Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 784 | 0,2 % |
| ≥50 % | 3.546 | 0,9 % |
| ≥10 % | 23.008 | 5,7 % |
| <10 % | 379.372 | 93,3 % |
[NEU] [mittel] Cisco Unified Computing System (UCS): Schwachstelle ermöglicht Codeausführung
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Cisco Unified Computing System (UCS) ausnutzen, um beliebigen Programmcode auszuführen. Weiterlesen
[NEU] [mittel] Cisco Identity Services Engine (ISE): Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Cisco Identity Services Engine (ISE) ausnutzen, um Sicherheitsvorkehrungen zu umgehen. Weiterlesen
[NEU] [mittel] Cisco Unified Communications Manager (CUCM): Schwachstelle ermöglicht Cross-Site Scripting
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Cisco Unified Communications Manager (CUCM) ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen. Weiterlesen
[NEU] [hoch] Linux Kernel: Schwachstelle ermöglicht nicht spezifizierten Angriff
Ein entfernter, anonymer Angreifer kann eine Schwachstelle im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen. Weiterlesen
[NEU] [hoch] apt: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Administratorrechten
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in apt ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen. Weiterlesen
CVE-2026-86562 | Red Hat Enterprise Linux vhost toctou (Nessus ID 376199)
A vulnerability was found in Red Hat Enterprise Linux, Fast Datapath, OpenShift Container Platform and OpenStack Platform. It has been declared as very critical. This impacts an unknown function of the component vhost. The manipulation resu
CVE-2026-86561 | Red Hat Enterprise Linux lib vhost memory corruption (Nessus ID 376199)
A vulnerability classified as critical was found in Red Hat Enterprise Linux, Fast Datapath for RHEL, OpenShift Container Platform and OpenStack Platform. Affected is an unknown function of the component lib vhost. Such manipulation leads t
CVE-2026-78383 | Apache Tomcat up to 11.0.25 AJP allocation of resources (Nessus ID 376200 / WID-SEC-2026-3527)
A vulnerability, which was classified as problematic, has been found in Apache Tomcat up to 7.0.109/8.5.100/9.0.121/10.1.59/11.0.25. This affects an unknown part of the component AJP Handler. Performing a manipulation results in allocation
CVE-2023-53729 | Linux Kernel up to 6.5.3 soc qmi_encdec out-of-bounds (Nessus ID 376201 / WID-SEC-2025-2394)
A vulnerability was found in Linux Kernel up to 6.5.3. It has been declared as critical. This affects the function qmi_encdec of the component soc. The manipulation results in out-of-bounds read. This vulnerability is known as CVE-2023-5372
Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day
Tracked as CVE-2026-107441, the out-of-bounds write flaw could allow attackers to execute OS commands via crafted HTTP requests. This article has been indexed from SecurityWeek Read the original article: Zyxel Switch Hacks Blamed on Patched
CVE-2022-4089 | rickxy Stock Management System /pages/processlogin.php user cross site scripting (EUVD-2022-51460)
A vulnerability marked as problematic has been reported in rickxy Stock Management System. Affected is an unknown function of the file /pages/processlogin.php. Performing a manipulation of the argument User results in cross site scripting.
