Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 785 | 0,2 % |
| ≥50 % | 3.559 | 0,9 % |
| ≥10 % | 13.139 | 3,2 % |
| <10 % | 396.072 | 95,8 % |
CVE-2025-63608 | CSZ CSZ-CMS up to 1.3.0 Form Builder View field sql injection
A vulnerability, which was classified as critical, has been found in CSZ CSZ-CMS up to 1.3.0. This affects an unknown function of the component Form Builder View. The manipulation of the argument Field leads to sql injection. This vulnerabi
CVE-2025-61876 | Inforcer Platform 2.0.153 API Endpoint /tenants/ resource injection
A vulnerability was found in Inforcer Platform 2.0.153 and classified as problematic. Affected by this issue is some unknown functionality of the file /tenants/ of the component API Endpoint. The manipulation results in improper control of
CVE-2025-61234 | Dataphone A920 2025.07.161103 access control
A vulnerability classified as critical was found in Dataphone A920 2025.07.161103. This affects an unknown part. Executing a manipulation can lead to improper access controls. This vulnerability is tracked as CVE-2025-61234. The attack is o
CVE-2025-61117 | Senza Keto & Fasting App 2.10.15 on Android API Endpoint access control
A vulnerability, which was classified as critical, was found in Senza Keto &amp; Fasting App 2.10.15 on Android. This issue affects some unknown processing of the component API Endpoint. Executing a manipulation can lead to improper acc
CVE-2025-61115 | ABC Fine Wine & Spirits App up to 11.27.5 on Android com.cta.abcfinewineandspirits improper authentication
A vulnerability classified as critical has been found in ABC Fine Wine &amp; Spirits App up to 11.27.5 on Android. Affected by this issue is some unknown functionality of the component com.cta.abcfinewineandspirits. This manipulation ca
CVE-2025-60898 | Halo CMS 2.21 Endpoint server-side request forgery
A vulnerability, which was classified as critical, has been found in Halo CMS 2.21. This vulnerability affects unknown code of the component Endpoint. The manipulation leads to server-side request forgery. This vulnerability is listed as CV
CVE-2025-60320 | memoQ up to 10.1.13.ef1b2b52aae memoQauhlp101 unquoted search path
A vulnerability was found in memoQ up to 10.1.13.ef1b2b52aae. It has been rated as problematic. This issue affects some unknown processing of the component memoQauhlp101. Performing a manipulation results in unquoted search path. This vulne
CVE-2025-57227 | Kingosoft Kingo ROOT 1.5.8.3353 unquoted search path (Exploit 51707 / EDB-51707)
A vulnerability identified as problematic has been detected in Kingosoft Kingo ROOT 1.5.8.3353. The affected element is an unknown function. The manipulation leads to unquoted search path. This vulnerability is traded as CVE-2025-57227. An
CVE-2025-50739 | iib0011 omni-tools 0.4.0 JSON deserialization
A vulnerability classified as critical was found in iib0011 omni-tools 0.4.0. Affected is an unknown function of the component JSON Handler. The manipulation results in deserialization. This vulnerability is reported as CVE-2025-50739. The
CVE-2025-50736 | Byaidu PDFMathTranslate 1.9.9 /gradio_api file redirect (EUVD-2025-37013)
A vulnerability was found in Byaidu PDFMathTranslate 1.9.9. It has been rated as problematic. This vulnerability affects unknown code of the file /gradio_api. The manipulation of the argument File leads to open redirect. This vulnerability
CVE-2025-50574 | Hiruna Gallage Glamour Salon Management System 1.0 blog-details.php blog comment section cross site scripting
A vulnerability was found in Hiruna Gallage Glamour Salon Management System 1.0. It has been declared as problematic. This affects an unknown part of the file blog-details.php. Executing a manipulation of the argument blog comment section c
CVE-2024-56426 | Samsung Mobile Processor/Wearable Processor Exynos up to 2400 USB Packet out-of-bounds write
A vulnerability was found in Samsung Mobile Processor and Wearable Processor Exynos up to 2400. It has been declared as critical. Impacted is an unknown function of the component USB Packet Handler. Executing a manipulation can lead to out-
CVE-2024-47866 | Ceph RGW Module denial of service (Nessus ID 275346 / WID-SEC-2025-2584)
