Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 739 | 0,2 % |
| ≥50 % | 3.222 | 0,8 % |
| ≥10 % | 22.086 | 5,8 % |
| <10 % | 354.682 | 93,2 % |
Critical GoAhead Vulnerability Lets Attackers Authenticate Using Revoked Certificates
A critical vulnerability in GoAhead’s OpenSSL integration lets attackers with revoked client credentials complete mutual TLS authentication and retain access tied to those identities. Tracked as CVE-2026-115881 and GOAHEAD-SA-2026-0006, the
Critical UEFI Firmware Flaw Allows Attackers to Execute Code Before Windows or Linux Boots
A critical vulnerability in EDK II’s PXE network boot implementation could let unauthenticated attackers run arbitrary code before Windows or Linux loads. Tracked as CVE-2026-97631, the flaw affects ICMP error handling in the NetworkPkg PXE
Siemens Software Center wird zum Einfallstor für Schadcode
Siemens meldet aktive Angriffe auf das Software Center. Dafür brauchen Angreifer lokalen Zugriff und hohe Rechte, dennoch ist der Schweregrad hoch. Updates, Indicators of Compromise und Empfehlungen stehen bereit. (Bild: © Celt Studio - sto
Sweet Security Offers All Organizations Affected by HTTP2Shell Virtual Patching Protection at No Cost
New York, NY, October 27th, 2026, CyberNewswire The root-cause fix will take weeks; protection can’t wait Sweet Security today announced Sweet Safety Net, extending its runtime Virtual Patching protection to every organization affected by H
CVE-2026-5259 | AutohomeCorp frostmourne up to 1.0 Alarm Preview AlarmController.java server-side request forgery
A vulnerability labeled as critical has been found in AutohomeCorp frostmourne up to 1.0. The affected element is an unknown function of the file frostmourne-monitor/src/main/java/com/autohome/frostmourne/monitor/controller/AlarmController.
CVE-2026-5257 | code-projects Simple Laundry System 1.0 Parameter /delstaffinfo.php userid sql injection
A vulnerability categorized as critical has been discovered in code-projects Simple Laundry System 1.0. This issue affects some unknown processing of the file /delstaffinfo.php of the component Parameter Handler. Such manipulation of the ar
CVE-2026-5256 | code-projects Simple Laundry System 1.0 Parameter /modify.php firstName sql injection
A vulnerability was found in code-projects Simple Laundry System 1.0. It has been rated as critical. This vulnerability affects unknown code of the file /modify.php of the component Parameter Handler. This manipulation of the argument first
CVE-2026-27101 | Dell Secure Connect Gateway up to 5.0/5.28.00.xx/5.32.00.xx path traversal (dsa-2026-020)
A vulnerability was found in Dell Secure Connect Gateway up to 5.0/5.28.00.xx/5.32.00.xx. It has been declared as critical. Impacted is an unknown function. The manipulation results in path traversal. This vulnerability is reported as CVE-2
PHP2Shell: Suspected North Korean campaign targets 216 vulnerable PHP hosts
Cyfirma links PHP2Shell scans of 216 vulnerable hosts to a suspected North Korean campaign using AI to rank public exploits. On October 21, PHP released emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619
CVE-2026-113005 | Google Chrome up to 155.0.8059.84 Bluetooth memory corruption (WID-SEC-2026-4067)
A vulnerability, which was classified as critical, has been found in Google Chrome. The impacted element is an unknown function of the component Bluetooth. This manipulation causes memory corruption. This vulnerability is tracked as CVE-202
CVE-2026-113004 | Google Chrome up to 155.0.8059.84 Sync memory corruption (WID-SEC-2026-4067)
A vulnerability classified as problematic was found in Google Chrome. The affected element is an unknown function of the component Sync. The manipulation results in memory corruption. This vulnerability is identified as CVE-2026-113004. The
CVE-2026-113003 | Google Chrome up to 155.0.8059.84 HID memory corruption (WID-SEC-2026-4067)
A vulnerability classified as critical has been found in Google Chrome. Impacted is an unknown function of the component HID. The manipulation leads to memory corruption. This vulnerability is referenced as CVE-2026-113003. Remote exploitat
CVE-2026-87897 | Nextcloud Whiteboard up to 0.x server-side request forgery (WID-SEC-2026-4185)
A vulnerability was found in Nextcloud Whiteboard up to 0.x. It has been classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to server-side request forgery. This vulnerability is traded as