CVE-2022-4088 | rickxy Stock Management System /pages/processlogin.php user/password sql injection (EUVD-2022-51459)
A vulnerability identified as critical has been detected in rickxy Stock Management System. This affects an unknown function of the file /pages/processlogin.php. This manipulation of the argument user/password causes sql injection. This vul
CVE-2022-4087 | iPXE TLS src/net/tls.c tls_new_ciphertext pad_len information exposure (EUVD-2022-51458)
A vulnerability was found in iPXE. It has been rated as problematic. This issue affects the function tls_new_ciphertext of the file src/net/tls.c of the component TLS. Performing a manipulation of the argument pad_len results in information
CVE-2022-4066 | davidmoreno onion Log src/onion/response.c onion_response_flush allocation of resources (ID 308 / EUVD-2022-51441)
A vulnerability identified as problematic has been detected in davidmoreno onion. Affected by this vulnerability is the function onion_response_flush of the file src/onion/response.c of the component Log Handler. This manipulation causes al
CVE-2022-4062 | Schneider Electric EcoStruxure Power Commission 2.22 improper authorization (SEVD-2022-347-03 / EUVD-2022-51439)
A vulnerability classified as critical was found in Schneider Electric EcoStruxure Power Commission 2.22. Affected by this vulnerability is an unknown functionality. The manipulation results in improper authorization. This vulnerability is
CVE-2026-107775 | Dokan Plugin up to 5.3.2 on WordPress authorization (EUVD-2026-117354)
A vulnerability classified as problematic has been found in Dokan Plugin up to 5.3.2 on WordPress. This affects an unknown part. Performing a manipulation results in incorrect authorization. This vulnerability is reported as CVE-2026-107775
CVE-2026-107774 | Dokan Plugin up to 5.3.2 on WordPress Contact Form authentication spoofing (EUVD-2026-117353)
A vulnerability labeled as problematic has been found in Dokan Plugin up to 5.3.2 on WordPress. Affected is an unknown function of the component Contact Form. The manipulation results in authentication bypass by spoofing. This vulnerability
CVE-2026-107787 | CatFolders Plugin up to 2.5.6 on WordPress Folder Maintenance Action authorization (EUVD-2026-117356)
A vulnerability identified as critical has been detected in CatFolders Plugin up to 2.5.6 on WordPress. Affected by this issue is some unknown functionality of the component Folder Maintenance Action. This manipulation causes missing author
CVE-2026-107786 | CatFolders Plugin up to 2.5.6 on WordPress sql injection (EUVD-2026-117355)
A vulnerability was found in CatFolders Plugin up to 2.5.6 on WordPress. It has been declared as critical. This impacts an unknown function. Executing a manipulation can lead to sql injection. The identification of this vulnerability is CVE
CVE-2026-109150 | WP PageNavi Style Plugin up to 1.4 on WordPress cross site scripting (EUVD-2026-117357)
A vulnerability was found in WP PageNavi Style Plugin up to 1.4 on WordPress. It has been rated as problematic. This affects an unknown part. This manipulation causes cross site scripting. The identification of this vulnerability is CVE-202
CVE-2026-123025 | OPNsense os-acme-client Plugin up to 4.17.0 Google Cloud DNS Validation DnsGcloud::prepare os command injection (EUVD-2026-117385)
A vulnerability, which was classified as very critical, was found in OPNsense os-acme-client Plugin up to 4.17.0. Affected by this vulnerability is the function DnsGcloud::prepare of the component Google Cloud DNS Validation Module. Executi
CVE-2026-123017 | GodotSteam up to 4.23.2 grant_gold peer improper authentication (EUVD-2026-117358)
A vulnerability, which was classified as critical, has been found in GodotSteam up to 4.23.2. Affected is the function grant_gold. Performing a manipulation of the argument peer results in improper authentication. This vulnerability is repo
CVE-2022-2127 | Samba up to 4.16.11/4.17.10/4.18.5 Winbind out-of-bounds (FEDORA-2023-bcd91bfcd3 / EUVD-2022-34413)
A vulnerability, which was classified as problematic, was found in Samba up to 4.16.11/4.17.10/4.18.5. This impacts an unknown function of the component Winbind. Executing a manipulation can lead to out-of-bounds read. This vulnerability is