A vulnerability classified as problematic has been found in Ceph. The affected element is an unknown function of the component RGW Module. This manipulation causes denial of service. This vulnerability is tracked as CVE-2024-47866. The atta
CVE-2024-45161 | Blu-Castle BCUM221E 1.0.0P2205 Image cross-site request forgery
A vulnerability has been found in Blu-Castle BCUM221E 1.0.0P2205 and classified as problematic. The impacted element is an unknown function of the component Image Handler. This manipulation causes cross-site request forgery. This vulnerabil
CVE-2024-44655 | PHPGurukul Complaint Management System 2.0 user-search.php search cross site scripting
A vulnerability was found in PHPGurukul Complaint Management System 2.0. It has been rated as problematic. Impacted is an unknown function of the file user-search.php. This manipulation of the argument Search causes cross site scripting. Th
CVE-2024-44654 | PHPGurukul Complaint Management System 2.0 reset-password.php email/mobileno sql injection
A vulnerability was found in PHPGurukul Complaint Management System 2.0. It has been declared as critical. Affected by this issue is some unknown functionality of the file reset-password.php. Executing a manipulation of the argument email/m
CVE-2024-44651 | Kashipara Ecommerce Website 1.0 user_password_recover.php recover_email sql injection
A vulnerability has been found in Kashipara Ecommerce Website 1.0 and classified as critical. This impacts an unknown function of the file user_password_recover.php. This manipulation of the argument recover_email causes sql injection. This
CVE-2024-44644 | PHPGurukul Small CRM 3.0 manage-tickets.php frm_id/aremark sql injection
A vulnerability has been found in PHPGurukul Small CRM 3.0 and classified as critical. The affected element is an unknown function of the file manage-tickets.php. The manipulation of the argument frm_id/aremark leads to sql injection. This
SSHole: A long password could bypass SSH authentication on affected Alpine Linux systems
A recent OpenSSH security issue caught my attention, especially because of how unusual the authentication bypass is. The vulnerability, known as SSHole (CVE-2026-123158), affects certain Linux systems running OpenSSH with musl libc and with
CVE-2026-97193 | Secure Custom Fields Plugin up to 6.9.7 on WordPress Bidirectional Relationship Synchronization authorization (EUVD-2026-119462)
A vulnerability labeled as problematic has been found in Secure Custom Fields Plugin up to 6.9.7 on WordPress. This affects an unknown function of the component Bidirectional Relationship Synchronization. The manipulation results in authori
CVE-2026-97192 | Secure Custom Fields Plugin up to 6.9.7 on WordPress Field Group Location Rules access control (EUVD-2026-119461)
A vulnerability classified as critical has been found in Secure Custom Fields Plugin up to 6.9.7 on WordPress. This affects an unknown function of the component Field Group Location Rules. This manipulation causes improper access controls.
CVE-2026-97195 | Secure Custom Fields Plugin up to 6.9.7 on WordPress Field Definition cross site scripting (EUVD-2026-119464)
A vulnerability was found in Secure Custom Fields Plugin up to 6.9.7 on WordPress and classified as problematic. This affects an unknown part of the component Field Definition. The manipulation results in cross site scripting. This vulnerab
CVE-2026-97194 | Secure Custom Fields Plugin up to 6.9.7 on WordPress Relational Fields information disclosure (EUVD-2026-119463)
A vulnerability, which was classified as problematic, has been found in Secure Custom Fields Plugin up to 6.9.7 on WordPress. Affected is an unknown function of the component Relational Fields. Performing a manipulation results in informati
CVE-2026-96961 | Pie Register Plugin up to 3.8.4.15 on WordPress Request authorization (EUVD-2026-119466)
A vulnerability has been found in Pie Register Plugin up to 3.8.4.15 on WordPress and classified as critical. This issue affects some unknown processing of the component Request Handler. This manipulation causes missing authorization. The i
CVE-2026-103375 | Antom Payments Plugin up to 2.0.11 on WordPress authorization (EUVD-2026-119465)
