Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 784 | 0,2 % |
| ≥50 % | 3.557 | 0,9 % |
| ≥10 % | 13.141 | 3,2 % |
| <10 % | 392.888 | 95,7 % |
Hackers Launch Over 240,000 Attacks Targeting WordPress Core Remote Code Execution Flaw
Hackers have launched more than 240,000 exploit attempts against a WordPress core race-condition flaw that exposes websites to unauthenticated remote code execution during upgrades. Wordfence researcher István Márton reported that probing b
Android-Schwachstelle GhostMap zwingt Smartphones in Absturzschleife
Bitdefender-Forscher haben mit GhostMap eine Schwachstelle entdeckt, durch die eine speziell präparierte Android-App einen dauerhaften Systemabsturz auslösen kann. Betroffene Geräte lassen sich unter Umständen nur noch durch ein Zurücksetze
CVE-2025-61543 | CraftMyCMS 4.0.2.2 HTTP Header Host password recovery
A vulnerability marked as problematic has been reported in CraftMyCMS 4.0.2.2. This vulnerability affects unknown code of the component HTTP Header Handler. Performing a manipulation of the argument Host results in weak password recovery. T
CVE-2025-61541 | Webmin 2.510 Header forgot_send.cgi get_webmin_email_url Host password recovery
A vulnerability identified as problematic has been detected in Webmin 2.510. Affected by this issue is the function get_webmin_email_url of the file forgot_send.cgi of the component Header Handler. This manipulation of the argument Host cau
CVE-2025-61540 | Ultimate PHP Board 2.2.7 lostpassword.php username sql injection
A vulnerability was found in Ultimate PHP Board 2.2.7. It has been declared as critical. This impacts an unknown function of the file lostpassword.php. Executing a manipulation of the argument Username can lead to sql injection. This vulner
CVE-2025-61539 | Ultimate PHP Board 2.2.7 lostpassword.php u_name cross site scripting
A vulnerability described as problematic has been identified in Ultimate PHP Board 2.2.7. This issue affects some unknown processing of the file lostpassword.php. Executing a manipulation of the argument u_name can lead to cross site script
CVE-2025-61536 | FelixRiddle dev-jobs-handlebars 1.0 req.headers.host password recovery
A vulnerability categorized as problematic has been discovered in FelixRiddle dev-jobs-handlebars 1.0. Affected by this vulnerability is an unknown functionality. The manipulation of the argument req.headers.host results in weak password re
CVE-2025-61330 | H3C Magic Telnet Service /etc/shadow weak password
A vulnerability was found in H3C Magic and classified as critical. Impacted is an unknown function of the file /etc/shadow of the component Telnet Service. Such manipulation leads to weak password requirements. This vulnerability is referen
CVE-2025-60641 | Vfront 0.99.52 mexcel.php mexcel deserialization
A vulnerability categorized as problematic has been discovered in Vfront 0.99.52. The affected element is an unknown function of the file mexcel.php. Executing a manipulation of the argument mexcel can lead to deserialization. This vulnerab
CVE-2025-56700 | Base Digitale Group Centrax Open PSIM 6.1 datafine sql injection
A vulnerability marked as critical has been reported in Base Digitale Group Centrax Open PSIM 6.1. The affected element is an unknown function. The manipulation of the argument datafine leads to sql injection. This vulnerability is traded a
CVE-2025-56699 | Base Digitale Group Centrax Open PSIM 6.1 sender sql injection
A vulnerability described as critical has been identified in Base Digitale Group Centrax Open PSIM 6.1. The impacted element is an unknown function. The manipulation of the argument sender results in sql injection. This vulnerability is kno
CVE-2026-72221 | Linux Kernel up to 6.6.144/6.12.96/6.18.39/7.1.4 sunrpc svc_tcp_handshake race condition (Nessus ID 377032)
A vulnerability was found in Linux Kernel up to 6.6.144/6.12.96/6.18.39/7.1.4. It has been declared as very critical. The affected element is the function svc_tcp_handshake of the component sunrpc. Executing a manipulation can lead to race
CVE-2026-72080 | Linux Kernel up to 6.18.41/7.1.4/7.2-rc2 resctrl fs/resctrl resctrl_exit priv use after free (Nessus ID 377032)
A vulnerability labeled as critical has been found in Linux Kernel up to 6.18.41/7.1.4/7.2-rc2. This impacts the function resctrl_exit of the file fs/resctrl of the component resctrl. The manipulation of the argument priv results in use aft
CVE-2026-72222 | Linux Kernel up to 6.6.144/6.12.96/6.18.39/7.1.4 sunrpc svc_tcp_handshake use after free (Nessus ID 377032)
A vulnerability described as very critical has been identified in Linux Kernel up to 6.6.144/6.12.96/6.18.39/7.1.4. The impacted element is the function svc_tcp_handshake of the component sunrpc. Executing a manipulation can lead to use aft
