Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 785 | 0,2 % |
| ≥50 % | 3.559 | 0,9 % |
| ≥10 % | 13.139 | 3,2 % |
| <10 % | 396.070 | 95,8 % |
CVE-2025-61482 | NetKnights privacyIDEA Authenticator 4.3.0 on Android OTP/TOTP/HOTP improper authentication
A vulnerability marked as critical has been reported in NetKnights privacyIDEA Authenticator 4.3.0 on Android. This affects an unknown part of the component OTP/TOTP/HOTP. This manipulation causes improper authentication. This vulnerability
CVE-2025-61247 | indieka900 online-shopping-system-php 1.0 login.php password sql injection (EUVD-2025-36203)
A vulnerability was found in indieka900 online-shopping-system-php 1.0. It has been classified as critical. The impacted element is an unknown function of the file login.php. This manipulation of the argument Password causes sql injection.
CVE-2025-52268 | StarCharge Artemis AC Charger 7-22 kW 1.0.4 AES Key hard-coded key
A vulnerability, which was classified as problematic, has been found in StarCharge Artemis AC Charger 7-22 kW 1.0.4. The affected element is an unknown function of the component AES Key Handler. The manipulation leads to use of hard-coded c
CVE-2025-52264 | StarCharge Artemis AC Charger 7-22 kW 1.0.4 download.cgi cgiMain stack-based overflow
A vulnerability classified as critical was found in StarCharge Artemis AC Charger 7-22 kW 1.0.4. Impacted is the function cgiMain of the file download.cgi. Executing a manipulation can lead to stack-based buffer overflow. This vulnerability
AI Found 948 Linux Kernel Bugs — Here's How OpenAI's Models Did It
Tags: #security #openai #linux #ai OpenAI's o3 and o4-mini reasoning models just changed what we thought AI could do in security research. Working alongside researchers, they surfaced 948 CVE-grade vulnerabilities in the Linux kernel —
CVE-2025-27225 | Rocket TRUfusion Enterprise up to 7.10.4.0 Endpoint internal_admin_contact_login.jsp information disclosure
A vulnerability was found in Rocket TRUfusion Enterprise up to 7.10.4.0. It has been declared as problematic. This vulnerability affects unknown code of the file /trufusionPortal/jsp/internal_admin_contact_login.jsp of the component Endpoin
CVE-2025-27222 | Rocket TRUfusion Enterprise up to 7.10.4.0 getCobrandingData path traversal
A vulnerability labeled as critical has been found in Rocket TRUfusion Enterprise up to 7.10.4.0. Affected is an unknown function of the file /trufusionPortal/getCobrandingData. The manipulation results in path traversal. This vulnerability
CVE-2025-60954 | Microweber CMS 2.0 Password Length password recovery
A vulnerability was found in Microweber CMS 2.0. It has been rated as problematic. This issue affects some unknown processing of the component Password Length Handler. The manipulation leads to weak password recovery. This vulnerability is
CVE-2025-60803 | Antabot White-Jotter up to 9bcadc /api/aaa;/../register os command injection (Issue 162 / EUVD-2025-35863)
A vulnerability classified as critical has been found in Antabot White-Jotter up to 9bcadc. The affected element is an unknown function of the file /api/aaa;/../register. This manipulation causes os command injection. This vulnerability is
CVE-2025-60730 | PerfreeBlog 4.0.11 unInstallTheme cleanup
A vulnerability was found in PerfreeBlog 4.0.11. It has been rated as problematic. The affected element is the function unInstallTheme. The manipulation leads to incomplete cleanup. This vulnerability is traded as CVE-2025-60730. It is poss
CVE-2025-60564 | D-Link DIR600L 116WWb01 formSetLog curTime buffer overflow
A vulnerability was found in D-Link DIR600L 116WWb01. It has been classified as critical. Affected by this issue is the function formSetLog. This manipulation of the argument curTime causes buffer overflow. This vulnerability appears as CVE
CVE-2025-60419 | Realtek NDIS Usermode I/O Driver RtkIOAC60.sys denial of service (EUVD-2025-35892)
