Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 744 | 0,2 % |
| ≥50 % | 3.221 | 0,8 % |
| ≥10 % | 22.086 | 5,8 % |
| <10 % | 354.678 | 93,2 % |
CVE-2026-115415 – Secret masking bypass in the environment tool in Strands Agents Tools
Bulletin ID: 2026-154-AWS Publication Date: 10/28/2026 12:30 PM PDT Description: We identified CVE-2026-115415, an issue where the environment tool accepted a masking parameter from the large language model (LLM) through its tool schema. A
CVE-2026-81839 | GitLab up to 19.2.7/19.3.4/19.4.1 Pipeline Execution Policy privileges management (WID-SEC-2026-3858)
A vulnerability classified as critical was found in GitLab up to 19.2.7/19.3.4/19.4.1. This affects an unknown part of the component Pipeline Execution Policy. Such manipulation leads to improper privilege management. This vulnerability is
CVE-2026-78335 | GitLab up to 19.2.7/19.3.4/19.4.1 Integrations improper authorization (WID-SEC-2026-3858)
A vulnerability classified as critical has been found in GitLab up to 19.2.7/19.3.4/19.4.1. Affected by this issue is some unknown functionality of the component Integrations. This manipulation causes improper authorization. This vulnerabil
CVE-2026-7767 | GitLab up to 19.2.7/19.3.4/19.4.1 Kubernetes Proxy redirect (WID-SEC-2026-3858)
A vulnerability described as problematic has been identified in GitLab up to 19.2.7/19.3.4/19.4.1. Affected by this vulnerability is an unknown functionality of the component Kubernetes Proxy. The manipulation results in open redirect. This
CVE-2026-6567 | GitLab up to 19.2.7/19.3.4/19.4.1 improper authorization (WID-SEC-2026-3858)
A vulnerability marked as problematic has been reported in GitLab up to 19.2.7/19.3.4/19.4.1. Affected is an unknown function. The manipulation leads to improper authorization. This vulnerability is traded as CVE-2026-6567. It is possible t
CVE-2026-5954 | GitLab 15.1/19.2.7/19.3.4/19.4.1 improper authorization (WID-SEC-2026-3858)
A vulnerability identified as problematic has been detected in GitLab 15.1/19.2.7/19.3.4/19.4.1. This affects an unknown function. Performing a manipulation results in improper authorization. This vulnerability is reported as CVE-2026-5954.
CVE-2026-16301 | GitLab up to 19.2.7/19.3.4/19.4.1 Downstream Pipeline Creation Service improper authorization (WID-SEC-2026-3858)
A vulnerability labeled as critical has been found in GitLab up to 19.2.7/19.3.4/19.4.1. This impacts an unknown function of the component Downstream Pipeline Creation Service. Executing a manipulation can lead to improper authorization. Th
CVE-2026-97229 | GitLab up to 19.2.7/19.3.4/19.4.1 Regular Expression Validation incorrect regex
A vulnerability categorized as critical has been discovered in GitLab up to 19.2.7/19.3.4/19.4.1. Affected is an unknown function of the component Regular Expression Validation. Executing a manipulation can lead to incorrect regular express
CVE-2026-76418 | Cisco Secure Firewall Adaptive Security Appliance Remote Access SSL VPN service denial of service
A vulnerability described as critical has been identified in Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense. Impacted is an unknown function of the component Remote Access SSL VPN service. The manipulat
CVE-2026-16275 | GitLab up to 19.2.7/19.3.4/19.4.1 improper authorization (WID-SEC-2026-3858)
A vulnerability categorized as problematic has been discovered in GitLab up to 19.2.7/19.3.4/19.4.1. The impacted element is an unknown function. Such manipulation leads to improper authorization. This vulnerability is documented as CVE-202
CVE-2026-14814 | GitLab up to 19.2.7/19.3.4/19.4.1 CI/CD Pipeline input validation (WID-SEC-2026-3858)
A vulnerability was found in GitLab up to 19.2.7/19.3.4/19.4.1. It has been declared as problematic. Impacted is an unknown function of the component CI/CD Pipeline. The manipulation results in improper input validation. This vulnerability
CVE-2026-14552 | GitLab up to 19.2.7/19.3.4/19.4.1 Epic improper authorization (WID-SEC-2026-3858)
