Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 753 | 0,2 % |
| ≥50 % | 3.308 | 0,9 % |
| ≥10 % | 22.038 | 5,7 % |
| <10 % | 360.707 | 93,3 % |
CVE-2026-99094 | Linux Kernel up to 6.12.112/6.18.56/7.2.10 btintel_pcie btintel_pcie_prepare_tx memory corruption
A vulnerability classified as very critical has been found in Linux Kernel up to 6.12.112/6.18.56/7.2.10. Affected by this vulnerability is the function btintel_pcie_prepare_tx of the component btintel_pcie. This manipulation causes memory
CVE-2026-116340 | iFlytek astron-agent up to 1.1.2 Console Knowledge-List Endpoint FileInfoV2Service.java FileInfoV2Service.listKnowledgeByPage space-id authorization
A vulnerability classified as problematic was found in iFlytek astron-agent up to 1.1.2. This impacts the function FileInfoV2Service.listKnowledgeByPage of the file FileInfoV2Service.java of the component Console Knowledge-List Endpoint. Su
CVE-2026-116283 | Kameleo up to 5.0.1.26 Local API /profiles information disclosure
A vulnerability was found in Kameleo up to 5.0.1.26. It has been rated as problematic. This affects an unknown part of the file /profiles of the component Local API. This manipulation causes information disclosure. This vulnerability is tra
CVE-2026-116257 | BillaBear up to 2025.01.03 Installation InstallController.php processInstall missing authentication
A vulnerability identified as critical has been detected in BillaBear up to 2025.01.03. Affected by this issue is the function processInstall of the file src/BillaBear/Controller/InstallController.php of the component Installation Handler.
CVE-2026-116254 | rathena FluxCP up to 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d PayPal IPN PaymentNotifyRequest.php verifyiprange X-Real-IP origin validation
A vulnerability, which was classified as critical, has been found in rathena FluxCP up to 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d. This issue affects the function verifyiprange of the file lib/Flux/PaymentNotifyRequest.php of the component
CVE-2026-116236 | Oray Pugongying X5 Pro 7.6.1 PPPoE WAN Setting /tmp/upload_files plugin_init pppd_options unrestricted upload
A vulnerability described as critical has been identified in Oray Pugongying X5 Pro 7.6.1. Affected by this issue is the function plugin_init of the file /tmp/upload_files of the component PPPoE WAN Setting Handler. Such manipulation of the
CVE-2026-116233 | Oray Pugongying X5 Pro 7.6.1 Dnsmasq rent_time crlf injection
A vulnerability identified as very critical has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the component Dnsmasq. The manipulation of the argument rent_time leads to crlf injection. This vulnerability
CVE-2026-116227 | Edimax BR-6208AC 1.32 Virtual Server Page cross site scripting
A vulnerability has been found in Edimax BR-6208AC 1.32 and classified as problematic. This vulnerability affects unknown code of the component Virtual Server Page. The manipulation leads to cross site scripting. This vulnerability is refer
CVE-2026-116563 | NextGEN Gallery Plugin up to 4.5.4 on WordPress Output Escaping comment cross site scripting (EUVD-2026-114573)
A vulnerability was found in NextGEN Gallery Plugin up to 4.5.4 on WordPress. It has been rated as problematic. This impacts an unknown function of the component Output Escaping. Performing a manipulation of the argument Comment results in
CVE-2026-109997 | kstover Ninja Forms Plugin up to 3.15.5 on WordPress Input Sanitization nf_ajax_submit formData.extra cross site scripting (EUVD-2026-114576)
A vulnerability has been found in kstover Ninja Forms Plugin up to 3.15.5 on WordPress and classified as problematic. Impacted is the function nf_ajax_submit of the component Input Sanitization. The manipulation of the argument formData.ext
CVE-2026-109234 | tigroumeow Meow Lightbox Plugin up to 5.6.4 on WordPress post_content cross site scripting (EUVD-2026-114574)
A vulnerability was found in tigroumeow Meow Lightbox Plugin up to 5.6.4 on WordPress and classified as problematic. The affected element is an unknown function. The manipulation of the argument post_content results in cross site scripting.