CVE-2026-113002 | Google Chrome up to 155.0.8059.84 Transactions Platform memory corruption (WID-SEC-2026-4067)
A vulnerability described as critical has been identified in Google Chrome. This issue affects some unknown processing of the component Transactions Platform. Executing a manipulation can lead to memory corruption. The identification of thi
CVE-2026-82986 | Nextcloud Tables up to 1.0.0 Link Sharing permission (WID-SEC-2026-4185)
A vulnerability, which was classified as critical, has been found in Nextcloud Tables up to 1.0.0. Affected by this vulnerability is an unknown functionality of the component Link Sharing. Performing a manipulation results in permission iss
CVE-2026-109999 | AI Marketing Expert Plugin up to 1.2.8 on WordPress Chatbot wp-admin/index.php name cross site scripting (EUVD-2026-111561)
A vulnerability categorized as problematic has been discovered in AI Marketing Expert Plugin up to 1.2.8 on WordPress. Impacted is an unknown function of the file wp-admin/index.php of the component Chatbot Module. Such manipulation of the
CVE-2026-97019 | mohammed_kaludi Amp for Wp Plugin up to 1.1.17 on WordPress Shortcode wp_filter_kses headline-* cross site scripting (EUVD-2026-111562)
A vulnerability classified as problematic was found in mohammed_kaludi Amp for Wp Plugin up to 1.1.17 on WordPress. Affected by this vulnerability is the function wp_filter_kses of the component Shortcode Handler. Such manipulation of the a
CVE-2026-111314 | cservit Affiliate-Toolkit Plugin up to 3.9.2 on WordPress AJAX handler atkp_product_producturl cross site scripting (EUVD-2026-111563)
A vulnerability marked as problematic has been reported in cservit Affiliate-Toolkit Plugin up to 3.9.2 on WordPress. This affects an unknown function of the component AJAX handler. The manipulation of the argument atkp_product_producturl l
CVE-2026-109209 | plugins360 All-in-One Video Gallery Plugin up to 4.9.7 on WordPress Input Sanitization save_meta_data embedcode cross site scripting (EUVD-2026-111564)
A vulnerability classified as problematic has been found in plugins360 All-in-One Video Gallery Plugin up to 4.9.7 on WordPress. Affected is the function save_meta_data of the component Input Sanitization. This manipulation of the argument
CVE-2026-118273 | a2ui-project a2ui up to 0.10.6 data-model.ts DataModel.set resource consumption (Issue 2386 / EUVD-2026-111566)
A vulnerability labeled as problematic has been found in a2ui-project a2ui up to 0.10.6. Affected by this vulnerability is the function DataModel.set of the file renderers/web_core/src/v0_9/state/data-model.ts. Executing a manipulation can
CVE-2026-107745 | tigroumeow AI Engine Plugin up to 3.8.4 on WordPress upload_file unrestricted upload (EUVD-2026-111565)
A vulnerability identified as critical has been detected in tigroumeow AI Engine Plugin up to 3.8.4 on WordPress. The affected element is the function upload_file. Performing a manipulation results in unrestricted upload. This vulnerability
CVE-2026-118274 | a2ui-project a2ui up to 0.10.6 Binder generic-binder.ts resource consumption (Issue 2387 / EUVD-2026-111567)
A vulnerability marked as problematic has been reported in a2ui-project a2ui up to 0.10.6. Affected by this issue is some unknown functionality of the file renderers/web_core/src/v0_9/rendering/generic-binder.ts of the component Binder. The
CVE-2026-118312 | Google Chrome up to 156.0.8078.47 Paint memory corruption (EUVD-2026-111473)
A vulnerability classified as critical was found in Google Chrome. Affected is an unknown function of the component Paint. The manipulation results in memory corruption. This vulnerability is reported as CVE-2026-118312. The attack can be l
CVE-2026-118338 | Google Chrome up to 156.0.8078.47 Animation use after free (EUVD-2026-111474)
A vulnerability has been found in Google Chrome and classified as critical. Impacted is an unknown function of the component Animation. The manipulation leads to use after free. This vulnerability is traded as CVE-2026-118338. It is possibl
CVE-2026-104016 | FasterXML jackson-dataformat-protobuf Protobuf Parser _finishShortText len heap-based overflow (EUVD-2026-111529)
A vulnerability, which was classified as problematic, has been found in FasterXML jackson-dataformat-protobuf. This impacts the function _finishShortText of the component Protobuf Parser. This manipulation of the argument len causes heap-ba
CVE-2026-110747 | FasterXML jackson-dataformat-protobuf ProtobufParser._readStringKey integer overflow (EUVD-2026-111531)
