Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 785 | 0,2 % |
| ≥50 % | 3.559 | 0,9 % |
| ≥10 % | 13.139 | 3,2 % |
| <10 % | 396.072 | 95,8 % |
CVE-2026-124508 | floci-io Floci up to 2.4.0 Artifact CodeBuildJsonHandler.java BuildspecParser.parseArtifacts buildspecOverride.artifacts.base-directory path traversal (GHSA-4hjc-ww34-35c4 / EUVD-2026-119769)
A vulnerability, which was classified as problematic, has been found in floci-io Floci up to 2.4.0. Impacted is the function BuildspecParser.parseArtifacts of the file src/main/java/io/github/hectorvent/floci/services/codebuild/CodeBuildJso
CVE-2026-124507 | conductor-oss conductor up to 3.32.4/3.33.0/3.34.0-rc3/4.0.0-alpha.1 PLANNER_CONTEXT_FETCH Task PlannerContextFetchTask.java WorkflowSystemTask.start url server-side request forgery (GHSA-cx7c-4mp7-rhcj / EUVD-2026-119768)
A vulnerability classified as problematic was found in conductor-oss conductor up to 3.32.4/3.33.0/3.34.0-rc3/4.0.0-alpha.1. This issue affects the function WorkflowSystemTask.start of the file PlannerContextFetchTask.java of the component
CVE-2026-116501 | IBM Qiskit SDK up to 2.6.1 out-of-bounds write (EUVD-2026-119683)
A vulnerability labeled as critical has been found in IBM Qiskit SDK up to 2.6.1. This affects an unknown function. Executing a manipulation can lead to out-of-bounds write. This vulnerability is handled as CVE-2026-116501. It is possible t
CVE-2026-116499 | IBM Qiskit SDK up to 2.6.2 deserialization (EUVD-2026-119685)
A vulnerability marked as problematic has been reported in IBM Qiskit SDK up to 2.6.2. This impacts an unknown function. The manipulation leads to deserialization. This vulnerability is uniquely identified as CVE-2026-116499. Local access i
CVE-2026-124509 | floci-io Floci up to 2.1.0 S3 Destination Configuration DeliveryStreamDescription.java S3Destination.bucketName BucketARN path traversal (Issue 4281 / EUVD-2026-119770)
A vulnerability, which was classified as critical, was found in floci-io Floci up to 2.1.0. The affected element is the function S3Destination.bucketName of the file services/firehose/model/DeliveryStreamDescription.java of the component S3
CVE-2026-110273 | IBM TRIRIGA Application Platform up to 5.0.9 os command injection (EUVD-2026-119691)
A vulnerability was found in IBM TRIRIGA Application Platform up to 5.0.9 and classified as critical. Affected is an unknown function. Such manipulation leads to os command injection. This vulnerability is documented as CVE-2026-110273. The
CVE-2026-124555 | JeecgBoot 3.9.5 Table Dictionary API getTableDictList JimuFormApiService.getTableDictList searchSql sql injection (EUVD-2026-119777)
A vulnerability was found in JeecgBoot 3.9.5. It has been declared as critical. This vulnerability affects the function JimuFormApiService.getTableDictList of the file /jeecg-boot/jmreport/form/getTableDictList of the component Table Dictio
CVE-2026-124554 | JeecgBoot 3.9.5 JimuBI getAllChartData params sql injection (EUVD-2026-119776)
A vulnerability was found in JeecgBoot 3.9.5. It has been classified as critical. This affects an unknown part of the file /jeecg-boot/drag/onlDragDatasetHead/getAllChartData of the component JimuBI. Performing a manipulation of the argumen
CVE-2026-124556 | kekingcn kkFileView up to 5.0.3 BaseUrlFilter.java BaseUrlFilter.getBaseUrl X-Base-Url redirect (GHSA-wrm9-r4fj-f8q5 / EUVD-2026-119778)
A vulnerability was found in kekingcn kkFileView up to 5.0.3. It has been rated as problematic. This issue affects the function BaseUrlFilter.getBaseUrl of the file server/src/main/java/cn/keking/web/filter/BaseUrlFilter.java. The manipulat
CVE-2026-124557 | OtterMind Chat2DB up to 5.3.8 Class Generator DbMybatisGenerateServiceImpl.java DbMybatisGenerateServiceImpl.generateClass tableName path traversal (EUVD-2026-119779)
A vulnerability categorized as critical has been discovered in OtterMind Chat2DB up to 5.3.8. Impacted is the function DbMybatisGenerateServiceImpl.generateClass of the file DbMybatisGenerateServiceImpl.java of the component Class Generator
CVE-2025-63608 | CSZ CSZ-CMS up to 1.3.0 Form Builder View field sql injection
A vulnerability, which was classified as critical, has been found in CSZ CSZ-CMS up to 1.3.0. This affects an unknown function of the component Form Builder View. The manipulation of the argument Field leads to sql injection. This vulnerabi
