Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 720 | 0,2 % |
| ≥50 % | 3.224 | 0,9 % |
| ≥10 % | 22.096 | 6,0 % |
| <10 % | 345.278 | 93,0 % |
CVE-2026-93895 | IBM WebSphere Application Server Liberty up to 26.0.0.10 gRPC Service access control (EUVD-2026-100497)
A vulnerability, which was classified as critical, has been found in IBM WebSphere Application Server Liberty up to 26.0.0.10. This impacts an unknown function of the component gRPC Service. The manipulation leads to improper access control
CVE-2026-11713 | IBM WebSphere Application Server up to 26.0.0.9 restConnector-2.0 privileges management (EUVD-2026-100491)
A vulnerability classified as critical was found in IBM WebSphere Application Server up to 26.0.0.9. Affected by this issue is some unknown functionality of the component restConnector-2.0. Such manipulation leads to improper privilege mana
CVE-2026-97381 | LegacyUpdate Legacy Update up to 1.13.1 ActiveX control IsPermitted privileges management (EUVD-2026-100662)
A vulnerability classified as problematic was found in LegacyUpdate Legacy Update up to 1.13.1. Affected is the function IsPermitted of the component ActiveX control. The manipulation results in improper privilege management. This vulnerabi
CVE-2026-95633 | Adobe Content Credentials Rust SDK improper authorization (EUVD-2026-100732)
A vulnerability categorized as problematic has been discovered in Adobe Content Credentials Rust SDK, C2PA Tool and Content Credentials JS SDK. This vulnerability affects unknown code. Such manipulation leads to improper authorization. This
CVE-2026-100118 | Adobe C2PA Tool certificate validation (EUVD-2026-100722)
A vulnerability described as problematic has been identified in Adobe C2PA Tool, Content Credentials JS SDK and Content Credentials Rust SDK. The affected element is an unknown function. Executing a manipulation can lead to improper certifi
CVE-2026-100113 | Adobe Content Credentials Rust SDK input validation (EUVD-2026-100721)
A vulnerability was found in Adobe Content Credentials Rust SDK, C2PA Tool and Content Credentials JS SDK. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to improper input vali
CVE-2026-100123 | Adobe C2PA Tool certificate validation (EUVD-2026-100734)
A vulnerability was found in Adobe C2PA Tool, Content Credentials JS SDK and Content Credentials Rust SDK and classified as problematic. Affected by this issue is some unknown functionality. Executing a manipulation can lead to improper cer
CVE-2026-103294 | Adobe Content Credentials Rust SDK certificate validation (EUVD-2026-100741)
A vulnerability has been found in Adobe Content Credentials Rust SDK, C2PA Tool and Content Credentials JS SDK and classified as problematic. This impacts an unknown function. Performing a manipulation results in improper certificate valida
CVE-2026-50215 | Akamai Guardicore Platform Agent up to 7.3 Windows WFP packet-capture driver use after free (EUVD-2026-100805)
A vulnerability classified as problematic has been found in Akamai Guardicore Platform Agent up to 7.3. This vulnerability affects unknown code of the component Windows WFP packet-capture driver. Performing a manipulation results in use aft
CVE-2026-111854 | Tektronix 3 MDO up to 1.21.0 SCPI FILESystem Command Interface path traversal (EUVD-2026-103207)
A vulnerability labeled as critical has been found in Tektronix 3 MDO up to 1.21.0. Impacted is an unknown function of the component SCPI FILESystem Command Interface. The manipulation results in path traversal. This vulnerability is identi
CVE-2026-111853 | Tektronix 3 Series MDO up to 1.21.0 SCPI FILESystem:MOUNT:DRIve SCPI command handler os command injection (EUVD-2026-103206)
A vulnerability identified as very critical has been detected in Tektronix 3 Series MDO up to 1.21.0. This issue affects the function FILESystem:MOUNT:DRIve SCPI command handler of the component SCPI. The manipulation leads to os command in
CVE-2026-111855 | Tektronix 3 MDO up to 1.21.0 Web Management Interface path traversal (EUVD-2026-103208)
A vulnerability marked as problematic has been reported in Tektronix 3 MDO up to 1.21.0. The affected element is an unknown function of the component Web Management Interface. This manipulation causes path traversal. This vulnerability is t
