Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 786 | 0,2 % |
| ≥50 % | 3.570 | 0,9 % |
| ≥10 % | 23.060 | 5,7 % |
| <10 % | 380.695 | 93,3 % |
Windows 11: Sicherheitslücke in Paint kann ohne einen einzigen Klick missbraucht werden
Gefährliche Sicherheitslücken können in so gut wie jedem Windows-Programm auftreten. Jetzt hat es Microsoft Paint getroffen, denn im allseits bekannten Zeichenprogramm von Windows steckt eine Schwachstelle, die Angreifer missbrauchen können
Windows-Sicherheitslücke: Ausgerechnet Microsoft Paint wird zum Einfallstor für Hacker
Schon Mitte Oktober 2026 hatte Microsoft eine Lücke in seinem Zeichenprogramm Paint gemeldet, über die Hacker:innen Schadcode einschleusen könnten. Weiterlesen
[NEU] [mittel] Cisco Unified Computing System (UCS): Schwachstelle ermöglicht Codeausführung
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Cisco Unified Computing System (UCS) ausnutzen, um beliebigen Programmcode auszuführen. Weiterlesen
[NEU] [mittel] Cisco Identity Services Engine (ISE): Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Cisco Identity Services Engine (ISE) ausnutzen, um Sicherheitsvorkehrungen zu umgehen. Weiterlesen
[NEU] [mittel] Cisco Unified Communications Manager (CUCM): Schwachstelle ermöglicht Cross-Site Scripting
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Cisco Unified Communications Manager (CUCM) ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen. Weiterlesen
[NEU] [hoch] Linux Kernel: Schwachstelle ermöglicht nicht spezifizierten Angriff
Ein entfernter, anonymer Angreifer kann eine Schwachstelle im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen. Weiterlesen
[NEU] [hoch] apt: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Administratorrechten
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in apt ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen. Weiterlesen
CVE-2026-86562 | Red Hat Enterprise Linux vhost toctou (Nessus ID 376199)
A vulnerability was found in Red Hat Enterprise Linux, Fast Datapath, OpenShift Container Platform and OpenStack Platform. It has been declared as very critical. This impacts an unknown function of the component vhost. The manipulation resu
CVE-2026-86561 | Red Hat Enterprise Linux lib vhost memory corruption (Nessus ID 376199)
A vulnerability classified as critical was found in Red Hat Enterprise Linux, Fast Datapath for RHEL, OpenShift Container Platform and OpenStack Platform. Affected is an unknown function of the component lib vhost. Such manipulation leads t
CVE-2026-78383 | Apache Tomcat up to 11.0.25 AJP allocation of resources (Nessus ID 376200 / WID-SEC-2026-3527)
A vulnerability, which was classified as problematic, has been found in Apache Tomcat up to 7.0.109/8.5.100/9.0.121/10.1.59/11.0.25. This affects an unknown part of the component AJP Handler. Performing a manipulation results in allocation
CVE-2023-53729 | Linux Kernel up to 6.5.3 soc qmi_encdec out-of-bounds (Nessus ID 376201 / WID-SEC-2025-2394)
A vulnerability was found in Linux Kernel up to 6.5.3. It has been declared as critical. This affects the function qmi_encdec of the component soc. The manipulation results in out-of-bounds read. This vulnerability is known as CVE-2023-5372
Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day
Tracked as CVE-2026-107441, the out-of-bounds write flaw could allow attackers to execute OS commands via crafted HTTP requests. This article has been indexed from SecurityWeek Read the original article: Zyxel Switch Hacks Blamed on Patched
CVE-2022-4089 | rickxy Stock Management System /pages/processlogin.php user cross site scripting (EUVD-2022-51460)
A vulnerability marked as problematic has been reported in rickxy Stock Management System. Affected is an unknown function of the file /pages/processlogin.php. Performing a manipulation of the argument User results in cross site scripting.
