Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 733 | 0,2 % |
| ≥50 % | 3.220 | 0,8 % |
| ≥10 % | 22.112 | 5,8 % |
| <10 % | 353.806 | 93,1 % |
Brotli bug reaches far beyond Node.js (CVE-2026-111497)
A vulnerability in Brotli, Google’s widely used open-source compression library, is putting a broad range of software at risk. About CVE-2026-111497 Alternatively known as “Node2Shell”, “Broccoli2Shell” and “Brotli2Shell”, CVE-2026-111497 i
IT Security News Hourly Summary 2026-10-27 19h : 23 posts
23 posts published in the last hour 17:46CVE-2026-89065 and CVE-2026-89066: Issue with projen – Path traversal and OS command injection 17:46CVE-2026-89049 – Server-side request forgery in the Session Manager port forwarding functionality i
CVE-2025-63448 | Water Management System 1.0 /edit_product.php cross site scripting
A vulnerability was found in Water Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /edit_product.php. Such manipulation leads to cross site scripting. This vulnerability is lis
CVE-2025-63418 | SelfBest Platform 2023.3 cross site scripting
A vulnerability described as problematic has been identified in SelfBest Platform 2023.3. This affects an unknown part. Such manipulation leads to cross site scripting. This vulnerability is uniquely identified as CVE-2025-63418. The attack
CVE-2025-63417 | SelfBest Platform 2023.3 Chat Message cross site scripting
A vulnerability marked as problematic has been reported in SelfBest Platform 2023.3. Affected by this issue is some unknown functionality of the component Chat Message Handler. This manipulation causes cross site scripting. This vulnerabili
CVE-2025-63334 | PocketVJ CP PocketVJ-CP-v3 pvj 3.9.1 POST Parameter submit_opacity.php opacityValue os command injection
A vulnerability categorized as critical has been discovered in PocketVJ CP PocketVJ-CP-v3 pvj 3.9.1. Affected by this issue is some unknown functionality of the file submit_opacity.php of the component POST Parameter Handler. The manipulati
CVE-2025-60925 | codeshare 1.0.0 information disclosure
A vulnerability categorized as problematic has been discovered in codeshare 1.0.0. This issue affects some unknown processing. Executing a manipulation can lead to information disclosure. This vulnerability is tracked as CVE-2025-60925. The
CVE-2025-54335 | Samsung Mobile Processor Exynos 1480/1580/2400/2500 GPU Driver use after free
A vulnerability marked as critical has been reported in Samsung Mobile Processor Exynos 1480/1580/2400/2500. Affected is an unknown function of the component GPU Driver. Performing a manipulation results in use after free. This vulnerabilit
CVE-2025-52910 | Samsung Mobile Processor/Wearable Processor Exynos up to 2400 GPU use after free
A vulnerability labeled as critical has been found in Samsung Mobile Processor and Wearable Processor Exynos up to 2400. This impacts an unknown function of the component GPU. Such manipulation leads to use after free. This vulnerability is
CVE-2025-50363 | PHPGurukul Maid Hiring Management System 1.0 /maid-hiring.php name cross site scripting
A vulnerability classified as problematic has been found in PHPGurukul Maid Hiring Management System 1.0. Affected is an unknown function of the file /maid-hiring.php. Performing a manipulation of the argument Name results in cross site scr
CVE-2025-61498 | Tenda AC8 03.03.10.01 UPnP Service buffer overflow
A vulnerability marked as critical has been reported in Tenda AC8 03.03.10.01. The affected element is an unknown function of the component UPnP Service. The manipulation leads to buffer overflow. This vulnerability is uniquely identified a
CVE-2025-61196 | BusinessNext CRMnext 10.8.3.0 code injection (EUVD-2025-37045)
A vulnerability was found in BusinessNext CRMnext 10.8.3.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to code injection. This vulnerability is handled as
CVE-2025-60749 | Trimble SketchUp Desktop 2025 sketchup_webhelper.exe uncontrolled search path
A vulnerability has been found in Trimble SketchUp Desktop 2025 and classified as problematic. This impacts an unknown function in the library libcef.dll of the file sketchup_webhelper.exe. This manipulation causes uncontrolled search path.