A vulnerability described as problematic has been identified in Realtek NDIS Usermode IO Driver. The affected element is an unknown function in the library RtkIOAC60.sys. Such manipulation leads to denial of service. This vulnerability is u
CVE-2025-60291 | eTimeTrackLite Web up to 12.0 permission
A vulnerability marked as critical has been reported in eTimeTrackLite Web up to 12.0. Affected is an unknown function. The manipulation leads to permission issues. This vulnerability is documented as CVE-2025-60291. The attack requires bei
CVE-2025-52263 | StarCharge Artemis AC Charger 7-22 kW 1.0.4 Web Configuration code download
A vulnerability was found in StarCharge Artemis AC Charger 7-22 kW 1.0.4. It has been declared as critical. This affects an unknown function of the component Web Configuration Module. Such manipulation leads to download of code without inte
CVE-2025-60563 | D-Link DIR600L 116WWb01 formSetPortTr curTime buffer overflow
A vulnerability was found in D-Link DIR600L 116WWb01 and classified as critical. Affected by this vulnerability is the function formSetPortTr. The manipulation of the argument curTime results in buffer overflow. This vulnerability is report
CVE-2025-60562 | D-Link DIR600L 116WWb01 formWlSiteSurvey curTime buffer overflow
A vulnerability has been found in D-Link DIR600L 116WWb01 and classified as critical. Affected is the function formWlSiteSurvey. The manipulation of the argument curTime leads to buffer overflow. This vulnerability is documented as CVE-2025
CVE-2025-60561 | D-Link DIR600L formSetEmail curTime buffer overflow
A vulnerability, which was classified as critical, was found in D-Link DIR600L. This impacts the function formSetEmail. Executing a manipulation of the argument curTime can lead to buffer overflow. This vulnerability is registered as CVE-20
CVE-2025-60559 | D-Link DIR600L 116WWb01 formSetDomainFilter curTime buffer overflow
A vulnerability, which was classified as critical, has been found in D-Link DIR600L 116WWb01. This affects the function formSetDomainFilter. Performing a manipulation of the argument curTime results in buffer overflow. This vulnerability is
CVE-2025-60558 | D-Link DIR600L 116WWb01 formVirtualServ curTime buffer overflow
A vulnerability, which was classified as critical, was found in D-Link DIR600L 116WWb01. Affected by this issue is the function formVirtualServ. The manipulation of the argument curTime results in buffer overflow. This vulnerability is cata
CVE-2025-60557 | D-Link DIR600L 116WWb01 formSetEasy_Wizard curTime buffer overflow
A vulnerability, which was classified as critical, has been found in D-Link DIR600L 116WWb01. Affected by this vulnerability is the function formSetEasy_Wizard. The manipulation of the argument curTime leads to buffer overflow. This vulnera
CVE-2025-60556 | D-Link DIR600L 116WWb01 formSetWizard1 curTime buffer overflow
A vulnerability classified as critical has been found in D-Link DIR600L 116WWb01. This impacts the function formSetWizard1. Performing a manipulation of the argument curTime results in buffer overflow. This vulnerability is identified as CV
CVE-2025-60555 | D-Link DIR600L 116WWb01 formSetWizardSelectMode curTime buffer overflow
A vulnerability categorized as critical has been discovered in D-Link DIR600L 116WWb01. The impacted element is the function formSetWizardSelectMode. The manipulation of the argument curTime results in buffer overflow. This vulnerability is
CVE-2025-60554 | D-Link DIR600L 116WWb01 formSetEnableWizard curTime buffer overflow
A vulnerability described as critical has been identified in D-Link DIR600L 116WWb01. This affects the function formSetEnableWizard. Such manipulation of the argument curTime leads to buffer overflow. This vulnerability is referenced as CVE
CVE-2025-61189 | JeecgBoot up to 3.8.2 Endpoint /sys/comment/addFile path traversal (Issue 8827)
A vulnerability classified as critical has been found in JeecgBoot up to 3.8.2. Affected by this vulnerability is an unknown functionality of the file /sys/comment/addFile of the component Endpoint. This manipulation causes path traversal.
