Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 741 | 0,2 % |
| ≥50 % | 3.215 | 0,8 % |
| ≥10 % | 22.048 | 5,8 % |
| <10 % | 354.725 | 93,2 % |
[UPDATE] [mittel] Red Hat Enterprise Linux (Libreswan): Schwachstelle ermöglicht Denial of Service
Ein lokaler Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux in Libreswan ausnutzen, um einen Denial of Service Angriff durchzuführen. Weiterlesen
[NEU] [mittel] Vaultwarden: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Vaultwarden ausnutzen, um Sicherheitsvorkehrungen zu umgehen und Informationen offenzulegen. Weiterlesen
[NEU] [hoch] GnuPG: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Benutzerrechten
Ein Angreifer kann eine Schwachstelle in GnuPG ausnutzen, um beliebigen Programmcode mit Benutzerrechten auszuführen. Weiterlesen
[NEU] [mittel] Veeam ONE: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Veeam ONE ausnutzen, um die Multi-Faktor-Authentifizierung zu umgehen. Weiterlesen
[NEU] [hoch] CrushFTP: Schwachstelle ermöglicht Erlangen von Administratorrechten
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in CrushFTP ausnutzen, um Sicherheitsvorkehrungen zu umgehen und Administratorrechte zu erlangen. Weiterlesen
[NEU] [UNGEPATCHT] [mittel] Grafana: Schwachstelle ermöglicht Offenlegung von Informationen
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Grafana ausnutzen, um Sicherheitsvorkehrungen zu umgehen und Informationen offenzulegen. Weiterlesen
[NEU] [hoch] Adobe Connect: Schwachstelle ermöglicht Codeausführung
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Adobe Connect ausnutzen, um beliebigen Programmcode auszuführen. Weiterlesen
[NEU] [mittel] NetApp Data ONTAP: Schwachstelle ermöglicht Offenlegung von Informationen
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in NetApp Data ONTAP ausnutzen, um Informationen offenzulegen. Weiterlesen
[NEU] [mittel] Axis Camera Station: Schwachstelle ermöglicht nicht spezifizierten Angriff
Ein lokaler Angreifer kann eine Schwachstelle in Axis Camera Station ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen. Weiterlesen
[NEU] [mittel] IBM SPSS Analytic Server: Schwachstelle ermöglicht Denial of Service
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in IBM SPSS Analytic Server ausnutzen, um einen Denial of Service Angriff durchzuführen. Weiterlesen
[NEU] [mittel] IBM i: Schwachstelle ermöglicht Offenlegung von Informationen
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in IBM i ausnutzen, um Informationen offenzulegen. Weiterlesen
KeyDrift missbraucht Cisco-SD-WAN-Schwachstelle CVE-2026-20127 zur Schlüssel-Diebstahl-Umgehung
LONDON (IT BOLTWISE) – Angreifer nutzen eine kritische Lücke in Cisco Catalyst SD-WAN, um im Netzwerksteuerungsbereich Malware zu platzieren, die Verschlüsselungsschlüssel für die spätere Wiederverwendung abgreift. Die Schwachstelle CVE-202
Cisco Warns of Actively Exploited Firewall Vulnerability Allowing Remote DoS Attacks
Cisco has warned that attackers are actively exploiting a high-severity vulnerability in its Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. Tracked as CVE-2026-76418, the flaw allows una
Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
CVE-2026-41709 allows attackers with administrative privileges to perform operations without being logged. This article has been indexed from SecurityWeek Read the original article: Chinese Hackers Quietly Used Low-Severity ESXi Logging Fla
Gasheizung: Test deckt eine Schwachstelle bei 4 von 5 Geräten auf
Ein Test aus den Niederlanden zeigt, wie Gaskessel auf eine zu niedrige Netzspannung reagieren. Bei vier von fünf Geräten lief die Umwälzpumpe schwerer. Weiterlesen
Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities (KEV) catalog, citin
CVE-2025-65136 | manikandan580 School-management-system 1.0 POST Parameter contact-us.php pagedes cross site scripting
A vulnerability labeled as problematic has been found in manikandan580 School-management-system 1.0. The affected element is an unknown function of the file /studentms/admin/contact-us.php of the component POST Parameter Handler. Such manip
CVE-2024-13362 | Advanced Scrollbar Plugin on WordPress Parameter url cross site scripting
A vulnerability identified as problematic has been detected in Advanced Scrollbar Plugin on WordPress. Affected is an unknown function of the component Parameter Handler. The manipulation of the argument url leads to cross site scripting. T
Lumen Uncovers Secret Chinese Hacking Network Behind Years of Zero-Day Attacks on U.S. Infrastructure
Black Lotus Labs has uncovered Silent Train, a covert hacking network used by Chinese state-sponsored threat group Volt Typhoon to attack strategically important U.S. organizations. Researchers tracked the operation for three years, issuing
ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws
