Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 785 | 0,2 % |
| ≥50 % | 3.561 | 0,9 % |
| ≥10 % | 13.151 | 3,2 % |
| <10 % | 396.058 | 95,8 % |
Barracuda Email Security Gateway Flaws Allow Unauthenticated Attackers to Execute Commands as Root
Two critical security vulnerabilities in Barracuda Email Security Gateway (ESG) could let unauthenticated attackers bypass authentication and run operating system commands as root. The vulnerabilities, tracked as CVE-2026-116606 and CVE-202
Chrome Update Patches Exploited XML Zero-Day, Eighth This Year
The high-severity use-after-free in Chrome’s XML component was reported anonymously on November 6 and is already exploited in attacks. This article has been indexed from SecurityWeek Read the original article: Chrome Update Patches Exploite
CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added four security flaws impacting GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex to its Known Exploited Vulnerabilities (KEV) catalog, cit
Chrome Update Patches Exploited XML Zero-Day, Eighth This Year
The high-severity use-after-free in Chrome’s XML component was reported anonymously on November 6 and is already exploited in attacks. The post Chrome Update Patches Exploited XML Zero-Day, Eighth This Year appeared first on SecurityWeek. W
Apple-Schwachstelle von 2024 in Angriffskampagne eingesetzt
Eine aktuell Spionagekampagne kombiniert eine 2024 behobene Apple-Schwachstelle mit einem weiteren WebKit-Fehler, um Cookies auf ungepatchten iPhones zu stehlen. Ein Zusammenhang mit den jüngsten Warnungen zur „Mercenary Spyware“ ist nicht
Google Fixes Actively Exploited Chrome Zero-Day Vulnerability in Emergency Security Update
Google released a Chrome security update that addresses nine security flaws, including an actively exploited zero-day in its XML component. Published November 9, 2026, the Stable channel release patches CVE-2026-125350, a high-severity memo
CVE-2026-49427 | FreeBSD up to p0.x/p6/p10/p15 Shared Memory sendfile privileges management
A vulnerability was found in FreeBSD up to p0.x/p6/p10/p15 and classified as very critical. Affected by this vulnerability is the function sendfile of the component Shared Memory. Such manipulation leads to improper privilege management. Th
CVE-2026-49426 | FreeBSD Kernel up to p0.x/p6/p10/p15 Audit AUDIT_SYSCALL_EXIT return value
A vulnerability labeled as problematic has been found in FreeBSD Kernel up to p0.x/p6/p10/p15. The affected element is the function AUDIT_SYSCALL_EXIT of the component Audit. Such manipulation leads to unchecked return value. This vulnerabi
CVE-2026-49422 | FreeBSD Kernel up to p0.x/p6/p10/p15 RACK setsockopt use after free
A vulnerability was found in FreeBSD Kernel up to p0.x/p6/p10/p15. It has been declared as very critical. Affected is the function setsockopt of the component RACK. Such manipulation leads to use after free. This vulnerability is referenced
CVE-2026-49421 | FreeBSD Kernel up to p0.x/p6/p10/p15 Path Resolution unlinkat/funlinkat AT_RESOLVE_BENEATH access control
A vulnerability was found in FreeBSD Kernel up to p0.x/p6/p10/p15. It has been classified as very critical. This impacts the function unlinkat/funlinkat of the component Path Resolution. This manipulation of the argument AT_RESOLVE_BENEATH
CVE-2026-49420 | FreeBSD libalias up to p0.x/p6/p10/p15 RTSP stack-based overflow
A vulnerability was found in FreeBSD libalias up to p0.x/p6/p10/p15 and classified as very critical. This affects an unknown function of the component RTSP Handler. The manipulation results in stack-based buffer overflow. This vulnerability
CVE-2026-19842 | SAML Single Sign On Plugin up to 5.4.6 on WordPress improper authentication (EUVD-2026-62293)
A vulnerability described as critical has been identified in SAML Single Sign On Plugin up to 5.4.6 on WordPress. This vulnerability affects unknown code. Such manipulation leads to improper authentication. This vulnerability is listed as C
CVE-2026-19782 | WPS Bidouille Plugin up to 1.33.4 on WordPress information disclosure (EUVD-2026-62292)