CVE-2022-4088 | rickxy Stock Management System /pages/processlogin.php user/password sql injection (EUVD-2022-51459)
A vulnerability identified as critical has been detected in rickxy Stock Management System. This affects an unknown function of the file /pages/processlogin.php. This manipulation of the argument user/password causes sql injection. This vul
CVE-2022-4087 | iPXE TLS src/net/tls.c tls_new_ciphertext pad_len information exposure (EUVD-2022-51458)
A vulnerability was found in iPXE. It has been rated as problematic. This issue affects the function tls_new_ciphertext of the file src/net/tls.c of the component TLS. Performing a manipulation of the argument pad_len results in information
CVE-2022-4066 | davidmoreno onion Log src/onion/response.c onion_response_flush allocation of resources (ID 308 / EUVD-2022-51441)
A vulnerability identified as problematic has been detected in davidmoreno onion. Affected by this vulnerability is the function onion_response_flush of the file src/onion/response.c of the component Log Handler. This manipulation causes al
CVE-2022-4062 | Schneider Electric EcoStruxure Power Commission 2.22 improper authorization (SEVD-2022-347-03 / EUVD-2022-51439)
A vulnerability classified as critical was found in Schneider Electric EcoStruxure Power Commission 2.22. Affected by this vulnerability is an unknown functionality. The manipulation results in improper authorization. This vulnerability is
CVE-2026-107775 | Dokan Plugin up to 5.3.2 on WordPress authorization (EUVD-2026-117354)
A vulnerability classified as problematic has been found in Dokan Plugin up to 5.3.2 on WordPress. This affects an unknown part. Performing a manipulation results in incorrect authorization. This vulnerability is reported as CVE-2026-107775
CVE-2026-107774 | Dokan Plugin up to 5.3.2 on WordPress Contact Form authentication spoofing (EUVD-2026-117353)
A vulnerability labeled as problematic has been found in Dokan Plugin up to 5.3.2 on WordPress. Affected is an unknown function of the component Contact Form. The manipulation results in authentication bypass by spoofing. This vulnerability
CVE-2026-107787 | CatFolders Plugin up to 2.5.6 on WordPress Folder Maintenance Action authorization (EUVD-2026-117356)
A vulnerability identified as critical has been detected in CatFolders Plugin up to 2.5.6 on WordPress. Affected by this issue is some unknown functionality of the component Folder Maintenance Action. This manipulation causes missing author
CVE-2026-107786 | CatFolders Plugin up to 2.5.6 on WordPress sql injection (EUVD-2026-117355)
A vulnerability was found in CatFolders Plugin up to 2.5.6 on WordPress. It has been declared as critical. This impacts an unknown function. Executing a manipulation can lead to sql injection. The identification of this vulnerability is CVE
CVE-2026-109150 | WP PageNavi Style Plugin up to 1.4 on WordPress cross site scripting (EUVD-2026-117357)
A vulnerability was found in WP PageNavi Style Plugin up to 1.4 on WordPress. It has been rated as problematic. This affects an unknown part. This manipulation causes cross site scripting. The identification of this vulnerability is CVE-202
CVE-2026-123025 | OPNsense os-acme-client Plugin up to 4.17.0 Google Cloud DNS Validation DnsGcloud::prepare os command injection (EUVD-2026-117385)
A vulnerability, which was classified as very critical, was found in OPNsense os-acme-client Plugin up to 4.17.0. Affected by this vulnerability is the function DnsGcloud::prepare of the component Google Cloud DNS Validation Module. Executi
CVE-2026-123017 | GodotSteam up to 4.23.2 grant_gold peer improper authentication (EUVD-2026-117358)
A vulnerability, which was classified as critical, has been found in GodotSteam up to 4.23.2. Affected is the function grant_gold. Performing a manipulation of the argument peer results in improper authentication. This vulnerability is repo
CVE-2022-2127 | Samba up to 4.16.11/4.17.10/4.18.5 Winbind out-of-bounds (FEDORA-2023-bcd91bfcd3 / EUVD-2022-34413)