A vulnerability was found in FasterXML jackson-dataformat-protobuf and classified as problematic. Affected by this issue is the function ProtobufParser._readStringKey. Executing a manipulation can lead to integer overflow. This vulnerabilit
CVE-2026-104895 | FasterXML jackson-dataformat-smile Asynchronous Smile Parser _decodeVInt allocation of resources (EUVD-2026-111530)
A vulnerability, which was classified as problematic, was found in FasterXML jackson-dataformat-smile. Affected is the function _decodeVInt of the component Asynchronous Smile Parser. Such manipulation leads to allocation of resources. This
CVE-2026-110879 | FasterXML jackson-databind Generic Argument Validation DatabindContext._resolveAndValidateGeneric deserialization (EUVD-2026-111532)
A vulnerability has been found in FasterXML jackson-databind and classified as critical. Affected by this vulnerability is the function DatabindContext._resolveAndValidateGeneric of the component Generic Argument Validation. Performing a ma
CVE-2026-114255 | oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 User Account Management admin_class.php save_user name/username/password/type/id sql injection (EUVD-2026-107325)
A vulnerability labeled as critical has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This impacts the function save_user of the file admin_class.php of the component User Account Managem
CVE-2026-113798 | Electron up to 42.11.8/43.7.5/44.4.x/45.0.0-alpha.12 PointerLock session.setPermissionRequestHandler isMainFrame cross-domain policy (EUVD-2026-107374)
A vulnerability was found in Electron up to 42.11.8/43.7.5/44.4.x/45.0.0-alpha.12 and classified as problematic. This issue affects the function session.setPermissionRequestHandler of the component PointerLock. The manipulation of the argum
CVE-2026-113790 | py-pdf pypdf up to 6.20.x resource consumption (EUVD-2026-107330)
A vulnerability, which was classified as problematic, has been found in py-pdf pypdf up to 6.20.x. This impacts an unknown function. This manipulation causes resource consumption. This vulnerability appears as CVE-2026-113790. The attack ma
CVE-2026-114258 | oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 File Management files.php fid/id sql injection (EUVD-2026-107390)
A vulnerability classified as critical has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this issue is some unknown functionality of the file files.php of the component File M
CVE-2026-114122 | Electron up to 42.11.5/43.7.2/44.4.2/45.0.0-alpha.8 GPU Process webContents.beginFrameSubscription out-of-bounds (EUVD-2026-107362)
A vulnerability, which was classified as problematic, was found in Electron up to 42.11.5/43.7.2/44.4.2/45.0.0-alpha.8. This affects the function webContents.beginFrameSubscription of the component GPU Process. Executing a manipulation can
CVE-2026-89035 | MikroTik RouterOS up to 7.23.6/7.24.5 WebFig libucrypto.so makeSessionKey authentication replay (EUVD-2026-107400)
A vulnerability was found in MikroTik RouterOS up to 7.23.6/7.24.5. It has been rated as critical. This affects the function makeSessionKey of the file libucrypto.so of the component WebFig. This manipulation causes authentication bypass by
CVE-2026-118271 | a2ui-project a2ui up to 0.10.6 data-context Resolver data-context.ts resource consumption (Issue 2384 / EUVD-2026-111537)
A vulnerability categorized as problematic has been discovered in a2ui-project a2ui up to 0.10.6. This impacts an unknown function of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component data-context Resolver. Suc
CVE-2026-114130 | Nuxt up to 4.5.99 NuxtLink/no-pages router cross site scripting (EUVD-2026-107413)
A vulnerability marked as problematic has been reported in Nuxt up to 4.5.99. The affected element is an unknown function of the component NuxtLink/no-pages router. The manipulation leads to cross site scripting. This vulnerability is refer
CVE-2026-117866 | Mozilla Firefox up to 115.43/153.5/158 Canvas2D use after free (Nessus ID 372630)
A vulnerability was found in Mozilla Firefox up to 115.43/153.5/158. It has been classified as critical. Affected by this vulnerability is an unknown functionality of the component Canvas2D. The manipulation leads to use after free. This vu
CVE-2026-109705 | Mozilla Firefox up to 153.4/157 Networking use after free (Nessus ID 372630)
