.c of the component Message Handler. Performing a manipulation of the argument
[NEU] [mittel] Moodle: Schwachstelle ermöglicht Offenlegung von Informationen
Ein Angreifer kann eine Schwachstelle in Moodle ausnutzen, um Informationen offenzulegen. Weiterlesen
[NEU] [hoch] Siemens SIMATIC IoT2050: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen und Ausführen von beliebigem Programmcode mit Administratorrechten
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Siemens SIMATIC IoT2050 Geräten ausnutzen, um Sicherheitsvorkehrungen zu umgehen und um beliebigen Programmcode mit Administratorrechten auszuführen. Weiterlesen
CVE-2025-59684 | DigiSign DigiSigner ONE 1.0.4.60 uncontrolled search path
A vulnerability marked as problematic has been reported in DigiSign DigiSigner ONE 1.0.4.60. This vulnerability affects unknown code. This manipulation causes uncontrolled search path. The identification of this vulnerability is CVE-2025-59
CVE-2025-57483 | tawk.to Chatbox Widget 4 cross site scripting
A vulnerability classified as problematic has been found in tawk.to Chatbox Widget 4. The affected element is an unknown function. The manipulation leads to cross site scripting. This vulnerability is referenced as CVE-2025-57483. Remote ex
CVE-2025-57275 | SPDK Storage Performance Development Kit 25.05 NVMe-oF Target buffer overflow
A vulnerability classified as critical was found in SPDK Storage Performance Development Kit 25.05. The affected element is an unknown function of the component NVMe-oF Target. Executing a manipulation can lead to buffer overflow. This vuln
CVE-2025-56449 | Obsidian Scheduler up to 6.3.0 REST API improper authentication (EUVD-2025-31578 / WID-SEC-2025-2158)
A vulnerability classified as critical was found in Obsidian Scheduler up to 6.3.0. This issue affects some unknown processing of the component REST API. Executing a manipulation can lead to improper authentication. This vulnerability is tr
CVE-2025-52042 | Frappe ERPNext 15.57.5 request_for_quotation.py get_rfq_containing_supplier txt sql injection
A vulnerability marked as critical has been reported in Frappe ERPNext 15.57.5. Affected by this vulnerability is the function get_rfq_containing_supplier of the file erpnext/buying/doctype/request_for_quotation/request_for_quotation.py. Th
CVE-2025-52041 | Frappe ERPNext 15.57.5 stock_reconciliation.py get_stock_balance_for inventory_dimensions_dict sql injection
A vulnerability classified as critical was found in Frappe ERPNext 15.57.5. This vulnerability affects the function get_stock_balance_for of the file erpnext/stock/doctype/stock_reconciliation/stock_reconciliation.py. Such manipulation of t
CVE-2025-52040 | Frappe ERPNext 15.57.5 queries.py get_blanket_orders blanket_order_type sql injection
A vulnerability described as critical has been identified in Frappe ERPNext 15.57.5. Affected by this issue is the function get_blanket_orders of the file erpnext/controllers/queries.py. The manipulation of the argument blanket_order_type r
CVE-2025-52039 | Frappe ERPNext 15.57.5 material_request.py get_material_requests_based_on_supplier txt sql injection
A vulnerability classified as critical has been found in Frappe ERPNext 15.57.5. This affects the function get_material_requests_based_on_supplier of the file erpnext/stock/doctype/material_request/material_request.py. This manipulation of
CVE-2025-39916 | Linux Kernel up to fd3e613a912bbb344ee18579cc2ad3329aacba41 damon_reclaim_apply_parameters divide by zero (EUVD-2025-31835 / Nessus ID 269681)
A vulnerability identified as critical has been detected in Linux Kernel up to 6.1.152/6.6.106/6.12.47/6.16.7/fd3e613a912bbb344ee18579cc2ad3329aacba41. This impacts the function damon_reclaim_apply_parameters. The manipulation leads to divi
CVE-2025-39891 | Linux Kernel up to 6.16.5 mwifiex_init_channel_scan_gap privilege escalation (Nessus ID 274583 / WID-SEC-2025-2170)
A vulnerability has been found in Linux Kernel up to 6.16.5 and classified as problematic. Affected by this vulnerability is the function mwifiex_init_channel_scan_gap. Performing a manipulation results in privilege escalation. This vulnera