A vulnerability classified as problematic was found in Antom Payments Plugin up to 2.0.11 on WordPress. Affected by this issue is some unknown functionality. Executing a manipulation can lead to authorization bypass. This vulnerability is h
CVE-2026-96963 | Pie Register Plugin up to 3.8.4.15 on WordPress authorization (EUVD-2026-119467)
A vulnerability was found in Pie Register Plugin up to 3.8.4.15 on WordPress. It has been classified as critical. The affected element is an unknown function. Performing a manipulation results in missing authorization. This vulnerability is
CVE-2026-122060 | WP Recipe Maker Plugin up to 10.9.1 on WordPress information disclosure (EUVD-2026-119457)
A vulnerability, which was classified as problematic, was found in WP Recipe Maker Plugin up to 10.9.1 on WordPress. This vulnerability affects unknown code. The manipulation results in information disclosure. This vulnerability was named C
CVE-2026-122062 | Pronamic Pay Plugin/Pronamic Pay doneren met Mollie Plugin on WordPress REST API information disclosure (EUVD-2026-119458)
A vulnerability was found in Pronamic Pay Plugin and Pronamic Pay doneren met Mollie Plugin on WordPress. It has been declared as problematic. This issue affects some unknown processing of the component REST API. Such manipulation leads to
CVE-2026-122085 | WooCommerce Event Tickets Manager for WooCommerce Plugin up to 1.5.x on WordPress Ticket Transfer Feature authorization (EUVD-2026-119459)
A vulnerability identified as critical has been detected in WooCommerce Event Tickets Manager for WooCommerce Plugin up to 1.5.x on WordPress. The impacted element is an unknown function of the component Ticket Transfer Feature. The manipul
CVE-2026-124504 | erupts erupt up to 2.3.0 ReportService.java ReportService.queryBiData sort sql injection (ID 485 / EUVD-2026-119760)
A vulnerability marked as critical has been reported in erupts erupt up to 2.3.0. Affected by this issue is the function ReportService.queryBiData of the file ReportService.java. Performing a manipulation of the argument sort results in sql
CVE-2026-124505 | Dianping CAT 3.0.0/3.1.0/4.0-RC1 Login/Logout Handler.java Handler.redirect rtnUrl (EUVD-2026-119761)
A vulnerability described as problematic has been identified in Dianping CAT 3.0.0/3.1.0/4.0-RC1. This affects the function Handler.redirect of the file Handler.java of the component Login/Logout. Executing a manipulation of the argument rt
CVE-2026-124501 | Tidelift moto up to 5.2.4 AWS Batch Emulation moto/batch/models.py privileged/volumes privileges management (EUVD-2026-119758)
A vulnerability identified as critical has been detected in Tidelift moto up to 5.2.4. Affected is an unknown function of the file moto/batch/models.py of the component AWS Batch Emulation. This manipulation of the argument privileged/volum
CVE-2026-98974 | Linux Kernel up to 6.12.113/6.18.56/7.2.10 XFS xmi_can_exchange_reflink_flags information disclosure (Nessus ID 377500)
A vulnerability marked as problematic has been reported in Linux Kernel up to 6.12.113/6.18.56/7.2.10. This affects the function xmi_can_exchange_reflink_flags of the component XFS. This manipulation causes information disclosure. The ident
CVE-2026-90315 | Linux Kernel up to 7.2.5 locking (Nessus ID 377500)
A vulnerability marked as critical has been reported in Linux Kernel up to 7.2.5. This affects the function pci_write_legacy_io/pci_mmap_legacy_mem/pci_mmap_legacy_io. This manipulation causes improper locking. This vulnerability is tracked
CVE-2026-80863 | Linux Kernel up to 7.2.2 RDMA/rxe rxe_qp.c free_rd_atomic_resources out-of-bounds (Nessus ID 377506)
A vulnerability, which was classified as very critical, has been found in Linux Kernel up to 7.2.2. Affected is the function free_rd_atomic_resources of the file drivers/infiniband/sw/rxe/rxe_qp.c of the component RDMA/rxe. The manipulation
CVE-2026-80864 | Linux Kernel up to 6.12.107/6.18.48/7.1.12/7.2.2 RDMA/rxe rxe_resp.c rxe_qp_from_attr/rxe_receiver use after free (Nessus ID 377506)
A vulnerability, which was classified as problematic, was found in Linux Kernel up to 6.12.107/6.18.48/7.1.12/7.2.2. This issue affects the function rxe_qp_from_attr/rxe_receiver of the file rxe_resp.c of the component RDMA/rxe. Executing a
CVE-2026-91203 | Cockpit Files race condition (Nessus ID 377511)