The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week. Oracle patched all three under a single identifier, CVE-2026-35273, in
PHP2Shell: Aktive Ausnutzung von CVE-2026-109618/109619 trifft öffentlich erreichbare PAN-OS-Management-Interfaces
LONDON (IT BOLTWISE) – Angreifer nutzen laut Anbieterhinweis die kürzlich gepatchten PHP2Shell-Schwachstellen CVE-2026-109618 und CVE-2026-109619 aktiv gegen ins Internet gestellte Management-Interfaces. Die Lücken ermöglichen eine nicht au
China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a security flaw impacting Broadcom VMware ESX to its Known Exploited Vulnerabilities (KEV) catalog, after CrowdStrike revealed that it had been weaponized b
Security Researchers Demonstrate Chrome Sandbox Escapes, Telegram Zero-Click Attacks and iOS Zero-Day Research
Security researchers at OffensiveCon Japan 2026 explored topics including Chrome sandbox escapes, zero-click attack surfaces in Telegram, and newly discovered iOS zero-day vulnerabilities. This two-day program took place on October 27–28. T
CVE-2026-97324 | YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08 Demo-order Payment Callback PayDemoOrderController.java updateDemoOrderPaid improper authorization
A vulnerability classified as critical has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected is the function updateDemoOrderPaid of the file yudao-module-pay/src/main/java/cn/iocoder/yudao/module/pay/controller/admin/
CVE-2026-2701 | Progress ShareFile Storage Zones Controller up to 5.12.3 unrestricted upload
A vulnerability was found in Progress ShareFile Storage Zones Controller up to 5.12.3. It has been declared as critical. The impacted element is an unknown function of the component File Handler. Such manipulation leads to unrestricted uplo
CVE-2026-2699 | Progress ShareFile Storage Zones Controller up to 5.12.3 redirect
A vulnerability was found in Progress ShareFile Storage Zones Controller up to 5.12.3. It has been declared as very critical. This issue affects some unknown processing. The manipulation results in execution after redirect. This vulnerabili
CVE-2023-7339 | Softing pnGate stack-based overflow
A vulnerability classified as critical has been found in Softing pnGate, epGate, mbGate, smartLink HW-DP and smartLink HW-PN. This issue affects some unknown processing. This manipulation causes stack-based buffer overflow. This vulnerabili
CVE-2026-14288 | GitLab 17.4/19.3.5/19.4.2/19.5.0 Approval Rule Synchronization access control (WID-SEC-2026-4115)
A vulnerability was found in GitLab 17.4/19.3.5/19.4.2/19.5.0. It has been declared as problematic. This impacts an unknown function of the component Approval Rule Synchronization. Such manipulation leads to improper access controls. This v
CVE-2026-13319 | GitLab up to 19.3.5/19.4.2/19.5.0 Group Milestones API improper authorization (WID-SEC-2026-4115)
A vulnerability was found in GitLab up to 19.3.5/19.4.2/19.5.0. It has been classified as problematic. This affects an unknown function of the component Group Milestones API. This manipulation causes improper authorization. The identificati
CVE-2026-12664 | GitLab up to 19.3.5/19.4.2/19.5.0 GraphQL Field privileges management (WID-SEC-2026-4115)
A vulnerability, which was classified as critical, has been found in GitLab up to 19.3.5/19.4.2/19.5.0. This issue affects some unknown processing of the component GraphQL Field. Performing a manipulation results in improper privilege manag
CVE-2026-112378 | GitLab up to 19.3.5/19.4.2/19.5.0 Billing Eligibility Checks privileges management (WID-SEC-2026-4115)
A vulnerability was found in GitLab up to 19.3.5/19.4.2/19.5.0. It has been rated as problematic. Affected is an unknown function of the component Billing Eligibility Checks. Performing a manipulation results in improper privilege managemen
CVE-2026-112326 | GitLab up to 19.3.5/19.4.2/19.5.0 Vulnerability Record Cleanup privileges management (WID-SEC-2026-4115)
A vulnerability was found in GitLab up to 19.3.5/19.4.2/19.5.0 and classified as problematic. The impacted element is an unknown function of the component Vulnerability Record Cleanup. The manipulation results in improper privilege manageme
CVE-2026-112212 | GitLab up to 19.3.5/19.4.2/19.5.0 OAuth/OIDC Discovery redirect (WID-SEC-2026-4115)
A vulnerability classified as problematic was found in GitLab up to 19.3.5/19.4.2/19.5.0. This vulnerability affects unknown code of the component OAuth/OIDC Discovery. Such manipulation leads to open redirect. This vulnerability is traded
CVE-2026-110610 | YunaiV ruoyi-vue-pro up to 2026.09 Image Service HttpUtil.downloadBytes referImageUrl server-side request forgery (Issue 1178)
A vulnerability labeled as critical has been found in YunaiV ruoyi-vue-pro up to 2026.09. The affected element is the function HttpUtil.downloadBytes of the component Image Service. Executing a manipulation of the argument referImageUrl can
