Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 785 | 0,2 % |
| ≥50 % | 3.556 | 0,9 % |
| ≥10 % | 13.140 | 3,2 % |
| <10 % | 390.630 | 95,7 % |
CVE-2025-61224 | DokuWiki 2025-05-14a q cross site scripting (Issue 4512)
A vulnerability classified as problematic was found in DokuWiki 2025-05-14a. This impacts an unknown function. Executing a manipulation of the argument q can lead to cross site scripting. This vulnerability is tracked as CVE-2025-61224. The
CVE-2025-61198 | Orban Optimod 5750HD Web UI cross site scripting
A vulnerability marked as problematic has been reported in Orban Optimod 5750HD, Optimod 5950, Optimod 5950HD and Optimod Trio. This vulnerability affects unknown code of the component Web UI. The manipulation leads to cross site scripting.
CVE-2025-61197 | Orban Optimod 5750 client-side enforcement of server-side security
A vulnerability described as critical has been identified in Orban Optimod 5750, Optimod 5750HD, Optimod 5950, Optimod 5950HD and Trio. This issue affects some unknown processing. The manipulation results in client-side enforcement of serve
CVE-2025-60962 | EndRun Sonoma D12 Network Time Server 6010-0071-000 Ver 4.00 os command injection
A vulnerability, which was classified as critical, was found in EndRun Sonoma D12 Network Time Server 6010-0071-000 Ver 4.00. Affected by this vulnerability is an unknown functionality. The manipulation results in os command injection. This
CVE-2025-60961 | EndRun Sonoma D12 Network Time Server 6010-0071-000 Ver 4.00 cross site scripting
A vulnerability identified as problematic has been detected in EndRun Sonoma D12 Network Time Server 6010-0071-000 Ver 4.00. The impacted element is an unknown function. This manipulation causes cross site scripting. This vulnerability is h
CVE-2025-60960 | EndRun Sonoma D12 Network Time Server 6010-0071-000 Ver 4.00 os command injection
A vulnerability has been found in EndRun Sonoma D12 Network Time Server 6010-0071-000 Ver 4.00 and classified as critical. Affected by this issue is some unknown functionality. This manipulation causes os command injection. This vulnerabili
CVE-2025-60959 | EndRun Sonoma D12 Network Time Server 6010-0071-000 Ver 4.00 os command injection
A vulnerability categorized as critical has been discovered in EndRun Sonoma D12 Network Time Server 6010-0071-000 Ver 4.00. The affected element is an unknown function. The manipulation results in os command injection. This vulnerability i
CVE-2025-60958 | EndRun Sonoma D12 Network Time Server 6010-0071-000 Ver 4.00 cross site scripting
A vulnerability marked as problematic has been reported in EndRun Sonoma D12 Network Time Server 6010-0071-000 Ver 4.00. This impacts an unknown function. Performing a manipulation results in cross site scripting. This vulnerability was nam
CVE-2025-60957 | EndRun Sonoma D12 Network Time Server 6010-0071-000 Ver 4.00 os command injection
A vulnerability, which was classified as critical, has been found in EndRun Sonoma D12 Network Time Server 6010-0071-000 Ver 4.00. Affected is an unknown function. The manipulation leads to os command injection. This vulnerability is listed
CVE-2025-60956 | EndRun Sonoma D12 Network Time Server 6010-0071-000 Ver 4.00 cross-site request forgery
A vulnerability was found in EndRun Sonoma D12 Network Time Server 6010-0071-000 Ver 4.00. It has been rated as problematic. Impacted is an unknown function. The manipulation leads to cross-site request forgery. This vulnerability is traded
CVE-2025-57247 | BATBToken Smart Contract Compiler 0.8.26 setColdWhiteList/setSpecialAddress access control
A vulnerability was found in BATBToken Smart Contract Compiler 0.8.26. It has been rated as critical. This affects the function setColdWhiteList/setSpecialAddress. Performing a manipulation results in improper access controls. This vulnerab
CVE-2024-6237 | 389-ds-base Extended Search Request denial of service (EUVD-2024-47979 / Nessus ID 210486)
A vulnerability marked as problematic has been reported in 389-ds-base. Affected by this vulnerability is an unknown functionality of the component Extended Search Request Handler. The manipulation leads to denial of service. This vulnerabi
CVE-2023-33952 | Linux Kernel vmwgfx Driver vmwgfx_bo.c double free (EUVD-2023-38088 / Nessus ID 214457)
A vulnerability has been found in Linux Kernel and classified as critical. The affected element is an unknown function of the file drivers/gpu/drm/vmwgfx/vmwgfx_bo.c of the component vmwgfx Driver. The manipulation leads to double free. Thi