CVE-2022-4055 | xdg-email 2368 Mailto URL command delimiter (Issue 205 / EUVD-2022-51432)
A vulnerability categorized as problematic has been discovered in xdg-email 2368. This impacts an unknown function of the component Mailto URL Handler. Executing a manipulation can lead to improper neutralization of expression/command delim
CVE-2022-4054 | GitLab Project Maintainer information disclosure (Issue 382260 / EUVD-2022-51431)
A vulnerability was found in GitLab. It has been rated as problematic. Affected by this vulnerability is an unknown functionality of the component Project Maintainer Handler. This manipulation causes information disclosure. This vulnerabili
CVE-2022-4053 | Student Attendance Management System createClass.php className cross site scripting (EUVD-2022-51430)
A vulnerability identified as problematic has been detected in Student Attendance Management System. Impacted is an unknown function of the file createClass.php. The manipulation of the argument className leads to cross site scripting. This
CVE-2022-4052 | Student Attendance Management System /Admin/createClass.php Id sql injection (EUVD-2022-51429)
A vulnerability categorized as critical has been discovered in Student Attendance Management System. This issue affects some unknown processing of the file /Admin/createClass.php. Executing a manipulation of the argument ID can lead to sql
U.S. CISA adds Apple flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Apple flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Apple flaw, tracked as CVE-2024-27834 (CV
The SOC Files 5: Ghost in the pipeline, or a fileless SharePoint breach by Storm-2603
Executive summary In 2025, several threat actors exploited CVE-2025-53770 and CVE-2025-53771 (ToolShell vulnerabilities) in on-premises Microsoft SharePoint to achieve remote code execution through crafted HTTP requests. One of the threat a
CVE-2026-90624 | Apache OpenOffice PDF File Parsing heap-based overflow (WID-SEC-2026-4332)
A vulnerability identified as critical has been detected in Apache OpenOffice. This issue affects some unknown processing of the component PDF File Parsing. Performing a manipulation results in heap-based buffer overflow. This vulnerability
CVE-2026-59268 | Apache OpenOffice WW8 PLCF reader heap-based overflow (WID-SEC-2026-4332)
A vulnerability classified as critical was found in Apache OpenOffice. This impacts an unknown function of the component WW8 PLCF reader. Such manipulation leads to heap-based buffer overflow. This vulnerability is traded as CVE-2026-59268.
CVE-2026-59267 | Apache OpenOffice heap-based overflow (WID-SEC-2026-4332)
A vulnerability was found in Apache OpenOffice and classified as critical. This affects an unknown part. The manipulation results in heap-based buffer overflow. This vulnerability was named CVE-2026-59267. The attack may be performed from r
CVE-2026-59264 | Apache OpenOffice uncontrolled search path (WID-SEC-2026-4332)
A vulnerability described as critical has been identified in Apache OpenOffice. The impacted element is an unknown function. The manipulation results in uncontrolled search path. This vulnerability is reported as CVE-2026-59264. The attack
CVE-2026-59263 | Apache OpenOffice input validation (WID-SEC-2026-4332)
A vulnerability labeled as critical has been found in Apache OpenOffice. Impacted is an unknown function. Executing a manipulation can lead to improper input validation. This vulnerability is registered as CVE-2026-59263. It is possible to
Zyxel patches a zero-day hiding behind an old fix
Zyxel has patched a zero-day vulnerability that attackers exploited to compromise 996 GS1900 network switches across 48 countries, exposing device configurations, network information and hashed root credentials. The attack began around Augu
CVE-2025-65843 | Aquarius Desktop 3.0.069 on macOS ~/Library/Logs/Aquarius information disclosure
A vulnerability classified as problematic was found in Aquarius Desktop 3.0.069 on macOS. Affected by this vulnerability is an unknown functionality in the library ~/Library/Logs/Aquarius. Executing a manipulation can lead to information di
CVE-2025-65842 | Aquarius HelperTool 1.0.003 on macOS XPC Service backdoor
