Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 738 | 0,2 % |
| ≥50 % | 3.223 | 0,8 % |
| ≥10 % | 22.096 | 5,8 % |
| <10 % | 354.672 | 93,2 % |
CVE-2026-22063 | NetApp ONTAP certificate validation (EUVD-2026-111406)
A vulnerability described as problematic has been identified in NetApp ONTAP, StorageGRID and E-Series SANtricity OS Controller Software. Impacted is an unknown function. Such manipulation leads to improper certificate validation. This vuln
CVE-2026-118358 | Google Chrome up to 156.0.8078.47 WebAudio memory corruption (EUVD-2026-111447)
A vulnerability described as critical has been identified in Google Chrome. The affected element is an unknown function of the component WebAudio. Executing a manipulation can lead to memory corruption. This vulnerability is tracked as CVE-
CVE-2026-118357 | Google Chrome up to 156.0.8078.47 FileSystem use after free (EUVD-2026-111427)
A vulnerability labeled as critical has been found in Google Chrome. This issue affects some unknown processing of the component FileSystem. Such manipulation leads to use after free. This vulnerability is referenced as CVE-2026-118357. It
CVE-2026-118359 | Google Chrome up to 156.0.8078.47 V8 memory corruption (EUVD-2026-111451)
A vulnerability marked as critical has been reported in Google Chrome. Impacted is an unknown function of the component V8. Performing a manipulation results in memory corruption. This vulnerability is identified as CVE-2026-118359. The att
CVE-2026-103995 | Python Software Foundation up to 3.15.x HTTP Response Parsing input validation (EUVD-2026-111382)
A vulnerability described as critical has been identified in Python Software Foundation Python up to 3.15.x. Affected is an unknown function of the component HTTP Response Parsing. Executing a manipulation can lead to improper input validat
CVE-2026-109708 | Mozilla Firefox up to 153.4/157 Networking sandbox (Nessus ID 372630)
A vulnerability has been found in Mozilla Firefox up to 153.4/157 and classified as critical. This issue affects some unknown processing of the component Networking. This manipulation causes sandbox issue. This vulnerability appears as CVE-
CVE-2026-117863 | Mozilla Firefox up to 115.43/153.5/158 Audio Video uninitialized variable (Nessus ID 372631)
A vulnerability classified as critical was found in Mozilla Firefox up to 115.43/153.5/158. The affected element is an unknown function of the component Audio Video. The manipulation results in use of uninitialized variable. This vulnerabil
CVE-2026-117862 | Mozilla Firefox up to 115.43/153.5/158 Networking privileges management (Nessus ID 372631)
A vulnerability was found in Mozilla Firefox up to 115.43/153.5/158 and classified as critical. Affected is an unknown function of the component Networking. Executing a manipulation can lead to improper privilege management. This vulnerabil
CVE-2026-117861 | Mozilla Firefox Navigation sandbox (Nessus ID 372631)
A vulnerability, which was classified as critical, has been found in Mozilla Firefox. The impacted element is an unknown function of the component Navigation Component. This manipulation causes sandbox issue. This vulnerability is registere
CVE-2022-48074 | NoMachine up to 8.2.2 NXS File privilege escalation (EUVD-2022-50788)
A vulnerability marked as problematic has been reported in NoMachine up to 8.2.2. This vulnerability affects unknown code of the component NXS File Handler. The manipulation leads to privilege escalation. This vulnerability is documented as
CVE-2022-48073 | Phicomm K2 22.6.534.263 Admin Password missing encryption (EUVD-2022-50787)
A vulnerability marked as problematic has been reported in Phicomm K2 22.6.534.263. This impacts an unknown function of the component Admin Password Handler. Performing a manipulation results in missing encryption of sensitive data. This vu
CVE-2022-48072 | Phicomm K2G 22.6.3.20 Automatic Upgrade autoUpTime command injection (EUVD-2022-50786)
A vulnerability classified as critical was found in Phicomm K2G 22.6.3.20. Affected by this issue is some unknown functionality of the component Automatic Upgrade Handler. The manipulation of the argument autoUpTime results in command injec
PHP Publishes Mitigation Advice for New RCE Flaw
PHP warns of critical RCE vulnerability CVE-2026-115560, but says limited exploit conditions mean most deployments are unlikely to be affected This article has been indexed from www.infosecurity-magazine.com Read the original article: PHP P