CVE-2026-84869: a ScreenConnect client bypass and the spread that followed it
CVE-2026-84869: the ScreenConnect client flaw and the worm-like spread that followed ConnectWise published an advisory for CVE-2026-84869 on 3 September 2026 and shipped the fix in ScreenConnect 26.6.5 on 8 September. CISA added the vulnera
Warning Over High-Risk Vulnerabilities in Widely Used LLM Gateway Tool
CVE-2026-35029 and CVE-2026-59823 affect LiteLLM, which is commonly used by enterprises to connect their AI applications to providers like OpenAI and Anthropic This article has been indexed from www.infosecurity-magazine.com Read the origin
Cisco schliesst bereits ausgenutzte Sicherheitslücke im Secure Email Gateway
... Cybersecurity. News · Wissen · Specials · IT-Markt. Schlüsselwörter. Webcode. News. Remote Code Execution ... Das Product Security Incident Response ... Weiterlesen
CVE-2026-106464 | Eclipse NetX Duo up to 6.5.2.202603 X.509 Parser _nx_secure_x509_parse_signature_data tlv_length out-of-bounds (EUVD-2026-101502)
A vulnerability described as critical has been identified in Eclipse NetX Duo up to 6.5.2.202603. This impacts the function _nx_secure_x509_parse_signature_data of the component X.509 Parser. The manipulation of the argument tlv_length resu
CVE-2026-79957 | ServiceNext GetUsuarios endpoint /api/Usuario/GetUsuarios ID authorization (EUVD-2026-101517)
A vulnerability marked as critical has been reported in ServiceNext. This vulnerability affects unknown code of the file /api/Usuario/GetUsuarios of the component GetUsuarios endpoint. Performing a manipulation of the argument ID results in
CVE-2026-106465 | Eclipse NetX Duo up to 6.5.2.202603 ClientHello parser improper authentication (EUVD-2026-101504)
A vulnerability labeled as critical has been found in Eclipse NetX Duo up to 6.5.2.202603. The impacted element is an unknown function of the component ClientHello parser. Executing a manipulation can lead to improper authentication. This v
CVE-2026-110816 | ljharb qs up to 6.16.0 String Coercion lib/stringify.js qs.stringify input validation (a952e75 / EUVD-2026-101710)
A vulnerability identified as problematic has been detected in ljharb qs up to 6.16.0. This vulnerability affects the function qs.stringify of the file lib/stringify.js of the component String Coercion. The manipulation leads to improper in
CVE-2026-102631 | Canonical authd up to 0.7.0 User Identity Matching manager.go UpdateUser improper authentication (EUVD-2026-102198)
A vulnerability was found in Canonical authd up to 0.7.0. It has been rated as very critical. The impacted element is the function UpdateUser of the file internal/users/manager.go of the component User Identity Matching. Performing a manipu
CVE-2026-108337 | Hitachi Vantara Remot Ops Agent up to 2.0 privileges management (EUVD-2026-101707)
A vulnerability was found in Hitachi Vantara Remot Ops Agent up to 2.0. It has been classified as problematic. Affected is an unknown function. This manipulation causes improper privilege management. This vulnerability is tracked as CVE-202
CVE-2026-107349 | PostgreSQL PgBouncer up to 1.26.0 Ignore Startup Parameter List Lookup options infinite loop (EUVD-2026-101499)
A vulnerability classified as problematic has been found in PostgreSQL PgBouncer up to 1.26.0. Affected is an unknown function of the component Ignore Startup Parameter List Lookup. This manipulation of the argument options causes infinite
Google Warns China-Linked Hackers Exploited BeyondTrust Zero-Day
Google says China-linked hackers exploited a critical BeyondTrust zero-day. See affected versions, patch guidance, and what defenders should check now. This article has been indexed from eSecurityPlanet Read the original article: Google War
CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE Vulnerability
IntroductionOn September 27, 2026, Citrix disclosed CVE-2026-88771, a critical remote code execution (RCE) vulnerability affecting NetScaler Application Delivery Controller (ADC) and NetScaler Gateway. The vulnerability carries a CVSS v3.1
CVE-2026-111823 | Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.
Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.