CVE-2025-60938 | Emoncms 11.7.3 Firmware Upload upload-custom-firmware filename/port/baud_rate/core/autoreset input validation (EUVD-2025-35852)
A vulnerability classified as critical was found in Emoncms 11.7.3. This issue affects some unknown processing of the file /admin/upload-custom-firmware of the component Firmware Upload Handler. The manipulation of the argument filename/por
CVE-2025-56807 | FairSketch RISE Ultimate Project Manager & CRM 3.9.4 cross site scripting
A vulnerability, which was classified as problematic, was found in FairSketch RISE Ultimate Project Manager &amp; CRM 3.9.4. Affected by this issue is some unknown functionality. Executing a manipulation can lead to cross site scripting
CVE-2025-56795 | hay-kot Mealie up to 3.0.1 /api/recipes/ note/text cross site scripting (Issue 5677)
A vulnerability labeled as problematic has been found in hay-kot Mealie up to 3.0.1. This vulnerability affects unknown code of the file /api/recipes/. Such manipulation of the argument note/text leads to cross site scripting. This vulnerab
CVE-2025-26278 | dref 0.1.2 lib.set prototype pollution
A vulnerability was found in dref 0.1.2. It has been classified as problematic. This affects the function lib.set. This manipulation causes improperly controlled modification of object prototype attributes. This vulnerability is registered
CVE-2025-11126 | Apeman ID71 218.53.203.117 /system/www/system.ini hard-coded credentials (EUVD-2025-31481 / CNNVD-202509-4430)
A vulnerability categorized as critical has been discovered in Apeman ID71 218.53.203.117. This vulnerability affects unknown code of the file /system/www/system.ini. The manipulation results in hard-coded credentials. This vulnerability wa
CVE-2025-57644 | Accela Automation Platform 22.2.3.0.230103 Test Script Feature server-side request forgery
A vulnerability, which was classified as critical, has been found in Accela Automation Platform 22.2.3.0.230103. Affected by this vulnerability is an unknown functionality of the component Test Script Feature. This manipulation causes serve
CVE-2025-57528 | Tenda AC6 15.03.05.16_multi_TD01 formSetCfm funcname/funcpara1/funcpara2 denial of service
A vulnerability marked as critical has been reported in Tenda AC6 15.03.05.16_multi_TD01. The impacted element is the function formSetCfm. Performing a manipulation of the argument funcname/funcpara1/funcpara2 results in denial of service.
CVE-2025-57295 | H3C NX15V100R015 Administrative Interface /etc/shadow default credentials
A vulnerability identified as very critical has been detected in H3C NX15V100R015. This impacts an unknown function of the file /etc/shadow of the component Administrative Interface. This manipulation causes use of default credentials. The
CVE-2025-56869 | Sync In Server up to 1.1.1 files-manager.service.ts FilesManager.saveMultipart path traversal
A vulnerability classified as critical was found in Sync In Server up to 1.1.1. Affected is the function FilesManager.saveMultipart of the file backend/src/applications/files/services/files-manager.service.ts. The manipulation results in pa
CVE-2025-55888 | ARD Ajax Transaction Manager Endpoint accountName cross site scripting
A vulnerability identified as problematic has been detected in ARD. This issue affects some unknown processing of the component Ajax Transaction Manager Endpoint. This manipulation of the argument accountName causes cross site scripting. Th
CVE-2025-34200 | Vasion Print Virtual Appliance Host/Print Application /etc/issue cleartext storage (EUVD-2025-30260 / WID-SEC-2025-2103)
A vulnerability classified as problematic has been found in Vasion Print Virtual Appliance Host and Print Application. Affected is an unknown function of the file /etc/issue. This manipulation causes cleartext storage of sensitive informati
CVE-2025-57625 | CYRISMA Sensor up to 443 on Windows Cyrisma_Agent Service DataSpotliteAgent.exe permission
A vulnerability was found in CYRISMA Sensor up to 443 on Windows. It has been classified as critical. This impacts an unknown function of the file DataSpotliteAgent.exe of the component Cyrisma_Agent Service. This manipulation causes permis
CVE-2025-57624 | CYRISMA Agent up to 443 uncontrolled search path
A vulnerability labeled as problematic has been found in CYRISMA Agent up to 443. This vulnerability affects unknown code. The manipulation results in uncontrolled search path. This vulnerability was named CVE-2025-57624. The attack needs t
