Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 737 | 0,2 % |
| ≥50 % | 3.215 | 0,8 % |
| ≥10 % | 22.038 | 5,8 % |
| <10 % | 354.739 | 93,2 % |
CVE-2026-33614 | MB connect line mbCONNECT24/mymbCONNECT24 up to 2.19.4 Getinfo Endpoint sql injection (VDE-2026-030)
A vulnerability was found in MB connect line mbCONNECT24 and mymbCONNECT24 up to 2.19.4. It has been classified as critical. Affected by this vulnerability is an unknown functionality of the component Getinfo Endpoint. Performing a manipula
CVE-2026-33613 | MB connect line mbCONNECT24/mymbCONNECT24 up to 2.19.4 generateSrpArray os command injection (VDE-2026-030)
A vulnerability has been found in MB connect line mbCONNECT24 and mymbCONNECT24 up to 2.19.4 and classified as critical. This impacts the function generateSrpArray. This manipulation causes os command injection. This vulnerability is tracke
CVE-2026-29144 | SEPPmail Secure Email Gateway up to 15.0.2 input validation
A vulnerability classified as critical was found in SEPPmail Secure Email Gateway up to 15.0.2. The affected element is an unknown function. Executing a manipulation can lead to improper input validation. The identification of this vulnerab
CVE-2026-29143 | SEPPmail Secure Email Gateway up to 15.0.2 SMIME Message improper authentication
A vulnerability classified as critical has been found in SEPPmail Secure Email Gateway up to 15.0.2. Impacted is an unknown function of the component SMIME Message Handler. Performing a manipulation results in improper authentication. This
CVE-2026-29142 | SEPPmail Secure Email Gateway up to 15.0.2 GINA Mail missing cryptographic step
A vulnerability described as problematic has been identified in SEPPmail Secure Email Gateway up to 15.0.2. This issue affects some unknown processing of the component GINA Mail Handler. Such manipulation leads to missing cryptographic step
CVE-2026-29141 | SEPPmail Secure Email Gateway up to 15.0.2 Subject input validation
A vulnerability labeled as problematic has been found in SEPPmail Secure Email Gateway up to 15.0.2. This affects an unknown part of the component Subject Handler. The manipulation results in improper input validation. This vulnerability is
CVE-2026-29140 | SEPPmail Secure Email Gateway up to 15.0.2 Certificate certificate validation
A vulnerability, which was classified as critical, was found in SEPPmail Secure Email Gateway up to 15.0.2. Impacted is an unknown function of the component Certificate Handler. Executing a manipulation can lead to improper certificate vali
CVE-2026-29139 | SEPPmail Secure Email Gateway up to 15.0.2 GINA Account authentication bypass
A vulnerability identified as critical has been detected in SEPPmail Secure Email Gateway up to 15.0.2. Affected by this issue is some unknown functionality of the component GINA Account Handler. The manipulation leads to authentication byp
CVE-2026-29138 | SEPPmail Secure Email Gateway up to 15.0.2 PGP Signature ldap injection
A vulnerability, which was classified as problematic, was found in SEPPmail Secure Email Gateway up to 15.0.2. This affects an unknown function of the component PGP Signature Handler. The manipulation results in ldap injection. This vulnera
CVE-2026-29137 | SEPPmail Secure Email Gateway up to 15.0.2 input validation
A vulnerability was found in SEPPmail Secure Email Gateway up to 15.0.2. It has been rated as problematic. Affected is an unknown function. Performing a manipulation results in improper input validation. This vulnerability is reported as CV
Volt Typhoon hides zero-day attacks using ‘Silent Train’ framework
Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand, including for zero-day attacks targeting high-value systems. […] This article has been
CVE-2026-5325 | SourceCodester Simple Customer Relationship Management System 1.0 Create Ticket /create-ticket.php description cross site scripting
A vulnerability was found in SourceCodester Simple Customer Relationship Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /create-ticket.php of the component Create Ticket. This
CVE-2026-5244 | Cesanta Mongoose up to 7.20 TLS 1.3 mongoose.c mg_tls_recv_cert pubkey heap-based overflow
A vulnerability categorized as critical has been discovered in Cesanta Mongoose up to 7.20. This affects the function mg_tls_recv_cert of the file mongoose.c of the component TLS 1.3 Handler. Such manipulation of the argument pubkey leads t
