Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 785 | 0,2 % |
| ≥50 % | 3.560 | 0,9 % |
| ≥10 % | 13.146 | 3,2 % |
| <10 % | 396.064 | 95,8 % |
CVE-2026-36983 | D-Link DCS-932L 2.18.01 /bin/alphapd sub_42EF14 LightSensorControl command injection
A vulnerability was found in D-Link DCS-932L 2.18.01. It has been classified as critical. Affected by this vulnerability is the function sub_42EF14 of the file /bin/alphapd. Performing a manipulation of the argument LightSensorControl resul
CVE-2026-31248 | Docling up to 2.61.0 XML Parser etree.fromstring xml external entity reference
A vulnerability was found in Docling up to 2.61.0. It has been classified as problematic. This vulnerability affects the function etree.fromstring of the component XML Parser. The manipulation leads to xml external entity reference. This vu
CVE-2026-31247 | Docling up to 2.61.0 xml external entity reference
A vulnerability described as problematic has been identified in Docling up to 2.61.0. This vulnerability affects unknown code. The manipulation results in xml external entity reference. This vulnerability is known as CVE-2026-31247. It is p
CVE-2025-12200 | dnsmasq up to 2.73rc6 Config File src/option.c parse_dhcp_opt m null pointer dereference (EUVD-2025-36059 / Nessus ID 276817)
A vulnerability, which was classified as problematic, has been found in dnsmasq up to 2.73rc6. Affected by this issue is the function parse_dhcp_opt of the file src/option.c of the component Config File Handler. This manipulation of the arg
CVE-2025-12199 | dnsmasq up to 2.73rc6 Config File src/network.c check_servers null pointer dereference (EUVD-2025-36060 / Nessus ID 276818)
A vulnerability classified as problematic was found in dnsmasq up to 2.73rc6. Affected by this vulnerability is the function check_servers of the file src/network.c of the component Config File Handler. The manipulation results in null poin
CVE-2025-12198 | dnsmasq up to 2.73rc6 Config File src/util.c parse_hex i heap-based overflow (EUVD-2025-36061 / Nessus ID 276816)
A vulnerability classified as critical has been found in dnsmasq up to 2.73rc6. Affected is the function parse_hex of the file src/util.c of the component Config File Handler. The manipulation of the argument i leads to heap-based buffer ov
CVE-2024-0391 | WSO2 Identity Server prior 7.0.0.131 response discrepancy
A vulnerability was found in WSO2 Identity Server, Open Banking IAM, Identity Server as Key Manager, Email OTP Authenticator and Carbon Authenticator Library for EmailOTP. It has been rated as problematic. Affected by this vulnerability is
CVE-2026-124033 – Relative path traversal in the log export commands in AWS ParallelCluster CLI
Bulletin ID: 2026-174-AWS Publication Date: 11/09/2026 13:00 PM PST Description: AWS ParallelCluster CLI is an open source command line tool, distributed on PyPI as aws-parallelcluster. We identified CVE-2026-124033, an issue where the expo
CVE-2026-123218 | IBM Aspera Faspex up to 5.0.19 improper authorization
A vulnerability was found in IBM Aspera Faspex up to 5.0.19 and classified as very critical. This vulnerability affects unknown code. Executing a manipulation can lead to improper authorization. This vulnerability is handled as CVE-2026-123
CVE-2026-113970 | Apple iOS/iPadOS/macOS/visionOS/watchOS prior 27.2.1 use after free (EUVD-2026-120412)
A vulnerability labeled as very critical has been found in Apple iOS, iPadOS, macOS, visionOS and watchOS. This affects an unknown part. The manipulation results in use after free. This vulnerability is known as CVE-2026-113970. It is possi
CVE-2026-113971 | Apple iOS/iPadOS up to 18.7.11/26.4 Lock Screen privileges management (EUVD-2026-120413)
A vulnerability described as problematic has been identified in Apple iOS and iPadOS up to 18.7.11/26.4. This issue affects some unknown processing of the component Lock Screen. Such manipulation leads to improper privilege management. This
CVE-2026-121223 | Google Chrome up to 157.0.8103.37 Media cross-domain policy (EUVD-2026-116301)
A vulnerability labeled as problematic has been found in Google Chrome up to 157.0.8103.37. This vulnerability affects unknown code of the component Media. The manipulation results in permissive cross-domain policy with untrusted domains. T
CVE-2026-121164 | Google Chrome up to 156.0.8078.79 Views privileges management (EUVD-2026-116300)
A vulnerability was found in Google Chrome. It has been rated as critical. Affected is an unknown function of the component Views. This manipulation causes improper privilege management. The identification of this vulnerability is CVE-2026-
CVE-2026-75879 | IBM Content Navigator 3.0.15.0/3.1.0.0/3.2.0.0/26.0.0.0 ldap injection (EUVD-2026-119722)
A vulnerability was found in IBM Content Navigator 3.0.15.0/26.0.0.0/3.1.0.0/3.2.0.0 and classified as problematic. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to ldap injection. This vulner
CVE-2026-121096 | Google Chrome up to 156.0.8078.79 V8 out-of-bounds (EUVD-2026-116290)
A vulnerability was found in Google Chrome. It has been classified as problematic. Affected is an unknown function of the component V8. The manipulation leads to out-of-bounds read. This vulnerability is referenced as CVE-2026-121096. The a
CVE-2026-119759 | trailbaseio TrailBase 0.28.2/0.35.9 FileUpload like resource injection (EUVD-2026-120414)
A vulnerability was found in trailbaseio TrailBase 0.28.2/0.35.9. It has been classified as critical. This affects an unknown function of the component FileUpload. This manipulation of the argument like causes improper control of resource i
CVE-2026-15266 | IBM Concert up to 3.0.1.1 os command injection (EUVD-2026-119668)
