Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 780 | 0,2 % |
| ≥50 % | 3.512 | 0,9 % |
| ≥10 % | 22.881 | 5,7 % |
| <10 % | 376.485 | 93,3 % |
CVE-2026-91453 | Oracle Java SE/GraalVM for JDK/GraalVM Enterprise Edition Lightweight HTTP Server improper authorization (Nessus ID 376139)
A vulnerability was found in Oracle Java SE, GraalVM for JDK and GraalVM Enterprise Edition. It has been declared as problematic. Impacted is an unknown function of the component Lightweight HTTP Server. Such manipulation leads to improper
CVE-2026-91452 | Oracle GraalVM Enterprise Edition/GraalVM for JDK/Java SE Networking improper authorization (Nessus ID 376139)
A vulnerability was found in Oracle GraalVM Enterprise Edition, GraalVM for JDK and Java SE. It has been rated as problematic. The affected element is an unknown function of the component Networking. Performing a manipulation results in imp
CVE-2026-91451 | Oracle Java SE/GraalVM for JDK/GraalVM Enterprise Edition Networking access control (Nessus ID 376139)
A vulnerability, which was classified as problematic, was found in Oracle Java SE, GraalVM for JDK and GraalVM Enterprise Edition. This vulnerability affects unknown code of the component Networking. Executing a manipulation can lead to imp
CVE-2026-91418 | Oracle Java SE ImageIO resource consumption (Nessus ID 376139)
A vulnerability, which was classified as problematic, has been found in Oracle Java SE, JavaFX, GraalVM for JDK and GraalVM Enterprise Edition. This issue affects some unknown processing of the component ImageIO. Performing a manipulation r
CVE-2026-91333 | Oracle Java SE 21.0.12.1/25.0.4.1/27 Security privileges management (Nessus ID 376139)
A vulnerability, which was classified as problematic, was found in Oracle Java SE 21.0.12.1/25.0.4.1/27. Affected by this vulnerability is an unknown functionality of the component Security. Executing a manipulation can lead to improper pri
CVE-2026-87291 | Oracle Java SE 21.0.12.1/25.0.4.1/27 Networking information disclosure (Nessus ID 376139)
A vulnerability classified as problematic was found in Oracle Java SE 21.0.12.1/25.0.4.1/27. This vulnerability affects unknown code of the component Networking. Such manipulation leads to information disclosure. This vulnerability is liste
APT Vulnerability Lets a MITM Run Code as Root
Debian and Ubuntu patched CVE-2026-109518 on November 4, 2026, an apt vulnerability that lets a man-in-the-middle swap a package after verification and run code as root. I list the fixed releases across eight Ubuntu lines and four Debian se
CVE-2022-4051 | Hostel Searching Project view-property.php property_id sql injection (EUVD-2022-51428)
A vulnerability was found in Hostel Searching Project. It has been rated as critical. This vulnerability affects unknown code of the file view-property.php. Performing a manipulation of the argument property_id results in sql injection. Thi
CVE-2022-4037 | GitLab Community Edition/Enterprise Edition up to 15.5.6/15.6.3/15.7.1 Email race condition (Issue 382957 / EUVD-2022-51416)
A vulnerability classified as problematic has been found in GitLab Community Edition and Enterprise Edition up to 15.5.6/15.6.3/15.7.1. Affected is an unknown function of the component Email Handler. The manipulation leads to race condition
CVE-2022-4025 | Google Chrome up to 97.0.4692.99 Paint cross-domain policy (EUVD-2022-51404)
A vulnerability identified as critical has been detected in Google Chrome. Affected is an unknown function of the component Paint. The manipulation leads to permissive cross-domain policy with untrusted domains. This vulnerability is refere
CVE-2022-4015 | Sports Club Management System 119 admin/make_payments.php m_id/plan sql injection (EUVD-2022-51395)
A vulnerability categorized as critical has been discovered in Sports Club Management System 119. This vulnerability affects unknown code of the file admin/make_payments.php. Such manipulation of the argument m_id/plan leads to sql injectio
CVE-2025-65202 | TRENDnet TEW-657BRM 1.00.1 HTTP Parameter setup.cgi command/todo/next_file os command injection
A vulnerability, which was classified as critical, was found in TRENDnet TEW-657BRM 1.00.1. This impacts an unknown function of the file setup.cgi of the component HTTP Parameter Handler. Such manipulation of the argument command/todo/next_
CVE-2025-63525 | Blood Bank Management System 1.0 Request delete.php privilege escalation (EUVD-2025-200000)
A vulnerability classified as critical has been found in Blood Bank Management System 1.0. The impacted element is an unknown function of the file delete.php of the component Request Handler. The manipulation leads to privilege escalation.