CVE-2025-60355 | zhangyd-c OneBlog up to 2.3.8 FreeMarker Template special elements in template engine
A vulnerability identified as problematic has been detected in zhangyd-c OneBlog up to 2.3.8. The affected element is an unknown function of the component FreeMarker Template Handler. This manipulation causes improper neutralization of spec
CVE-2025-60319 | PerfreeBlog 4.0.11 API Endpoint AttachController.java uploadAttachByUrl authorization
A vulnerability identified as problematic has been detected in PerfreeBlog 4.0.11. Affected by this vulnerability is the function uploadAttachByUrl of the file AttachController.java of the component API Endpoint. The manipulation leads to m
CVE-2024-38564 | Linux Kernel up to 6.6.32/6.8.11/6.9.2 bpf type confusion (Nessus ID 209785 / WID-SEC-2024-1418)
A vulnerability was found in Linux Kernel up to 6.6.32/6.8.11/6.9.2. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component bpf. The manipulation results in type confusion. This vuln
Nintendo Switch 2: Hacker finden schwerwiegende Sicherheitslücke - ingame.de
Mithilfe eines manipulierten Spielstandes und anderen Methoden sind Hacker nun unter der neuesten Firmware 23.0.1 in der Lage, Inhalte der Konsole zu ... Weiterlesen
CVE-2026-118129 | jeremyckahn Chitchatter up to f82538633813c854a81a8b2112a2f6ba17b39cbc PostMessage src/Bootstrap.tsx isConfigMessageEvent parentDomain improper authentication
A vulnerability was found in jeremyckahn Chitchatter up to f82538633813c854a81a8b2112a2f6ba17b39cbc. It has been rated as critical. The affected element is the function isConfigMessageEvent of the file src/Bootstrap.tsx of the component Pos
CVE-2026-35273: SSRF to RCE in Oracle PeopleSoft
On September 25, 2026, Mandiant released a report regarding continued mass exploitation of CVE-2026-35273 by the ShinyHunters group. TrendAI’s Zero Day Initiative first reported this CVE to Oracle on June 10, 2026, following an investigatio
Ruby Regexp CVEs: alt-ruby Updates for CloudLinux (CVE-2026-97229 and 3 Others)
📋 TL;DR: last updated 2026-10-27 16:05 UTCRuby fixed four memory-corruption bugs in its regular expression engine in versions 4.0.9, 3.4.12, and 3.3.13, published October 23, 2026. The bugs are reached only when an application compiles a re
CVE-2025-62396 | Moodle Router r.php exposure of information through directory listing (EUVD-2025-35671 / Nessus ID 276840)
A vulnerability classified as problematic was found in Moodle. This impacts an unknown function of the file r.php of the component Router. Such manipulation leads to exposure of information through directory listing. This vulnerability is u
CVE-2025-61035 | seffaflik up to 0.0.9 permission
A vulnerability marked as critical has been reported in seffaflik up to 0.0.9. Affected by this vulnerability is an unknown functionality. The manipulation leads to permission issues. This vulnerability is uniquely identified as CVE-2025-61
CVE-2025-60424 | Nagios Fusion 2024R1.2/2024R2 OTP Verification excessive authentication
A vulnerability described as problematic has been identified in Nagios Fusion 2024R1.2/2024R2. This vulnerability affects unknown code of the component OTP Verification. Such manipulation leads to improper restriction of excessive authentic
CVE-2025-60335 | TOTOLINK N600R 4.3.0cu.7866_B20220506 null pointer dereference
A vulnerability was found in TOTOLINK N600R 4.3.0cu.7866_B20220506. It has been rated as critical. Affected is an unknown function. Performing a manipulation results in null pointer dereference. This vulnerability is reported as CVE-2025-60
CVE-2025-52079 | D-Link DIR-820L 1.06B02 POST /get_set.ccp unverified password change
A vulnerability was found in D-Link DIR-820L 1.06B02. It has been rated as critical. This impacts an unknown function of the file /get_set.ccp of the component POST Handler. Performing a manipulation results in unverified password change. T
CVE-2025-50950 | Audiofile 0.3.7 ModuleState::setup null pointer dereference (Nessus ID 271717 / WID-SEC-2025-2882)