A vulnerability was found in Aquarius HelperTool 1.0.003 on macOS. It has been declared as critical. This issue affects some unknown processing of the component XPC Service. Executing a manipulation can lead to backdoor. This vulnerability
CVE-2025-65841 | Aquarius Desktop up to 3.0.069 on macOS ~/Library/Application weak password encoding
A vulnerability marked as critical has been reported in Aquarius Desktop up to 3.0.069 on macOS. This impacts an unknown function in the library ~/Library/Application. Performing a manipulation results in weak encoding for password. This vu
CVE-2025-65320 | Abacre Restaurant Point of Sale up to 15.0.0.1656 cleartext storage
A vulnerability categorized as critical has been discovered in Abacre Restaurant Point of Sale up to 15.0.0.1656. Impacted is an unknown function. Executing a manipulation can lead to cleartext storage of sensitive information. The identifi
CVE-2025-65267 | ERPNext/Frappe SVG Avatar Image cross site scripting
A vulnerability was found in ERPNext and Frappe and classified as problematic. Affected by this issue is some unknown functionality of the component SVG Avatar Image Handler. The manipulation results in cross site scripting. This vulnerabil
CVE-2025-63401 | HCL Limited HCLTech DRAGON up to 7.5.x cross site scripting
A vulnerability classified as problematic has been found in HCL Limited HCLTech DRAGON up to 7.5.x. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. This vulnerability is referenced
CVE-2025-57202 | AVTECH DGM1104 FullImg-1015-1004-1006-1003 PwdGrp.cgi username cross site scripting
A vulnerability identified as problematic has been detected in AVTECH DGM1104 FullImg-1015-1004-1006-1003. The affected element is an unknown function of the file PwdGrp.cgi. The manipulation of the argument Username leads to cross site scr
CVE-2025-57200 | AVTECH DGM1104 FullImg-1015-1004-1006-1003 test_mail command injection
A vulnerability classified as critical was found in AVTECH DGM1104 FullImg-1015-1004-1006-1003. This affects the function test_mail. Such manipulation leads to command injection. This vulnerability is documented as CVE-2025-57200. The attac
CVE-2025-57199 | AVTECH DGM1104 FullImg-1015-1004-1006-1003 NetFailDetectD command injection
A vulnerability was found in AVTECH DGM1104 FullImg-1015-1004-1006-1003. It has been declared as critical. This vulnerability affects unknown code of the component NetFailDetectD. Such manipulation leads to command injection. This vulnerabi
CVE-2025-57198 | AVTECH DGM1104 FullImg-1015-1004-1006-1003 Machine.cgi command injection
A vulnerability, which was classified as critical, has been found in AVTECH DGM1104 FullImg-1015-1004-1006-1003. This impacts an unknown function of the file Machine.cgi. Performing a manipulation results in command injection. This vulnerab
CVE-2025-54326 | Samsung Mobile Processor Exynos 1280/2200 Camera null pointer dereference
A vulnerability was found in Samsung Mobile Processor Exynos 1280/2200 and classified as problematic. The impacted element is an unknown function of the component Camera. Executing a manipulation can lead to null pointer dereference. This v
CVE-2025-53965 | Samsung Mobile Processor/Wearable Processor/Modem Exynos up to 5400 memory corruption
A vulnerability has been found in Samsung Mobile Processor, Wearable Processor and Modem Exynos up to 5400 and classified as critical. The affected element is an unknown function. Performing a manipulation results in memory corruption. This
CVE-2025-50360 | Pepper Language PR File compiler.c heap-based overflow
A vulnerability marked as critical has been reported in Pepper Language 0.1.1commit 961a5d9988c5986d563310275adad3fd181b2bb7.. Affected by this vulnerability is an unknown functionality in the library compiler.h of the file compiler.c of th
CVE-2026-109408 | jopenlibs vault-java-driver up to 6.2.3 TLS Configuration SslConfig.isVerify certificate validation (EUVD-2026-117400)
A vulnerability labeled as problematic has been found in jopenlibs vault-java-driver up to 6.2.3. This affects the function SslConfig.isVerify of the component TLS Configuration. The manipulation results in improper certificate validation.