CVE-2025-63522 | FeehiCMS 2.1.1 reverse tabnabbing (Issue 76)
A vulnerability was found in FeehiCMS 2.1.1. It has been rated as critical. Affected is an unknown function. The manipulation leads to use of web link to untrusted target with window.opener access. This vulnerability is listed as CVE-2025-6
CVE-2025-63520 | FeehiCMS 2.1.1 User Update id cross site scripting (Issue 74)
A vulnerability identified as problematic has been detected in FeehiCMS 2.1.1. Affected by this issue is some unknown functionality of the component User Update Handler. This manipulation of the argument ID causes cross site scripting. This
CVE-2026-122049 | Campcodes Bitcoin Wallet System 1.0 ForgotPasswordController.php random_int excessive authentication (EUVD-2026-117196)
A vulnerability identified as problematic has been detected in Campcodes Bitcoin Wallet System 1.0. This affects the function random_int of the file core/app/Http/Controllers/Auth/ForgotPasswordController.php. This manipulation causes impro
CVE-2026-71364 | Red Hat Ansible Automation Platform Archive Extraction project_archive path traversal (EUVD-2026-64918 / Nessus ID 339184)
A vulnerability was found in Red Hat Ansible Automation Platform. It has been declared as very critical. The affected element is the function project_archive of the component Archive Extraction. Executing a manipulation can lead to path tra
CVE-2026-71365 | Red Hat Ansible Automation Platform Webhook Status Callback server-side request forgery (EUVD-2026-61015 / Nessus ID 339184)
A vulnerability, which was classified as problematic, has been found in Red Hat Ansible Automation Platform. Affected is an unknown function of the component Webhook Status Callback. This manipulation causes server-side request forgery. The
CVE-2026-71366 | Red Hat Ansible Automation Platform Notification Backend server-side request forgery (EUVD-2026-64923 / Nessus ID 339184)
A vulnerability was found in Red Hat Ansible Automation Platform and classified as problematic. The impacted element is an unknown function of the component Notification Backend. Executing a manipulation can lead to server-side request forg
CVE-2026-75092 | Red Hat Enterprise Linux/OpenStack Platform scan_mysql actor mysqld-auto.cnf dlopen privileges management (EUVD-2026-78326)
A vulnerability was found in Red Hat Enterprise Linux and OpenStack Platform. It has been declared as very critical. Affected by this vulnerability is the function dlopen of the file mysqld-auto.cnf of the component scan_mysql actor. Execut
CVE-2025-65670 | classroomio 0.1.13 resource injection
A vulnerability categorized as problematic has been discovered in classroomio 0.1.13. This issue affects some unknown processing. Such manipulation leads to improper control of resource identifiers. This vulnerability is documented as CVE-2
CVE-2025-65276 | henzljw hashtech 1.0 /admin_index.php access control
A vulnerability classified as critical has been found in henzljw hashtech 1.0. The affected element is an unknown function of the file /admin_index.php. The manipulation leads to improper access controls. This vulnerability is uniquely iden
CVE-2025-65239 | OpenCode USSD Gateway OC 6.13.11 /aux1/ocussd/trace access control
A vulnerability was found in OpenCode USSD Gateway OC 6.13.11. It has been rated as critical. Impacted is an unknown function of the file /aux1/ocussd/trace. This manipulation causes improper access controls. This vulnerability appears as C
CVE-2025-65238 | OpenCode USSD Gateway OC 6.13.11 getSubUsersByProvider access control
A vulnerability, which was classified as problematic, has been found in OpenCode USSD Gateway OC 6.13.11. This affects the function getSubUsersByProvider. Performing a manipulation results in improper access controls. This vulnerability is
CVE-2025-65237 | Opencode USSD Gateway OC cross site scripting
A vulnerability, which was classified as problematic, was found in Opencode USSD Gateway OC. This vulnerability affects unknown code. Executing a manipulation can lead to cross site scripting. This vulnerability is tracked as CVE-2025-65237
CVE-2025-50433 | imonnit 2025-04-24 password recovery