CVE-2026-95818 | GNU glibc up to 2.44 Dynamic Loader ld.so ORIGIN buffer overflow (Nessus ID 377033 / WID-SEC-2026-3522)
A vulnerability classified as problematic has been found in GNU glibc up to 2.44. This issue affects some unknown processing of the file ld.so of the component Dynamic Loader. The manipulation of the argument ORIGIN leads to buffer overflow
CVE-2026-86805 | GNU glibc up to 2.44 Dynamic Loader ld.so toctou (Nessus ID 377033 / WID-SEC-2026-3522)
A vulnerability identified as problematic has been detected in GNU glibc up to 2.44. This affects an unknown function of the file ld.so of the component Dynamic Loader. The manipulation leads to time-of-check time-of-use. This vulnerability
CVE-2026-8674 | glibc up to 2.44 DNS stub resolver buffer overflow (Nessus ID 377033)
A vulnerability has been found in glibc up to 2.44 and classified as problematic. This issue affects some unknown processing of the component DNS stub resolver. The manipulation leads to buffer overflow. This vulnerability is traded as CVE-
Hackers Exploit SonicWall SSL-VPN Vulnerability to Bypass Multi-Factor Authentication in Active Attacks
SonicWall has disclosed an SSL-VPN authentication enforcement flaw that could let attackers bypass SAML authentication and associated multi-factor authentication controls. Tracked as CVE-2026-19868, the issue carries a CVSS score of 7.1. Ad
Fragnesia: Linux-Lücke CVE-2026-46300, CVSS 7,8 [2026] - Tech Insider
Windows-Server stehen bei Patch-Dienstagen im Takt, Linux-Server hängen vom Rhythmus der jeweiligen Distribution ab. Wer viele verschiedene Linux ... Weiterlesen
CVE-2025-9640 | Red Hat Enterprise Linux/OpenShift Container Platform Samba vfs_streams_xattr information disclosure (Nessus ID 270677 / WID-SEC-2025-2322)
A vulnerability was found in Red Hat Enterprise Linux and OpenShift Container Platform. It has been declared as problematic. This impacts the function vfs_streams_xattr of the component Samba. The manipulation results in information disclos
CVE-2025-60537 | kafka-ui 0.6.0/0.7.2 CustomSerdeLoader.java input validation
A vulnerability classified as problematic was found in kafka-ui 0.6.0/0.7.2. The affected element is an unknown function of the file /kafka/ui/serdes/CustomSerdeLoader.java. Executing a manipulation can lead to improper input validation. Th
CVE-2025-60536 | kafka-ui up to 0.7.2 Configure New Cluster Interface denial of service
A vulnerability classified as problematic has been found in kafka-ui up to 0.7.2. Impacted is an unknown function of the component Configure New Cluster Interface. Performing a manipulation results in denial of service. This vulnerability i
CVE-2025-57618 | Starnet FastX3 up to 3.3.67 path traversal
A vulnerability was found in Starnet FastX3 up to 3.3.67. It has been classified as critical. Impacted is an unknown function. The manipulation leads to path traversal. This vulnerability is uniquely identified as CVE-2025-57618. The attack
CVE-2025-57563 | Starnet FastX up to 4.1.51 path traversal
A vulnerability described as critical has been identified in Starnet FastX up to 4.1.51. This issue affects some unknown processing. Such manipulation leads to path traversal. This vulnerability is listed as CVE-2025-57563. The attack may b
CVE-2025-56749 | Creativeitem Academy LMS up to 6.14 improper authentication
A vulnerability, which was classified as critical, was found in Creativeitem Academy LMS up to 6.14. This impacts an unknown function. The manipulation results in improper authentication. This vulnerability is reported as CVE-2025-56749. Th
CVE-2025-56748 | Creativeitem Academy LMS up to 5.13 Password Reset password recovery
A vulnerability was found in Creativeitem Academy LMS up to 5.13 and classified as problematic. This affects an unknown function of the component Password Reset Handler. The manipulation results in weak password recovery. This vulnerability
CVE-2025-56746 | Creativeitem Academy LMS up to 5.13 session fixiation
A vulnerability described as critical has been identified in Creativeitem Academy LMS up to 5.13. Impacted is an unknown function. Such manipulation leads to session fixiation. This vulnerability is listed as CVE-2025-56746. The attack may
CVE-2023-43788 | libXpm XPM Image File resource consumption (USN-6408-1 / Nessus ID 235522)
A vulnerability has been found in libXpm and classified as problematic. This issue affects some unknown processing of the component XPM Image File Handler. Performing a manipulation results in resource consumption. This vulnerability is rep
CVE-2023-3106 | Linux Kernel up to 4.8-rc6 Netlink Socket net/xfrm/xfrm_user.c xfrm_dump_sa null pointer dereference
A vulnerability was found in Linux Kernel up to 4.8-rc6 and classified as problematic. The impacted element is the function xfrm_dump_sa of the file net/xfrm/xfrm_user.c of the component Netlink Socket Handler. The manipulation results in n