CVE-2026-89096 | A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory growth. Sustained requests can exhaust system resources, eventually causing the service to degrade or crash.
A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated
CVE-2026-89088 | A flaw was found in parted. A heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT16 volumes. By convincing a user or administrator to resize a specially crafted FAT16 file system image with malformed directory metadata, an attacker can trigger an oversized read into a fixed-size memory buffer. This issue causes memory corruption, resulting in an application crash and a denial of service (DoS).
A flaw was found in parted. A heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT16 volumes. By convincing a user or administrator to resize a specially crafted FAT16 file system image with malforme
CVE-2026-89085 | A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due to an integer calculation error during buffer allocation. A local attacker could exploit this by enticing a user or automated service to open a malicious filesystem image, resulting in an application crash leading to a Denial of Service (DoS) or potential memory corruption.
A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due to an integer calculation error during buffer allocation. A local attacker could exploit this by enticing a user or
BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs
Ivanti, Cisco, and Palo Alto Networks all had vulnerabilities in edge devices come under fire this week. Now BeyondTrust joins the group. This article has been indexed from darkreading Read the original article: BeyondTrust Remote Support Z
CVE-2026-89649 | Linux Kernel up to 6.12.108/6.18.49/7.2.3 Ceph __build_xattrs val_len out-of-bounds (EUVD-2026-76561)
A vulnerability has been found in Linux Kernel up to 6.12.108/6.18.49/7.2.3 and classified as problematic. Affected by this vulnerability is the function __build_xattrs of the component Ceph. The manipulation of the argument val_len leads t
CVE-2026-89652 | Linux Kernel up to 6.12.108/6.18.49/7.2.3 Ceph NFS Export ceph_get_name/__get_snap_name dname_len out-of-bounds write (EUVD-2026-76564)
A vulnerability identified as very critical has been detected in Linux Kernel up to 6.12.108/6.18.49/7.2.3. Affected by this vulnerability is the function ceph_get_name/__get_snap_name of the component Ceph NFS Export. This manipulation of
CVE-2026-89650 | Linux Kernel up to 6.12.108/6.18.49/7.2.3 CephFS Client fs/ceph/mdsmap.c ceph_mdsmap_decode num_export_targets out-of-bounds (EUVD-2026-76562)
A vulnerability labeled as problematic has been found in Linux Kernel up to 6.12.108/6.18.49/7.2.3. The affected element is the function ceph_mdsmap_decode of the file fs/ceph/mdsmap.c of the component CephFS Client. Executing a manipulatio
CVE-2026-89653 | Linux Kernel up to 6.12.108/6.18.49/7.2.3 ceph check_new_map stack-based overflow (EUVD-2026-76565)
A vulnerability labeled as problematic has been found in Linux Kernel up to 6.12.108/6.18.49/7.2.3. Affected by this issue is the function check_new_map of the component ceph. Such manipulation leads to stack-based buffer overflow. This vul
CVE-2026-89655 | Linux Kernel up to 6.12.108/6.18.49/7.2.3 ceph __kick_flushing_caps use after free (EUVD-2026-76567)
A vulnerability marked as very critical has been reported in Linux Kernel up to 6.12.108/6.18.49/7.2.3. This affects the function __kick_flushing_caps of the component ceph. Performing a manipulation results in use after free. This vulnerab
CVE-2026-89654 | Linux Kernel up to 7.2.3 Ceph md.c check_new_map s use after free (EUVD-2026-76566)
A vulnerability labeled as very critical has been found in Linux Kernel up to 7.2.3. This vulnerability affects the function check_new_map of the file md.c of the component Ceph. Such manipulation of the argument s leads to use after free.