CVE-2026-29136 | SEPPmail Secure Email Gateway up to 15.0.2 Notification cross site scripting
A vulnerability marked as problematic has been reported in SEPPmail Secure Email Gateway up to 15.0.2. This vulnerability affects unknown code of the component Notification Handler. This manipulation causes cross site scripting. This vulner
CVE-2026-29135 | SEPPmail Secure Email Gateway up to 15.0.2 password-tag input validation
A vulnerability was found in SEPPmail Secure Email Gateway up to 15.0.2. It has been declared as critical. This impacts an unknown function. Such manipulation of the argument password-tag leads to improper input validation. This vulnerabili
CVE-2026-29134 | SEPPmail Secure Email Gateway up to 15.0.2 GINA Webdomain Metadata reliance on untrusted inputs in a security decision
A vulnerability was found in SEPPmail Secure Email Gateway up to 15.0.2. It has been classified as critical. This affects an unknown function of the component GINA Webdomain Metadata Handler. This manipulation causes reliance on untrusted i
CVE-2026-29133 | SEPPmail Secure Email Gateway up to 15.0.2 PGP Key input validation
A vulnerability was found in SEPPmail Secure Email Gateway up to 15.0.2 and classified as problematic. The impacted element is an unknown function of the component PGP Key Handler. The manipulation results in improper input validation. This
CVE-2026-29132 | SEPPmail Secure Email Gateway up to 15.0.2 missing authentication
A vulnerability has been found in SEPPmail Secure Email Gateway up to 15.0.2 and classified as critical. The affected element is an unknown function. The manipulation leads to missing authentication. This vulnerability is listed as CVE-2026
CVE-2026-29131 | SEPPmail Secure Email Gateway up to 15.0.2 ldap injection
A vulnerability categorized as problematic has been discovered in SEPPmail Secure Email Gateway up to 15.0.2. Affected by this vulnerability is an unknown functionality of the component Email Handler. Executing a manipulation can lead to ld
CVE-2026-0634 | TECNO Pova7 Pro 5G 15.1.0 on Android AssistFeedbackService argument injection
A vulnerability, which was classified as critical, has been found in TECNO Pova7 Pro 5G 15.1.0 on Android. The impacted element is an unknown function of the component AssistFeedbackService. The manipulation leads to argument injection. Thi
CVE-2026-118029 – Unverified ownership of the default Athena query result location in AWS SDK for pandas
Bulletin ID: 2026-153-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/28/2026 08:30 AM PDT Description: AWS SDK for pandas (awswrangler) is an open-source Python library that integrates pandas with AWS data
Volt Typhoon hides zero-day attacks using 'Silent Train' framework
Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand, including for zero-day attacks targeting high-value systems. [...] Weiterlesen
CVE-2026-3987 | WatchGuard Fireware OS up to 12.11.8/2026.1.2 Web UI path traversal (wgsa-2026-00009)
A vulnerability labeled as critical has been found in WatchGuard Fireware OS up to 12.11.8/2026.1.2. This issue affects some unknown processing of the component Web UI. The manipulation results in path traversal. This vulnerability was name
CVE-2026-32927 | Fuji Electric V-SFT up to 6.2.10.0 set_temp_type_default out-of-bounds
A vulnerability was found in Fuji Electric V-SFT up to 6.2.10.0. It has been rated as problematic. This impacts the function set_temp_type_default. This manipulation causes out-of-bounds read. This vulnerability is handled as CVE-2026-32927
CVE-2026-32926 | Fuji Electric V-SFT up to 6.2.10.0 load_link_inf out-of-bounds
A vulnerability was found in Fuji Electric V-SFT up to 6.2.10.0. It has been declared as problematic. This affects the function load_link_inf. The manipulation results in out-of-bounds read. This vulnerability is known as CVE-2026-32926. At
CISA urges federal agencies to patch after PHP exploits observed
The US Cybersecurity and Infrastructure Security Agency (CISA) has urged federal agencies to implement PHP (PHP Hypertext Preprocessor) patches after observing exploits in the wild. CISA added the two vulnerabilities, tracked as CVE-2026-10
CVE-2026-34572 | ci4-cms-erp ci4ms 0.28.5.0 access control (GHSA-8fq3-c5w3-pj3q)
A vulnerability, which was classified as critical, was found in ci4-cms-erp ci4ms 0.28.5.0. Affected is an unknown function. The manipulation results in improper access controls. This vulnerability is cataloged as CVE-2026-34572. The attack