SSH-Sicherheitslücke in Alpine Linux: Login ohne Passwort möglich - All About Security
Sinnvoll ist es, zuerst die aus dem Internet erreichbaren Hosts zu prüfen: Welche Server bieten SSH an, welche akzeptieren Passwörter, und welche sind ... Weiterlesen
Patch verification for CVE-2025-4517 in containers and dependencies
Patch verification for CVE-2025-4517 in containers and dependencies Why checking one interpreter is not enough CVE-2025-4517 is a critical arbitrary-file-write flaw in Python tar extraction. It can bypass the intended path boundary even whe
CVE-2025-60454 | MetInfo CMS 8.0 Image Management img_admin.class.php cross site scripting
A vulnerability was found in MetInfo CMS 8.0 and classified as problematic. The affected element is an unknown function of the file app\system\img\admin\img_admin.class.php of the component Image Management Module. The manipulation results
CVE-2025-60453 | MetInfo CMS 8.0 Column Management index.class.php cross site scripting
A vulnerability has been found in MetInfo CMS 8.0 and classified as problematic. Impacted is an unknown function of the file app\system\column\admin\index.class.php of the component Column Management Module. The manipulation leads to cross
CVE-2025-60452 | MetInfo CMS 8.0 Download Management download_admin.class.php cross site scripting
A vulnerability, which was classified as problematic, was found in MetInfo CMS 8.0. This issue affects some unknown processing of the file app\system\download\admin\download_admin.class.php of the component Download Management Module. Execu
CVE-2025-60451 | MetInfo CMS 8.0 Website Settings uploadify.class.php cross site scripting
A vulnerability, which was classified as problematic, has been found in MetInfo CMS 8.0. This vulnerability affects unknown code of the file app\system\include\module\uploadify.class.php of the component Website Settings Module. Performing
CVE-2025-60450 | MetInfo CMS 8.0 SVG File Uploader.class.php cross site scripting
A vulnerability classified as problematic was found in MetInfo CMS 8.0. This affects an unknown part of the file app\system\include\module\editor\Uploader.class.php of the component SVG File Handler. Such manipulation leads to cross site sc
CVE-2025-60449 | SeaCMS 13.1 admin_safe.php information disclosure
A vulnerability was found in SeaCMS 13.1. It has been classified as problematic. The impacted element is an unknown function of the file admin_safe.php. This manipulation causes information disclosure. This vulnerability is registered as CV
CVE-2025-39947 | Linux Kernel up to 6.6.107/6.12.48/6.16.8 mlx5_uplink_netdev_get null pointer dereference (Nessus ID 269450 / WID-SEC-2025-2194)
A vulnerability identified as critical has been detected in Linux Kernel up to 6.6.107/6.12.48/6.16.8. Impacted is the function mlx5_uplink_netdev_get. The manipulation leads to null pointer dereference. This vulnerability is referenced as
IT Security News Hourly Summary 2026-11-06 21h : 15 posts
15 posts published in the last hour 19:32GhostMap Android Vulnerability Can Crash Phones Without Opening an App 19:32CISA Adds One Known Exploited Vulnerability to Catalog 19:32Certificate authority DigiCert reports data breach involving bu
CVE-2025-8277 | Red Hat Enterprise Linux/OpenShift Container Platform libssh memory leak (EUVD-2025-27246 / Nessus ID 264494)
A vulnerability, which was classified as problematic, was found in Red Hat Enterprise Linux and OpenShift Container Platform. Affected by this issue is some unknown functionality of the component libssh. Such manipulation leads to memory le
CVE-2025-60448 | Emlog Pro 2.5.19 SVG File /admin/media.php cross site scripting
A vulnerability was found in Emlog Pro 2.5.19. It has been rated as problematic. This impacts an unknown function of the file /admin/media.php of the component SVG File Handler. Performing a manipulation results in cross site scripting. Thi
CVE-2025-60447 | Emlog Pro 2.5.19 Email Template Configuration setting.php?action=mail cross site scripting
A vulnerability was found in Emlog Pro 2.5.19. It has been declared as problematic. This affects an unknown function of the file /admin/setting.php?action=mail of the component Email Template Configuration. Such manipulation leads to cross
CVE-2025-60445 | XunRuiCMS 4.7.1 SVG File Upload.php cross site scripting