A vulnerability has been found in Audiofile 0.3.7 and classified as problematic. Impacted is the function ModuleState::setup. The manipulation leads to null pointer dereference. This vulnerability is referenced as CVE-2025-50950. The attack
CVE-2026-6653 reaches further than the libxml2 package name
CVE-2026-6653 reaches further than the libxml2 package name The advisory for CVE-2026-6653 names one upstream project, but the affected list is a map of downstream products. Anyone responsible for patching should read that list before assum
CVE-2026-108359 | PHPOffice PhpSpreadsheet up to 5.9.x Ods Reader Ods.php Ods::processTableRow resource consumption (EUVD-2026-108267)
A vulnerability described as problematic has been identified in PHPOffice PhpSpreadsheet up to 1.30.6/2.1.18/2.4.7/3.10.7/5.9.x. This impacts the function Ods::processTableRow of the file src/PhpSpreadsheet/Reader/Ods.php of the component O
CVE-2026-114619 | Authlib up to 1.8.x Implicit Grant implicit.py improper authorization (EUVD-2026-108521)
A vulnerability was found in Authlib up to 1.8.x and classified as problematic. This issue affects the function OpenIDImplicitGrant.validate_authorization_request of the file authlib/oidc/core/grants/implicit.py of the component Implicit Gr
CVE-2026-114615 | Authlib up to 1.8.x OctKey oct_key.py OctKey.import_key improper authentication (EUVD-2026-108514)
A vulnerability was found in Authlib up to 1.8.x. It has been rated as critical. This issue affects the function OctKey.import_key of the file authlib/jose/rfc7518/oct_key.py of the component OctKey. The manipulation leads to improper authe
CVE-2026-108360 | PHPOffice PhpSpreadsheet up to 5.9.x Image URL Validation setPath server-side request forgery (EUVD-2026-108264)
A vulnerability was found in PHPOffice PhpSpreadsheet up to 1.30.6/2.1.18/2.4.7/3.10.7/5.9.x. It has been classified as problematic. This affects the function Worksheet\Drawing::setPath of the component Image URL Validation. The manipulatio
CVE-2026-114618 | Authlib up to 1.8.x JWT Bearer Grant JWTBearerGrant.get_audiences improper authorization (EUVD-2026-108520)
A vulnerability was found in Authlib up to 1.8.x. It has been declared as critical. The affected element is the function JWTBearerGrant.get_audiences of the component JWT Bearer Grant. The manipulation results in improper authorization. Thi
CVE-2026-114617 | Authlib up to 1.8.x OpenID Connect sync_openid.py OpenIDMixin.parse_id_token authentication replay (EUVD-2026-108519)
A vulnerability was found in Authlib up to 1.8.x. It has been classified as critical. Impacted is the function OpenIDMixin.parse_id_token of the file authlib/integrations/base_client/sync_openid.py of the component OpenID Connect. The manip
CVE-2026-117510 | Dexmal Dexbotic up to 0.2.0 gr00tsonic Checkpoint Loader gr00tsonic_arch.py load_pretrained_gr00t weight_map path traversal (Issue 103 / EUVD-2026-111084)
A vulnerability was found in Dexmal Dexbotic up to 0.2.0. It has been classified as critical. Affected by this vulnerability is the function load_pretrained_gr00t of the file dexbotic/model/gr00tsonic/gr00tsonic_arch.py of the component gr0
CVE-2026-109823 | Tidewave AI up to 0.9.1 Host Header Validation cross-domain policy (EUVD-2026-111085)
A vulnerability has been found in Tidewave AI Tidewave up to 0.9.1 and classified as problematic. This issue affects some unknown processing of the component Host Header Validation. The manipulation leads to permissive cross-domain policy w
CVE-2026-110839 | FreeRDP up to 3.31.x JPEG Conversion winpr_convert_from_jpeg heap-based overflow (Nessus ID 372227)
A vulnerability categorized as problematic has been discovered in FreeRDP up to 3.31.x. Impacted is the function winpr_convert_from_jpeg of the component JPEG Conversion. The manipulation results in heap-based buffer overflow. This vulnerab
CVE-2026-111379 | FreeRDP up to 3.31.x Persistent Cache persistent_cache_read_entry_v3 width/height heap-based overflow (Nessus ID 372227)
A vulnerability, which was classified as problematic, was found in FreeRDP up to 3.31.x. This affects the function persistent_cache_read_entry_v3 of the component Persistent Cache. The manipulation of the argument width/height results in he