CVE-2026-33981 | dgtlmoon changedetection.io up to 0.54.6 Environment Variable SALTED_PASS/PLAYWRIGHT_DRIVER_URL/HTTP_PROXY information disclosure (GHSA-58r7-4wr5-hfx8)
A vulnerability has been found in dgtlmoon changedetection.io up to 0.54.6 and classified as problematic. The affected element is an unknown function of the component Environment Variable Handler. Performing a manipulation of the argument S
CVE-2026-33980 | pab1it0 adx-mcp-server up to 1.1.0 table_name data query logic injection (GHSA-vphc-468g-8rfp)
A vulnerability labeled as critical has been found in pab1it0 adx-mcp-server up to 1.1.0. This issue affects the function get_table_schema/sample_table_data/get_table_details. Executing a manipulation of the argument table_name can lead to
CVE-2026-82984 | Nextcloud Server up to 33.0.0 Resources API Endpoint information disclosure (WID-SEC-2026-4185)
A vulnerability classified as problematic was found in Nextcloud Server up to 33.0.0. The impacted element is an unknown function of the component Resources API Endpoint. The manipulation results in information disclosure. This vulnerabilit
CVE-2026-82983 | Nextcloud Tables up to 2.0.0 Share Listing /apps/tables/share/table tableId privileges management (WID-SEC-2026-4185)
A vulnerability was found in Nextcloud Tables up to 2.0.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /apps/tables/share/table of the component Share Listing. Executing a manipulatio
CVE-2026-77173 | Nextcloud up to 5.0.0 Files Confidential privileges management (WID-SEC-2026-4185)
A vulnerability was found in Nextcloud up to 5.0.0 and classified as problematic. The affected element is an unknown function of the component Files Confidential. Such manipulation leads to improper privilege management. This vulnerability
CVE-2026-77172 | Nextcloud Server up to 34.0.0 privileges management (WID-SEC-2026-4185)
A vulnerability was found in Nextcloud Server up to 34.0.0 and classified as problematic. This vulnerability affects unknown code. The manipulation results in improper privilege management. This vulnerability is reported as CVE-2026-77172.
CVE-2026-77171 | Nextcloud Collectives up to 4.0.0 privileges management (WID-SEC-2026-4185)
A vulnerability classified as problematic has been found in Nextcloud Collectives up to 4.0.0. This impacts an unknown function. This manipulation causes improper privilege management. This vulnerability is tracked as CVE-2026-77171. The at
CVE-2026-77167 | Nextcloud Server up to 34.0.0 Federated Share Endpoint denial of service (WID-SEC-2026-4185)
A vulnerability marked as critical has been reported in Nextcloud Server up to 34.0.0. This issue affects some unknown processing of the component Federated Share Endpoint. Performing a manipulation results in denial of service. This vulner
CVE-2026-67400 | Nextcloud Richdocuments up to 11.0.0 WOPI information disclosure (WID-SEC-2026-4185)
A vulnerability labeled as problematic has been found in Nextcloud Richdocuments up to 11.0.0. The affected element is an unknown function of the component WOPI. Executing a manipulation can lead to information disclosure. The identificatio
CVE-2026-117860 | Mozilla Firefox up to 153.5/158 Navigation cross-domain policy (Nessus ID 372631)
A vulnerability has been found in Mozilla Firefox up to 153.5/158 and classified as problematic. This impacts an unknown function of the component Navigation Component. Performing a manipulation results in permissive cross-domain policy wit
CVE-2026-118177 | Mozilla Thunderbird up to 153.5/158 Calendar Subscription input validation (Nessus ID 372632)
A vulnerability classified as critical has been found in Mozilla Thunderbird up to 153.5/158. This affects an unknown function of the component Calendar Subscription. Performing a manipulation results in improper input validation. This vuln
CVE-2026-118176 | Mozilla Thunderbird up to 153.5/158 Mailbox URL improper authentication (Nessus ID 372632)
A vulnerability was found in Mozilla Thunderbird up to 153.5/158. It has been rated as problematic. This affects an unknown part of the component Mailbox URL Handler. Performing a manipulation results in improper authentication. This vulner
CVE-2026-118175 | Mozilla Thunderbird up to 153.5/158 information disclosure (Nessus ID 372632)
A vulnerability identified as problematic has been detected in Mozilla Thunderbird up to 153.5/158. This issue affects some unknown processing. The manipulation leads to information disclosure. This vulnerability is documented as CVE-2026-1
