Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 780 | 0,2 % |
| ≥50 % | 3.518 | 0,9 % |
| ≥10 % | 22.974 | 5,7 % |
| <10 % | 378.013 | 93,3 % |
U.S. CISA adds Apple flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Apple flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Apple flaw, tracked as CVE-2024-27834 (CV
The SOC Files 5: Ghost in the pipeline, or a fileless SharePoint breach by Storm-2603
Executive summary In 2025, several threat actors exploited CVE-2025-53770 and CVE-2025-53771 (ToolShell vulnerabilities) in on-premises Microsoft SharePoint to achieve remote code execution through crafted HTTP requests. One of the threat a
CVE-2026-90624 | Apache OpenOffice PDF File Parsing heap-based overflow (WID-SEC-2026-4332)
A vulnerability identified as critical has been detected in Apache OpenOffice. This issue affects some unknown processing of the component PDF File Parsing. Performing a manipulation results in heap-based buffer overflow. This vulnerability
CVE-2026-59268 | Apache OpenOffice WW8 PLCF reader heap-based overflow (WID-SEC-2026-4332)
A vulnerability classified as critical was found in Apache OpenOffice. This impacts an unknown function of the component WW8 PLCF reader. Such manipulation leads to heap-based buffer overflow. This vulnerability is traded as CVE-2026-59268.
CVE-2026-59267 | Apache OpenOffice heap-based overflow (WID-SEC-2026-4332)
A vulnerability was found in Apache OpenOffice and classified as critical. This affects an unknown part. The manipulation results in heap-based buffer overflow. This vulnerability was named CVE-2026-59267. The attack may be performed from r
CVE-2026-59264 | Apache OpenOffice uncontrolled search path (WID-SEC-2026-4332)
A vulnerability described as critical has been identified in Apache OpenOffice. The impacted element is an unknown function. The manipulation results in uncontrolled search path. This vulnerability is reported as CVE-2026-59264. The attack
CVE-2026-59263 | Apache OpenOffice input validation (WID-SEC-2026-4332)
A vulnerability labeled as critical has been found in Apache OpenOffice. Impacted is an unknown function. Executing a manipulation can lead to improper input validation. This vulnerability is registered as CVE-2026-59263. It is possible to
Zyxel patches a zero-day hiding behind an old fix
Zyxel has patched a zero-day vulnerability that attackers exploited to compromise 996 GS1900 network switches across 48 countries, exposing device configurations, network information and hashed root credentials. The attack began around Augu
CVE-2025-65843 | Aquarius Desktop 3.0.069 on macOS ~/Library/Logs/Aquarius information disclosure
A vulnerability classified as problematic was found in Aquarius Desktop 3.0.069 on macOS. Affected by this vulnerability is an unknown functionality in the library ~/Library/Logs/Aquarius. Executing a manipulation can lead to information di
CVE-2025-65842 | Aquarius HelperTool 1.0.003 on macOS XPC Service backdoor
A vulnerability was found in Aquarius HelperTool 1.0.003 on macOS. It has been declared as critical. This issue affects some unknown processing of the component XPC Service. Executing a manipulation can lead to backdoor. This vulnerability
CVE-2025-65841 | Aquarius Desktop up to 3.0.069 on macOS ~/Library/Application weak password encoding
A vulnerability marked as critical has been reported in Aquarius Desktop up to 3.0.069 on macOS. This impacts an unknown function in the library ~/Library/Application. Performing a manipulation results in weak encoding for password. This vu
CVE-2025-65320 | Abacre Restaurant Point of Sale up to 15.0.0.1656 cleartext storage