A vulnerability marked as problematic has been reported in WPS Bidouille Plugin up to 1.33.4 on WordPress. This affects an unknown part. This manipulation causes information disclosure. This vulnerability is tracked as CVE-2026-19782. The a
CVE-2026-19417 | KiviCare Plugin up to 4.5.3 on WordPress authorization (EUVD-2026-62290)
A vulnerability labeled as problematic has been found in KiviCare Plugin up to 4.5.3 on WordPress. Affected by this issue is some unknown functionality. The manipulation results in authorization bypass. This vulnerability is identified as C
CVE-2026-19416 | KiviCare Plugin up to 4.5.3 on WordPress authorization
A vulnerability identified as critical has been detected in KiviCare Plugin up to 4.5.3 on WordPress. Affected by this vulnerability is an unknown functionality. The manipulation leads to authorization bypass. This vulnerability is referenc
CVE-2026-18937 | Broken Link Checker Plugin up to 2.4.11 on WordPress code injection
A vulnerability was found in Broken Link Checker Plugin up to 2.4.11 on WordPress. It has been declared as critical. This affects an unknown part. Executing a manipulation can lead to code injection. The identification of this vulnerability
CVE-2026-18779 | TrueBooker Plugin up to 1.2.6 on WordPress authorization
A vulnerability was found in TrueBooker Plugin up to 1.2.6 on WordPress. It has been rated as critical. This impacts an unknown function. Performing a manipulation results in missing authorization. This vulnerability was named CVE-2026-1877
CVE-2026-18778 | TrueBooker Plugin up to 1.2.6 on WordPress information disclosure
A vulnerability was found in TrueBooker Plugin up to 1.2.6 on WordPress. It has been declared as problematic. This affects an unknown function. Such manipulation leads to information disclosure. This vulnerability is uniquely identified as
CVE-2026-100225 | Microsoft Windows up to Server 2025 Storage buffer overflow (WID-SEC-2026-3892)
A vulnerability was found in Microsoft Windows. It has been declared as very critical. This impacts an unknown function of the component Storage. Executing a manipulation can lead to buffer overflow. This vulnerability is handled as CVE-202
CVE-2026-100222 | Microsoft Windows up to Server 2025 Network Policy Server buffer overflow (WID-SEC-2026-3892)
A vulnerability labeled as very critical has been found in Microsoft Windows. Affected is an unknown function of the component Network Policy Server. The manipulation results in buffer overflow. This vulnerability is identified as CVE-2026-
CVE-2026-100220 | Microsoft Windows up to Server 2025 Media Video Decoder heap-based overflow (WID-SEC-2026-3892)
A vulnerability marked as very critical has been reported in Microsoft Windows. Affected by this vulnerability is an unknown functionality of the component Media Video Decoder. This manipulation causes heap-based buffer overflow. This vulne
CVE-2026-100219 | Microsoft Windows up to Server 2025 QUIC use after free (WID-SEC-2026-3892)
A vulnerability was found in Microsoft Windows up to Server 2025. It has been classified as very critical. Impacted is an unknown function of the component QUIC. This manipulation causes use after free. This vulnerability is handled as CVE-
CVE-2026-100218 | Microsoft Windows up to Server 2025 Remote Desktop Gateway Service use after free (WID-SEC-2026-3892)
A vulnerability categorized as very critical has been discovered in Microsoft Windows. This affects an unknown function of the component Remote Desktop Gateway Service. Executing a manipulation can lead to use after free. The identification
CVE-2026-100217 | Microsoft Windows up to Server 2025 Group Policy privileges management (WID-SEC-2026-3892)
A vulnerability was found in Microsoft Windows. It has been classified as very critical. This affects an unknown function of the component Group Policy. Performing a manipulation results in improper privilege management. This vulnerability
CVE-2026-100216 | Microsoft Windows up to Server 2025 buffer overflow (WID-SEC-2026-3892)