A vulnerability classified as problematic has been found in XunRuiCMS 4.7.1. Affected by this issue is some unknown functionality in the library dayrui/Fcms/Library/Upload.php of the component SVG File Handler. This manipulation causes cros
CVE-2025-60019 | Red Hat Enterprise Linux up to 10 glib-networking null pointer dereference (ID 227 / Nessus ID 266124)
A vulnerability described as problematic has been identified in Red Hat Enterprise Linux 6/7/8/9/10. This issue affects some unknown processing of the component glib-networking. The manipulation results in null pointer dereference. This vul
CVE-2025-60018 | Red Hat Enterprise Linux up to 10 glib-networking BIO_write out-of-bounds (ID 226 / Nessus ID 266140)
A vulnerability classified as critical was found in Red Hat Enterprise Linux 6/7/8/9/10. The affected element is the function BIO_write of the component glib-networking. Such manipulation leads to out-of-bounds read. This vulnerability is u
CVE-2025-56019 | Agasta Easytouch+ 9.3.97 Bluetooth Low Energy denial of service
A vulnerability labeled as problematic has been found in Agasta Easytouch+ 9.3.97. Affected is an unknown function of the component Bluetooth Low Energy Handler. Such manipulation leads to denial of service. This vulnerability is listed as
CVE-2026-103682 | Checkmk up to 2.5.0p15 Jolokia Special Agent information disclosure (WID-SEC-2026-4035)
A vulnerability, which was classified as problematic, was found in Checkmk up to 2.5.0p15. The impacted element is an unknown function of the component Jolokia Special Agent. The manipulation results in information disclosure. This vulnerab
CVE-2026-101333 | Red Hat Keycloak/Single Sign-On Micrometer user-event metrics listener memory allocation (WID-SEC-2026-3614)
A vulnerability, which was classified as critical, has been found in Red Hat Keycloak and Single Sign-On. This affects an unknown part of the component Micrometer user-event metrics listener. The manipulation leads to uncontrolled memory al
CVE-2026-123277 | JetBrains CLion up to 2026.2.4.0/2026.3.0.0 missing authentication (WID-SEC-2026-4381)
A vulnerability marked as problematic has been reported in JetBrains CLion up to 2026.2.4.0/2026.3.0.0. The affected element is an unknown function. The manipulation leads to missing authentication. This vulnerability is referenced as CVE-2
CVE-2026-103674 | Checkmk up to 2.5.0p15 Special Agent information disclosure (WID-SEC-2026-4035)
A vulnerability, which was classified as problematic, has been found in Checkmk up to 2.5.0p15. The affected element is an unknown function of the component Special Agent. The manipulation leads to information disclosure. This vulnerability
CVE-2026-123276 | JetBrains CLion prior 2026.3/2026.2.4.1 GDB Server Debug Profile code injection (WID-SEC-2026-4381)
A vulnerability classified as problematic has been found in JetBrains CLion. Affected is an unknown function of the component GDB Server Debug Profile. This manipulation causes code injection. This vulnerability is registered as CVE-2026-12
CVE-2026-58115 | Siemens SIMATIC IoT2050 Advanced up to 1.28 Node-RED HTTP interface improper authentication (WID-SEC-2026-4382)
A vulnerability, which was classified as very critical, has been found in Siemens SIMATIC IoT2050 Advanced. The impacted element is an unknown function of the component Node-RED HTTP interface. The manipulation leads to improper authenticat
CVE-2026-123655 | Moodle up to 4.5.14/5.0.10/5.1.7/5.2.3 H5P access control (WID-SEC-2026-4385)
A vulnerability was found in Moodle up to 4.5.14/5.0.10/5.1.7/5.2.3. It has been rated as problematic. Affected by this vulnerability is an unknown functionality of the component H5P. This manipulation causes improper access controls. This
CVE-2025-59407 | Flock Safety Bravo Edge AI Compute Device 6.35.33 on Android com.flocksafety.android.objects flock_rye.bks hard-coded password
A vulnerability described as critical has been identified in Flock Safety Bravo Edge AI Compute Device 6.35.33 on Android. Affected by this issue is some unknown functionality of the file flock_rye.bks of the component com.flocksafety.andro
CVE-2024-4603 | OpenSSL up to 3.0.13/3.1.5/3.2.1/3.3.0 DSA crypto/dsa/dsa_check.c EVP_PKEY_param_check/EVP_PKEY_public_check denial of service (Nessus ID 209278 / WID-SEC-2024-1171)
A vulnerability categorized as problematic has been discovered in OpenSSL up to 3.0.13/3.1.5/3.2.1/3.3.0. This impacts the function EVP_PKEY_param_check/EVP_PKEY_public_check of the file crypto/dsa/dsa_check.c of the component DSA Handler.