CVE-2026-118174 | Mozilla Thunderbird up to 153.5/158 OpenPGP information disclosure (Nessus ID 372632)
A vulnerability, which was classified as problematic, was found in Mozilla Thunderbird up to 153.5/158. This affects an unknown function of the component OpenPGP. Executing a manipulation can lead to information disclosure. The identificati
CVE-2026-34046 | langflow-ai langflow up to 1.5.0 flows.py _read_flow authorization (GHSA-8c4j-f57c-35cf)
A vulnerability classified as critical was found in langflow-ai langflow up to 1.5.0. Impacted is the function _read_flow of the file src/backend/base/langflow/api/v1/flows.py. The manipulation results in authorization bypass. This vulnerab
CVE-2026-33907 | ellanetworks core up to 1.6.x null pointer dereference (GHSA-55q8-2gwx-29pc)
A vulnerability was found in ellanetworks core up to 1.6.x. It has been classified as problematic. This affects an unknown part. This manipulation causes null pointer dereference. This vulnerability is tracked as CVE-2026-33907. The attack
CVE-2026-33906 | ellanetworks core up to 1.6.x Restore Endpoint privileges management (GHSA-87j9-m7x6-hvw2)
A vulnerability described as critical has been identified in ellanetworks core up to 1.6.x. The affected element is an unknown function of the component Restore Endpoint. The manipulation results in improper privilege management. This vulne
CVE-2026-33904 | ellanetworks core up to 1.6.x N2 Interface deadlock (GHSA-9h59-p45g-445h)
A vulnerability labeled as problematic has been found in ellanetworks core up to 1.6.x. The impacted element is an unknown function of the component N2 Interface. The manipulation results in deadlock. This vulnerability is reported as CVE-2
CVE-2026-33903 | ellanetworks core up to 1.6.x NGAP Location Report null pointer dereference (GHSA-f2f3-9cx3-wcmf)
A vulnerability identified as problematic has been detected in ellanetworks core up to 1.6.x. The affected element is an unknown function of the component NGAP Location Report Handler. The manipulation leads to null pointer dereference. Thi
Microsoft Rushes out Fixes for .NET
Brotli Emergency Patches, PHP-to-Shell Exploited, and Australia Disrupts 180K Amadey Infections | Cybersecurity Today On Cybersecurity Today (Oct. 28, 2026), Microsoft issues out-of-band .NET updates for a critical flaw in Google's Bro
CVE-2026-33887 | Statamic CMS up to 5.73.15/6.7.1 Edit Permission authorization (GHSA-4hp7-3wxg-cv9q)
A vulnerability was found in Statamic CMS up to 5.73.15/6.7.1 and classified as critical. Affected by this issue is some unknown functionality of the component Edit Permission Handler. The manipulation results in missing authorization. This
CVE-2026-33886 | Statamic CMS up to 5.73.15/6.7.1 Application Configuration information disclosure (GHSA-gcqf-5x9f-hq7f)
A vulnerability was found in Statamic CMS up to 5.73.15/6.7.1 and classified as problematic. This issue affects some unknown processing of the component Application Configuration. Such manipulation leads to information disclosure. This vuln
CVE-2026-33885 | Statamic CMS up to 5.73.15/6.7.1 redirect (GHSA-7f74-7q5w-hj4r)
A vulnerability has been found in Statamic CMS up to 5.73.15/6.7.1 and classified as problematic. This vulnerability affects unknown code. This manipulation causes open redirect. The identification of this vulnerability is CVE-2026-33885. I
CVE-2026-33884 | Statamic CMS up to 5.73.15/6.7.1 authorization (GHSA-8vwx-ccf6-5wg2)
A vulnerability, which was classified as problematic, has been found in Statamic CMS up to 5.73.15/6.7.1. Affected by this issue is some unknown functionality. The manipulation leads to incorrect authorization. This vulnerability is uniquel
CVE-2026-33883 | Statamic CMS up to 5.73.15/6.7.1 user:reset_password_form cross site scripting (GHSA-3jg4-p23x-p4qx)
A vulnerability, which was classified as problematic, was found in Statamic CMS up to 5.73.15/6.7.1. This affects an unknown part. The manipulation of the argument user:reset_password_form results in cross site scripting. This vulnerability
CVE-2026-33879 | londonaicentre FLIP up to 0.1.1 excessive authentication (GHSA-p34f-488j-5cwv)
A vulnerability categorized as problematic has been discovered in londonaicentre FLIP up to 0.1.1. The impacted element is an unknown function. Executing a manipulation can lead to improper restriction of excessive authentication attempts.