CVE-2025-61876 | Inforcer Platform 2.0.153 API Endpoint /tenants/ resource injection
A vulnerability was found in Inforcer Platform 2.0.153 and classified as problematic. Affected by this issue is some unknown functionality of the file /tenants/ of the component API Endpoint. The manipulation results in improper control of
CVE-2025-61234 | Dataphone A920 2025.07.161103 access control
A vulnerability classified as critical was found in Dataphone A920 2025.07.161103. This affects an unknown part. Executing a manipulation can lead to improper access controls. This vulnerability is tracked as CVE-2025-61234. The attack is o
CVE-2025-61117 | Senza Keto & Fasting App 2.10.15 on Android API Endpoint access control
A vulnerability, which was classified as critical, was found in Senza Keto &amp; Fasting App 2.10.15 on Android. This issue affects some unknown processing of the component API Endpoint. Executing a manipulation can lead to improper acc
CVE-2025-61115 | ABC Fine Wine & Spirits App up to 11.27.5 on Android com.cta.abcfinewineandspirits improper authentication
A vulnerability classified as critical has been found in ABC Fine Wine &amp; Spirits App up to 11.27.5 on Android. Affected by this issue is some unknown functionality of the component com.cta.abcfinewineandspirits. This manipulation ca
CVE-2025-60898 | Halo CMS 2.21 Endpoint server-side request forgery
A vulnerability, which was classified as critical, has been found in Halo CMS 2.21. This vulnerability affects unknown code of the component Endpoint. The manipulation leads to server-side request forgery. This vulnerability is listed as CV
CVE-2025-60320 | memoQ up to 10.1.13.ef1b2b52aae memoQauhlp101 unquoted search path
A vulnerability was found in memoQ up to 10.1.13.ef1b2b52aae. It has been rated as problematic. This issue affects some unknown processing of the component memoQauhlp101. Performing a manipulation results in unquoted search path. This vulne
CVE-2025-57227 | Kingosoft Kingo ROOT 1.5.8.3353 unquoted search path (Exploit 51707 / EDB-51707)
A vulnerability identified as problematic has been detected in Kingosoft Kingo ROOT 1.5.8.3353. The affected element is an unknown function. The manipulation leads to unquoted search path. This vulnerability is traded as CVE-2025-57227. An
CVE-2025-50739 | iib0011 omni-tools 0.4.0 JSON deserialization
A vulnerability classified as critical was found in iib0011 omni-tools 0.4.0. Affected is an unknown function of the component JSON Handler. The manipulation results in deserialization. This vulnerability is reported as CVE-2025-50739. The
CVE-2025-50736 | Byaidu PDFMathTranslate 1.9.9 /gradio_api file redirect (EUVD-2025-37013)
A vulnerability was found in Byaidu PDFMathTranslate 1.9.9. It has been rated as problematic. This vulnerability affects unknown code of the file /gradio_api. The manipulation of the argument File leads to open redirect. This vulnerability
CVE-2025-50574 | Hiruna Gallage Glamour Salon Management System 1.0 blog-details.php blog comment section cross site scripting
A vulnerability was found in Hiruna Gallage Glamour Salon Management System 1.0. It has been declared as problematic. This affects an unknown part of the file blog-details.php. Executing a manipulation of the argument blog comment section c
CVE-2024-56426 | Samsung Mobile Processor/Wearable Processor Exynos up to 2400 USB Packet out-of-bounds write
A vulnerability was found in Samsung Mobile Processor and Wearable Processor Exynos up to 2400. It has been declared as critical. Impacted is an unknown function of the component USB Packet Handler. Executing a manipulation can lead to out-
CVE-2024-47866 | Ceph RGW Module denial of service (Nessus ID 275346 / WID-SEC-2025-2584)
A vulnerability classified as problematic has been found in Ceph. The affected element is an unknown function of the component RGW Module. This manipulation causes denial of service. This vulnerability is tracked as CVE-2024-47866. The atta
CVE-2024-45161 | Blu-Castle BCUM221E 1.0.0P2205 Image cross-site request forgery
A vulnerability has been found in Blu-Castle BCUM221E 1.0.0P2205 and classified as problematic. The impacted element is an unknown function of the component Image Handler. This manipulation causes cross-site request forgery. This vulnerabil