CVE-2025-61505 | e107 CMS up to 2.3.3 POST Parameter install.php base64_decode previous_steps deserialization
A vulnerability described as critical has been identified in e107 CMS up to 2.3.3. Impacted is the function base64_decode of the file install.php of the component POST Parameter Handler. The manipulation of the argument previous_steps resul
CVE-2025-60838 | MCMS 6.0.1 unrestricted upload
A vulnerability marked as critical has been reported in MCMS 6.0.1. Impacted is an unknown function. This manipulation causes unrestricted upload. This vulnerability appears as CVE-2025-60838. The attack may be initiated remotely. There is
CVE-2025-60535 | Wallos 4.1.1 GET Request currency cross-site request forgery
A vulnerability, which was classified as problematic, was found in Wallos 4.1.1. This affects an unknown function of the file /endpoints/currency/currency of the component GET Request Handler. The manipulation results in cross-site request
CVE-2025-60308 | code-projects Simple Online Hotel Reservation System 1.0 Add Room Description cross site scripting
A vulnerability, which was classified as problematic, was found in code-projects Simple Online Hotel Reservation System 1.0. The impacted element is an unknown function of the component Add Room Handler. Executing a manipulation of the argu
CVE-2025-60306 | code-projects Simple Car Rental System 1.0 permission
A vulnerability marked as critical has been reported in code-projects Simple Car Rental System 1.0. This affects an unknown part. The manipulation leads to permission issues. This vulnerability is traded as CVE-2025-60306. It is possible to
CVE-2025-60269 | JeeWMS 20250820 CgExportExcelController.java exportXls sql injection
A vulnerability was found in JeeWMS 20250820. It has been declared as critical. Impacted is the function exportXls of the file src/main/java/org/jeecgframework/web/cgreport/controller/excel/CgExportExcelController.java. Executing a manipula
CVE-2025-56747 | Creativeitem Academy LMS up to 5.13 Api_instructor Controller privileges management
A vulnerability, which was classified as critical, was found in Creativeitem Academy LMS up to 5.13. Affected by this issue is some unknown functionality of the component Api_instructor Controller. Such manipulation leads to improper privil
CVE-2025-55903 | CodeCanyon Perfex CRM 3.3.1 Estimate Bill To cross site scripting
A vulnerability labeled as problematic has been found in CodeCanyon Perfex CRM 3.3.1. This impacts an unknown function of the component Estimate Module. Such manipulation of the argument Bill To leads to basic cross site scripting. This vul
CVE-2025-54603 | Claroty Secure Access up to 4.0.2 improper authentication
A vulnerability, which was classified as critical, has been found in Claroty Secure Access up to 4.0.2. The impacted element is an unknown function. The manipulation leads to improper authentication. This vulnerability is documented as CVE-
CVE-2026-63687 | Apache CXF up to 3.6.11/4.1.7/4.2.2 JwtRequestCodeFilter nonce improper authentication (WID-SEC-2026-2682)
A vulnerability classified as critical has been found in Apache CXF up to 3.6.11/4.1.7/4.2.2. This affects the function JwtRequestCodeFilter. Performing a manipulation of the argument nonce results in improper authentication. This vulnerabi
CVE-2026-61466 | Apache CXF up to 3.6.11/4.1.7/4.2.2 Dynamic Client Registration privileges management (WID-SEC-2026-2682)
A vulnerability described as critical has been identified in Apache CXF up to 3.6.11/4.1.7/4.2.2. Affected by this issue is some unknown functionality of the component Dynamic Client Registration. Such manipulation leads to improper privile
CVE-2026-57818 | Apache CXF up to 3.6.11/4.1.7/4.2.2 JCacheCodeDataProvider toctou (WID-SEC-2026-2682)
A vulnerability marked as critical has been reported in Apache CXF up to 3.6.11/4.1.7/4.2.2. Affected by this vulnerability is an unknown functionality of the component JCacheCodeDataProvider. This manipulation causes time-of-check time-of-
CVE-2026-57817 | Apache CXF up to 3.6.11/4.1.7/4.2.2 c_hash input validation (WID-SEC-2026-2682)
A vulnerability was found in Apache CXF up to 3.6.11/4.1.7/4.2.2 and classified as critical. This issue affects some unknown processing. The manipulation of the argument c_hash results in improper input validation. This vulnerability is cat
CVE-2026-94218 | Red Hat Keycloak/Single Sign-On Session Management improper authentication (EUVD-2026-83846 / WID-SEC-2026-3484)
A vulnerability, which was classified as critical, was found in Red Hat Keycloak and Single Sign-On. The impacted element is an unknown function of the component Session Management. Such manipulation leads to improper authentication. This v
CVE-2026-94217 | Red Hat Keycloak/Single Sign-On UMA Implementation permission (EUVD-2026-83845 / WID-SEC-2026-3484)