A vulnerability categorized as very critical has been discovered in IBM Concert up to 3.0.1.1. This impacts an unknown function. Executing a manipulation can lead to os command injection. This vulnerability appears as CVE-2026-15266. The at
CVE-2026-124992 | nushell up to 0.116.1 Data Conversion ser.rs escape_bytes control sequence (Issue 19197 / EUVD-2026-120415)
A vulnerability has been found in nushell up to 0.116.1 and classified as problematic. Impacted is the function escape_bytes of the file crates/nu-json/src/ser.rs of the component Data Conversion Handler. The manipulation leads to improper
CVE-2026-121033 | Google Chrome up to 156.0.8078.79 GPU uninitialized pointer (EUVD-2026-116480)
A vulnerability classified as critical has been found in Google Chrome. This affects an unknown function of the component GPU. The manipulation leads to uninitialized pointer. This vulnerability is referenced as CVE-2026-121033. Remote expl
CVE-2026-122056 | Red Hat Enterprise Linux SDS Compose buffer overflow (EUVD-2026-120416)
A vulnerability, which was classified as problematic, has been found in Red Hat Enterprise Linux. This issue affects some unknown processing of the component SDS Compose. Performing a manipulation results in buffer overflow. This vulnerabil
CVE-2026-121190 | Google Chrome up to 156.0.8078.79 Extensions cross site scripting (EUVD-2026-116322)
A vulnerability was found in Google Chrome. It has been classified as problematic. This vulnerability affects unknown code of the component Extensions. Performing a manipulation results in cross site scripting. This vulnerability is known a
CVE-2026-19706 | Red Hat Assisted Installer for OpenShift Container Platform CSR Approval certificate validation (EUVD-2026-120121)
A vulnerability was found in Red Hat Assisted Installer for OpenShift Container Platform, Multicluster Engine for Kubernetes and OpenShift Container Platform and classified as problematic. This issue affects some unknown processing of the c
CVE-2026-60117 | KasemJaffer receive_sharing_intent up to 1.9.0 Android Implementation FileDirectory.getDataColumn _display_name path traversal (EUVD-2026-120158)
A vulnerability categorized as problematic has been discovered in KasemJaffer receive_sharing_intent up to 1.9.0. This affects the function FileDirectory.getDataColumn of the component Android Implementation. Executing a manipulation of the
CVE-2026-125063 | Red Hat Ansible Automation Platform Rrule Validation rrule redos (EUVD-2026-120159)
A vulnerability marked as critical has been reported in Red Hat Ansible Automation Platform. Affected by this vulnerability is an unknown functionality of the component Rrule Validation. This manipulation of the argument rrule causes ineffi
CVE-2026-95743 | HPE Fabric Composer up to 7.3.4/7.4.0 privileges management (EUVD-2026-116160)
A vulnerability classified as very critical was found in HPE Fabric Composer up to 7.3.4/7.4.0. Affected by this vulnerability is an unknown functionality. The manipulation results in improper privilege management. This vulnerability is cat
CVE-2026-95742 | HPE Fabric Composer up to 7.3.4/7.4.0 file inclusion (EUVD-2026-116286)
A vulnerability, which was classified as very critical, has been found in HPE Fabric Composer up to 7.3.4/7.4.0. Affected by this issue is some unknown functionality. This manipulation causes file inclusion. This vulnerability is registered
CVE-2026-84503 | Red Hat Ansible Automation Platform Ansible Core ansible.builtin.git repository URL command injection (EUVD-2026-120161)
A vulnerability classified as critical has been found in Red Hat Ansible Automation Platform Ansible Core. This affects an unknown part of the component ansible.builtin.git. Performing a manipulation of the argument repository URL results i
CVE-2026-112899 | Pillow Eps Image Loading EpsImagePlugin.py Ghostscript scale denial of service (EUVD-2026-117791)
A vulnerability categorized as problematic has been discovered in Pillow. This vulnerability affects the function Ghostscript of the file src/PIL/EpsImagePlugin.py of the component Eps Image Loading. Such manipulation of the argument scale
CVE-2026-95745 | HPE Fabric Composer up to 7.3.4/7.4.0 denial of service (EUVD-2026-116162)
A vulnerability was found in HPE Fabric Composer up to 7.3.4/7.4.0. It has been classified as critical. Affected is an unknown function. This manipulation causes denial of service. This vulnerability is handled as CVE-2026-95745. The attack
CVE-2026-95744 | HPE Fabric Composer up to 7.3.4/7.4.0 information disclosure (EUVD-2026-116161)
A vulnerability labeled as problematic has been found in HPE Fabric Composer up to 7.3.4/7.4.0. Affected by this issue is some unknown functionality. Executing a manipulation can lead to information disclosure. This vulnerability is tracked
CVE-2026-114604 | Ardatan graphql-tools up to 12.0.1 setObjectKeyPath mergeIncrementalResult.ts mergeIncrementalResult path prototype pollution (EUVD-2026-117792)
A vulnerability labeled as critical has been found in Ardatan graphql-tools up to 12.0.1. The impacted element is the function mergeIncrementalResult of the file packages/utils/src/mergeIncrementalResult.ts of the component setObjectKeyPath
CVE-2026-0401 | SonicWall SonicOS null pointer dereference (SNWLID-2026-0001 / Nessus ID 300077)
A vulnerability was found in SonicWall SonicOS and classified as problematic. Affected is an unknown function. The manipulation results in null pointer dereference. This vulnerability is known as CVE-2026-0401. It is possible to launch the
CVE-2026-0400 | SonicWall SonicOS format string (SNWLID-2026-0001 / Nessus ID 300077)