CVE-2026-116520 | buildwps PPWP Plugin up to 1.9.26 on WordPress Shortcode desc_below_form cross site scripting (EUVD-2026-114579)
A vulnerability was found in buildwps PPWP Plugin up to 1.9.26 on WordPress. It has been declared as problematic. This affects an unknown function of the component Shortcode. Such manipulation of the argument desc_below_form leads to cross
CVE-2026-111254 | Boldgrid W3 Total Cache Plugin up to 2.10.7 on WordPress comment cross site scripting (EUVD-2026-114591)
A vulnerability marked as problematic has been reported in Boldgrid W3 Total Cache Plugin up to 2.10.7 on WordPress. This affects an unknown function. The manipulation of the argument Comment leads to cross site scripting. This vulnerabilit
CVE-2026-111109 | pfefferle Webmention Plugin up to 5.10.1 on WordPress Webmention Processing Receiver::process cross site scripting (EUVD-2026-114592)
A vulnerability classified as problematic has been found in pfefferle Webmention Plugin up to 5.10.1 on WordPress. Affected is the function Receiver::process of the component Webmention Processing. This manipulation causes cross site script
CVE-2026-120240 | WAVLINK WN553X1-B V260403_2.0.0 WireGuard CLI Group /bin/ioos sub_41A748 group_id/group_name os command injection (EUVD-2026-114882)
A vulnerability categorized as very critical has been discovered in WAVLINK WN553X1-B V260403_2.0.0. This issue affects the function sub_41A748 of the file /bin/ioos of the component WireGuard CLI Group Handler. Executing a manipulation of
CVE-2026-120238 | WAVLINK WN553X1-B 260403_2.0.0 ovpn_file /bin/ioos sub_4162A8 file_id os command injection (EUVD-2026-114880)
A vulnerability was found in WAVLINK WN553X1-B 260403_2.0.0. It has been declared as very critical. This affects the function sub_4162A8 of the file /bin/ioos of the component ovpn_file Handler. Such manipulation of the argument file_id lea
CVE-2026-107653 | SureCart Plugin up to 4.9.4 on WordPress Buy Button Block comment cross site scripting (EUVD-2026-114596)
A vulnerability was found in SureCart Plugin up to 4.9.4 on WordPress and classified as problematic. This issue affects some unknown processing of the component Buy Button Block. The manipulation of the argument Comment results in cross sit
CVE-2026-120239 | WAVLINK WN553X1-B V260403_2.0.0 WireGuard CLI /bin/ioos sub_419DA8 file_id os command injection (EUVD-2026-114881)
A vulnerability was found in WAVLINK WN553X1-B V260403_2.0.0. It has been rated as very critical. This vulnerability affects the function sub_419DA8 of the file /bin/ioos of the component WireGuard CLI Handler. Performing a manipulation of
CVE-2026-120241 | Ruijie RG-ES205GC ESW_1.0(1)B1P48 Local Firmware Upgrade Interface httpupg.cgi buffer overflow (EUVD-2026-114883)
A vulnerability identified as critical has been detected in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P ESW_1.0(1)B1P48. Impacted is an unknown function of the file httpupg.cgi of the component Local Firmware
GitLab's Critical CVSS 10.0 Wake-Up Call: Is Your CI/CD Pipeline Secure?