CVE-2026-89656 | Linux Kernel up to 6.12.108/6.18.49/7.2.3 libceph bucket_perm_choose out-of-bounds write (EUVD-2026-76568)
A vulnerability described as very critical has been identified in Linux Kernel up to 6.12.108/6.18.49/7.2.3. This affects the function bucket_perm_choose of the component libceph. The manipulation results in out-of-bounds write. This vulner
BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs
Ivanti, Cisco, and Palo Alto Networks all had vulnerabilities in edge devices come under fire this week. Now BeyondTrust joins the group. Weiterlesen
CVE-2026-89659 | Linux Kernel up to 6.18.50/7.2.3 NFSD nfs4_laundromat use after free (EUVD-2026-76571)
A vulnerability classified as very critical has been found in Linux Kernel up to 6.18.50/7.2.3. This issue affects the function nfs4_laundromat of the component NFSD. The manipulation leads to use after free. This vulnerability is traded as
CVE-2026-89662 | Linux Kernel up to 6.12.108/6.18.49/7.2.3 NFSD __destroy_client use after free (EUVD-2026-76574)
A vulnerability classified as very critical was found in Linux Kernel up to 6.12.108/6.18.49/7.2.3. Impacted is the function __destroy_client of the component NFSD. The manipulation results in use after free. This vulnerability is known as
CVE-2026-89675 | Linux Kernel up to 6.18.50/7.2.3 NFSd Async Copy nfsd4_do_async_copy refcount/nf_src/nf_dst/copy_task use after free (EUVD-2026-76587 / Nessus ID 364483)
A vulnerability has been found in Linux Kernel up to 6.18.50/7.2.3 and classified as very critical. This affects the function nfsd4_do_async_copy of the component NFSd Async Copy. Performing a manipulation of the argument refcount/nf_src/nf
CVE-2026-89672 | Linux Kernel up to 6.12.108/6.18.49/7.2.3 NFSACL nfsacld_proc_setacl mask input validation (EUVD-2026-76584)
A vulnerability classified as very critical has been found in Linux Kernel up to 6.12.108/6.18.49/7.2.3. The affected element is the function nfsacld_proc_setacl of the component NFSACL. The manipulation of the argument mask leads to improp
CVE-2026-89676 | Linux Kernel up to 6.18.49/7.2.3 nfsd nfsd4_copy use after free (EUVD-2026-76588 / Nessus ID 364483)
A vulnerability was found in Linux Kernel up to 6.18.49/7.2.3 and classified as very critical. This impacts the function nfsd4_copy of the component nfsd. Executing a manipulation can lead to use after free. The identification of this vulne
PwnEscape (CVE-2026-99999): Patched kernels available in testing
A new Linux kernel vulnerability, nicknamed PwnEscape (CVE-2026-99999), has been disclosed. It is a guest-to-host virtual machine (VM) escape: anyone who controls a guest VM can send specially crafted network packets that leak the host’s ke
CVE-2026-89685 | Linux Kernel up to 6.18.50/7.2.3 nfsd clients_still_reclaiming comparison (EUVD-2026-76597)
A vulnerability was found in Linux Kernel up to 6.18.50/7.2.3. It has been rated as critical. The affected element is the function clients_still_reclaiming of the component nfsd. Performing a manipulation results in incorrect comparison. Th
CVE-2026-89699 | Linux Kernel up to 6.12.108/6.18.49/7.2.3 nfsd nfsd4_decode_create cr_datalen out-of-bounds write (EUVD-2026-76611)
A vulnerability was found in Linux Kernel up to 6.12.108/6.18.49/7.2.3. It has been rated as critical. Affected by this issue is the function nfsd4_decode_create of the component nfsd. This manipulation of the argument cr_datalen causes out
CVE-2026-89697 | Linux Kernel up to 6.12.108/6.18.49/7.2.3 nfsd nfsd_proc_setattr authorization (EUVD-2026-76609)
A vulnerability classified as very critical has been found in Linux Kernel up to 6.12.108/6.18.49/7.2.3. The impacted element is the function nfsd_proc_setattr of the component nfsd. This manipulation causes missing authorization. This vuln
CVE-2026-89686 | Linux Kernel up to 6.12.108/6.18.49/7.2.3 nfsd nfsd4_alloc_layout_stateid locking (EUVD-2026-76598)
A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.12.108/6.18.49/7.2.3. This affects the function nfsd4_alloc_layout_stateid of the component nfsd. This manipulation causes improper locking. The ident
Ghostscript Sicherheitslücke mit 9,8, ein hochgeladenes PDF genügt für Schadcode
Lesezeit. Cybersicherheit cybersicherheit sicherheitslücke ghostscript cve-2026-39919 ghostscript lücke wordpress imagick wordfence argus pdf. Weiterlesen
CVE-2026-111802 | A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash without verifying whether the trash directory paths are symbolic links. An attacker can exploit this flaw by tricking a user into mounting a crafted storage volume and confirming the prompt to empty the trash, leading to the arbitrary deletion of files accessible to that user.