CVE-2026-97320 | YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08 AI Knowledge AiKnowledgeDocumentServiceImpl.java AiKnowledgeDocumentServiceImpl.readUrl url server-side request forgery (Issue 1176)
A vulnerability identified as critical has been detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The affected element is the function AiKnowledgeDocumentServiceImpl.readUrl of the file AiKnowledgeDocumentServiceImpl.java of the
China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a security flaw impacting Broadcom VMware ESX to its Known Exploited Vulnerabilities (KEV) catalog, after CrowdStrike revealed that it had been weaponized b
Security Researchers Demonstrate Chrome Sandbox Escapes, Telegram Zero-Click Attacks and iOS Zero-Day Research
Security researchers at OffensiveCon Japan 2026 explored topics including Chrome sandbox escapes, zero-click attack surfaces in Telegram, and newly discovered iOS zero-day vulnerabilities. This two-day program took place on October 27–28. T
CVE-2026-114173 | Canva Ortto Plugin up to 1.0.24 information disclosure (EUVD-2026-112570)
A vulnerability was found in Canva Ortto Plugin up to 1.0.24. It has been declared as problematic. This vulnerability affects unknown code. Executing a manipulation can lead to information disclosure. This vulnerability is handled as CVE-20
CVE-2026-66088 | Apereo openEQUELLA up to 2026.0 Scripting Engine system.execute os command injection (EUVD-2026-112564)
A vulnerability classified as critical has been found in Apereo openEQUELLA up to 2026.0. Affected is the function system.execute of the component Scripting Engine. The manipulation leads to os command injection. This vulnerability is liste
CVE-2026-16889 | Apereo openEQUELLA up to 2026.0 Image Upload Endpoint image name cross site scripting (EUVD-2026-112563)
A vulnerability marked as problematic has been reported in Apereo openEQUELLA up to 2026.0. This affects an unknown function of the file /api/preloginnotice/image of the component Image Upload Endpoint. Performing a manipulation of the argu
CVE-2026-113409 | Canva Ortto Plugin up to 1.0.24 cross site scripting (EUVD-2026-112571)
A vulnerability labeled as problematic has been found in Canva Ortto Plugin up to 1.0.24. The impacted element is an unknown function. Such manipulation leads to cross site scripting. This vulnerability is referenced as CVE-2026-113409. It
CVE-2026-66090 | Apereo openEQUELLA up to 2026.0 XML parser /api/item server-side request forgery (EUVD-2026-112566)
A vulnerability was found in Apereo openEQUELLA up to 2026.0. It has been rated as critical. This issue affects some unknown processing of the file /api/item of the component XML parser. The manipulation leads to server-side request forgery
CVE-2026-66089 | Apereo openEQUELLA up to 2026.0 SOAP API server-side request forgery (EUVD-2026-112565)
A vulnerability identified as critical has been detected in Apereo openEQUELLA up to 2026.0. The affected element is an unknown function of the component SOAP API. This manipulation causes server-side request forgery. The identification of
CVE-2026-66091 | Apereo openEQUELLA up to 2026.0 userinfobackup uniqueId authorization (EUVD-2026-112567)
A vulnerability described as problematic has been identified in Apereo openEQUELLA up to 2026.0. This impacts an unknown function of the file /api/userquery/userinfobackup. Executing a manipulation of the argument uniqueId can lead to missi
CVE-2026-66092 | Apereo openEQUELLA up to 2026.1 Pre-Login Notice /api/preloginnotice cross site scripting (EUVD-2026-112568)
A vulnerability classified as problematic was found in Apereo openEQUELLA up to 2026.1. Affected by this vulnerability is an unknown functionality of the file /api/preloginnotice of the component Pre-Login Notice. The manipulation results i
CVE-2026-96741 | mlfactory DSGVO All in one for WP Plugin up to 5.0 on WordPress Comment Content cross site scripting (EUVD-2026-112585)
A vulnerability identified as problematic has been detected in mlfactory DSGVO All in one for WP Plugin up to 5.0 on WordPress. This impacts an unknown function of the component Comment Content. Performing a manipulation results in cross si
CVE-2026-96669 | wpscripts Food Store Plugin up to 1.5.5 on WordPress Cookie service_type/type cross site scripting (EUVD-2026-112586)
A vulnerability marked as problematic has been reported in wpscripts Food Store Plugin up to 1.5.5 on WordPress. Affected by this vulnerability is an unknown functionality of the component Cookie Handler. The manipulation of the argument se
CVE-2026-109516 | guruteam Bot for Telegram Plugin up to 1.3.0 on WordPress REST Endpoint main bftow_get_user_system_id tgId improper authentication (EUVD-2026-112584)