The Alpine Linux incident reveals why patching GitLab is not enough—and what every business should do to protect its software supply chain. A critical vulnerability can turn a trusted development platform into an attacker's entry point
CVE-2026-105483 remediation checklist for Node.js teams
CVE-2026-105483 remediation checklist for Node.js teams The fastest accurate response to CVE-2026-105483 starts with the runtime version and ends with evidence that the deployed client rejects the wrong certificate identity. The bug affects
CVE-2026-109782 | Mozilla Firefox up to 153.4 File unnecessary privileges (Nessus ID 374794)
A vulnerability, which was classified as critical, has been found in Mozilla Firefox up to 153.4. The affected element is an unknown function of the component File Handler. Performing a manipulation results in execution with unnecessary pri
CVE-2026-109745 | Mozilla Firefox up to 153.4/157 Web Serial uninitialized pointer (Nessus ID 374794)
A vulnerability, which was classified as critical, has been found in Mozilla Firefox up to 153.4/157. This vulnerability affects unknown code of the component Web Serial. This manipulation causes uninitialized pointer. This vulnerability is
CVE-2026-109709 | Mozilla Firefox up to 153.4/157 Process Sandboxing privileges management (Nessus ID 374794)
A vulnerability described as critical has been identified in Mozilla Firefox up to 153.4/157. Affected is an unknown function of the component Process Sandboxing. Such manipulation leads to improper privilege management. This vulnerability
CVE-2026-109724 | Mozilla Firefox up to 153.4/157 DOM/HTML use after free (Nessus ID 374794)
A vulnerability, which was classified as critical, was found in Mozilla Firefox up to 153.4/157. This impacts an unknown function of the component DOM/HTML. Executing a manipulation can lead to use after free. This vulnerability is register
CVE-2026-109713 | Mozilla Firefox up to 153.4/157 Crash Reporting use after free (Nessus ID 374794)
A vulnerability was found in Mozilla Firefox up to 153.4/157. It has been rated as critical. This affects an unknown function of the component Crash Reporting. The manipulation leads to use after free. This vulnerability is uniquely identif
CVE-2026-109740 | Mozilla Firefox up to 153.4/157 Win32 sandbox (Nessus ID 374794)
A vulnerability marked as critical has been reported in Mozilla Firefox up to 153.4/157. Affected is an unknown function of the component Win32. Performing a manipulation results in sandbox issue. This vulnerability was named CVE-2026-10974
CVE-2026-109706 | Mozilla Firefox up to 115.42/153.4/157 IndexedDB use after free (Nessus ID 374794)
A vulnerability, which was classified as critical, has been found in Mozilla Firefox up to 115.42/153.4/157. This affects an unknown part of the component IndexedDB. The manipulation leads to use after free. This vulnerability is documented
CVE-2026-109715 | Mozilla Firefox up to 115.42/153.4/157 JavaScript Engine integer overflow (Nessus ID 374794)
A vulnerability identified as critical has been detected in Mozilla Firefox up to 115.42/153.4/157. Affected is an unknown function of the component JavaScript Engine. This manipulation causes integer overflow. The identification of this vu
CVE-2026-96391 | Drupal Webform REST up to 4.2.0 improper authorization
A vulnerability was found in Drupal Webform REST up to 4.2.0. It has been classified as critical. Affected is an unknown function of the component REST. The manipulation leads to improper authorization. This vulnerability is documented as C
CVE-2026-96379 | Drupal CookieCuttr up to 2.0.3 cross site scripting
A vulnerability was found in Drupal CookieCuttr up to 2.0.3. It has been classified as problematic. The impacted element is an unknown function. Performing a manipulation results in cross site scripting. This vulnerability is reported as CV
CVE-2026-92202 | Luxion KeyShot BIP File Parser uncontrolled search path
A vulnerability marked as critical has been reported in Luxion KeyShot. This issue affects some unknown processing of the component BIP File Parser. The manipulation leads to uncontrolled search path. This vulnerability is traded as CVE-202
CVE-2026-87938 | Drupal CSP log Plugin up to 1.0.2 sql injection