A vulnerability categorized as critical has been discovered in Abacre Restaurant Point of Sale up to 15.0.0.1656. Impacted is an unknown function. Executing a manipulation can lead to cleartext storage of sensitive information. The identifi
CVE-2025-65267 | ERPNext/Frappe SVG Avatar Image cross site scripting
A vulnerability was found in ERPNext and Frappe and classified as problematic. Affected by this issue is some unknown functionality of the component SVG Avatar Image Handler. The manipulation results in cross site scripting. This vulnerabil
CVE-2025-63401 | HCL Limited HCLTech DRAGON up to 7.5.x cross site scripting
A vulnerability classified as problematic has been found in HCL Limited HCLTech DRAGON up to 7.5.x. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. This vulnerability is referenced
CVE-2025-57202 | AVTECH DGM1104 FullImg-1015-1004-1006-1003 PwdGrp.cgi username cross site scripting
A vulnerability identified as problematic has been detected in AVTECH DGM1104 FullImg-1015-1004-1006-1003. The affected element is an unknown function of the file PwdGrp.cgi. The manipulation of the argument Username leads to cross site scr
CVE-2025-57200 | AVTECH DGM1104 FullImg-1015-1004-1006-1003 test_mail command injection
A vulnerability classified as critical was found in AVTECH DGM1104 FullImg-1015-1004-1006-1003. This affects the function test_mail. Such manipulation leads to command injection. This vulnerability is documented as CVE-2025-57200. The attac
CVE-2025-57199 | AVTECH DGM1104 FullImg-1015-1004-1006-1003 NetFailDetectD command injection
A vulnerability was found in AVTECH DGM1104 FullImg-1015-1004-1006-1003. It has been declared as critical. This vulnerability affects unknown code of the component NetFailDetectD. Such manipulation leads to command injection. This vulnerabi
CVE-2025-57198 | AVTECH DGM1104 FullImg-1015-1004-1006-1003 Machine.cgi command injection
A vulnerability, which was classified as critical, has been found in AVTECH DGM1104 FullImg-1015-1004-1006-1003. This impacts an unknown function of the file Machine.cgi. Performing a manipulation results in command injection. This vulnerab
CVE-2025-54326 | Samsung Mobile Processor Exynos 1280/2200 Camera null pointer dereference
A vulnerability was found in Samsung Mobile Processor Exynos 1280/2200 and classified as problematic. The impacted element is an unknown function of the component Camera. Executing a manipulation can lead to null pointer dereference. This v
CVE-2025-53965 | Samsung Mobile Processor/Wearable Processor/Modem Exynos up to 5400 memory corruption
A vulnerability has been found in Samsung Mobile Processor, Wearable Processor and Modem Exynos up to 5400 and classified as critical. The affected element is an unknown function. Performing a manipulation results in memory corruption. This
CVE-2025-50360 | Pepper Language PR File compiler.c heap-based overflow
A vulnerability marked as critical has been reported in Pepper Language 0.1.1commit 961a5d9988c5986d563310275adad3fd181b2bb7.. Affected by this vulnerability is an unknown functionality in the library compiler.h of the file compiler.c of th
CVE-2026-109408 | jopenlibs vault-java-driver up to 6.2.3 TLS Configuration SslConfig.isVerify certificate validation (EUVD-2026-117400)
A vulnerability labeled as problematic has been found in jopenlibs vault-java-driver up to 6.2.3. This affects the function SslConfig.isVerify of the component TLS Configuration. The manipulation results in improper certificate validation.
CVE-2026-107776 | Dokan Plugin up to 5.3.2 on WordPress logic error (EUVD-2026-117401)
A vulnerability was found in Dokan Plugin up to 5.3.2 on WordPress. It has been rated as problematic. Impacted is an unknown function. Performing a manipulation results in business logic errors. This vulnerability was named CVE-2026-107776.