A vulnerability was found in Microsoft Windows up to Server 2025 and classified as very critical. The impacted element is an unknown function. Such manipulation leads to buffer overflow. This vulnerability is traded as CVE-2026-100216. An a
Terminal2Shell: 55-Year-Old ‘Zero-Day’ Dating Back to 1971 Claims to Affect Billions of Devices
Terminal2Shell claims a critical flaw dating back to 1971 affects more than two billion devices, allowing anyone who opens a terminal to gain an interactive shell. However, the website is satire, not a confirmed vulnerability disclosure. It
CVE-2026-112322 | Red Hat Enterprise Linux GSSAPI Authentication svc_auth_gssapi.c clean_client resource consumption (Nessus ID 377860)
A vulnerability marked as critical has been reported in Red Hat Enterprise Linux. This vulnerability affects the function clean_client of the file lib/rpc/svc_auth_gssapi.c of the component GSSAPI Authentication. Performing a manipulation r
CVE-2026-121611 | Red Hat Enterprise Linux 7/8/9/10 gst-plugins-bad uninitialized pointer (Nessus ID 377861)
A vulnerability labeled as critical has been found in Red Hat Enterprise Linux 7/8/9/10. The affected element is an unknown function of the component gst-plugins-bad. Such manipulation leads to uninitialized pointer. This vulnerability is u
CVE-2026-116337 | Qt Framework Qt Network resource consumption (Nessus ID 377862)
A vulnerability identified as problematic has been detected in Qt Framework. Affected by this issue is some unknown functionality of the component Qt Network Module. Performing a manipulation results in resource consumption. This vulnerabil
Google Chrome: Sicherheitsupdate stopft aktiv ausgenutzte Zero-Day-Lücke
Google hat ein Update für den Desktop-Browser Chrome im Stable Channel veröffentlicht. Die neue Version 157.0.8103.50/.51 steht für Windows und macOS bereit, Linux-Nutzer erhalten die Version...Zum Beitrag: Google Chrome: Sicherheitsupdate
CVE-2026-76014 | BusyBox up to 1.30.1 FEATURE_WGET_TIMEOUT networking/wget.c -T null pointer dereference (Issue 124)
A vulnerability was found in BusyBox up to 1.30.1. It has been declared as problematic. This vulnerability affects unknown code of the file networking/wget.c of the component FEATURE_WGET_TIMEOUT Handler. Such manipulation of the argument -
CVE-2026-70408 | Extra Innovation acmailer CGI/acmailer DB improper authorization
A vulnerability was found in Extra Innovation acmailer CGI and acmailer DB. It has been declared as critical. Affected by this issue is some unknown functionality. Such manipulation leads to improper authorization. This vulnerability is lis
CVE-2026-66358 | Extra Innovation acmailer CGI/acmailer DB cross site scripting
A vulnerability was found in Extra Innovation acmailer CGI and acmailer DB. It has been declared as problematic. This vulnerability affects unknown code. Such manipulation leads to cross site scripting. This vulnerability is documented as C
CVE-2026-18777 | TrueBooker Plugin up to 1.2.6 on WordPress authorization
A vulnerability was found in TrueBooker Plugin up to 1.2.6 on WordPress. It has been classified as critical. The impacted element is an unknown function. This manipulation causes missing authorization. This vulnerability is handled as CVE-2
CVE-2026-18776 | TrueBooker Plugin up to 1.2.6 on WordPress privileges management
A vulnerability was found in TrueBooker Plugin up to 1.2.6 on WordPress and classified as critical. The affected element is an unknown function. The manipulation results in improper privilege management. This vulnerability is known as CVE-2
CVE-2026-18466 | WP Maps Plugin up to 4.9.7 on WordPress access control
A vulnerability, which was classified as problematic, has been found in WP Maps Plugin up to 4.9.7 on WordPress. This vulnerability affects unknown code. Performing a manipulation results in improper access controls. This vulnerability is r
CVE-2026-18231 | WP Directory Kit Plugin up to 1.5.6 on WordPress information disclosure