CVE-2026-34571 | ci4-cms-erp ci4ms 0.28.5.0 Administrative Interface cross site scripting (GHSA-fc4p-p49v-r948)
A vulnerability, which was classified as problematic, was found in ci4-cms-erp ci4ms 0.28.5.0. This affects an unknown part of the component Administrative Interface. Such manipulation leads to cross site scripting. This vulnerability is li
CVE-2026-34570 | ci4-cms-erp ci4ms 0.28.5.0 access control (GHSA-4vxv-4xq4-p84h)
A vulnerability, which was classified as critical, has been found in ci4-cms-erp ci4ms 0.28.5.0. This impacts an unknown function. The manipulation leads to improper access controls. This vulnerability is listed as CVE-2026-34570. The attac
CVE-2026-34569 | ci4-cms-erp ci4ms 0.28.5.0 category title cross site scripting (GHSA-fhrf-q333-82fm)
A vulnerability classified as problematic was found in ci4-cms-erp ci4ms 0.28.5.0. Affected by this vulnerability is an unknown functionality. The manipulation of the argument category title results in cross site scripting. This vulnerabili
CVE-2026-34567 | ci4-cms-erp ci4ms 0.28.5.0 Categories Section cross site scripting (GHSA-r33w-c82v-x5v7)
A vulnerability marked as problematic has been reported in ci4-cms-erp ci4ms 0.28.5.0. This affects an unknown function of the component Categories Section. Performing a manipulation results in cross site scripting. This vulnerability was n
CVE-2026-34566 | ci4-cms-erp ci4ms 0.28.5.0 cross site scripting (GHSA-458r-h248-29c5)
A vulnerability labeled as problematic has been found in ci4-cms-erp ci4ms 0.28.5.0. The impacted element is an unknown function. Such manipulation leads to cross site scripting. This vulnerability is uniquely identified as CVE-2026-34566.
CVE-2026-34565 | ci4-cms-erp ci4ms up to 0.31.0.0 Posts Section cross site scripting (GHSA-xgh5-w62m-8mpr)
A vulnerability classified as problematic has been found in ci4-cms-erp ci4ms up to 0.31.0.0. Affected is an unknown function of the component Posts Section. The manipulation leads to cross site scripting. This vulnerability is referenced a
CVE-2026-34564 | ci4-cms-erp ci4ms up to 0.31.0.0 Pages Section cross site scripting (GHSA-g4pp-fhgf-8653)
A vulnerability identified as problematic has been detected in ci4-cms-erp ci4ms up to 0.31.0.0. The affected element is an unknown function of the component Pages Section. This manipulation causes cross site scripting. This vulnerability i
CVE-2026-34563 | ci4-cms-erp ci4ms 0.28.5.0 cross site scripting (GHSA-85m8-g393-jcxf)
A vulnerability categorized as problematic has been discovered in ci4-cms-erp ci4ms 0.28.5.0. Impacted is an unknown function. The manipulation results in cross site scripting. This vulnerability is known as CVE-2026-34563. It is possible t
CVE-2026-34562 | ci4-cms-erp ci4ms 0.28.5.0 Setting cross site scripting (GHSA-v897-c6vq-6cr3)
A vulnerability was found in ci4-cms-erp ci4ms 0.28.5.0. It has been classified as problematic. This affects an unknown part of the component Setting Handler. Performing a manipulation results in cross site scripting. This vulnerability is
CVE-2026-34560 | ci4-cms-erp ci4ms 0.28.5.0 Logs Interface cross site scripting (GHSA-r4v5-rwr2-q7r4)
A vulnerability was found in ci4-cms-erp ci4ms 0.28.5.0. It has been declared as problematic. This vulnerability affects unknown code of the component Logs Interface. Executing a manipulation can lead to cross site scripting. This vulnerabi
CVE-2026-4820 | IBM Maximo Application Suite up to 8.10/8.11.0/9.0/10.6.5.0 Authorization Token missing secure attribute
A vulnerability has been found in IBM Maximo Application Suite up to 8.10/8.11.0/9.0/10.6.5.0 and classified as problematic. This affects an unknown function of the component Authorization Token Handler. The manipulation leads to sensitive
CVE-2026-4364 | IBM Verify Identity Access Container up to 11.0.2 Content-Type cross site scripting
A vulnerability has been found in IBM Verify Identity Access Container, Security Verify Access Container, Verify Identity Access and Security Verify Access up to 11.0.2 and classified as problematic. Impacted is an unknown function of the c
CVE-2026-4101 | IBM Verify Identity Access Container up to 11.0.2 improper authentication
A vulnerability identified as critical has been detected in IBM Verify Identity Access Container, Security Verify Access Container, Verify Identity Access and Security Verify Access up to 11.0.2. This affects an unknown function. This manip