CVE-2025-56562 | Signify Wiz Connected 1.9.1 denial of service
A vulnerability categorized as problematic has been discovered in Signify Wiz Connected 1.9.1. Affected by this issue is some unknown functionality. Executing a manipulation can lead to denial of service. This vulnerability is handled as CV
CVE-2025-56557 | Tuya Smart Life App 5.6.1 Matter Protocol unnecessary privileges (EUVD-2025-29640)
A vulnerability identified as critical has been detected in Tuya Smart Life App 5.6.1. This affects an unknown part of the component Matter Protocol Handler. The manipulation leads to execution with unnecessary privileges. This vulnerabilit
CVE-2025-56295 | code-projects Computer Laboratory System 1.0 unrestricted upload
A vulnerability was found in code-projects Computer Laboratory System 1.0. It has been classified as critical. Impacted is an unknown function. Performing a manipulation results in unrestricted upload. This vulnerability was named CVE-2025-
CVE-2025-56293 | code-projects Human Resource Integrated System 1.0 Add Child Information Section Childs Name cross site scripting
A vulnerability was found in code-projects Human Resource Integrated System 1.0 and classified as problematic. The impacted element is an unknown function of the component Add Child Information Section. Executing a manipulation of the argum
CVE-2025-56280 | code-projects Food Ordering Review System 1.0 cross site scripting
A vulnerability has been found in code-projects Food Ordering Review System 1.0 and classified as problematic. The affected element is an unknown function. Performing a manipulation results in cross site scripting. This vulnerability is kno
CVE-2025-57117 | Rems Employee Management System 1.0 Add Department department.php Department Name cross site scripting
A vulnerability, which was classified as problematic, was found in Rems Employee Management System 1.0. Impacted is an unknown function of the file department.php of the component Add Department Handler. Executing a manipulation of the argu
CVE-2025-56710 | PHPGurukul Student Result Management System 2.0 Profile Page /create-class.php cross-site request forgery
A vulnerability has been found in PHPGurukul Student Result Management System 2.0 and classified as problematic. This affects an unknown function of the file /create-class.php of the component Profile Page. Performing a manipulation results
CVE-2025-56448 | Positron PX360BT 8 authentication replay
A vulnerability described as critical has been identified in Positron PX360BT 8. The affected element is an unknown function. Executing a manipulation can lead to authentication bypass by capture-replay. The identification of this vulnerabi
CVE-2025-56274 | SourceCodester Web-based Pharmacy Product Management System 1.0 access control
A vulnerability, which was classified as critical, was found in SourceCodester Web-based Pharmacy Product Management System 1.0. This affects an unknown part. Such manipulation leads to improper access controls. This vulnerability is docume
CVE-2025-56252 | ServitiumCRM 2.10 URL mobile cross site scripting
A vulnerability labeled as problematic has been found in ServitiumCRM 2.10. This impacts an unknown function of the component URL Handler. Executing a manipulation of the argument mobile can lead to cross site scripting. The identification
CVE-2025-55834 | JeeWMS up to 3.7 logController.do cross site scripting
A vulnerability was found in JeeWMS up to 3.7. It has been declared as problematic. This vulnerability affects unknown code of the file logController.do. Such manipulation leads to cross site scripting. This vulnerability is referenced as C
CVE-2025-52044 | Frappe ERPNext 15.57.5 erpnext/stock/utils.py get_stock_balance inventory_dimensions_dict sql injection
A vulnerability has been found in Frappe ERPNext 15.57.5 and classified as critical. This affects the function get_stock_balance of the file erpnext/stock/utils.py. Performing a manipulation of the argument inventory_dimensions_dict results
CVE-2025-50944 | AVTECH EagleEyes 2.0.0 checkServerTrusted certificate validation
A vulnerability was found in AVTECH EagleEyes 2.0.0. It has been classified as critical. Affected is the function checkServerTrusted. The manipulation leads to improper certificate validation. This vulnerability is listed as CVE-2025-50944.