A vulnerability marked as critical has been reported in Mozilla Firefox up to 153.4/157. This impacts an unknown function of the component Networking. This manipulation causes use after free. This vulnerability is tracked as CVE-2026-109705
CVE-2026-114267 | SourceCodester Food Order Management System 1.0 Admin Endpoint authorization (EUVD-2026-107494)
A vulnerability categorized as critical has been discovered in SourceCodester Food Order Management System 1.0. Affected is an unknown function of the component Admin Endpoint. The manipulation results in missing authorization. This vulnera
CVE-2026-114264 | ProjectWorlds Advanced Library Management System 1.0 edit_member.php firstname/middlename/lastname/address/branch/type sql injection (EUVD-2026-107415)
A vulnerability was found in ProjectWorlds Advanced Library Management System 1.0. It has been classified as problematic. The impacted element is an unknown function of the file edit_member.php. Performing a manipulation of the argument fir
CVE-2026-106013 | Artbees Jupiter X Core Plugin up to 4.61.0 on WordPress Twitter/X Social Login verify_twitter_callback improper authentication (EUVD-2026-111538)
A vulnerability was found in Artbees Jupiter X Core Plugin up to 4.61.0 on WordPress. It has been classified as critical. This affects the function verify_twitter_callback of the component Twitter/X Social Login Handler. The manipulation le
CVE-2026-114438 | Red Hat Keycloak/Single Sign-On Update User Locale improper authorization (EUVD-2026-107540)
A vulnerability, which was classified as critical, has been found in Red Hat Keycloak and Single Sign-On. Affected by this vulnerability is an unknown functionality of the component Update User Locale. The manipulation leads to improper aut
CVE-2026-114139 | getsentry sentry-javascript up to 9.47.1/10.75.1/11.0.0-rc.0 Webpack Integration improper authorization (EUVD-2026-107549)
A vulnerability was found in getsentry sentry-javascript up to 9.47.1/10.75.1/11.0.0-rc.0. It has been declared as critical. Impacted is an unknown function of the component Webpack Integration. Executing a manipulation can lead to improper
CVE-2026-114379 | EKKOLearnAI ekko-studio up to 1.0.6 Media Generation API media.ts saveGeneratedImages output_path file inclusion (Issue 3319 / EUVD-2026-107558)
A vulnerability has been found in EKKOLearnAI ekko-studio up to 1.0.6 and classified as problematic. This vulnerability affects the function saveGeneratedImages of the file packages/server/src/modules/studio/controllers/media.ts of the comp
CVE-2026-5254 | welovemedia FFmate up to 2.0.15 Webhook AppJsonTreeView.vue cross site scripting
A vulnerability was found in welovemedia FFmate up to 2.0.15. It has been classified as problematic. Affected by this issue is some unknown functionality of the file /ui/app/components/AppJsonTreeView.vue of the component Webhook Handler. T
CVE-2026-33994 | locutusjs locutus up to 3.0.24 Query prototype pollution
A vulnerability was found in locutusjs locutus up to 3.0.24. It has been classified as problematic. This affects an unknown function of the component Query Handler. The manipulation leads to improperly controlled modification of object prot
CVE-2026-33993 | locutusjs locutus up to 3.0.24 unserialize prototype pollution
A vulnerability marked as problematic has been reported in locutusjs locutus up to 3.0.24. Affected by this vulnerability is the function unserialize. Performing a manipulation results in improperly controlled modification of object prototy
CVE-2026-33989 | mobile-next mobile-mcp up to 0.0.48 Fileystem Operation saveTo/output path traversal (GHSA-3p2m-h2v6-g9mx)
A vulnerability was found in mobile-next mobile-mcp up to 0.0.48 and classified as critical. The impacted element is the function mobile_save_screenshot/mobile_start_screen_recording of the component Fileystem Operation Handler. Executing a
CVE-2026-77173 | Nextcloud up to 5.0.0 Files Confidential privileges management (WID-SEC-2026-4185)
A vulnerability was found in Nextcloud up to 5.0.0 and classified as problematic. The affected element is an unknown function of the component Files Confidential. Such manipulation leads to improper privilege management. This vulnerability
CVE-2026-77172 | Nextcloud Server up to 34.0.0 privileges management (WID-SEC-2026-4185)
A vulnerability was found in Nextcloud Server up to 34.0.0 and classified as problematic. This vulnerability affects unknown code. The manipulation results in improper privilege management. This vulnerability is reported as CVE-2026-77172.