CVE-2026-34559 | ci4-cms-erp ci4ms 0.28.5.0 tag name cross site scripting (GHSA-4333-387x-w245)
A vulnerability, which was classified as problematic, has been found in ci4-cms-erp ci4ms 0.28.5.0. Affected by this issue is some unknown functionality. This manipulation of the argument tag name causes cross site scripting. This vulnerabi
CVE-2026-34749 | payloadcms payload up to 3.79.0 cross-site request forgery (GHSA-p6mr-xf3r-ghq4)
A vulnerability was found in payloadcms payload up to 3.79.0 and classified as problematic. This vulnerability affects unknown code. Such manipulation leads to cross-site request forgery. This vulnerability is traded as CVE-2026-34749. The
CVE-2026-34748 | payloadcms payload up to 3.77.x cross site scripting (GHSA-mmxc-95ch-2j7c)
A vulnerability was found in payloadcms payload up to 3.77.x. It has been classified as problematic. This issue affects some unknown processing. Performing a manipulation results in cross site scripting. This vulnerability is known as CVE-2
CVE-2026-34747 | payloadcms payload up to 3.79.0 sql injection (GHSA-7xxh-373w-35vg)
A vulnerability, which was classified as critical, has been found in payloadcms payload up to 3.79.0. Affected by this vulnerability is an unknown functionality. The manipulation leads to sql injection. This vulnerability is documented as C
CVE-2026-2862 | IBM Verify Identity Access Container up to 11.0.2 Reverse Proxy request smuggling
A vulnerability classified as problematic has been found in IBM Verify Identity Access Container, Security Verify Access Container, Verify Identity Access and Security Verify Access up to 11.0.2. This issue affects some unknown processing o
CVE-2026-1491 | IBM Verify Identity Access Container up to 11.0.2 Reverse Proxy request smuggling
A vulnerability, which was classified as problematic, was found in IBM Verify Identity Access Container, Security Verify Access Container, Verify Identity Access and Security Verify Access up to 11.0.2. The impacted element is an unknown fu
CVE-2026-1345 | IBM Verify Identity Access Container up to 11.0.2 os command injection
A vulnerability was found in IBM Verify Identity Access Container, Security Verify Access Container, Verify Identity Access and Security Verify Access up to 11.0.2. It has been declared as critical. Impacted is an unknown function. Executin
CVE-2025-63031 | WP Grids EasyTest Plugin up to 1.0.1 on WordPress authorization
A vulnerability was found in WP Grids EasyTest Plugin up to 1.0.1 on WordPress. It has been classified as problematic. Impacted is an unknown function. Performing a manipulation results in missing authorization. This vulnerability is report
Oracle E-Business Suite: RCE-Lücke CVE-2026-101767 schon nach Patch im Visier
LONDON (IT BOLTWISE) – Bedrohungsakteure scannen offenbar direkt nach dem Patch nach einer kritisch bewerteten Schwachstelle in Oracle E-Business Suite. Betroffen ist CVE-2026-101767 (CVSS 9,8), die in der Oracle Application Object Library
VeloCloud-Lücke CVE-2026-114625: CVSS 9,9 [2026] - shattered.io
Weitere Meldungen aus diesem Bereich bündeln wir in der Rubrik Cybersicherheit. Das Fazit: Der Orchestrator ist kein Randprodukt, und eine Lücke ... Weiterlesen
Windows: Brotli-Sicherheitslücke kann Speicher beschädigen
Während zunächst keine aktiven Angriffe bekannt waren, verweist das US-amerikanische Center for Internet Security in einer Aktualisierung vom 27. Weiterlesen
ZDI-26-818: (0Day) Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious fil
ZDI-26-817: (0Day) Ultralytics parse_model Code Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious fil
ZDI-26-816: (0Day) Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious fil
ZDI-26-815: (0Day) Ultralytics parse_model Code Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious fil
ZDI-26-814: (0Day) Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious fil
ZDI-26-813: (0Day) Ultralytics check_det_dataset Code Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious fil
ZDI-26-812: (0Day) Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious fil
ZDI-26-829: (0Day) (Pwn2Own) Alpine iLX-F511 Bluetooth OBEX Packet Handling Heap-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.8.
ZDI-26-828: (0Day) (Pwn2Own) Alpine iLX-F511 Android Auto Service Stack-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. Th