A vulnerability has been found in SonicWall SonicOS and classified as critical. This impacts an unknown function. The manipulation leads to format string. This vulnerability is traded as CVE-2026-0400. It is possible to initiate the attack
CVE-2026-0399 | SonicWall SonicOS API Endpoint stack-based overflow (SNWLID-2026-0001 / Nessus ID 300077)
A vulnerability was found in SonicWall SonicOS. It has been declared as critical. Affected by this issue is some unknown functionality of the component API Endpoint. Such manipulation leads to stack-based buffer overflow. This vulnerability
CVE-2024-33396 | karmada up to 1.9.0 Token access control
A vulnerability was found in karmada up to 1.9.0. It has been declared as problematic. Affected by this issue is some unknown functionality of the component Token. Executing a manipulation can lead to improper access controls. This vulnerab
News alert: Insignary offers free scanner to help companies detect PHP2Shell, Node2Shell
TORONTO, Nov. 6, 2026, CyberNewswire — Insignary, a global open-source security company, today released insignary-chk, a free tool that checks for PHP2Shell and Node2Shell, two recently disclosed runtime vulnerabilities affecting PHP and No
USN-9013-1: Fetchmail vulnerabilities
Christian Herdtweck discovered that Fetchmail incorrectly handled certain long log messages. A remote attacker could possibly use this issue to cause Fetchmail to crash, resulting in a denial of service. This issue only affected Ubuntu 16.0
USN-9010-1: OpenJDK 11 vulnerabilities
It was discovered that the Security component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-83374) It was discovered that the JSSE component of OpenJD
USN-9004-1: OpenJDK 25 vulnerabilities
It was discovered that the 2D component of OpenJDK 25 did not correctly authenticate users. A remote attacker could possibly use this issue to cause a denial of service or to read or modify sensitive data. (CVE-2026-91415) It was discovered
CVE-2026-18836 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinations and return the response to the attacker.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended des
CVE-2026-18689 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accepted where it should not be, which could reveal the names of other organizations.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accep
CVE-2026-17428 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization decisions without sufficient verification, which could allow access to information belonging to others.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization
CVE-2026-17411 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized before it is used in database queries.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized befo
CVE-2026-17410 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.
CVE-2026-17409 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of a request, which could allow restricted operations to be reached.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access c
CVE-2026-17408 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.
CVE-2026-17407 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before being used in a database query, which could allow SQL commands to run.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before
CVE-2026-17406 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Address checks can be bypassed, which could allow the server to reach destinations that should be blocked.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Address checks can be bypassed, which could allow the s
CVE-2026-17405 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm that the requesting user is permitted to read them, which could expose keystore information.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm
CVE-2026-17404 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17403 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.
CVE-2026-17402 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is passed to the operating system, which could allow commands to run on the underlying host.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is pas
CVE-2026-17401 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.
CVE-2026-17400 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
CVE-2026-17399 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to insufficient validation of uploaded content. Content uploaded to the product is not sufficiently checked before it is processed, which could allow code to run on the server.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to insufficient validation of uploaded content. Content uploaded to the product is not suffic
CVE-2026-17398 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17397 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17396 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
CVE-2026-17395 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access internal network resources due to improper validation of a user-supplied URL. Destinations are not sufficiently restricted, which could allow the server to be made to contact internal systems.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access internal network resources due to improper validation of a user-supplied URL. Destinations are not sufficiently r
CVE-2026-17394 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improperly controlled modification of object attributes. A user-supplied value could change an access-related setting that should be controlled by the system, which could expose sensitive information.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improperly controlled modification of object attributes. A user-supplied value could