A vulnerability has been found in WP Directory Kit Plugin up to 1.5.6 on WordPress and classified as problematic. Impacted is an unknown function. The manipulation leads to information disclosure. This vulnerability is traded as CVE-2026-18
CVE-2026-18051 | W3 Total Cache Plugin up to 2.10.4 on WordPress path traversal
A vulnerability categorized as critical has been discovered in W3 Total Cache Plugin up to 2.10.4 on WordPress. This issue affects some unknown processing. The manipulation results in path traversal. This vulnerability is identified as CVE-
CVE-2026-18031 | TabaPay Gateway Plugin up to 1.4.0 on WordPress improper authentication
A vulnerability, which was classified as critical, was found in TabaPay Gateway Plugin up to 1.4.0 on WordPress. This issue affects some unknown processing. Executing a manipulation can lead to improper authentication. This vulnerability ap
CVE-2026-17565 | Elementor Animation Addons for Elementor Plugin up to 2.7.1 on WordPress server-side request forgery
A vulnerability described as problematic has been identified in Elementor Animation Addons for Elementor Plugin up to 2.7.1 on WordPress. Affected by this vulnerability is an unknown functionality. The manipulation results in server-side re
CVE-2026-16979 | SmartCrawl Plugin up to 3.16.2 on WordPress authorization
A vulnerability marked as problematic has been reported in SmartCrawl Plugin up to 3.16.2 on WordPress. Affected is an unknown function. The manipulation leads to authorization bypass. This vulnerability is listed as CVE-2026-16979. The att
CVE-2026-16950 | Product Shortlist Plugin up to 1.0.4 on WordPress sql injection
A vulnerability labeled as critical has been found in Product Shortlist Plugin up to 1.0.4 on WordPress. This impacts an unknown function. Executing a manipulation can lead to sql injection. This vulnerability is tracked as CVE-2026-16950.
CVE-2026-100203 | Microsoft Windows up to Server 2025 Windows Update Service buffer overflow (WID-SEC-2026-3892)
A vulnerability, which was classified as very critical, has been found in Microsoft Windows. This issue affects some unknown processing of the component Windows Update Service. The manipulation leads to buffer overflow. This vulnerability i
CVE-2026-100202 | Microsoft Windows up to Server 2025 Queue Manager use after free (WID-SEC-2026-3892)
A vulnerability was found in Microsoft Windows. It has been rated as very critical. The impacted element is an unknown function of the component Queue Manager. Performing a manipulation results in use after free. This vulnerability was name
CVE-2026-100201 | Microsoft Windows up to Server 2025 Client License Service buffer overflow (WID-SEC-2026-3892)
A vulnerability classified as very critical was found in Microsoft Windows up to Server 2025. This vulnerability affects unknown code of the component Client License Service. Executing a manipulation can lead to buffer overflow. This vulner
CVE-2026-100200 | Microsoft Windows up to Server 2025 Windows Update Service use after free (WID-SEC-2026-3892)
A vulnerability classified as very critical has been found in Microsoft Windows up to Server 2025. This affects an unknown part of the component Windows Update Service. Performing a manipulation results in use after free. This vulnerability
CVE-2026-73974 | Linuxfabrik Monitoring Plugins/Linuxfabrik-lib Testing Helper deb-updates lib.lftest.test information disclosure
A vulnerability labeled as problematic has been found in Linuxfabrik Monitoring Plugins and Linuxfabrik-lib. This impacts the function lib.lftest.test of the file check-plugins/deb-updates/deb-updates of the component Testing Helper. Execut
CVE-2026-70800 | Oracle SDP Number Portability up to 12.2.15 Internal Operations improper authorization
A vulnerability, which was classified as critical, was found in Oracle SDP Number Portability up to 12.2.15. This affects an unknown part of the component Internal Operations. The manipulation results in improper authorization. This vulnera
CVE-2026-70799 | Oracle SDP Number Portability up to 12.2.15 Internal Operations improper authorization