CVE-2025-44034 | oa_system oasys 1.1 AddrController alph sql injection
A vulnerability, which was classified as critical, was found in oa_system oasys 1.1. The impacted element is an unknown function of the file src/main/Java/cn/gson/oasys/controller/address/AddrController. Such manipulation of the argument al
CVE-2026-17211 | IBM API Connect up to 10.0.8.12/12.1.1.2 denial of service (EUVD-2026-118655)
A vulnerability, which was classified as problematic, has been found in IBM API Connect up to 10.0.8.12/12.1.1.2. This issue affects some unknown processing. The manipulation leads to denial of service. This vulnerability is listed as CVE-2
CVE-2026-110283 | IBM Db2 Genius Hub 1.1.2/1.1.3/1.1.4/1.1.5 resource consumption (EUVD-2026-117104)
A vulnerability classified as problematic was found in IBM Db2 Genius Hub 1.1.2/1.1.3/1.1.4/1.1.5. The affected element is an unknown function. Such manipulation leads to resource consumption. This vulnerability is listed as CVE-2026-110283
CVE-2026-108838 | IBM Db2 Genius Hub 1.1.2/1.1.3/1.1.4/1.1.5 resource consumption (EUVD-2026-117108)
A vulnerability categorized as critical has been discovered in IBM Db2 Genius Hub 1.1.2/1.1.3/1.1.4/1.1.5. This vulnerability affects unknown code. Executing a manipulation can lead to resource consumption. This vulnerability is handled as
CVE-2026-19128 | IBM API Connect up to 12.1.1.2 server-side request forgery (EUVD-2026-118799)
A vulnerability, which was classified as problematic, has been found in IBM API Connect up to 12.1.1.2. This issue affects some unknown processing. Performing a manipulation results in server-side request forgery. This vulnerability is repo
CVE-2026-17202 | IBM API Connect up to 12.1.1.2 information exposure (EUVD-2026-118654)
A vulnerability classified as problematic was found in IBM API Connect up to 12.1.1.2. This impacts an unknown function. Such manipulation leads to information exposure through discrepancy. This vulnerability is referenced as CVE-2026-17202
CVE-2026-17098 | IBM API Connect up to 10.0.8.12/12.1.1.2 information exposure (EUVD-2026-118628)
A vulnerability was found in IBM API Connect up to 10.0.8.12/12.1.1.2. It has been rated as problematic. This issue affects some unknown processing. This manipulation causes information exposure through error message. This vulnerability is
CVE-2026-114713 | UnrealIRCd up to 6.2.7 labeled-response module injection (EUVD-2026-119377)
A vulnerability labeled as critical has been found in UnrealIRCd. Impacted is an unknown function of the component labeled-response module. Executing a manipulation can lead to injection. This vulnerability appears as CVE-2026-114713. The a
CVE-2022-4184 | Google Chrome up to 107.0.5304.121 Autofill Remote Code Execution (EUVD-2022-51545)
A vulnerability marked as critical has been reported in Google Chrome. Affected by this vulnerability is an unknown functionality of the component Autofill. Performing a manipulation results in Remote Code Execution. This vulnerability was
CVE-2022-4183 | Google Chrome up to 107.0.5304.121 Popup Blocker Remote Code Execution (EUVD-2022-51544)
A vulnerability labeled as critical has been found in Google Chrome. Affected is an unknown function of the component Popup Blocker. Such manipulation leads to Remote Code Execution. This vulnerability is uniquely identified as CVE-2022-418