A vulnerability, which was classified as critical, was found in imonnit 2025-04-24. This issue affects some unknown processing. The manipulation results in weak password recovery. This vulnerability was named CVE-2025-50433. The attack may
CVE-2025-26155 | NCP Secure Enterprise Client untrusted search path
A vulnerability was found in NCP Secure Enterprise Client and Secure Entry Windows Client and classified as problematic. This affects an unknown function. Such manipulation leads to untrusted search path. This vulnerability is listed as CVE
CVE-2026-112892 | python-pillow Pillow up to 12.x MSP RLE decoder buffer overflow (Nessus ID 376140)
A vulnerability identified as problematic has been detected in python-pillow Pillow up to 12.x. Affected by this vulnerability is an unknown functionality of the component MSP RLE decoder. The manipulation leads to buffer overflow. This vul
CVE-2026-112406 | Pillow up to 12.x PDF Page PdfParser.rewrite_pages infinite loop (Nessus ID 376140)
A vulnerability categorized as problematic has been discovered in Pillow up to 12.x. Affected is the function PdfParser.rewrite_pages of the component PDF Page. Executing a manipulation can lead to infinite loop. This vulnerability is track
CVE-2026-112894 | python-pillow Pillow up to 12.x Pdf Parser PdfParser.next_object_id resource consumption (Nessus ID 376140)
A vulnerability, which was classified as problematic, was found in python-pillow Pillow up to 12.x. The impacted element is the function PdfParser.next_object_id of the component Pdf Parser. The manipulation results in resource consumption.
Ubuntu users blast Canonical for slow kernel security fix
Canonical is fixing a critical Linux kernel flaw in Ubuntu, weeks after Debian and other distros did – and users aren’t happy about the wait. As of 3 November, patched kernels for CVE-2026-98432 are in testing for Ubuntu 22.04, 24.04 and 26
CVE-2025-65647 | PHPGurukul Online Shopping Portal 2.1 Track Order Function oid authorization
A vulnerability was found in PHPGurukul Online Shopping Portal 2.1. It has been classified as problematic. Affected is an unknown function of the component Track Order Function. This manipulation of the argument oid causes authorization byp
CVE-2025-65236 | Opencode USSD Gateway OC index.php Session ID sql injection
A vulnerability classified as critical has been found in Opencode USSD Gateway OC. Affected by this vulnerability is an unknown functionality of the file /occontrolpanel/index.php. This manipulation of the argument Session ID causes sql inj
CVE-2025-65235 | OpenCode USSD Gateway OC 6.13.11 getSubUsersByProvider ID sql injection
A vulnerability has been found in OpenCode USSD Gateway OC 6.13.11 and classified as critical. This issue affects the function getSubUsersByProvider. The manipulation of the argument ID leads to sql injection. This vulnerability is listed a
CVE-2025-64067 | Primakon Primakon Pi Portal 1.0.18 API Endpoint user_id/project_id information disclosure
A vulnerability marked as problematic has been reported in Primakon Primakon Pi Portal 1.0.18. Affected is an unknown function of the component API Endpoint. Performing a manipulation of the argument user_id/project_id results in informatio
CVE-2025-64065 | Primakon Pi Portal 1.0.18 /api/V2/pp_udfv_admin access control
A vulnerability, which was classified as critical, has been found in Primakon Pi Portal 1.0.18. Affected by this vulnerability is an unknown functionality of the file /api/V2/pp_udfv_admin. The manipulation leads to improper access controls
CVE-2025-64064 | Primakon Pi Portal 1.0.18 PATCH Request /api/v2/pp_users PP_SECURITY_PROFILE_ID access control
A vulnerability was found in Primakon Pi Portal 1.0.18. It has been classified as critical. This issue affects some unknown processing of the file /api/v2/pp_users of the component PATCH Request Handler. Performing a manipulation of the arg
CVE-2025-64063 | Primakon Pi Portal 1.0.18 API Endpoint direct request
A vulnerability classified as critical was found in Primakon Pi Portal 1.0.18. Affected is an unknown function of the component API Endpoint. Executing a manipulation can lead to direct request. This vulnerability appears as CVE-2025-64063.