A vulnerability has been found in Cockpit and classified as very critical. The affected element is an unknown function of the component Files. Performing a manipulation results in race condition. This vulnerability is known as CVE-2026-9120
CVE-2026-80584 | Linux Kernel up to 7.1.9 s390 qeth qeth_snmp_command udata_len buffer overflow (Nessus ID 377513)
A vulnerability marked as critical has been reported in Linux Kernel up to 7.1.9. This affects the function qeth_snmp_command of the component s390 qeth. The manipulation of the argument udata_len leads to buffer overflow. This vulnerabilit
CVE-2026-80571 | Linux Kernel up to 6.18.45/7.1.9 papr-phy-attest papr_phy_attest_create_handle cmd.length buffer overflow (Nessus ID 377513)
A vulnerability was found in Linux Kernel up to 6.18.45/7.1.9 and classified as very critical. Affected by this vulnerability is the function papr_phy_attest_create_handle of the component papr-phy-attest. The manipulation of the argument c
CVE-2026-85344 | Flowplayer FV Flowplayer Video Player Plugin 7.5.55.7212/7.5.56.7212 on WordPress authorization (EUVD-2026-119460)
A vulnerability, which was classified as problematic, has been found in Flowplayer FV Flowplayer Video Player Plugin 7.5.55.7212/7.5.56.7212 on WordPress. This affects an unknown part. The manipulation leads to missing authorization. This v
CVE-2026-101371 | Oracle REST Data Services up to 26.1.0 Core improper authorization (EUVD-2026-105787)
A vulnerability categorized as problematic has been discovered in Oracle REST Data Services up to 26.1.0. The affected element is an unknown function of the component Core. Executing a manipulation can lead to improper authorization. This v
CVE-2026-101370 | Oracle REST Data Services up to 26.1.0 Core information disclosure (EUVD-2026-105786)
A vulnerability marked as problematic has been reported in Oracle REST Data Services up to 26.1.0. This impacts an unknown function of the component Core. This manipulation causes information disclosure. This vulnerability is handled as CVE
CVE-2026-101369 | Oracle REST Data Services up to 26.1.0 Backend-as-a-Service access control (EUVD-2026-105785)
A vulnerability identified as critical has been detected in Oracle REST Data Services up to 26.1.0. The impacted element is an unknown function of the component Backend-as-a-Service. The manipulation leads to improper access controls. This
CVE-2026-101372 | Oracle REST Data Services up to 26.1.0 Core information disclosure (EUVD-2026-105788)
A vulnerability labeled as problematic has been found in Oracle REST Data Services up to 26.1.0. This affects an unknown function of the component Core. The manipulation results in information disclosure. This vulnerability is known as CVE-
CVE-2026-101477 | Oracle Autonomous Health Framework up to 26.8 Trace File Analyzer privileges management (EUVD-2026-105893)
A vulnerability classified as very critical has been found in Oracle Autonomous Health Framework up to 26.8. This affects an unknown part of the component Trace File Analyzer. This manipulation causes improper privilege management. This vul
CVE-2026-101452 | Oracle Autonomous Health Framework up to 26.8 AHF Instant Diagnostic Replay privileges management (EUVD-2026-105868)
A vulnerability was found in Oracle Autonomous Health Framework up to 26.8. It has been rated as very critical. Affected by this issue is some unknown functionality of the component AHF Instant Diagnostic Replay. Performing a manipulation r
CVE-2026-101478 | Oracle Autonomous Health Framework up to 26.8 Trace File Analyzer privileges management (EUVD-2026-105894)
A vulnerability, which was classified as very critical, has been found in Oracle Autonomous Health Framework up to 26.8. This issue affects some unknown processing of the component Trace File Analyzer. Performing a manipulation results in i
CVE-2026-124499 | Fengoffice Feng Office up to 3.11.13.11/4.2.1.2 Translation Tool ToolController.class.php write_translations lang code injection (EUVD-2026-119756)
A vulnerability was found in Fengoffice Feng Office up to 3.11.13.11/4.2.1.2. It has been rated as problematic. This affects the function write_translations of the file application/controllers/ToolController.class.php of the component Trans