CVE-2024-44655 | PHPGurukul Complaint Management System 2.0 user-search.php search cross site scripting
A vulnerability was found in PHPGurukul Complaint Management System 2.0. It has been rated as problematic. Impacted is an unknown function of the file user-search.php. This manipulation of the argument Search causes cross site scripting. Th
CVE-2024-44654 | PHPGurukul Complaint Management System 2.0 reset-password.php email/mobileno sql injection
A vulnerability was found in PHPGurukul Complaint Management System 2.0. It has been declared as critical. Affected by this issue is some unknown functionality of the file reset-password.php. Executing a manipulation of the argument email/m
CVE-2024-44651 | Kashipara Ecommerce Website 1.0 user_password_recover.php recover_email sql injection
A vulnerability has been found in Kashipara Ecommerce Website 1.0 and classified as critical. This impacts an unknown function of the file user_password_recover.php. This manipulation of the argument recover_email causes sql injection. This
CVE-2024-44644 | PHPGurukul Small CRM 3.0 manage-tickets.php frm_id/aremark sql injection
A vulnerability has been found in PHPGurukul Small CRM 3.0 and classified as critical. The affected element is an unknown function of the file manage-tickets.php. The manipulation of the argument frm_id/aremark leads to sql injection. This
SSHole: A long password could bypass SSH authentication on affected Alpine Linux systems
A recent OpenSSH security issue caught my attention, especially because of how unusual the authentication bypass is. The vulnerability, known as SSHole (CVE-2026-123158), affects certain Linux systems running OpenSSH with musl libc and with
CVE-2026-97193 | Secure Custom Fields Plugin up to 6.9.7 on WordPress Bidirectional Relationship Synchronization authorization (EUVD-2026-119462)
A vulnerability labeled as problematic has been found in Secure Custom Fields Plugin up to 6.9.7 on WordPress. This affects an unknown function of the component Bidirectional Relationship Synchronization. The manipulation results in authori
CVE-2026-97192 | Secure Custom Fields Plugin up to 6.9.7 on WordPress Field Group Location Rules access control (EUVD-2026-119461)
A vulnerability classified as critical has been found in Secure Custom Fields Plugin up to 6.9.7 on WordPress. This affects an unknown function of the component Field Group Location Rules. This manipulation causes improper access controls.
CVE-2026-97195 | Secure Custom Fields Plugin up to 6.9.7 on WordPress Field Definition cross site scripting (EUVD-2026-119464)
A vulnerability was found in Secure Custom Fields Plugin up to 6.9.7 on WordPress and classified as problematic. This affects an unknown part of the component Field Definition. The manipulation results in cross site scripting. This vulnerab
CVE-2026-97194 | Secure Custom Fields Plugin up to 6.9.7 on WordPress Relational Fields information disclosure (EUVD-2026-119463)
A vulnerability, which was classified as problematic, has been found in Secure Custom Fields Plugin up to 6.9.7 on WordPress. Affected is an unknown function of the component Relational Fields. Performing a manipulation results in informati
CVE-2026-96961 | Pie Register Plugin up to 3.8.4.15 on WordPress Request authorization (EUVD-2026-119466)
A vulnerability has been found in Pie Register Plugin up to 3.8.4.15 on WordPress and classified as critical. This issue affects some unknown processing of the component Request Handler. This manipulation causes missing authorization. The i
CVE-2026-103375 | Antom Payments Plugin up to 2.0.11 on WordPress authorization (EUVD-2026-119465)
A vulnerability classified as problematic was found in Antom Payments Plugin up to 2.0.11 on WordPress. Affected by this issue is some unknown functionality. Executing a manipulation can lead to authorization bypass. This vulnerability is h
CVE-2026-96963 | Pie Register Plugin up to 3.8.4.15 on WordPress authorization (EUVD-2026-119467)
A vulnerability was found in Pie Register Plugin up to 3.8.4.15 on WordPress. It has been classified as critical. The affected element is an unknown function. Performing a manipulation results in missing authorization. This vulnerability is
CVE-2026-122060 | WP Recipe Maker Plugin up to 10.9.1 on WordPress information disclosure (EUVD-2026-119457)