CVE-2026-107776 | Dokan Plugin up to 5.3.2 on WordPress logic error (EUVD-2026-117401)
A vulnerability was found in Dokan Plugin up to 5.3.2 on WordPress. It has been rated as problematic. Impacted is an unknown function. Performing a manipulation results in business logic errors. This vulnerability was named CVE-2026-107776.
CVE-2026-100109 | Security for WooCommerce Plugin up to 1.0.16 on WordPress authorization (EUVD-2026-117402)
A vulnerability categorized as critical has been discovered in Security for WooCommerce Plugin up to 1.0.16 on WordPress. The affected element is an unknown function. Executing a manipulation can lead to missing authorization. The identific
CVE-2026-62041 | Ashok Dudhat Event Manager Plugin up to 3.4.1 on WordPress authorization (EUVD-2026-95728)
A vulnerability was found in Ashok Dudhat Event Manager Plugin up to 3.4.1 on WordPress. It has been classified as critical. This vulnerability affects unknown code. The manipulation leads to missing authorization. This vulnerability is uni
CVE-2026-112072 | jopenlibs vault-java-driver up to 6.2.3 minimal-json parser stack-based overflow (EUVD-2026-117399)
A vulnerability identified as critical has been detected in jopenlibs vault-java-driver up to 6.2.3. The impacted element is an unknown function of the component minimal-json parser. The manipulation leads to stack-based buffer overflow. Th
CVE-2026-73996 | Masteriyo Plugin up to 2.3.2 on WordPress unrestricted upload (EUVD-2026-60810)
A vulnerability marked as critical has been reported in Masteriyo Plugin up to 2.3.2 on WordPress. Impacted is an unknown function. This manipulation causes unrestricted upload. The identification of this vulnerability is CVE-2026-73996. It
CVE-2026-117679 | SHIRASAGI Project up to 1.21.0 cross site scripting (EUVD-2026-117398)
A vulnerability marked as problematic has been reported in SHIRASAGI Project SHIRASAGI up to 1.21.0. This impacts an unknown function. This manipulation causes cross site scripting. This vulnerability is tracked as CVE-2026-117679. The atta
CVE-2026-118869 | SHIRASAGI Project up to 1.21.0 os command injection (EUVD-2026-117397)
A vulnerability described as very critical has been identified in SHIRASAGI Project SHIRASAGI up to 1.21.0. Affected is an unknown function. Such manipulation leads to os command injection. This vulnerability is listed as CVE-2026-118869. T
CVE-2026-80948 | Linux Kernel up to 6.18.49/7.2.3 iwlwifi iwl_op_mode_dvm_start nvm_data/eeprom_blob memory leak (WID-SEC-2026-3321)
A vulnerability was found in Linux Kernel up to 6.18.49/7.2.3. It has been rated as critical. The affected element is the function iwl_op_mode_dvm_start of the component iwlwifi. This manipulation of the argument nvm_data/eeprom_blob causes
CVE-2026-79405 | Unisoc Modem UDX710 input validation (EUVD-2026-116697)
A vulnerability classified as critical has been found in Unisoc Modem UDX710. Affected by this vulnerability is an unknown functionality. Performing a manipulation results in improper input validation. This vulnerability is reported as CVE-
CVE-2026-16437 | Mitsubishi Electric AnalytiX Password Recovery password recovery (EUVD-2026-101941)
A vulnerability marked as very critical has been reported in Mitsubishi Electric AnalytiX, BizViz, GENESIS, GENESIS32, GENESIS64, Hyper Historian, ICONICS Suite, IoTWorX, MC Works64 and MobileHMI. Impacted is an unknown function of the comp
CVE-2026-123029 | Wowza Streaming Engine up to 4.12.1 xml external entity reference (EUVD-2026-117386)
A vulnerability was found in Wowza Streaming Engine up to 4.12.1. It has been classified as critical. This vulnerability affects unknown code. This manipulation causes xml external entity reference. This vulnerability is handled as CVE-2026