A vulnerability was found in guruteam Bot for Telegram Plugin up to 1.3.0 on WordPress. It has been rated as critical. The impacted element is the function bftow_get_user_system_id of the file /wp-json/woo-telegram/v1/main of the component
CVE-2026-93904 | dejanmarkovic Social Web Suite Plugin up to 4.1.12 on WordPress exclude_posts sql injection (EUVD-2026-112588)
A vulnerability labeled as critical has been found in dejanmarkovic Social Web Suite Plugin up to 4.1.12 on WordPress. Affected is an unknown function. Executing a manipulation of the argument exclude_posts can lead to sql injection. The id
CVE-2026-93855 | brewlabs SendPress Newsletters Plugin up to 1.26.1.20 on WordPress Shortcode subscriberid sql injection (EUVD-2026-112587)
A vulnerability categorized as critical has been discovered in brewlabs SendPress Newsletters Plugin up to 1.26.1.20 on WordPress. This affects an unknown function of the component Shortcode Handler. Such manipulation of the argument subscr
CVE-2026-96666 | Schema App Structured Data Plugin up to 2.3.2 on WordPress Remove Microdata Output Filter cross site scripting (EUVD-2026-112589)
A vulnerability described as problematic has been identified in Schema App Structured Data Plugin up to 2.3.2 on WordPress. Affected by this issue is some unknown functionality of the component Remove Microdata Output Filter. The manipulati
CVE-2026-96228 | sslplugins SSL Wireless SMS Notification Plugin up to 3.8.1 on WordPress Login final_login_ajax_action sslcare_login_phone/cap_data improper authentication (EUVD-2026-112590)
A vulnerability was found in sslplugins SSL Wireless SMS Notification Plugin up to 3.8.1 on WordPress. It has been declared as critical. The affected element is the function final_login_ajax_action of the component Login Handler. The manipu
CVE-2026-93757 | Wild Apricot Login Plugin up to 1.0.18 on WordPress SSO Authentication Module.php syncWaContact improper authentication (EUVD-2026-112591)
A vulnerability was found in Wild Apricot Login Plugin up to 1.0.18 on WordPress. It has been classified as critical. Impacted is the function UserSynchronizer::syncWaContact of the file Module.php of the component SSO Authentication. The m
CVE-2023-54227 | Linux Kernel up to 6.5.4 /mnt nr_hw_queues memory leak (Nessus ID 319348 / WID-SEC-2025-2941)
A vulnerability identified as critical has been detected in Linux Kernel up to 6.5.4. This vulnerability affects the function nr_hw_queues of the file /mnt. This manipulation causes memory leak. This vulnerability is registered as CVE-2023-
CVE-2026-115417 | AWS aws-c-mqtt up to 0.16.1 MQTT 3.1.1 Compatibility Adapter denial of service (EUVD-2026-108508)
A vulnerability, which was classified as problematic, was found in AWS aws-c-mqtt up to 0.16.1. This issue affects some unknown processing of the component MQTT 3.1.1 Compatibility Adapter. Such manipulation leads to denial of service. This
CVE-2026-90732 | Dell PowerProtect Data Domain up to 8.6.1.20 stack-based overflow (EUVD-2026-110812)
A vulnerability identified as problematic has been detected in Dell PowerProtect Data Domain up to 7.7.1.0/LTS 2026/7.13.1.80/8.3.1.40/8.6.1.20. Affected by this vulnerability is an unknown functionality. The manipulation leads to stack-bas
CVE-2026-90731 | Dell PowerProtect Data Domain up to 8.7 stack-based overflow (EUVD-2026-110814)
A vulnerability was found in Dell PowerProtect Data Domain up to 8.7. It has been rated as problematic. This impacts an unknown function. Performing a manipulation results in stack-based buffer overflow. This vulnerability is identified as
CVE-2026-106484 | Google chrome-devtools-mcp up to 1.4.x Policy Enforcement privileges management (EUVD-2026-112366)
A vulnerability described as problematic has been identified in Google chrome-devtools-mcp up to 1.4.x. This issue affects some unknown processing of the component Policy Enforcement. Executing a manipulation can lead to improper privilege
CVE-2026-116639 | A vulnerability was detected in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to a8902bf64575e325f6d6bf93a55f7bd273ec58cd. Affected is an unknown function of the file chat.php. Performing a manipulation of the argument ID results in cross site scripting. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for aff
A vulnerability was detected in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to a8902bf64575e325f6d6bf93a55f7bd273ec58cd. Affected is an unknown function of the file chat.php. Performing a manipulation of the argument ID results in
CVE-2026-116839 | A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to make unauthorized changes and execute a Denial of Service (DoS) attack on the device.
A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to make unauthorized changes and execute a Denial of Service (DoS) attack on the