CVE-2026-77171 | Nextcloud Collectives up to 4.0.0 privileges management (WID-SEC-2026-4185)
A vulnerability classified as problematic has been found in Nextcloud Collectives up to 4.0.0. This impacts an unknown function. This manipulation causes improper privilege management. This vulnerability is tracked as CVE-2026-77171. The at
CVE-2026-77167 | Nextcloud Server up to 34.0.0 Federated Share Endpoint denial of service (WID-SEC-2026-4185)
A vulnerability marked as critical has been reported in Nextcloud Server up to 34.0.0. This issue affects some unknown processing of the component Federated Share Endpoint. Performing a manipulation results in denial of service. This vulner
CVE-2026-67400 | Nextcloud Richdocuments up to 11.0.0 WOPI information disclosure (WID-SEC-2026-4185)
A vulnerability labeled as problematic has been found in Nextcloud Richdocuments up to 11.0.0. The affected element is an unknown function of the component WOPI. Executing a manipulation can lead to information disclosure. The identificatio
CVE-2026-117860 | Mozilla Firefox up to 153.5/158 Navigation cross-domain policy (Nessus ID 372631)
A vulnerability has been found in Mozilla Firefox up to 153.5/158 and classified as problematic. This impacts an unknown function of the component Navigation Component. Performing a manipulation results in permissive cross-domain policy wit
CVE-2026-118177 | Mozilla Thunderbird up to 153.5/158 Calendar Subscription input validation (Nessus ID 372632)
A vulnerability classified as critical has been found in Mozilla Thunderbird up to 153.5/158. This affects an unknown function of the component Calendar Subscription. Performing a manipulation results in improper input validation. This vuln
CVE-2026-118176 | Mozilla Thunderbird up to 153.5/158 Mailbox URL improper authentication (Nessus ID 372632)
A vulnerability was found in Mozilla Thunderbird up to 153.5/158. It has been rated as problematic. This affects an unknown part of the component Mailbox URL Handler. Performing a manipulation results in improper authentication. This vulner
CVE-2026-118175 | Mozilla Thunderbird up to 153.5/158 information disclosure (Nessus ID 372632)
A vulnerability identified as problematic has been detected in Mozilla Thunderbird up to 153.5/158. This issue affects some unknown processing. The manipulation leads to information disclosure. This vulnerability is documented as CVE-2026-1
CVE-2026-118174 | Mozilla Thunderbird up to 153.5/158 OpenPGP information disclosure (Nessus ID 372632)
A vulnerability, which was classified as problematic, was found in Mozilla Thunderbird up to 153.5/158. This affects an unknown function of the component OpenPGP. Executing a manipulation can lead to information disclosure. The identificati
CVE-2026-34046 | langflow-ai langflow up to 1.5.0 flows.py _read_flow authorization (GHSA-8c4j-f57c-35cf)
A vulnerability classified as critical was found in langflow-ai langflow up to 1.5.0. Impacted is the function _read_flow of the file src/backend/base/langflow/api/v1/flows.py. The manipulation results in authorization bypass. This vulnerab
CVE-2026-33907 | ellanetworks core up to 1.6.x null pointer dereference (GHSA-55q8-2gwx-29pc)
A vulnerability was found in ellanetworks core up to 1.6.x. It has been classified as problematic. This affects an unknown part. This manipulation causes null pointer dereference. This vulnerability is tracked as CVE-2026-33907. The attack