A vulnerability, which was classified as problematic, was found in Samba up to 4.16.11/4.17.10/4.18.5. This impacts an unknown function of the component Winbind. Executing a manipulation can lead to out-of-bounds read. This vulnerability is
CVE-2022-4055 | xdg-email 2368 Mailto URL command delimiter (Issue 205 / EUVD-2022-51432)
A vulnerability categorized as problematic has been discovered in xdg-email 2368. This impacts an unknown function of the component Mailto URL Handler. Executing a manipulation can lead to improper neutralization of expression/command delim
CVE-2022-4054 | GitLab Project Maintainer information disclosure (Issue 382260 / EUVD-2022-51431)
A vulnerability was found in GitLab. It has been rated as problematic. Affected by this vulnerability is an unknown functionality of the component Project Maintainer Handler. This manipulation causes information disclosure. This vulnerabili
CVE-2022-4053 | Student Attendance Management System createClass.php className cross site scripting (EUVD-2022-51430)
A vulnerability identified as problematic has been detected in Student Attendance Management System. Impacted is an unknown function of the file createClass.php. The manipulation of the argument className leads to cross site scripting. This
CVE-2022-4052 | Student Attendance Management System /Admin/createClass.php Id sql injection (EUVD-2022-51429)
A vulnerability categorized as critical has been discovered in Student Attendance Management System. This issue affects some unknown processing of the file /Admin/createClass.php. Executing a manipulation of the argument ID can lead to sql
CVE-2025-65843 | Aquarius Desktop 3.0.069 on macOS ~/Library/Logs/Aquarius information disclosure
A vulnerability classified as problematic was found in Aquarius Desktop 3.0.069 on macOS. Affected by this vulnerability is an unknown functionality in the library ~/Library/Logs/Aquarius. Executing a manipulation can lead to information di
CVE-2025-65842 | Aquarius HelperTool 1.0.003 on macOS XPC Service backdoor
A vulnerability was found in Aquarius HelperTool 1.0.003 on macOS. It has been declared as critical. This issue affects some unknown processing of the component XPC Service. Executing a manipulation can lead to backdoor. This vulnerability
CVE-2025-65841 | Aquarius Desktop up to 3.0.069 on macOS ~/Library/Application weak password encoding
A vulnerability marked as critical has been reported in Aquarius Desktop up to 3.0.069 on macOS. This impacts an unknown function in the library ~/Library/Application. Performing a manipulation results in weak encoding for password. This vu
CVE-2025-65320 | Abacre Restaurant Point of Sale up to 15.0.0.1656 cleartext storage
A vulnerability categorized as critical has been discovered in Abacre Restaurant Point of Sale up to 15.0.0.1656. Impacted is an unknown function. Executing a manipulation can lead to cleartext storage of sensitive information. The identifi
CVE-2025-65267 | ERPNext/Frappe SVG Avatar Image cross site scripting
A vulnerability was found in ERPNext and Frappe and classified as problematic. Affected by this issue is some unknown functionality of the component SVG Avatar Image Handler. The manipulation results in cross site scripting. This vulnerabil
CVE-2025-63401 | HCL Limited HCLTech DRAGON up to 7.5.x cross site scripting
A vulnerability classified as problematic has been found in HCL Limited HCLTech DRAGON up to 7.5.x. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. This vulnerability is referenced
CVE-2025-57202 | AVTECH DGM1104 FullImg-1015-1004-1006-1003 PwdGrp.cgi username cross site scripting
A vulnerability identified as problematic has been detected in AVTECH DGM1104 FullImg-1015-1004-1006-1003. The affected element is an unknown function of the file PwdGrp.cgi. The manipulation of the argument Username leads to cross site scr
CVE-2025-57200 | AVTECH DGM1104 FullImg-1015-1004-1006-1003 test_mail command injection