CVE-2025-51742 | jishenghua JSH_ERP 2.3.1 Endpoint getMaterialEnableSerialNumberList parseObject query deserialization
A vulnerability was found in jishenghua JSH_ERP 2.3.1. It has been declared as critical. Affected by this vulnerability is the function parseObject of the file /material/getMaterialEnableSerialNumberList of the component Endpoint. Such mani
CVE-2025-50402 | FAST FAC1200R F400_FAC1200R_Q sub_80435780 fac_password buffer overflow
A vulnerability has been found in FAST FAC1200R F400_FAC1200R_Q and classified as critical. Affected by this issue is the function sub_80435780. Performing a manipulation of the argument fac_password results in buffer overflow. This vulnera
CVE-2025-50399 | FAST FAC1200R F400_FAC1200R_Q sub_80435780 password buffer overflow
A vulnerability was found in FAST FAC1200R F400_FAC1200R_Q. It has been declared as critical. This issue affects the function sub_80435780. The manipulation of the argument Password results in buffer overflow. This vulnerability is reported
CVE-2025-46174 | y_project RuoYi 4.8.0 SysUserController.java resetPwd access control (EUVD-2025-199729)
A vulnerability was found in y_project RuoYi 4.8.0 and classified as critical. This affects the function resetPwd of the file SysUserController.java. Executing a manipulation can lead to improper access controls. This vulnerability is regis
CVE-2025-45311 | fail2ban-client 0.11.2 permission (EUVD-2025-199734 / Nessus ID 276966)
A vulnerability, which was classified as critical, has been found in fail2ban-client 0.11.2. Affected is an unknown function. This manipulation causes permission issues. This vulnerability is tracked as CVE-2025-45311. The attack is only po
CVE-2025-65955 | ImageMagick up to 6.9.13-33/7.1.2-8 Magick++ Layer Options::fontFamily double free (GHSA-q3hc-j9x5-mp9m / EUVD-2025-200466)
A vulnerability was found in ImageMagick up to 6.9.13-33/7.1.2-8. It has been classified as critical. The impacted element is the function Options::fontFamily of the component Magick++ Layer. Performing a manipulation results in double free
CVE-2025-65896 | long2ice assyncmy up to 0.2.10 Dict Key sql injection
A vulnerability was found in long2ice assyncmy up to 0.2.10 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Dict Key Handler. Executing a manipulation can lead to sql injection. The id
CVE-2025-65657 | FeehiCMS 2.1.1 unrestricted upload (Issue 78)
A vulnerability, which was classified as critical, has been found in FeehiCMS 2.1.1. This vulnerability affects unknown code. The manipulation leads to unrestricted upload. This vulnerability is traded as CVE-2025-65657. It is possible to i
CVE-2025-65380 | PHPGurukul Billing System 1.0 /admin/index.php username sql injection (EUVD-2025-200326)
A vulnerability, which was classified as critical, was found in PHPGurukul Billing System 1.0. This issue affects some unknown processing of the file /admin/index.php. The manipulation of the argument Username results in sql injection. This
CVE-2025-13502 | WebKitGTK/WPE WebKit GLib Remote Inspector Server integer overflow (EUVD-2025-199556 / Nessus ID 276745)
A vulnerability has been found in WebKitGTK and WPE WebKit and classified as problematic. The impacted element is an unknown function of the component GLib Remote Inspector Server. Performing a manipulation results in integer overflow. This
CVE-2025-10230 | Samba WINS Server Hook Script command injection (EUVD-2025-38301 / Nessus ID 270677)
A vulnerability has been found in Samba and classified as critical. This affects an unknown part of the component WINS Server Hook Script. Performing a manipulation results in command injection. This vulnerability is reported as CVE-2025-10