CVE-2026-76957 | Libexpat up to 2.8.3 use after free (Nessus ID 372240 / WID-SEC-2026-2930)
A vulnerability, which was classified as critical, has been found in Libexpat up to 2.8.3. The affected element is an unknown function. Performing a manipulation results in use after free. This vulnerability is reported as CVE-2026-76957. T
CVE-2026-118008 | Mozilla Firefox up to 158 Navigation privileges management (EUVD-2026-110906)
A vulnerability identified as critical has been detected in Mozilla Firefox up to 158. Affected by this issue is some unknown functionality of the component Navigation Component. The manipulation leads to improper privilege management. This
CVE-2026-117976 | Mozilla Firefox up to 153.5/158 Navigation isolation (EUVD-2026-111007)
A vulnerability marked as critical has been reported in Mozilla Firefox up to 153.5/158. This affects an unknown function of the component Navigation. Performing a manipulation results in improper isolation or compartmentalization. This vul
CVE-2026-117505 | a2aproject a2a-java up to 1.2.0.Final ChildQueue queue.offer resource consumption (ID 1040 / EUVD-2026-110927)
A vulnerability, which was classified as problematic, has been found in a2aproject a2a-java up to 1.2.0.Final. The impacted element is the function queue.offer of the component ChildQueue. Performing a manipulation results in resource consu
CVE-2026-117999 | Mozilla Firefox up to 153.5/158 IPC race condition (EUVD-2026-110898)
A vulnerability was found in Mozilla Firefox up to 153.5/158. It has been classified as critical. This affects an unknown function of the component IPC. This manipulation causes race condition. The identification of this vulnerability is CV
CVE-2026-117604 | Getgrav Grav up to 1.7.53.5 Debugger isDebuggerRequestAuthorized authorization (EUVD-2026-110928)
A vulnerability categorized as problematic has been discovered in Getgrav Grav. This affects the function Debugger::isDebuggerRequestAuthorized of the component Debugger. Such manipulation leads to authorization bypass. This vulnerability i
CVE-2026-114609 | py-pdf fpdf2 up to 2.8.7 Shared Image Loader FPDF.image/FPDF.write_html server-side request forgery (EUVD-2026-108261)
A vulnerability was found in py-pdf fpdf2 up to 2.8.7. It has been rated as problematic. This issue affects the function FPDF.image/FPDF.write_html of the component Shared Image Loader. This manipulation causes server-side request forgery.
CVE-2026-117506 | a2aproject a2a-java up to 1.2.0.Final Push Notification Config Store JpaDatabasePushNotificationConfigStore.java InMemoryPushNotificationConfigStore.setInfo resource consumption (ID 1044 / EUVD-2026-110929)
A vulnerability, which was classified as problematic, was found in a2aproject a2a-java up to 1.2.0.Final. This affects the function InMemoryPushNotificationConfigStore.setInfo of the file... Weiterlesen
CVE-2026-28167 | Super Forms Plugin up to 6.3.315 on WordPress information disclosure (EUVD-2026-64796 / CNNVD-2026-96785795)
A vulnerability identified as problematic has been detected in Super Forms Plugin up to 6.3.315 on WordPress. Impacted is an unknown function. Performing a manipulation results in information disclosure. This vulnerability is identified as
CVE-2026-109242 | FreeRDP up to 2.x/3.31.x Tile Rendering out-of-bounds (Nessus ID 372241)
A vulnerability identified as critical has been detected in FreeRDP up to 2.x/3.31.x. Affected by this vulnerability is an unknown functionality of the component Tile Rendering. The manipulation leads to out-of-bounds read. This vulnerabili
CVE-2026-111377 | FreeRDP up to 3.31.x Static Virtual Channel WTSProcessChannelData resource consumption (Nessus ID 372241)
A vulnerability, which was classified as problematic, has been found in FreeRDP up to 3.31.x. This impacts the function WTSProcessChannelData of the component Static Virtual Channel. Performing a manipulation results in resource consumption
CVE-2026-110838 | FreeRDP up to 3.31.x Shadow Server injection (Nessus ID 372241)