A vulnerability classified as critical was found in AVTECH DGM1104 FullImg-1015-1004-1006-1003. This affects the function test_mail. Such manipulation leads to command injection. This vulnerability is documented as CVE-2025-57200. The attac
CVE-2025-57199 | AVTECH DGM1104 FullImg-1015-1004-1006-1003 NetFailDetectD command injection
A vulnerability was found in AVTECH DGM1104 FullImg-1015-1004-1006-1003. It has been declared as critical. This vulnerability affects unknown code of the component NetFailDetectD. Such manipulation leads to command injection. This vulnerabi
CVE-2025-57198 | AVTECH DGM1104 FullImg-1015-1004-1006-1003 Machine.cgi command injection
A vulnerability, which was classified as critical, has been found in AVTECH DGM1104 FullImg-1015-1004-1006-1003. This impacts an unknown function of the file Machine.cgi. Performing a manipulation results in command injection. This vulnerab
CVE-2025-54326 | Samsung Mobile Processor Exynos 1280/2200 Camera null pointer dereference
A vulnerability was found in Samsung Mobile Processor Exynos 1280/2200 and classified as problematic. The impacted element is an unknown function of the component Camera. Executing a manipulation can lead to null pointer dereference. This v
CVE-2025-53965 | Samsung Mobile Processor/Wearable Processor/Modem Exynos up to 5400 memory corruption
A vulnerability has been found in Samsung Mobile Processor, Wearable Processor and Modem Exynos up to 5400 and classified as critical. The affected element is an unknown function. Performing a manipulation results in memory corruption. This
CVE-2025-50360 | Pepper Language PR File compiler.c heap-based overflow
A vulnerability marked as critical has been reported in Pepper Language 0.1.1commit 961a5d9988c5986d563310275adad3fd181b2bb7.. Affected by this vulnerability is an unknown functionality in the library compiler.h of the file compiler.c of th
CVE-2026-109408 | jopenlibs vault-java-driver up to 6.2.3 TLS Configuration SslConfig.isVerify certificate validation (EUVD-2026-117400)
A vulnerability labeled as problematic has been found in jopenlibs vault-java-driver up to 6.2.3. This affects the function SslConfig.isVerify of the component TLS Configuration. The manipulation results in improper certificate validation.
CVE-2026-107776 | Dokan Plugin up to 5.3.2 on WordPress logic error (EUVD-2026-117401)
A vulnerability was found in Dokan Plugin up to 5.3.2 on WordPress. It has been rated as problematic. Impacted is an unknown function. Performing a manipulation results in business logic errors. This vulnerability was named CVE-2026-107776.
CVE-2026-100109 | Security for WooCommerce Plugin up to 1.0.16 on WordPress authorization (EUVD-2026-117402)
A vulnerability categorized as critical has been discovered in Security for WooCommerce Plugin up to 1.0.16 on WordPress. The affected element is an unknown function. Executing a manipulation can lead to missing authorization. The identific
CVE-2026-62041 | Ashok Dudhat Event Manager Plugin up to 3.4.1 on WordPress authorization (EUVD-2026-95728)
A vulnerability was found in Ashok Dudhat Event Manager Plugin up to 3.4.1 on WordPress. It has been classified as critical. This vulnerability affects unknown code. The manipulation leads to missing authorization. This vulnerability is uni
CVE-2026-112072 | jopenlibs vault-java-driver up to 6.2.3 minimal-json parser stack-based overflow (EUVD-2026-117399)
A vulnerability identified as critical has been detected in jopenlibs vault-java-driver up to 6.2.3. The impacted element is an unknown function of the component minimal-json parser. The manipulation leads to stack-based buffer overflow. Th
CVE-2026-73996 | Masteriyo Plugin up to 2.3.2 on WordPress unrestricted upload (EUVD-2026-60810)
A vulnerability marked as critical has been reported in Masteriyo Plugin up to 2.3.2 on WordPress. Impacted is an unknown function. This manipulation causes unrestricted upload. The identification of this vulnerability is CVE-2026-73996. It
CVE-2026-117679 | SHIRASAGI Project up to 1.21.0 cross site scripting (EUVD-2026-117398)