CVE-2026-100109 | Security for WooCommerce Plugin up to 1.0.16 on WordPress authorization (EUVD-2026-117402)
A vulnerability categorized as critical has been discovered in Security for WooCommerce Plugin up to 1.0.16 on WordPress. The affected element is an unknown function. Executing a manipulation can lead to missing authorization. The identific
CVE-2026-62041 | Ashok Dudhat Event Manager Plugin up to 3.4.1 on WordPress authorization (EUVD-2026-95728)
A vulnerability was found in Ashok Dudhat Event Manager Plugin up to 3.4.1 on WordPress. It has been classified as critical. This vulnerability affects unknown code. The manipulation leads to missing authorization. This vulnerability is uni
CVE-2026-112072 | jopenlibs vault-java-driver up to 6.2.3 minimal-json parser stack-based overflow (EUVD-2026-117399)
A vulnerability identified as critical has been detected in jopenlibs vault-java-driver up to 6.2.3. The impacted element is an unknown function of the component minimal-json parser. The manipulation leads to stack-based buffer overflow. Th
CVE-2026-73996 | Masteriyo Plugin up to 2.3.2 on WordPress unrestricted upload (EUVD-2026-60810)
A vulnerability marked as critical has been reported in Masteriyo Plugin up to 2.3.2 on WordPress. Impacted is an unknown function. This manipulation causes unrestricted upload. The identification of this vulnerability is CVE-2026-73996. It
CVE-2026-117679 | SHIRASAGI Project up to 1.21.0 cross site scripting (EUVD-2026-117398)
A vulnerability marked as problematic has been reported in SHIRASAGI Project SHIRASAGI up to 1.21.0. This impacts an unknown function. This manipulation causes cross site scripting. This vulnerability is tracked as CVE-2026-117679. The atta
CVE-2026-118869 | SHIRASAGI Project up to 1.21.0 os command injection (EUVD-2026-117397)
A vulnerability described as very critical has been identified in SHIRASAGI Project SHIRASAGI up to 1.21.0. Affected is an unknown function. Such manipulation leads to os command injection. This vulnerability is listed as CVE-2026-118869. T
Zyxel GS1900: Patch 2 blockiert Zero-Day nicht – Patch 3 gegen CVE-2026-107441
LONDON (IT BOLTWISE) – Zyxel muss bei mehreren GS1900-Switch-Modellen nachlegen: Der bereits ausgerollte Patch 2 schließt einen Zero-Day nicht zuverlässig. Angreifer können trotz fehlender Anmeldung Befehle mit Root-Rechten über die Webverw
CVE-2026-80948 | Linux Kernel up to 6.18.49/7.2.3 iwlwifi iwl_op_mode_dvm_start nvm_data/eeprom_blob memory leak (WID-SEC-2026-3321)
A vulnerability was found in Linux Kernel up to 6.18.49/7.2.3. It has been rated as critical. The affected element is the function iwl_op_mode_dvm_start of the component iwlwifi. This manipulation of the argument nvm_data/eeprom_blob causes
CVE-2026-79405 | Unisoc Modem UDX710 input validation (EUVD-2026-116697)
A vulnerability classified as critical has been found in Unisoc Modem UDX710. Affected by this vulnerability is an unknown functionality. Performing a manipulation results in improper input validation. This vulnerability is reported as CVE-
CVE-2026-16437 | Mitsubishi Electric AnalytiX Password Recovery password recovery (EUVD-2026-101941)
A vulnerability marked as very critical has been reported in Mitsubishi Electric AnalytiX, BizViz, GENESIS, GENESIS32, GENESIS64, Hyper Historian, ICONICS Suite, IoTWorX, MC Works64 and MobileHMI. Impacted is an unknown function of the comp
CVE-2026-123029 | Wowza Streaming Engine up to 4.12.1 xml external entity reference (EUVD-2026-117386)
A vulnerability was found in Wowza Streaming Engine up to 4.12.1. It has been classified as critical. This vulnerability affects unknown code. This manipulation causes xml external entity reference. This vulnerability is handled as CVE-2026
CVE-2026-123033 | iXsystems TrueNAS SCALE up to 25.10.7 middlewared improper authentication (EUVD-2026-117387)
A vulnerability was found in iXsystems TrueNAS SCALE up to 25.10.7. It has been declared as very critical. This issue affects some unknown processing of the component middlewared. Such manipulation leads to improper authentication. This vul
CVE-2026-80335 | Unisoc Bootloader up to T9100 Bootloader Download out-of-bounds write (EUVD-2026-116698)