A vulnerability categorized as critical has been discovered in Drupal CSP log Plugin up to 1.0.2. The affected element is an unknown function. Such manipulation leads to sql injection. This vulnerability is referenced as CVE-2026-87938. It
CVE-2026-76529 | Splunk SOAR up to 8.6.x improper protection of alternate path
A vulnerability was found in Splunk SOAR up to 8.6.x and classified as critical. This issue affects some unknown processing. Executing a manipulation can lead to improper protection of alternate path. The identification of this vulnerabilit
CVE-2026-76408 | Splunk SOAR up to 8.6.x resource control
A vulnerability marked as very critical has been reported in Splunk SOAR up to 8.6.x. This affects an unknown function. Performing a manipulation results in improper control of resource through lifetime. This vulnerability is reported as CV
CVE-2026-76288 | Splunk Enterprise up to 9.4.15/10.0.10/10.2.7/10.4.3 JavaScript Logger Endpoint resource consumption
A vulnerability has been found in Splunk Enterprise up to 9.4.15/10.0.10/10.2.7/10.4.3 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component JavaScript Logger Endpoint. This manipulation
CVE-2026-105869 | Apache Pulsar up to 4.0.13/4.2.4 MultiRolesTokenAuthorizationProvider improper authentication
A vulnerability was found in Apache Pulsar up to 4.0.13/4.2.4. It has been declared as very critical. This issue affects some unknown processing of the component MultiRolesTokenAuthorizationProvider. Such manipulation leads to improper auth
CVE-2026-86959 | Apple iOS/iPadOS/macOS input validation
A vulnerability identified as critical has been detected in Apple iOS, iPadOS and macOS. The impacted element is an unknown function. The manipulation leads to improper input validation. This vulnerability is uniquely identified as CVE-2026
CVE-2026-86948 | Apple Xcode up to 26 sandbox
A vulnerability was found in Apple Xcode up to 26. It has been declared as problematic. The impacted element is an unknown function. Executing a manipulation can lead to sandbox issue. This vulnerability appears as CVE-2026-86948. The attac
CVE-2026-86944 | Apple iOS/iPadOS/macOS prior 26.7/26.7/15.8/26.7 out-of-bounds write
A vulnerability classified as very critical has been found in Apple iOS, iPadOS and macOS. Affected by this vulnerability is an unknown functionality. Performing a manipulation results in out-of-bounds write. This vulnerability is identifie
CVE-2026-86935 | Apple macOS up to 26 information disclosure
A vulnerability was found in Apple macOS up to 26. It has been classified as problematic. The affected element is an unknown function. Performing a manipulation results in information disclosure. This vulnerability is reported as CVE-2026-8
CVE-2026-84582 | Apple iOS/iPadOS/macOS/tvOS/visionOS/watchOS up to 26 access control
A vulnerability described as problematic has been identified in Apple iOS, iPadOS, macOS, tvOS, visionOS and watchOS up to 26. The impacted element is an unknown function. The manipulation results in improper access controls. This vulnerabi
CVE-2026-83651 | Microsoft Windows up to Server 2025 GDI out-of-bounds
A vulnerability identified as problematic has been detected in Microsoft Windows. This impacts an unknown function of the component GDI. This manipulation causes out-of-bounds read. This vulnerability is registered as CVE-2026-83651. Remote
CVE-2026-68482 | Apache Answer improper authorization
A vulnerability was found in Apache Answer. It has been declared as problematic. Affected is an unknown function. Such manipulation leads to improper authorization. This vulnerability is uniquely identified as CVE-2026-68482. The attack can
CVE-2026-113264 | Google Chrome up to 155.0.8059.84 Extensions input validation
A vulnerability marked as critical has been reported in Google Chrome. The impacted element is an unknown function of the component Extensions. This manipulation causes improper input validation. The identification of this vulnerability is
ParticleDB's Jepsen report, Lenovo's fingerprint USB stick, Karpathy's HackerTube and the Linux TCP bug CVE-2026-98432
Four developer stories from Sunday, November 1, 2026, each read from its own source. The first is a database whose home page said Full ACID. The video has the walkthrough; this article keeps the quotes, numbers and links in one place. TL;DR
CVE-2026-95117 | zserge jsmn jsmn.h jsmn_parse buffer overflow (ID 25647e6)