A vulnerability marked as problematic has been reported in SHIRASAGI Project SHIRASAGI up to 1.21.0. This impacts an unknown function. This manipulation causes cross site scripting. This vulnerability is tracked as CVE-2026-117679. The atta
CVE-2026-118869 | SHIRASAGI Project up to 1.21.0 os command injection (EUVD-2026-117397)
A vulnerability described as very critical has been identified in SHIRASAGI Project SHIRASAGI up to 1.21.0. Affected is an unknown function. Such manipulation leads to os command injection. This vulnerability is listed as CVE-2026-118869. T
CVE-2026-80948 | Linux Kernel up to 6.18.49/7.2.3 iwlwifi iwl_op_mode_dvm_start nvm_data/eeprom_blob memory leak (WID-SEC-2026-3321)
A vulnerability was found in Linux Kernel up to 6.18.49/7.2.3. It has been rated as critical. The affected element is the function iwl_op_mode_dvm_start of the component iwlwifi. This manipulation of the argument nvm_data/eeprom_blob causes
CVE-2026-79405 | Unisoc Modem UDX710 input validation (EUVD-2026-116697)
A vulnerability classified as critical has been found in Unisoc Modem UDX710. Affected by this vulnerability is an unknown functionality. Performing a manipulation results in improper input validation. This vulnerability is reported as CVE-
CVE-2026-16437 | Mitsubishi Electric AnalytiX Password Recovery password recovery (EUVD-2026-101941)
A vulnerability marked as very critical has been reported in Mitsubishi Electric AnalytiX, BizViz, GENESIS, GENESIS32, GENESIS64, Hyper Historian, ICONICS Suite, IoTWorX, MC Works64 and MobileHMI. Impacted is an unknown function of the comp
CVE-2026-123029 | Wowza Streaming Engine up to 4.12.1 xml external entity reference (EUVD-2026-117386)
A vulnerability was found in Wowza Streaming Engine up to 4.12.1. It has been classified as critical. This vulnerability affects unknown code. This manipulation causes xml external entity reference. This vulnerability is handled as CVE-2026
CVE-2026-123033 | iXsystems TrueNAS SCALE up to 25.10.7 middlewared improper authentication (EUVD-2026-117387)
A vulnerability was found in iXsystems TrueNAS SCALE up to 25.10.7. It has been declared as very critical. This issue affects some unknown processing of the component middlewared. Such manipulation leads to improper authentication. This vul
CVE-2026-80335 | Unisoc Bootloader up to T9100 Bootloader Download out-of-bounds write (EUVD-2026-116698)
A vulnerability, which was classified as very critical, has been found in Unisoc Bootloader up to T9100. This affects an unknown part of the component Bootloader Download Module. The manipulation leads to out-of-bounds write. This vulnerabi
CVE-2025-65881 | SourceCodester Zoo Management System 1.0 /classes/Login.php cross site scripting
A vulnerability was found in SourceCodester Zoo Management System 1.0. It has been rated as problematic. Affected by this vulnerability is an unknown functionality of the file /classes/Login.php. The manipulation leads to cross site scripti
CVE-2025-65844 | EverShop 2.0.1 /api/images unrestricted upload (Issue 819 / EUVD-2025-200288)
A vulnerability labeled as critical has been found in EverShop 2.0.1. This vulnerability affects unknown code of the file /api/images. Such manipulation leads to unrestricted upload. This vulnerability is documented as CVE-2025-65844. The a
CVE-2025-65215 | SourceCodester Web-based Pharmacy Product Management System 1.0 add-supplier.php Name cross site scripting
A vulnerability was found in SourceCodester Web-based Pharmacy Product Management System 1.0. It has been declared as problematic. Affected is an unknown function of the file /product_expiry/add-supplier.php. Executing a manipulation of the
CVE-2025-65187 | CiviCRM up to 6.6 Accounting Batches cross site scripting
A vulnerability categorized as problematic has been discovered in CiviCRM up to 6.6. Affected by this issue is some unknown functionality. The manipulation of the argument Accounting Batches results in cross site scripting. This vulnerabili