A vulnerability, which was classified as very critical, has been found in Unisoc Bootloader up to T9100. This affects an unknown part of the component Bootloader Download Module. The manipulation leads to out-of-bounds write. This vulnerabi
CVE-2025-65881 | SourceCodester Zoo Management System 1.0 /classes/Login.php cross site scripting
A vulnerability was found in SourceCodester Zoo Management System 1.0. It has been rated as problematic. Affected by this vulnerability is an unknown functionality of the file /classes/Login.php. The manipulation leads to cross site scripti
CVE-2025-65844 | EverShop 2.0.1 /api/images unrestricted upload (Issue 819 / EUVD-2025-200288)
A vulnerability labeled as critical has been found in EverShop 2.0.1. This vulnerability affects unknown code of the file /api/images. Such manipulation leads to unrestricted upload. This vulnerability is documented as CVE-2025-65844. The a
CVE-2025-65215 | SourceCodester Web-based Pharmacy Product Management System 1.0 add-supplier.php Name cross site scripting
A vulnerability was found in SourceCodester Web-based Pharmacy Product Management System 1.0. It has been declared as problematic. Affected is an unknown function of the file /product_expiry/add-supplier.php. Executing a manipulation of the
CVE-2025-65187 | CiviCRM up to 6.6 Accounting Batches cross site scripting
A vulnerability categorized as problematic has been discovered in CiviCRM up to 6.6. Affected by this issue is some unknown functionality. The manipulation of the argument Accounting Batches results in cross site scripting. This vulnerabili
CVE-2025-64070 | SourceCodester Student Grades Management System 1.0 Add New Subject Description cross site scripting
A vulnerability described as problematic has been identified in SourceCodester Student Grades Management System 1.0. Impacted is an unknown function. Executing a manipulation of the argument Add New Subject Description can lead to cross sit
CVE-2025-60854 | D-Link R15 up to 1.20.01 Password Change model name command injection
A vulnerability has been found in D-Link R15 up to 1.20.01 and classified as critical. The impacted element is an unknown function of the component Password Change Handler. This manipulation of the argument model name causes command injecti
CVE-2025-60736 | code-projects Online Medicine Guide 1.0 /login.php upass sql injection
A vulnerability classified as critical has been found in code-projects Online Medicine Guide 1.0. This vulnerability affects unknown code of the file /login.php. Performing a manipulation of the argument upass results in sql injection. This
CVE-2025-59705 | Entrust nShield Connect XC/nShield 5c/nShield HSMi up to 13.6.11/13.7 USB Interface improper authorization
A vulnerability categorized as critical has been discovered in Entrust nShield Connect XC, nShield 5c and nShield HSMi up to 13.6.11/13.7. The affected element is an unknown function of the component USB Interface. Such manipulation leads t
CVE-2025-59703 | Entrust nShield Connect XC/nShield 5c/nShield HSMi up to 13.6.11/13.7 access control (EUVD-2025-200272)
A vulnerability, which was classified as problematic, has been found in Entrust nShield Connect XC, nShield 5c and nShield HSMi up to 13.6.11/13.7. This affects an unknown part. Performing a manipulation results in improper access controls.
CVE-2025-58386 | Terminalfour up to 8.4.1.1 User Management userLevel improper authorization
A vulnerability, which was classified as critical, has been found in Terminalfour up to 8.4.1.1. Impacted is an unknown function of the component User Management Handler. The manipulation of the argument userLevel leads to improper authoriz
Paint hat eine schwerwiegende Sicherheitslücke: So prüft ihr euer System
Das Programm, mit dem wir seit Jahrzehnten Pfeile auf Screenshots malen, hat eine ernsthafte Sicherheitslücke: Microsoft führt sie als CVE-2026-83844 mit einem Schweregrad von 8.1 und stuft sie als „Wichtig“ ein. Es handelt sich um einen Ou
CVE-2026-80946 | Linux Kernel up to 6.18.50/7.2.3 FUSE fs/fuse/dev_uring.c fuse_uring_copy_to_ring stack-based overflow (WID-SEC-2026-3321)
A vulnerability marked as critical has been reported in Linux Kernel up to 6.18.50/7.2.3. The impacted element is the function fuse_uring_copy_to_ring of the file fs/fuse/dev_uring.c of the component FUSE. Performing a manipulation results