CVE-2026-124500 | Fengoffice Feng Office up to 3.11.13.11/4.2.1.2 File FilesController.class.php upload_document_image url server-side request forgery (EUVD-2026-119755)
A vulnerability categorized as critical has been discovered in Fengoffice Feng Office up to 3.11.13.11/4.2.1.2. This impacts the function upload_document_image of the file application/controllers/FilesController.class.php of the component F
CVE-2026-18093 | IBM App Connect Enterprise up to 13.0.8.2 access control (WID-SEC-2026-4383)
A vulnerability was found in IBM App Connect Enterprise up to 13.0.8.2. It has been declared as problematic. Affected is an unknown function. Executing a manipulation can lead to improper access controls. This vulnerability is registered as
CVE-2026-72813 | actix actix-files up to 0.6.9 Range resource consumption (Nessus ID 377516)
A vulnerability was found in actix actix-files up to 0.6.9. It has been declared as problematic. The impacted element is an unknown function. Such manipulation of the argument Range leads to resource consumption. This vulnerability is refer
CVE-2026-48057 | Randombit Botan up to 3.12.x X.509 Distinguished Name Decoder certificate validation (Nessus ID 377525)
A vulnerability was found in Randombit Botan up to 3.12.x. It has been declared as problematic. Affected by this issue is some unknown functionality of the component X.509 Distinguished Name Decoder. Such manipulation leads to improper cert
CVE-2026-99277 | Linux Kernel up to 7.3.1 ksmbd ksmbd_session_unregister use after free (Nessus ID 377526)
A vulnerability marked as very critical has been reported in Linux Kernel up to 7.3.1. The affected element is the function ksmbd_session_unregister of the component ksmbd. This manipulation causes use after free. This vulnerability is regi
CVE-2026-99271 | Linux Kernel up to 6.18.60/7.3.1 ALSA line6 playback.c submit_audio_out_urb prev_fbuf use after free (Nessus ID 377528)
A vulnerability was found in Linux Kernel up to 6.18.60/7.3.1. It has been classified as critical. Affected by this vulnerability is the function submit_audio_out_urb of the file sound/usb/line6/playback.c of the component ALSA line6. This
CVE-2026-124040 | CivetWeb up to 1.16 handle_http2 use after free (Nessus ID 377527)
A vulnerability classified as critical was found in CivetWeb up to 1.16. Impacted is the function handle_http2. The manipulation results in use after free. This vulnerability is identified as CVE-2026-124040. The attack can be executed remo
CVE-2026-99278 | Linux Kernel up to 7.3.1 ksmbd allocation of resources (Nessus ID 377529)
A vulnerability was found in Linux Kernel up to 7.3.1. It has been declared as critical. Affected by this issue is some unknown functionality of the component ksmbd. Such manipulation leads to allocation of resources. This vulnerability is
CVE-2026-99276 | Linux Kernel up to 7.3.1 ksmbd destroy_previous_session locking (Nessus ID 377530)
A vulnerability described as critical has been identified in Linux Kernel up to 7.3.1. The impacted element is the function destroy_previous_session of the component ksmbd. Such manipulation leads to improper locking. This vulnerability is
CVE-2026-103022 | Urwid up to 4.0.6 Web Display Interface urwid/display/web.py handle_short_request denial of service (Nessus ID 377531)
A vulnerability was found in Urwid up to 4.0.6 and classified as problematic. Affected is the function handle_short_request of the file urwid/display/web.py of the component Web Display Interface. The manipulation results in denial of servi
CVE-2026-16682 | IBM OPENBMC/Hardware Management Console up to OP940.00-OP940.A2 uninitialized resource (EUVD-2026-119742)
A vulnerability categorized as critical has been discovered in IBM OPENBMC and Hardware Management Console. The impacted element is an unknown function. Executing a manipulation can lead to uninitialized resource. This vulnerability is regi
CVE-2026-101493 | Oracle REST Data Services up to 26.2.1 Core improper authorization (EUVD-2026-105909)
A vulnerability was found in Oracle REST Data Services up to 26.2.1. It has been classified as critical. Affected by this vulnerability is an unknown functionality of the component Core. Performing a manipulation results in improper authori