A vulnerability, which was classified as problematic, was found in WP Recipe Maker Plugin up to 10.9.1 on WordPress. This vulnerability affects unknown code. The manipulation results in information disclosure. This vulnerability was named C
CVE-2026-122062 | Pronamic Pay Plugin/Pronamic Pay doneren met Mollie Plugin on WordPress REST API information disclosure (EUVD-2026-119458)
A vulnerability was found in Pronamic Pay Plugin and Pronamic Pay doneren met Mollie Plugin on WordPress. It has been declared as problematic. This issue affects some unknown processing of the component REST API. Such manipulation leads to
CVE-2026-122085 | WooCommerce Event Tickets Manager for WooCommerce Plugin up to 1.5.x on WordPress Ticket Transfer Feature authorization (EUVD-2026-119459)
A vulnerability identified as critical has been detected in WooCommerce Event Tickets Manager for WooCommerce Plugin up to 1.5.x on WordPress. The impacted element is an unknown function of the component Ticket Transfer Feature. The manipul
CVE-2026-124504 | erupts erupt up to 2.3.0 ReportService.java ReportService.queryBiData sort sql injection (ID 485 / EUVD-2026-119760)
A vulnerability marked as critical has been reported in erupts erupt up to 2.3.0. Affected by this issue is the function ReportService.queryBiData of the file ReportService.java. Performing a manipulation of the argument sort results in sql
CVE-2026-124505 | Dianping CAT 3.0.0/3.1.0/4.0-RC1 Login/Logout Handler.java Handler.redirect rtnUrl (EUVD-2026-119761)
A vulnerability described as problematic has been identified in Dianping CAT 3.0.0/3.1.0/4.0-RC1. This affects the function Handler.redirect of the file Handler.java of the component Login/Logout. Executing a manipulation of the argument rt
CVE-2026-124501 | Tidelift moto up to 5.2.4 AWS Batch Emulation moto/batch/models.py privileged/volumes privileges management (EUVD-2026-119758)
A vulnerability identified as critical has been detected in Tidelift moto up to 5.2.4. Affected is an unknown function of the file moto/batch/models.py of the component AWS Batch Emulation. This manipulation of the argument privileged/volum
CVE-2026-98974 | Linux Kernel up to 6.12.113/6.18.56/7.2.10 XFS xmi_can_exchange_reflink_flags information disclosure (Nessus ID 377500)
A vulnerability marked as problematic has been reported in Linux Kernel up to 6.12.113/6.18.56/7.2.10. This affects the function xmi_can_exchange_reflink_flags of the component XFS. This manipulation causes information disclosure. The ident
CVE-2026-90315 | Linux Kernel up to 7.2.5 locking (Nessus ID 377500)
A vulnerability marked as critical has been reported in Linux Kernel up to 7.2.5. This affects the function pci_write_legacy_io/pci_mmap_legacy_mem/pci_mmap_legacy_io. This manipulation causes improper locking. This vulnerability is tracked
CVE-2026-80863 | Linux Kernel up to 7.2.2 RDMA/rxe rxe_qp.c free_rd_atomic_resources out-of-bounds (Nessus ID 377506)
A vulnerability, which was classified as very critical, has been found in Linux Kernel up to 7.2.2. Affected is the function free_rd_atomic_resources of the file drivers/infiniband/sw/rxe/rxe_qp.c of the component RDMA/rxe. The manipulation
CVE-2026-80864 | Linux Kernel up to 6.12.107/6.18.48/7.1.12/7.2.2 RDMA/rxe rxe_resp.c rxe_qp_from_attr/rxe_receiver use after free (Nessus ID 377506)
A vulnerability, which was classified as problematic, was found in Linux Kernel up to 6.12.107/6.18.48/7.1.12/7.2.2. This issue affects the function rxe_qp_from_attr/rxe_receiver of the file rxe_resp.c of the component RDMA/rxe. Executing a
CVE-2026-91203 | Cockpit Files race condition (Nessus ID 377511)
A vulnerability has been found in Cockpit and classified as very critical. The affected element is an unknown function of the component Files. Performing a manipulation results in race condition. This vulnerability is known as CVE-2026-9120
CVE-2026-80584 | Linux Kernel up to 7.1.9 s390 qeth qeth_snmp_command udata_len buffer overflow (Nessus ID 377513)
A vulnerability marked as critical has been reported in Linux Kernel up to 7.1.9. This affects the function qeth_snmp_command of the component s390 qeth. The manipulation of the argument udata_len leads to buffer overflow. This vulnerabilit
CVE-2026-80571 | Linux Kernel up to 6.18.45/7.1.9 papr-phy-attest papr_phy_attest_create_handle cmd.length buffer overflow (Nessus ID 377513)