A vulnerability was found in GitLab up to 19.2.7/19.3.4/19.4.1. It has been rated as problematic. The affected element is an unknown function of the component Epic. This manipulation causes improper authorization. This vulnerability is regi
CVE-2026-105458 | GitLab up to 19.2.7/19.3.4/19.4.1 Duo Agent Platform permission (WID-SEC-2026-3858)
A vulnerability was found in GitLab up to 19.2.7/19.3.4/19.4.1 and classified as problematic. This vulnerability affects unknown code of the component Duo Agent Platform. Executing a manipulation can lead to permission issues. This vulnerab
CVE-2026-104661 | GitLab up to 19.2.7/19.3.4/19.4.1 Compliance Pipeline permission (WID-SEC-2026-3858)
A vulnerability, which was classified as problematic, was found in GitLab up to 19.2.7/19.3.4/19.4.1. Affected by this issue is some unknown functionality of the component Compliance Pipeline. Such manipulation leads to permission issues. T
CVE-2026-100104 | GitLab up to 19.2.7/19.3.4/19.4.1 URL Validation race condition (WID-SEC-2026-3858)
A vulnerability has been found in GitLab up to 19.2.7/19.3.4/19.4.1 and classified as critical. This affects an unknown part of the component URL Validation. Performing a manipulation results in race condition. This vulnerability is identif
HTTP2Shell - Brotli-Sicherheitslücke geht über Node.js hinaus - Netzpalaver
Cybersecurity-Gefahr - anfälliger Brotli-Code könnte auch in anderen Laufzeiten, Paketen, HTTP2Shell tauchte kurz nach PHP2Shell auf, doch die ... Weiterlesen
CVE-2024-53326 | LINQPad up to 5.52.0 PopulateFromCache deserialization
A vulnerability labeled as problematic has been found in LINQPad up to 5.52.0. This issue affects the function LINQPad.AutoRefManager::PopulateFromCache. Such manipulation leads to deserialization. This vulnerability is documented as CVE-20
CVE-2024-51092 | LibreNMS up to 24.9.x AboutController.php index os command injection
A vulnerability, which was classified as critical, has been found in LibreNMS up to 24.9.x. The affected element is the function index of the file AboutController.php. The manipulation leads to os command injection. This vulnerability is un
CVE-2024-46508 | yeti-platform yeti up to 2.1.11 hard-coded key
A vulnerability identified as problematic has been detected in yeti-platform yeti up to 2.1.11. This vulnerability affects unknown code. This manipulation causes use of hard-coded cryptographic key . This vulnerability is registered as CVE-
CVE-2024-46507 | yeti-platform yeti up to 2.1.11 special elements in template engine
A vulnerability was found in yeti-platform yeti up to 2.1.11. It has been rated as critical. Affected by this issue is some unknown functionality. The manipulation leads to improper neutralization of special elements used in a template engi
CVE-2024-45257 | BYOB 2.0 Payload Build Page core/generators.py build command injection
A vulnerability was found in BYOB 2.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file core/generators.py of the component Payload Build Page. Executing a manipulation of the argument
CVE-2024-33724 | SOPlanning 1.52.00 process/groupe_save.php groupe_id cross site scripting
A vulnerability categorized as problematic has been discovered in SOPlanning 1.52.00. This affects an unknown part of the file process/groupe_save.php. The manipulation of the argument groupe_id results in cross site scripting. This vulnera
CVE-2024-33722 | SOPlanning 1.52.00 projets.php statut[] sql injection
A vulnerability was found in SOPlanning 1.52.00 and classified as critical. This impacts an unknown function of the file projets.php. Such manipulation of the argument statut[] leads to sql injection. This vulnerability is referenced as CVE
CVE-2024-33288 | Prison Management System 1.0 Admin Login Page username sql injection
A vulnerability, which was classified as critical, was found in Prison Management System 1.0. The impacted element is an unknown function of the component Admin Login Page. The manipulation of the argument Username results in sql injection.