A vulnerability was found in FreeRDP up to 3.31.x. It has been rated as problematic. This issue affects some unknown processing of the component Shadow Server. The manipulation leads to injection. This vulnerability is listed as CVE-2026-11
CVE-2026-111378 | FreeRDP up to 3.31.x NLA Parsing parse_nla_mode_pdu resource consumption (Nessus ID 372241)
A vulnerability was found in FreeRDP up to 3.31.x. It has been classified as problematic. This affects the function parse_nla_mode_pdu of the component NLA Parsing. This manipulation causes resource consumption. This vulnerability is tracke
CVE-2026-83366 | Oracle Shipping Execution up to 12.2.15 Workflow Events access control (EUVD-2026-106286)
A vulnerability, which was classified as critical, has been found in Oracle Shipping Execution up to 12.2.15. The affected element is an unknown function of the component Workflow Events. Performing a manipulation results in improper access
CVE-2026-90727 | Dell PowerProtect Data Domain up to 8.8 path traversal (EUVD-2026-110858)
A vulnerability described as problematic has been identified in Dell PowerProtect Data Domain up to 8.8. This issue affects some unknown processing. Executing a manipulation can lead to path traversal. This vulnerability is tracked as CVE-2
CVE-2026-90726 | Dell PowerProtect Data Domain up to 8.6.1.20 path traversal (EUVD-2026-110859)
A vulnerability labeled as problematic has been found in Dell PowerProtect Data Domain up to 7.7.1.0/8.8/7.13.1.80/8.3.1.40/8.6.1.20. This affects an unknown part. Such manipulation leads to path traversal. This vulnerability is referenced
CVE-2026-83377 | Oracle HRMS up to 12.2.15 Mobile Applications privileges management (EUVD-2026-106295)
A vulnerability marked as problematic has been reported in Oracle HRMS up to 12.2.15. Impacted is an unknown function of the component Mobile Applications. This manipulation causes improper privilege management. This vulnerability is tracke
CVE-2026-113718 | pypa virtualenv up to 21.14.8 Xonsh Activation activate.xsh quote XONSH_ENCODING encoding error (EUVD-2026-105299)
A vulnerability labeled as problematic has been found in pypa virtualenv up to 21.14.8. The affected element is the function quote of the file activate.xsh of the component Xonsh Activation. Such manipulation of the argument XONSH_ENCODING
CVE-2026-113713 | pypa virtualenv up to 21.14.9 App-Data Seeder state issue (EUVD-2026-105259)
A vulnerability, which was classified as problematic, has been found in pypa virtualenv up to 21.14.9. This affects an unknown function of the component App-Data Seeder. The manipulation leads to state issue. This vulnerability is traded as
CVE-2026-111382 | FreeRDP up to 3.31.x RDPGFX general_LumaToYUV444 out-of-bounds write (Nessus ID 372241)
A vulnerability was found in FreeRDP up to 3.31.x. It has been declared as critical. This vulnerability affects the function general_LumaToYUV444 of the component RDPGFX. Such manipulation leads to out-of-bounds write. This vulnerability is
CVE-2026-111381 | FreeRDP up to 3.31.x Persistent Cache persistent_cache_read_entry_v2 height heap-based overflow (Nessus ID 372241)
A vulnerability, which was classified as problematic, has been found in FreeRDP up to 3.31.x. Affected by this issue is the function persistent_cache_read_entry_v2 of the component Persistent Cache. The manipulation of the argument height l
CVE-2026-103263 | TornadoWeb Tornado up to 6.5.8 StaticFileHandler path traversal (Nessus ID 372243)
A vulnerability was found in TornadoWeb Tornado up to 6.5.8. It has been declared as problematic. Affected by this issue is the function StaticFileHandler. Executing a manipulation can lead to path traversal. This vulnerability is registere
CVE-2026-100236 | Red Hat Enterprise Linux GSO Library integer overflow (Nessus ID 372250)
A vulnerability, which was classified as very critical, was found in Red Hat Enterprise Linux, Fast Datapath, OpenShift Container Platform and OpenStack Platform. The impacted element is an unknown function of the component GSO Library. Suc