CVE-2026-33875 | Gematik app-Authenticator up to 4.15.x verification of source (GHSA-qg87-cf56-2rmr)
A vulnerability categorized as critical has been discovered in Gematik app-Authenticator up to 4.15.x. This affects an unknown function. The manipulation results in improper verification of source of a communication channel. This vulnerabil
CVE-2026-4974 | Tenda AC7 15.03.06.44 POST Request /goform/SetSysTimeCfg fromSetSysTime time stack-based overflow (EUVD-2026-16809)
A vulnerability labeled as critical has been found in Tenda AC7 15.03.06.44. Affected by this issue is the function fromSetSysTime of the file /goform/SetSysTimeCfg of the component POST Request Handler. Executing a manipulation of the argu
CVE-2026-34475 | varnish-software Varnish Cache up to 8.0.0 validate before canonicalize (EUVD-2026-16801 / Nessus ID 304158)
A vulnerability categorized as problematic has been discovered in varnish-software Varnish Cache up to 8.0.0. This affects an unknown part. Such manipulation leads to incorrect behavior order: validate before canonicalize. This vulnerabilit
CVE-2026-34391 | fleetdm fleet up to 4.81.0 wrong session (GHSA-wg7j-pcc3-h4rh)
A vulnerability was found in fleetdm fleet up to 4.81.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation results in exposure of data element to wrong session. This vulnerabil
CVE-2026-34389 | fleetdm fleet up to 4.80.x Device Management improper authentication (GHSA-4f9r-x588-pp2h)
A vulnerability described as critical has been identified in fleetdm fleet up to 4.80.x. This vulnerability affects unknown code of the component Device Management Handler. Executing a manipulation can lead to improper authentication. This
CVE-2026-34205 | home-assistant up to 17.1 Internal Docker Bridge Interface communication channel to intended endpoints (GHSA-gh5m-4m97-c95h)
A vulnerability identified as critical has been detected in home-assistant up to 17.1. This impacts an unknown function of the component Internal Docker Bridge Interface. This manipulation causes improper restriction of communication channe
CVE-2026-33872 | revelrylabs elixir-nodejs up to 3.1.3 race condition (ID 100)
A vulnerability classified as problematic has been found in revelrylabs elixir-nodejs up to 3.1.3. This impacts an unknown function. This manipulation causes race condition. The identification of this vulnerability is CVE-2026-33872. It is
CVE-2026-33765 | pi-hole web up to 5.x savesettings.php exec webtheme os command injection (GHSA-828h-5x96-rqx7)
A vulnerability was found in pi-hole web up to 5.x. It has been declared as critical. This affects the function exec of the file savesettings.php. The manipulation of the argument webtheme results in os command injection. This vulnerability
CVE-2026-33654 | HKUDS nanobot up to 0.1.5 Email Channel Handler email.py code injection (GHSA-4gmr-2vc8-7qh3)
A vulnerability was found in HKUDS nanobot up to 0.1.5. It has been rated as critical. Affected by this issue is some unknown functionality of the file nanobot/channels/email.py of the component Email Channel Handler Module. This manipulati
CVE-2026-114063 | sveltejs SvelteKit up to 2.x Vite Preview Server path traversal (EUVD-2026-107014)
A vulnerability, which was classified as problematic, has been found in sveltejs SvelteKit up to 2.x. This affects an unknown function of the component Vite Preview Server. The manipulation leads to path traversal. This vulnerability is lis
CVE-2026-114058 | ArcadeData ArcadeDB up to 26.10.0 Bolt Protocol db.labels db missing authentication (EUVD-2026-107009)