Node2Shell Sicherheitslücke: CVE-2026-111497 [2026] - shattered.io
Das belgische Zentrum für Cybersicherheit CCB warnte in einem Advisory vor mehreren Node.js-Lücken und forderte sofortiges Patchen. Eine eigene ... Weiterlesen
CVE-2026-119178 | shark986 Smart Cookie Kit Plugin up to 2.3.2 on WordPress comment cross site scripting (EUVD-2026-118197)
A vulnerability, which was classified as problematic, has been found in shark986 Smart Cookie Kit Plugin up to 2.3.2 on WordPress. Impacted is an unknown function. This manipulation of the argument Comment causes cross site scripting. This
CVE-2026-107658 | themekraft BuddyForms Plugin up to 2.10.5 on WordPress Customize Changeset bf_post_type/buddyforms_form_content cross site scripting (EUVD-2026-118198)
A vulnerability has been found in themekraft BuddyForms Plugin up to 2.10.5 on WordPress and classified as problematic. The impacted element is an unknown function of the component Customize Changeset. Performing a manipulation of the argum
CVE-2026-120035 | meIsle RSS Aggregator Plugin up to 5.2.13 on WordPress item_title cross site scripting (EUVD-2026-118199)
A vulnerability was found in meIsle RSS Aggregator Plugin up to 5.2.13 on WordPress. It has been declared as problematic. Affected is an unknown function. The manipulation of the argument item_title results in cross site scripting. This vul
CVE-2026-103908 | mohammed_kaludi AMP for WP Plugin up to 1.1.18 on WordPress Shortcode Execution do_shortcode ampforwp-cat-description code injection (EUVD-2026-118200)
A vulnerability described as critical has been identified in mohammed_kaludi AMP for WP Plugin up to 1.1.18 on WordPress. This affects the function do_shortcode of the component Shortcode Execution. Executing a manipulation of the argument
CVE-2026-103002 | GPUStack up to 2.2.1 cluster_apiserver_proxy privileges management (EUVD-2026-117177)
A vulnerability labeled as very critical has been found in GPUStack up to 2.2.1. This affects an unknown function of the component cluster_apiserver_proxy. Such manipulation leads to improper privilege management. This vulnerability is uniq
CVE-2026-102894 | GPUStack up to 2.2.1 SAML Callback authentication replay (EUVD-2026-117125)
A vulnerability identified as critical has been detected in GPUStack up to 2.2.1. The impacted element is an unknown function of the component SAML Callback. This manipulation causes authentication bypass by capture-replay. This vulnerabili
CVE-2026-85627 | Apache OFBiz up to 24.09.7 Template Engine special elements in template engine (EUVD-2026-117467)
A vulnerability marked as critical has been reported in Apache OFBiz up to 24.09.7. The impacted element is an unknown function of the component Template Engine. This manipulation causes improper neutralization of special elements used in a
CVE-2022-4138 | GitLab Community Edition/Enterprise Edition Project cross-site request forgery (Issue 383709 / EUVD-2022-51500)
A vulnerability was found in GitLab Community Edition and Enterprise Edition. It has been rated as problematic. Affected by this vulnerability is an unknown functionality of the component Project Handler. The manipulation leads to cross-sit
CVE-2022-4136 | qmpaas leadshop routine (EUVD-2022-51499)
A vulnerability described as problematic has been identified in qmpaas leadshop. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to exposed dangerous routine. The identification of this vulnerab
CVE-2022-4131 | GitLab Community Edition/Enterprise Edition up to 15.5.6/15.6.3/15.7.1 User-Agent Parser denial of service (Issue 383598 / EUVD-2022-51496)
A vulnerability, which was classified as problematic, was found in GitLab Community Edition and Enterprise Edition up to 15.5.6/15.6.3/15.7.1. Affected is an unknown function of the component User-Agent Parser. The manipulation results in d
CVE-2025-59362 | Squid Web Proxy up to 7.1 lib/snmplib/asn1.c asn_build_objid encoding error (EUVD-2025-31363 / Nessus ID 266118)
A vulnerability was found in Squid Web Proxy up to 7.1 and classified as problematic. The affected element is the function asn_build_objid in the library lib/snmplib/asn1.c. Executing a manipulation can lead to encoding error. The identific