CVE-2024-2511 | OpenSSL up to 1.1.1x/3.0.13/3.1.5/3.2.1 TLSv1.3 denial of service (Nessus ID 209278)
A vulnerability was found in OpenSSL up to 1.1.1x/3.0.13/3.1.5/3.2.1. It has been classified as critical. The impacted element is an unknown function of the component TLSv1.3 Handler. Performing a manipulation results in denial of service.
CVE-2024-13176 | OpenSSL up to 3.4.0 ECDSA Signature covert timing channel (Nessus ID 214984 / WID-SEC-2025-0131)
A vulnerability labeled as problematic has been found in OpenSSL up to 3.4.0. Affected is an unknown function of the component ECDSA Signature Handler. Such manipulation leads to covert timing channel. This vulnerability is referenced as CV
CVE-2023-6237 | OpenSSL up to 3.0.12/3.1.4/3.2.0 RSA Public Key EVP_PKEY_public_check denial of service (Nessus ID 209841)
A vulnerability was found in OpenSSL up to 3.0.12/3.1.4/3.2.0. It has been declared as problematic. This impacts the function EVP_PKEY_public_check of the component RSA Public Key Handler. Executing a manipulation can lead to denial of serv
CVE-2007-5894 | MIT Kerberos 5 ftpd.c reply Remote Code Execution (Nessus ID 29991 / ID 165712)
A vulnerability has been found in MIT Kerberos 5 and classified as very critical. This issue affects the function reply of the file ftpd.c of the component Kerberos. Performing a manipulation results in Remote Code Execution. This vulnerabi
CVE-2026-122193 – Issue with Trusted Remote Execution Setup Guide – OS command injection in the example SSM documents in Trusted Remote Execution (REX)
Bulletin ID: 2026-173-AWS Publication Date: 11/06/2026 09:00 AM PST Description: We identified CVE-2026-122193, an OS command injection issue in an example provided in the set-up documentation. The example included a script that creates AWS
Sicherheitslücke in Microsoft Paint ermöglicht Angriffe ohne Nutzerinteraktion - DSIN
Automatische Updates aktivieren: Stellen Sie sicher, dass Anwendungen möglichst automatisch aktualisiert werden. IT-Sicherheit prüfen: Unternehmen ... Weiterlesen
DFN-CERT-2026-5761 Python: Eine Schwachstelle ermöglicht u. a. einen Denial-of-Service-Angriff
Cyber Security Senior Professional (m/w/d)Karlsdorf-Neuthard, Home Office. Bundesanstalt für Immobilienaufgaben. Expertin / Experte Produktbetreuung ... Weiterlesen
ZDI-26-897: (Pwn2Own) Home Assistant Green aiohttp_client Server-Side Request Forgery Vulnerability
This vulnerability allows network-adjacent attackers to initiate arbitrary server-side requests on affected installations of Home Assistant Green. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rat
ZDI-26-895: LibreOffice dBase File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of LibreOffice. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious fil
ZDI-26-889: Quest NetVault Backup nvpmgr Integer Underflow Denial-of-Service Vulnerability
This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Quest NetVault Backup. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5.
ZDI-26-888: Quest NetVault Backup StnzCreateKey Numeric Truncation Error Denial-of-Service Vulnerability
This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Quest NetVault Backup. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5.
ZDI-26-892: Philips Hue Bridge Pro Protection Mechanism Failure Authentication Bypass Vulnerability
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Philips Hue Bridge Pro. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The
ZDI-26-893: Trimble SketchUp SKP File Parsing Use-After-Free Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a maliciou
ZDI-26-894: Docker Sandboxes Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability
This vulnerability allows local attackers to execute arbitrary code on affected installations of Docker Sandboxes. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious
ZDI-26-891: Philips Hue Bridge Pro SQL Injection Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge Pro. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can
ZDI-26-875: OriginLab Origin Viewer OGWU File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a m
ZDI-26-885: OriginLab Origin Viewer OPJ File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a m
ZDI-26-884: OriginLab Origin Viewer OGWU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a m
ZDI-26-883: OriginLab Origin Viewer OGM File Parsing Memory Corruption Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a m
ZDI-26-882: OriginLab Origin Viewer OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a m
ZDI-26-881: OriginLab Origin Viewer OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a m