A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash without verifying whether the trash directory paths are symbolic links. An attacker can exploit this fl
CVE-2026-17591 | A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issue arises when the archive_entry_copy_mac_metadata() function deallocates an internal buffer before completing a data copy. An attacker who can supply input to an application utilizing this function can trigger the flaw to cras
A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issue a
CVE-2026-111044 | Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificate that chained to a stored paired-client certificate, but it did not require the presented certificate to be the exact enabled paired identity. Certificate text was also compared without canonicalizing equivalent PEM encodings. A previously paired client that retains its private key can present an alternate certificate
Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificate that chained to a stored paired-client certificate, but it did not require the presented certific
CVE-2026-62438 | A flaw was found in GIMP. An attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory contents by convincing a user to open or preview a specially crafted Bohemia Interactive (PAA) texture file. Due to an integer overflow when calculating image dimensions during file decompression, the application allocates an undersized memory buffer. Subsequent processing reads memory past the buffer boundary, terminating the plug-in process une
A flaw was found in GIMP. An attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory contents by convincing a user to open or preview a specially crafted Bohemia Interactive (PAA) texture file. Due to an intege
CVE-2026-62439 | A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR (.pvr) file, an attacker can trigger a heap-based buffer overflow, potentially leading to arbitrary code execution or a Denial of Service (DoS) via an application crash.
A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR (.pvr) file, an attacker can t
CVE-2022-46740 | Huawei WS7100-20 Wi-Fi denial of service (EUVD-2022-49526)
A vulnerability categorized as problematic has been discovered in Huawei WS7100-20. This affects an unknown function of the component Wi-Fi Module. Executing a manipulation can lead to denial of service. The identification of this vulnerabi
CVE-2022-46723 | Apache macOS privilege escalation (EUVD-2022-49512)
A vulnerability labeled as critical has been found in Apache macOS. Affected is an unknown function. Such manipulation leads to privilege escalation. This vulnerability is traded as CVE-2022-46723. The attack may be launched remotely. There
CVE-2022-46720 | Apple iOS/iPadOS up to 16.1.x integer overflow (HT213530 / EUVD-2022-49509)
A vulnerability classified as problematic was found in Apple iOS and iPadOS up to 16.1.x. This issue affects some unknown processing. Executing a manipulation can lead to integer overflow. This vulnerability appears as CVE-2022-46720. The a
CVE-2022-46718 | Apple macOS information disclosure (EUVD-2022-49507)
A vulnerability was found in Apple macOS. It has been rated as problematic. This vulnerability affects unknown code. Performing a manipulation results in information disclosure. This vulnerability was named CVE-2022-46718. The attack needs
CVE-2022-46717 | Apple iOS/iPadOS up to 16.1 Accessibility Features information disclosure (EUVD-2022-49506)
A vulnerability marked as problematic has been reported in Apple iOS and iPadOS up to 16.1. Affected is an unknown function of the component Accessibility Features. Performing a manipulation results in information disclosure. This vulnerabi
CVE-2022-46716 | Apple macOS Private Relay state issue (EUVD-2022-49505)
A vulnerability labeled as problematic has been found in Apple macOS. This issue affects some unknown processing of the component Private Relay Handler. The manipulation results in state issue. This vulnerability was named CVE-2022-46716. T
CVE-2026-108372 | Open and provider-neutral, LoopX is a lightweight state kernel and local-first control plane for loop engineering. From version 0.0.1 until 0.4.5, `loopx serve-status` in `loopx/status_server.py` uses `StatusRequestHandler._send_json()` and `do_OPTIONS()` to send `Access-Control-Allow-Origin: *` for unauthenticated responses on predictable loopback ports. A remote attacker can cause an operator who visits attacker-controlled web content to issue cross-origin
Open and provider-neutral, LoopX is a lightweight state kernel and local-first control plane for loop engineering. From version 0.0.1 until 0.4.5, `loopx serve-status` in `loopx/status_server.py` uses `StatusRequestHandler._send_json()` and