CVE-2025-58385 | DOXENSE WATCHDOC prior 6.1.0.5094 Active Directory hard-coded credentials
A vulnerability described as critical has been identified in DOXENSE WATCHDOC. Affected by this vulnerability is an unknown functionality of the component Active Directory Handler. Executing a manipulation can lead to hard-coded credentials
CVE-2025-57428 | Each Italy Wireless Mini Router WIRELESS-N 300M 20190211 Telnet Service default credentials (EUVD-2025-31573)
A vulnerability marked as critical has been reported in Each Italy Wireless Mini Router WIRELESS-N 300M 20190211. Affected by this issue is some unknown functionality of the component Telnet Service. This manipulation causes use of default
CVE-2025-57292 | Todoist 8484 Avatar cross site scripting
A vulnerability was found in Todoist 8484. It has been rated as problematic. This impacts an unknown function of the component Avatar Handler. This manipulation causes cross site scripting. This vulnerability is tracked as CVE-2025-57292. T
CVE-2025-56463 | Mercusys MW305R up to 3.30 TLS certificate validation
A vulnerability has been found in Mercusys MW305R up to 3.30 and classified as critical. Impacted is an unknown function of the component TLS Handler. Performing a manipulation results in improper certificate validation. This vulnerability
CVE-2025-52970 | Fortinet FortiWeb up to 7.0.10/7.2.10/7.4.7/7.6.3 parameters (FG-IR-25-448 / WID-SEC-2025-1805)
A vulnerability categorized as critical has been discovered in Fortinet FortiWeb up to 7.0.10/7.2.10/7.4.7/7.6.3. Affected by this issue is some unknown functionality. The manipulation results in improper handling of parameters. This vulner
CVE-2022-4130 | Red Hat Satellite HTTP Header Referer server-side request forgery (EUVD-2022-51495)
A vulnerability was found in Red Hat Satellite. It has been rated as critical. The impacted element is an unknown function of the component HTTP Header Handler. Performing a manipulation of the argument Referer results in server-side reques
CVE-2022-4129 | Linux Kernel L2TP net/l2tp/l2tp_core.c sk_user_data null pointer dereference (FEDORA-2022-24041b1667 / EUVD-2022-51494)
A vulnerability, which was classified as problematic, has been found in Linux Kernel. This vulnerability affects the function sk_user_data of the file net/l2tp/l2tp_core.c of the component L2TP Handler. The manipulation leads to null pointe
CVE-2022-4128 | Linux Kernel MPTCP Protocol null pointer dereference (EUVD-2022-51493)
A vulnerability described as problematic has been identified in Linux Kernel. Affected by this vulnerability is an unknown functionality of the component MPTCP Protocol Handler. Such manipulation leads to null pointer dereference. This vuln
USN-9003-1: Linux kernel (NVIDIA) vulnerabilities
It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds con
USN-9002-1: Linux kernel (NVIDIA Tegra) vulnerabilities
It was discovered that the io_uring subsystem in the Linux kernel did not properly handle canceled task work when processing certain wait operations, leading to the operation being performed in the wrong task context. A local attacker could
CVE-2026-75029 | ISC BIND up to 9.21.25 resource consumption (Nessus ID 362910 / WID-SEC-2026-3420)
A vulnerability, which was classified as critical, has been found in ISC BIND up to 9.18.50/9.18.50-S1/9.20.27/9.20.27-S1/9.21.25. This issue affects some unknown processing. The manipulation leads to resource consumption. This vulnerabilit
CVE-2026-19941 | ISC BIND up to 9.20.27-S1 named input validation (Nessus ID 362910 / WID-SEC-2026-3420)
A vulnerability classified as problematic has been found in ISC BIND up to 9.18.50/9.20.27/9.21.25/9.18.50-S1/9.20.27-S1. This issue affects some unknown processing of the component named. Performing a manipulation results in improper input
CVE-2026-19668 | ISC BIND up to 9.18.50/9.20.27/9.21.25 Recursive Resolver resource consumption (Nessus ID 362910 / WID-SEC-2026-3420)
A vulnerability identified as critical has been detected in ISC BIND up to 9.18.50/9.20.27/9.21.25. This impacts an unknown function of the component Recursive Resolver. The manipulation leads to resource consumption. This vulnerability is