A vulnerability has been found in Red Hat Keycloak and Single Sign-On and classified as problematic. This affects an unknown function of the component UMA Implementation. Performing a manipulation results in permission issues. This vulnerab
CVE-2026-94215 | Red Hat Keycloak Admin REST API privileges management (EUVD-2026-83841 / WID-SEC-2026-3484)
A vulnerability, which was classified as problematic, has been found in Red Hat Keycloak. The affected element is an unknown function of the component Admin REST API. This manipulation causes improper privilege management. This vulnerabilit
CVE-2025-61319 | ReNgine up to 2.2.0 Vulnerabilities cross site scripting
A vulnerability classified as problematic has been found in ReNgine up to 2.2.0. This vulnerability affects unknown code of the component Vulnerabilities Module. The manipulation leads to cross site scripting. This vulnerability is referenc
CVE-2025-60869 | Publii CMS 0.46.5 Build 17089 Site Description/Footer Follow Buttons cross site scripting
A vulnerability was found in Publii CMS 0.46.5 Build 17089. It has been rated as problematic. Affected by this vulnerability is an unknown functionality. This manipulation of the argument Site Description/Footer Follow Buttons causes cross
CVE-2025-60375 | Perfex CRM up to 3.3.0 password improper authentication
A vulnerability, which was classified as critical, was found in Perfex CRM up to 3.3.0. Affected by this issue is some unknown functionality. Such manipulation of the argument Password leads to improper authentication. This vulnerability is
CVE-2025-60307 | code-projects Computer Laboratory System 1.0 Password Field sql injection
A vulnerability, which was classified as critical, has been found in code-projects Computer Laboratory System 1.0. The affected element is an unknown function of the component Password Field Handler. Performing a manipulation results in sql
CVE-2025-60305 | SourceCodester Online Student Clearance System 1.0 access control
A vulnerability identified as critical has been detected in SourceCodester Online Student Clearance System 1.0. Impacted is an unknown function. The manipulation leads to improper access controls. This vulnerability is traded as CVE-2025-60
CVE-2026-89092 | GNU C Library up to 2.44 nscd stack-based overflow (Nessus ID 377033 / WID-SEC-2026-3317)
A vulnerability was found in GNU C Library up to 2.44. It has been declared as critical. The impacted element is an unknown function of the component nscd. Executing a manipulation can lead to stack-based buffer overflow. This vulnerability
CVE-2026-113733 | djangoproject Django up to 6.0.9/6.1.2 Admin Utils utils.py django.contrib.admin.utils.display_for_field information disclosure (Nessus ID 377035)
A vulnerability was found in djangoproject Django up to 6.0.9/6.1.2 and classified as problematic. This issue affects the function django.contrib.admin.utils.display_for_field of the file django/contrib/admin/utils.py of the component Admin
CVE-2026-111211 | Django Software Foundation up to 5.2.18/6.0.9/6.1.2 Geometry Widget widgets.py neutralization for logs (Nessus ID 377036)
A vulnerability classified as problematic was found in Django Software Foundation Django up to 5.2.18/6.0.9/6.1.2. Affected by this vulnerability is the function django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize of the file dj
CVE-2026-114582 | Django Software Foundation up to 5.2.18/6.0.9/6.1.2 SpatialReference __init__.py transform srs/srid server-side request forgery (Nessus ID 377036)
A vulnerability was found in Django Software Foundation Django up to 5.2.18/6.0.9/6.1.2. It has been declared as critical. The affected element is the function transform of the file django/contrib/gis/gdal/__init__.py of the component Spati
CVE-2026-18836 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinations and return the response to the attacker.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended des
CVE-2026-18689 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accepted where it should not be, which could reveal the names of other organizations.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accep
CVE-2026-17428 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization decisions without sufficient verification, which could allow access to information belonging to others.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization
CVE-2026-17411 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized before it is used in database queries.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized befo
CVE-2026-17410 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.
CVE-2026-17409 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of a request, which could allow restricted operations to be reached.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access c