A vulnerability categorized as problematic has been discovered in ArcadeData ArcadeDB up to 26.10.0. This issue affects the function db.labels of the component Bolt Protocol Handler. The manipulation of the argument db results in missing au
CVE-2026-57203 | Asterisk prior 23.4.1 Log Grabber ast_loggrabber privileges management (EUVD-2026-111402)
A vulnerability identified as problematic has been detected in Asterisk. This affects the function ast_loggrabber of the component Log Grabber. The manipulation leads to improper privilege management. This vulnerability is listed as CVE-202
CVE-2026-57190 | Asterisk up to 23.4.0 cel_pgsql/cel_tds CELGenUserEvent eventtype sql injection (EUVD-2026-111401)
A vulnerability was found in Asterisk up to 23.4.0. It has been classified as critical. This impacts the function CELGenUserEvent of the component cel_pgsql/cel_tds. This manipulation of the argument eventtype causes sql injection. The iden
CVE-2026-114073 | Trigger.dev up to 4.5.8 CLI information disclosure (EUVD-2026-107024)
A vulnerability identified as problematic has been detected in Trigger.dev up to 4.5.8. This affects an unknown function of the component CLI. Performing a manipulation results in information disclosure. This vulnerability is known as CVE-2
CVE-2026-114068 | Trigger.dev up to 4.5.x Waitpoint Token Wait Endpoint authorization (EUVD-2026-107019)
A vulnerability classified as problematic has been found in Trigger.dev up to 4.5.x. This impacts an unknown function of the component Waitpoint Token Wait Endpoint. The manipulation leads to missing authorization. This vulnerability is ref
CVE-2026-114078 | triggerdotdev Trigger.dev up to 4.5.5 Schedule Service friendlyId authorization (EUVD-2026-107029)
A vulnerability marked as problematic has been reported in triggerdotdev Trigger.dev up to 4.5.5. Affected is the function DeleteTaskScheduleService/SetActiveOnTaskScheduleService of the component Schedule Service. The manipulation of the a
CVE-2026-78376 | Red Hat Enterprise Linux WebKitGTK use after free (EUVD-2026-64858 / Nessus ID 339187)
A vulnerability has been found in Red Hat Enterprise Linux and classified as very critical. This affects an unknown function of the component WebKitGTK. Performing a manipulation results in use after free. This vulnerability is reported as
CVE-2026-114083 | triggerdotdev Trigger.dev up to 4.5.0-rc.2 Packets /api/v1/packets filename path traversal (EUVD-2026-106886)
A vulnerability, which was classified as critical, has been found in triggerdotdev Trigger.dev up to 4.5.0-rc.2. This vulnerability affects unknown code of the file /api/v1/packets of the component Packets. Performing a manipulation of the
CVE-2026-34387 | fleetdm fleet up to 4.81.0 on macOS/Linux os command injection (GHSA-7rhw-5mpv-gp4h)
A vulnerability was found in fleetdm fleet up to 4.81.0 on macOS/Linux and classified as critical. This vulnerability affects unknown code. The manipulation results in os command injection. This vulnerability is cataloged as CVE-2026-34387.
CVE-2026-34386 | fleetdm fleet up to 4.80.x API Call sql injection (GHSA-9p23-p2m4-2r4m)
A vulnerability was found in fleetdm fleet up to 4.80.x. It has been rated as critical. This impacts an unknown function of the component API Call Handler. The manipulation leads to sql injection. This vulnerability is documented as CVE-202
CVE-2026-34385 | fleetdm fleet up to 4.80.x Apple MDM Profile Delivery Pipeline sql injection (GHSA-v895-833r-8c45)
A vulnerability categorized as critical has been discovered in fleetdm fleet up to 4.80.x. Affected by this issue is some unknown functionality of the component Apple MDM Profile Delivery Pipeline. The manipulation results in sql injection.