CVE-2024-27686 | MikroTik RouterOS 5.0/6.44/6.49.10 SMB Request denial of service (ID 177811)
A vulnerability described as problematic has been identified in MikroTik RouterOS 5.0/6.44/6.49.10. Affected by this issue is some unknown functionality of the component SMB Request Handler. The manipulation results in denial of service. Th
CVE-2023-46453 | GL.iNet Device 4.3.7 incorrect regex (Exploit 51865)
A vulnerability, which was classified as very critical, was found in GL.iNet Device 4.3.7. Affected is an unknown function. Such manipulation leads to incorrect regular expression. This vulnerability is uniquely identified as CVE-2023-46453
CVE-2023-27753 | MK-Auth 23.01K4.9 PHP File unrestricted upload
A vulnerability classified as critical was found in MK-Auth 23.01K4.9. Affected is an unknown function of the component PHP File Handler. Executing a manipulation can lead to unrestricted upload. This vulnerability is handled as CVE-2023-27
CVE-2026-39814 | Fortinet FortiWeb up to 7.4.12/7.6.6/8.0.2 path traversal (FG-IR-26-114)
A vulnerability classified as problematic was found in Fortinet FortiWeb up to 7.4.12/7.6.6/8.0.2. The impacted element is an unknown function. Executing a manipulation can lead to relative path traversal. The identification of this vulnera
CVE-2023-54349 | Spondonit AmazCart CMS 3.4 Search History cross site scripting (Exploit 51219)
A vulnerability classified as problematic has been found in Spondonit AmazCart CMS 3.4. This affects an unknown part of the component Search History Handler. Performing a manipulation results in cross site scripting. This vulnerability was
CVE-2023-54347 | OpenEMR 7.0.1 Main Login Endpoint authUser/clearPass excessive authentication (Exploit 51413)
A vulnerability categorized as problematic has been discovered in OpenEMR 7.0.1. This affects an unknown function of the component Main Login Endpoint. Executing a manipulation of the argument authUser/clearPass can lead to improper restric
CVE-2023-54346 | Backupbliss WordPress Plugin Backup Migration 1.2.8 on WordPress Configuration File file information disclosure (Exploit 51445)
A vulnerability was found in Backupbliss WordPress Plugin Backup Migration 1.2.8 on WordPress. It has been classified as problematic. Impacted is an unknown function of the component Configuration File Handler. This manipulation causes file
CVE-2023-54345 | Frappe ERPNext 13.4.0 call /app/server-script gi_frame code injection (Exploit 51580)
A vulnerability was found in Frappe ERPNext 13.4.0 and classified as critical. This issue affects some unknown processing of the file /app/server-script of the component call Handler. The manipulation of the argument gi_frame results in cod
CVE-2023-54344 | Eclipse equinox OSGi up to 3.7.2 Console Interface missing authentication (Exploit 51879)
A vulnerability was found in Eclipse equinox OSGi up to 3.7.2. It has been rated as critical. The impacted element is an unknown function of the component Console Interface. Performing a manipulation results in missing authentication. This
CVE-2023-54342 | Eclipse equinox OSGi up to 3.18 Console Interface missing authentication (Exploit 51878)
A vulnerability was found in Eclipse equinox OSGi up to 3.18. It has been declared as critical. The affected element is an unknown function of the component Console Interface. Such manipulation leads to missing authentication. This vulnerab
IT Security News Hourly Summary 2026-10-29 20h : 36 posts
36 posts published in the last hour 18:36Yoba Malware Abuses Signed ChatGPT and Claude Binaries to Target AI Users 18:36Claude Model Builds Exploits Across Major Browsers &amp; OSes 18:36Artificial Intimacy: Love and lies in the age of
CVE-2026-117870 | Mozilla Firefox up to 115.43/153.5/158 JavaScript Engine use after free (Nessus ID 373648)