A vulnerability marked as problematic has been reported in zserge jsmn. The impacted element is the function jsmn_parse of the file jsmn.h. The manipulation leads to buffer overflow. This vulnerability is listed as CVE-2026-95117. The attac
CVE-2026-70125 | Microsoft Outlook code injection
A vulnerability described as problematic has been identified in Microsoft Outlook. Impacted is an unknown function. The manipulation results in code injection. This vulnerability is known as CVE-2026-70125. It is possible to launch the atta
CVE-2026-67240 | RabbitMQ up to 4.2.6/4.3.0 Like Filter rabbit_amqp_session.erl incorrect regex
A vulnerability labeled as problematic has been found in RabbitMQ up to 4.2.6/4.3.0. Impacted is an unknown function of the file rabbit_amqp_session.erl of the component Like Filter. Executing a manipulation can lead to incorrect regular ex
CVE-2026-67228 | RabbitMQ up to 4.2.6/4.3.0 Runtime Parameter Lookup rabbit_runtime_parameters.erl lookup_component denial of service
A vulnerability was found in RabbitMQ up to 4.2.6/4.3.0. It has been classified as problematic. This vulnerability affects the function lookup_component of the file deps/rabbit/src/rabbit_runtime_parameters.erl of the component Runtime Para
CVE-2026-66069 | RabbitMQ up to 4.1.12/4.2.6/4.2.x Management Plugin rabbit_mgmt_wm_reset.erl is_authorized privileges management (WID-SEC-2026-2268)
A vulnerability described as problematic has been identified in RabbitMQ up to 4.1.12/4.2.6/4.2.x. The impacted element is the function is_authorized of the file rabbit_mgmt_wm_reset.erl of the component Management Plugin. The manipulation
CVE-2026-66067 | VMware RabbitMQ up to 4.2.6/4.3.0 Stream Open privileges management
A vulnerability marked as problematic has been reported in VMware RabbitMQ up to 4.2.6/4.3.0. The affected element is an unknown function of the component Stream Open Handler. The manipulation leads to improper privilege management. This vu
CVE-2026-109763 | Mozilla Firefox up to 153.4/157 File privileges assignment
A vulnerability was found in Mozilla Firefox up to 153.4/157. It has been declared as critical. This affects an unknown function of the component File Handler. The manipulation results in incorrect privilege assignment. This vulnerability i
CVE-2026-107161 | Cyrus Cyrus-SASL add_to_challenge heap-based overflow
A vulnerability identified as very critical has been detected in Cyrus Cyrus-SASL. This affects the function add_to_challenge. Performing a manipulation results in heap-based buffer overflow. This vulnerability is reported as CVE-2026-10716
CVE-2026-104040 | Red Hat Enterprise Linux/OpenShift Container Platform sssd information disclosure
A vulnerability was found in Red Hat Enterprise Linux and OpenShift Container Platform. It has been declared as problematic. Affected is an unknown function of the component sssd. The manipulation results in information disclosure. This vul
CVE-2026-104029 | sssd autofs out-of-bounds
A vulnerability marked as critical has been reported in sssd. This vulnerability affects unknown code of the component autofs. The manipulation leads to out-of-bounds read. This vulnerability is traded as CVE-2026-104029. It is possible to
CVE-2026-100517 | Villame Photo Reviews Plugin up to 1.2.30 on WordPress resource injection
A vulnerability described as critical has been identified in Villame Photo Reviews Plugin up to 1.2.30 on WordPress. Affected by this vulnerability is an unknown functionality. Such manipulation leads to improper control of resource identif
Apple-Sicherheitslücke: CVE-2026-86950 kann Geräte vollständig übernehmen
Illustration mit AI erstellt. Die Nationale Agentur für Cybersicherheit Aserbaidschans hat vor einer neu entdeckten Schwachstelle in den ... Weiterlesen
CVE-2022-48309 | Sophos Connect 2.1 cross-site request forgery (EUVD-2022-51009)
A vulnerability classified as problematic was found in Sophos Connect 2.1. This issue affects some unknown processing. The manipulation results in cross-site request forgery. This vulnerability was named CVE-2022-48309. The attack may be pe
CVE-2022-48308 | Palantir Sls-logging certificate host validation (EUVD-2022-51008)
A vulnerability has been found in Palantir Sls-logging and classified as critical. Affected by this issue is some unknown functionality. The manipulation leads to certificate with host mismatch. This vulnerability is traded as CVE-2022-4830