A vulnerability was found in Linux Kernel up to 6.18.45/7.1.9 and classified as very critical. Affected by this vulnerability is the function papr_phy_attest_create_handle of the component papr-phy-attest. The manipulation of the argument c
CVE-2026-85344 | Flowplayer FV Flowplayer Video Player Plugin 7.5.55.7212/7.5.56.7212 on WordPress authorization (EUVD-2026-119460)
A vulnerability, which was classified as problematic, has been found in Flowplayer FV Flowplayer Video Player Plugin 7.5.55.7212/7.5.56.7212 on WordPress. This affects an unknown part. The manipulation leads to missing authorization. This v
CVE-2026-101371 | Oracle REST Data Services up to 26.1.0 Core improper authorization (EUVD-2026-105787)
A vulnerability categorized as problematic has been discovered in Oracle REST Data Services up to 26.1.0. The affected element is an unknown function of the component Core. Executing a manipulation can lead to improper authorization. This v
CVE-2026-101370 | Oracle REST Data Services up to 26.1.0 Core information disclosure (EUVD-2026-105786)
A vulnerability marked as problematic has been reported in Oracle REST Data Services up to 26.1.0. This impacts an unknown function of the component Core. This manipulation causes information disclosure. This vulnerability is handled as CVE
CVE-2026-101369 | Oracle REST Data Services up to 26.1.0 Backend-as-a-Service access control (EUVD-2026-105785)
A vulnerability identified as critical has been detected in Oracle REST Data Services up to 26.1.0. The impacted element is an unknown function of the component Backend-as-a-Service. The manipulation leads to improper access controls. This
CVE-2026-101372 | Oracle REST Data Services up to 26.1.0 Core information disclosure (EUVD-2026-105788)
A vulnerability labeled as problematic has been found in Oracle REST Data Services up to 26.1.0. This affects an unknown function of the component Core. The manipulation results in information disclosure. This vulnerability is known as CVE-
CVE-2026-101477 | Oracle Autonomous Health Framework up to 26.8 Trace File Analyzer privileges management (EUVD-2026-105893)
A vulnerability classified as very critical has been found in Oracle Autonomous Health Framework up to 26.8. This affects an unknown part of the component Trace File Analyzer. This manipulation causes improper privilege management. This vul
CVE-2026-101452 | Oracle Autonomous Health Framework up to 26.8 AHF Instant Diagnostic Replay privileges management (EUVD-2026-105868)
A vulnerability was found in Oracle Autonomous Health Framework up to 26.8. It has been rated as very critical. Affected by this issue is some unknown functionality of the component AHF Instant Diagnostic Replay. Performing a manipulation r
CVE-2026-101478 | Oracle Autonomous Health Framework up to 26.8 Trace File Analyzer privileges management (EUVD-2026-105894)
A vulnerability, which was classified as very critical, has been found in Oracle Autonomous Health Framework up to 26.8. This issue affects some unknown processing of the component Trace File Analyzer. Performing a manipulation results in i
CVE-2026-124499 | Fengoffice Feng Office up to 3.11.13.11/4.2.1.2 Translation Tool ToolController.class.php write_translations lang code injection (EUVD-2026-119756)
A vulnerability was found in Fengoffice Feng Office up to 3.11.13.11/4.2.1.2. It has been rated as problematic. This affects the function write_translations of the file application/controllers/ToolController.class.php of the component Trans
CVE-2026-124500 | Fengoffice Feng Office up to 3.11.13.11/4.2.1.2 File FilesController.class.php upload_document_image url server-side request forgery (EUVD-2026-119755)
A vulnerability categorized as critical has been discovered in Fengoffice Feng Office up to 3.11.13.11/4.2.1.2. This impacts the function upload_document_image of the file application/controllers/FilesController.class.php of the component F
CVE-2026-18093 | IBM App Connect Enterprise up to 13.0.8.2 access control (WID-SEC-2026-4383)
A vulnerability was found in IBM App Connect Enterprise up to 13.0.8.2. It has been declared as problematic. Affected is an unknown function. Executing a manipulation can lead to improper access controls. This vulnerability is registered as