A vulnerability marked as critical has been reported in Mozilla Firefox up to 115.43/153.5/158. The affected element is an unknown function of the component JavaScript Engine. The manipulation leads to use after free. This vulnerability is
CVE-2026-117869 | Mozilla Firefox up to 115.43/153.5/158 DOM Core/HTML use after free (Nessus ID 373648)
A vulnerability described as critical has been identified in Mozilla Firefox up to 115.43/153.5/158. The impacted element is an unknown function of the component DOM Core/HTML. The manipulation results in use after free. This vulnerability
CVE-2026-117868 | Mozilla Firefox up to 115.43/153.5/158 Networking sandbox (Nessus ID 373648)
A vulnerability identified as critical has been detected in Mozilla Firefox up to 115.43/153.5/158. This issue affects some unknown processing of the component Networking. Performing a manipulation results in sandbox issue. This vulnerabili
CVE-2026-117867 | Mozilla Firefox up to 115.43/153.5/158 Layout use after free (Nessus ID 373648)
A vulnerability categorized as critical has been discovered in Mozilla Firefox up to 115.43/153.5/158. This vulnerability affects unknown code of the component Layout. Such manipulation leads to use after free. This vulnerability is uniquel
CVE-2026-117865 | Mozilla Firefox GC use after free (Nessus ID 373648)
A vulnerability was found in Mozilla Firefox. It has been rated as critical. This affects an unknown part of the component GC. This manipulation causes use after free. This vulnerability is handled as CVE-2026-117865. The attack can be init
CVE-2026-74049 | Apache Tomcat up to 11.0.26 redirect (EUVD-2026-105005)
A vulnerability classified as problematic has been found in Apache Tomcat up to 7.0.109/8.5.100/9.0.122/10.1.60/11.0.26. This vulnerability affects unknown code. Performing a manipulation results in open redirect. This vulnerability is cata
CVE-2026-89009 | WAVLINK WN535M1/WN535M3 up to M35M1_V250922 sync_server daemon filename path traversal (EUVD-2026-76129)
A vulnerability was found in WAVLINK WN535M1 and WN535M3 up to M35M1_V250922. It has been rated as critical. Impacted is an unknown function of the component sync_server daemon. This manipulation of the argument filename causes path travers
CVE-2026-80353 | Apache Tomcat up to 9.0.122 APR-Native connector toctou (EUVD-2026-105006)
A vulnerability, which was classified as problematic, has been found in Apache Tomcat up to 9.0.122. Impacted is an unknown function of the component APR-Native connector. The manipulation leads to time-of-check time-of-use. This vulnerabil
CVE-2026-46651 | intranda goobi-viewer-core up to 26.04 Download Task Endpoint monitor.socket DownloadTaskEndpoint missing authentication (EUVD-2026-109059)
A vulnerability described as critical has been identified in intranda goobi-viewer-core up to 26.04. This impacts the function DownloadTaskEndpoint of the file /tasks/download/monitor.socket of the component Download Task Endpoint. Executin
CVE-2026-115477 | -40-Thieves obsidian-tc up to 1.31.3 Handler privileges management (EUVD-2026-109082)
A vulnerability was found in -40-Thieves obsidian-tc up to 1.31.3. It has been declared as problematic. This vulnerability affects unknown code of the component Handler. Executing a manipulation can lead to improper privilege management. Th
CVE-2026-51851 | agent0ai Agent-Zero 1.7/1.8/1.9/1.10 FileBrowser file_browser.py save_text_file path traversal (EUVD-2026-113288)
A vulnerability described as critical has been identified in agent0ai Agent-Zero 1.7/1.8/1.9/1.10. This vulnerability affects the function save_text_file of the file python/helpers/file_browser.py of the component FileBrowser. The manipulat
Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware
A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware framework called KeyDrift.