CVE-2024-3019 | PCP 4.3.4 pmproxy Configuration exposure of resource (RHSA-2024:2566 / Nessus ID 208212)
A vulnerability was found in PCP 4.3.4. It has been rated as problematic. This vulnerability affects unknown code of the component pmproxy Configuration. The manipulation leads to exposure of resource. This vulnerability is listed as CVE-20
CVE-2023-5824 | Squid Web Proxy up to 6.3 HTTP Response Cache structural elements (GHSA-543m-w2m2-g255 / EUVD-2023-58107)
A vulnerability was found in Squid Web Proxy up to 6.3. It has been rated as critical. This vulnerability affects unknown code of the component HTTP Response Cache Handler. The manipulation leads to improper handling of structural elements.
CVE-2023-5557 | tracker-miners sandbox (EUVD-2023-57857 / Nessus ID 242769)
A vulnerability marked as critical has been reported in tracker-miners. This affects an unknown function. Performing a manipulation results in sandbox issue. This vulnerability is known as CVE-2023-5557. Remote exploitation of the attack is
CVE-2026-112397 | python-pillow Pillow up to 12.x Morphology ImageMorph.MorphOp.apply buffer overflow (Nessus ID 376140)
A vulnerability described as problematic has been identified in python-pillow Pillow up to 12.x. The affected element is the function ImageMorph.MorphOp.apply of the component Morphology. Executing a manipulation can lead to buffer overflow
CVE-2022-4013 | Hospital Management Center appointment.php cross-site request forgery (EUVD-2022-51394)
A vulnerability was found in Hospital Management Center. It has been declared as problematic. Affected by this issue is some unknown functionality of the file appointment.php. The manipulation results in cross-site request forgery. This vul
CVE-2022-4012 | Hospital Management Center patient-info.php pt_id sql injection (EUVD-2022-51393)
A vulnerability was found in Hospital Management Center. It has been classified as critical. Affected by this vulnerability is an unknown functionality of the file patient-info.php. The manipulation of the argument pt_id leads to sql inject
CVE-2022-4011 | Simple History Plugin on WordPress Header X-Forwarded-For neutralization for logs (EUVD-2022-51392)
A vulnerability was found in Simple History Plugin on WordPress and classified as critical. Affected is an unknown function of the component Header Handler. Executing a manipulation of the argument X-Forwarded-For can lead to improper outpu
CVE-2022-4009 | Octopus Deploy Offline Package code injection (EUVD-2022-51390)
A vulnerability described as critical has been identified in Octopus Deploy. The impacted element is an unknown function of the component Offline Package Handler. Executing a manipulation can lead to code injection. This vulnerability is ha
CVE-2022-4008 | Octopus Deploy ZIP File denial of service (EUVD-2022-51389)
A vulnerability was found in Octopus Deploy. It has been declared as problematic. Affected by this issue is some unknown functionality of the component ZIP File Handler. The manipulation results in denial of service. This vulnerability is k
plex2scan
Find Plex Media Servers affected by Plex2Shell (CVE-2026-96652 and three more) Weiterlesen
Hackers Target Alpine Linux GitLab Server in Attempted Critical RCE Attack
Alpine Linux has rebuilt its GitLab server and reset all user passwords after hackers attempted to exploit a critical remote code execution (RCE) vulnerability in its development infrastructure. The attacks targeted a maximum-severity vuln