CVE-2026-80942 | Linux Kernel up to 6.12.108/6.18.49/7.2.3 rtl8192du rtl92du_init_sw_vars memory leak (WID-SEC-2026-3321)
A vulnerability has been found in Linux Kernel up to 6.12.108/6.18.49/7.2.3 and classified as critical. This affects the function rtl92du_init_sw_vars of the component rtl8192du. Performing a manipulation results in memory leak. This vulner
CVE-2026-120959 | MongoDB Atlas SQL up to 3.0.0 memory corruption (WID-SEC-2026-4328)
A vulnerability was found in MongoDB Atlas SQL up to 3.0.0. It has been declared as problematic. Affected by this issue is some unknown functionality. Executing a manipulation can lead to memory corruption. This vulnerability appears as CVE
Critical Citrix XenServer Vulnerability Could Let Hackers Take Over Virtualization Hosts Without Authentication
Citrix has disclosed a critical XenServer vulnerability that could let an unauthenticated attacker compromise virtualization hosts and supporting appliances. Tracked as CVE-2026-98432, the flaw requires access to the management network, an
CVE-2026-120954 | MongoDB C Driver up to 2.5.7 BSON Vector integer overflow (WID-SEC-2026-4328)
A vulnerability labeled as problematic has been found in MongoDB C Driver up to 2.5.7. The affected element is an unknown function of the component BSON Vector Handler. The manipulation results in integer overflow. This vulnerability is cat
CVE-2026-120953 | MongoDB Atlas SQL JDBC Driver up to 4.0.0 Authentication redirect (WID-SEC-2026-4328)
A vulnerability, which was classified as problematic, was found in MongoDB Atlas SQL JDBC Driver up to 4.0.0. Affected by this issue is some unknown functionality of the component Authentication Component. The manipulation results in open r
CVE-2026-120952 | MongoDB Atlas SQL ODBC Driver up to 3.0.0 out-of-bounds write (WID-SEC-2026-4328)
A vulnerability, which was classified as problematic, was found in MongoDB Atlas SQL ODBC Driver up to 3.0.0. This affects an unknown function. The manipulation results in out-of-bounds write. This vulnerability is cataloged as CVE-2026-120
CVE-2026-120684 | MongoDB C Driver up to 1.30.14/2.5.7 GridFS uninitialized pointer (Nessus ID 376173 / WID-SEC-2026-4328)
A vulnerability identified as problematic has been detected in MongoDB C Driver up to 1.30.14/2.5.7. Impacted is an unknown function of the component GridFS. The manipulation leads to uninitialized pointer. This vulnerability is listed as C
CVE-2026-120678 | MongoDB C Driver up to 1.30.14/2.5.7 memory leak (WID-SEC-2026-4328)
A vulnerability classified as critical has been found in MongoDB C Driver up to 1.30.14/2.5.7. This impacts an unknown function. Performing a manipulation results in memory leak. This vulnerability is reported as CVE-2026-120678. The attack
CVE-2026-120673 | MongoDB Rust Driver up to 3.9.0 Diagnostic Tracing information disclosure (WID-SEC-2026-4328)
A vulnerability marked as problematic has been reported in MongoDB Rust Driver up to 3.9.0. The impacted element is an unknown function of the component Diagnostic Tracing. This manipulation causes information disclosure. This vulnerability
CVE-2026-120567 | MongoDB Entity Framework Core Provider up to 9.1.4/10.0.4 sql injection (WID-SEC-2026-4328)
A vulnerability was found in MongoDB Entity Framework Core Provider up to 9.1.4/10.0.4. It has been rated as critical. This impacts an unknown function. This manipulation causes sql injection. The identification of this vulnerability is CVE
CVE-2026-119776 | FRRouting OSPFv3 improper authentication (Nessus ID 376170)
A vulnerability, which was classified as very critical, was found in FRRouting. This affects an unknown function of the component OSPFv3. The manipulation results in improper authentication. This vulnerability is identified as CVE-2026-1197
CVE-2026-114627 | Web::Simple up to 0.35 String Interpolation cross site scripting (Nessus ID 376171)
A vulnerability described as problematic has been identified in Web::Simple up to 0.35. The impacted element is an unknown function of the component String Interpolation. Executing a manipulation can lead to cross site scripting. This vulne