GitHub Release: nodejs/node v27.0.0-alpha.0.0.0 (29.10.2026)
🛡️ Security Fix nodejs/nodev27.0.0-alpha.0.0.029.10.2026@RafaelGSSNotable Changes V8 15.6 The V8 engine is updated to version 15.6.75.13, up from 14.6 in Node.js 26. Highlights: New language features enabled by default: Math.sumPrecise(),
GHSA-VPP8-G58W-M8MP: GHSA-vpp8-g58w-m8mp: HTTP/2 Rapid Reset Denial of Service in Twisted Web
GHSA-vpp8-g58w-m8mp: HTTP/2 Rapid Reset Denial of Service in Twisted Web Vulnerability ID: GHSA-VPP8-G58W-M8MP CVSS Score: 7.5 Published: 2026-10-29 Twisted versions up to and including 26.4.0 are vulnerable to an unauthenticated remote den
CVE-2022-48123 | TOTOLINK A7100RU 7.4cu.2313_B20191024 Setting delStaticDhcpRules servername command injection (EUVD-2022-50835)
A vulnerability described as critical has been identified in TOTOLINK A7100RU 7.4cu.2313_B20191024. Affected is the function delStaticDhcpRules of the component Setting Handler. The manipulation of the argument servername results in command
CVE-2022-48122 | TOTOlink A7100RU 7.4cu.2313_B20191024 Setting delStaticDhcpRules dayvalid command injection (EUVD-2022-50834)
A vulnerability marked as critical has been reported in TOTOlink A7100RU 7.4cu.2313_B20191024. This impacts the function delStaticDhcpRules of the component Setting Handler. The manipulation of the argument dayvalid leads to command injecti
CVE-2022-48121 | TOTOlink A7100RU 7.4cu.2313_B20191024 delStaticDhcpRules rsabits command injection (EUVD-2022-50833)
A vulnerability labeled as critical has been found in TOTOlink A7100RU 7.4cu.2313_B20191024. This affects an unknown function of the file setting/delStaticDhcpRules. Executing a manipulation of the argument rsabits can lead to command injec
CVE-2022-48120 | Hospital Management System /search.php contact/doctor sql injection (Issue 32 / EUVD-2022-50832)
A vulnerability has been found in Hospital Management System and classified as critical. This issue affects some unknown processing of the file /search.php. The manipulation of the argument contact/doctor leads to sql injection. This vulner
CVE-2026-111497: Node2Shell / HTTP2Shell Vulnerability May Allow RCE
IntroductionOn October 21, 2026, the Node.js project disclosed CVE-2026-111497, an out-of-bounds write vulnerability in Google’s Brotli decoder used by Node.js and other software. The vulnerability is also known as Node2Shell and more recen
CVE-2026-34950 | nearform fast-jwt up to 6.1.0 JSON Web Token fast-jwt/src/crypto.js risky encryption (GHSA-mvf2-f6gm-w987)
A vulnerability was found in nearform fast-jwt up to 6.1.0 and classified as problematic. The affected element is an unknown function of the file fast-jwt/src/crypto.js of the component JSON Web Token Handler. The manipulation results in ri
CVE-2026-34899 | Eniture LTL Freight Quotes Plugin up to 5.2.1 on WordPress authorization
A vulnerability labeled as critical has been found in Eniture LTL Freight Quotes Plugin up to 5.2.1 on WordPress. This issue affects some unknown processing. The manipulation results in missing authorization. This vulnerability is reported
CVE-2026-34896 | Analytify Under Construction, Coming Soon & Maintenance Mode Plugin cross-site request forgery
A vulnerability marked as problematic has been reported in Analytify Under Construction, Coming Soon &amp; Maintenance Mode Plugin up to 2.1.1 on WordPress. Impacted is an unknown function. This manipulation causes cross-site request fo
CVE-2026-1839 | huggingface transformers up to 5.0.0rc2 trainer.py _load_rng_state deserialization
A vulnerability has been found in huggingface transformers up to 5.0.0rc2 and classified as problematic. This affects the function _load_rng_state of the file src/transformers/trainer.py. The manipulation leads to deserialization. This vuln
CVE-2026-1114 | parisneo lollms up to 2.1.x JSON Web Token access control
A vulnerability was found in parisneo lollms up to 2.1.x. It has been classified as critical. Affected is an unknown function of the component JSON Web Token Handler. This manipulation causes improper access controls. This vulnerability is
USN-8958-1: .NET vulnerabilities
It was discovered that the .NET Blazor WebAssembly debug proxy did not properly escape certain values. An attacker could possibly use this issue to execute arbitrary code. The fix for this CVE was originally released via USN-8942-1, but it