A vulnerability was found in Oracle SDP Number Portability up to 12.2.15 and classified as problematic. This affects an unknown function of the component Internal Operations. Executing a manipulation can lead to improper authorization. This
CVE-2026-70709 | Oracle Agile Engineering Data Management 6.2.1 Engineering Communication Interface privileges management
A vulnerability, which was classified as critical, was found in Oracle Agile Engineering Data Management 6.2.1. Affected by this vulnerability is an unknown functionality of the component Engineering Communication Interface. Such manipulati
CVE-2026-70708 | Oracle Sales Foundation up to 12.2.15 Security API improper authorization
A vulnerability classified as critical has been found in Oracle Sales Foundation up to 12.2.15. Affected by this issue is some unknown functionality of the component Security API. The manipulation leads to improper authorization. This vulne
CVE-2026-62988 | Froxlor up to 2.3.7 API Command Customers.php password/data_2fa weak password hash
A vulnerability, which was classified as problematic, was found in Froxlor up to 2.3.7. Affected by this vulnerability is the function Customers.get/Customers.listing/Admins.get/Admins.listing/Ftps.get/Ftps.listing of the file lib/Froxlor/A
CVE-2026-55593 | Froxlor up to 2.3.7 CSRF Token Validation Ajax.php Ajax::editApiKey cross-site request forgery
A vulnerability was found in Froxlor up to 2.3.7 and classified as problematic. Impacted is the function Ajax::editApiKey of the file lib/Froxlor/Ajax/Ajax.php of the component CSRF Token Validation. Executing a manipulation can lead to cro
CVE-2026-54543 | Froxlor up to 2.3.7 API Command DomainZones.php DomainZones.add record/type injection
A vulnerability classified as problematic has been found in Froxlor up to 2.3.7. This affects the function DomainZones.add of the file lib/Froxlor/Api/Commands/DomainZones.php of the component API Command. Performing a manipulation of the a
CVE-2026-54348 | Froxlor up to 2.3.7 API Command Handlers Admins.php ipaddress sql injection
A vulnerability, which was classified as problematic, has been found in Froxlor up to 2.3.7. Affected is an unknown function of the file lib/Froxlor/Api/Commands/Admins.php of the component API Command Handlers. The manipulation of the argu
CVE-2026-54347 | Froxlor up to 2.3.7 DNS TXT Record DomainZones.php Text::wordwrap cross site scripting
A vulnerability classified as problematic was found in Froxlor up to 2.3.7. This impacts the function Text::wordwrap of the file lib/Froxlor/Api/Commands/DomainZones.php of the component DNS TXT Record Handler. Executing a manipulation can
CVE-2026-48796 | CefSharp up to 148.0.89 FolderSchemeHandlerFactory FolderSchemeHandlerFactory.cs filePath.StartsWith path traversal
A vulnerability marked as problematic has been reported in CefSharp up to 148.0.89. This affects the function filePath.StartsWith of the file CefSharp/SchemeHandler/FolderSchemeHandlerFactory.cs of the component FolderSchemeHandlerFactory.
CVE-2026-21580 | Atlassian Confluence Data Center/Confluence Server cross site scripting
A vulnerability identified as problematic has been detected in Atlassian Confluence Data Center and Confluence Server. This impacts an unknown function. The manipulation leads to cross site scripting. This vulnerability is listed as CVE-202
CVE-2026-112314 | Red Hat Enterprise Linux RPC Client lib/rpc/clnt_tcp.c clnttcp_call memory leak (Nessus ID 377875)
A vulnerability identified as critical has been detected in Red Hat Enterprise Linux. This issue affects the function clnttcp_call of the file lib/rpc/clnt_tcp.c of the component RPC Client. Performing a manipulation results in memory leak.
CVE-2026-112323 | Red Hat Enterprise Linux 1.5.2 AUTH_GSSAPI handler svc_auth_gssapi.c memory allocation (Nessus ID 377876)
A vulnerability, which was classified as critical, has been found in Red Hat Enterprise Linux 1.5.2. The impacted element is an unknown function of the file lib/rpc/svc_auth_gssapi.c of the component AUTH_GSSAPI handler. This manipulation c