Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | 2026-09-19 | 2026-10-03 |
|---|---|---|
| ≥90 % | 538 | 364 |
| ≥50 % | 1603 | 1115 |
| ≥10 % | 17 | 3 |
| <10 % | 56400 | 485 |
Citrix NetScaler Appliances Reboot Repeatedly After 0-Day Security Update
Citrix NetScaler administrators report repeated appliance crashes and forced reboots after deploying emergency updates for recently disclosed zero-day vulnerabilities, with the disruption now linked to a newly observed issue affecting SAML
CVE-2025-62583 | NAVER Whale Browser up to 4.32.315.22 iFrame Sandbox security check
A vulnerability, which was classified as problematic, was found in NAVER Whale Browser up to 4.32.315.22. The impacted element is an unknown function of the component iFrame Sandbox Handler. The manipulation results in security check for st
CVE-2025-62371 | opensearch-project data-prepper up to 2.12.1 certificate validation
A vulnerability was found in opensearch-project data-prepper up to 2.12.1. It has been classified as critical. Affected by this issue is some unknown functionality. Performing a manipulation results in improper certificate validation. This
CVE-2025-58426 | NEOJAPAN desknets NEO up to 9.0R2.0 hard-coded key
A vulnerability, which was classified as problematic, has been found in NEOJAPAN desknets NEO up to 9.0R2.0. Affected by this issue is some unknown functionality. Performing a manipulation results in use of hard-coded cryptographic key . Th
CVE-2025-34253 | D-Link Nuclias Connect up to 1.3.1.4 Network cross site scripting (EUVD-2025-34830)
A vulnerability identified as problematic has been detected in D-Link Nuclias Connect up to 1.3.1.4. Impacted is an unknown function. The manipulation of the argument Network leads to cross site scripting. This vulnerability is listed as CV
CVE-2025-62672 | boyns rplay up to 3.3.2 librplay/rplay.c RPLAY_DATA allocation of resources (EUVD-2025-35001 / Nessus ID 271680)
A vulnerability categorized as problematic has been discovered in boyns rplay up to 3.3.2. Affected by this issue is the function RPLAY_DATA of the file librplay/rplay.c. The manipulation results in allocation of resources. This vulnerabili
CVE-2025-59557 | ThemeMove Learts Addons Plugin up to 1.7.5 on WordPress sql injection
A vulnerability classified as critical has been found in ThemeMove Learts Addons Plugin up to 1.7.5 on WordPress. Affected by this vulnerability is an unknown functionality. This manipulation causes sql injection. This vulnerability is hand
CVE-2025-59006 | themebon Easy Woocommerce Customizer Plugin up to 1.0.2 on WordPress cross site scripting
A vulnerability has been found in themebon Easy Woocommerce Customizer Plugin up to 1.0.2 on WordPress and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross site scripting. This vulnerabi
CVE-2025-53067 | Oracle MySQL Server up to 9.4.0 Optimizer denial of service (Nessus ID 276863 / WID-SEC-2025-2363)
A vulnerability classified as problematic has been found in Oracle MySQL Server up to 9.4.0. The affected element is an unknown function of the component Optimizer. Performing a manipulation results in denial of service. This vulnerability
CVE-2025-49940 | ThemeFusion Fusion Builder Plugin up to 3.13.2 on WordPress cross site scripting
A vulnerability, which was classified as problematic, was found in ThemeFusion Fusion Builder Plugin up to 3.13.2 on WordPress. This issue affects some unknown processing. The manipulation results in cross site scripting. This vulnerability
CVE-2024-58274 | Hikvision CSMP iSecure Center up to 2024-08-01 detection os command injection (EUVD-2024-55040 / CNNVD-202510-3181)
A vulnerability categorized as critical has been discovered in Hikvision CSMP iSecure Center up to 2024-08-01. This vulnerability affects unknown code of the file /center/api/installation/detection. Such manipulation leads to os command inj
CVE-2024-42192 | HCL Traveler for Microsoft Outlook 3.0.14 insufficiently protected credentials (KB0124066)
A vulnerability classified as problematic has been found in HCL Traveler for Microsoft Outlook 3.0.14. This impacts an unknown function. Performing a manipulation results in insufficiently protected credentials. This vulnerability is report
CVE-2024-31573 | xmlunit-core prior 2.10.0 XSLT Stylesheet Parser resource transfer (EUVD-2024-1578 / Nessus ID 271645)
A vulnerability categorized as problematic has been discovered in xmlunit-core. This impacts an unknown function of the component XSLT Stylesheet Parser. The manipulation results in incorrect resource transfer. This vulnerability was named
CVE-2025-59497 | Microsoft Defender for Endpoint on Linux toctou (EUVD-2025-34266)
A vulnerability classified as critical was found in Microsoft Defender for Endpoint on Linux. Affected by this vulnerability is an unknown functionality. The manipulation results in time-of-check time-of-use. This vulnerability is reported
CVE-2025-42939 | SAP S4HANA 4CORE 104 up to 108 Manage Processing Rules authorization (EUVD-2025-34118 / CNNVD-202510-2076)
A vulnerability marked as critical has been reported in SAP S4HANA 4CORE 104 up to 108. Impacted is an unknown function of the component Manage Processing Rules. The manipulation leads to incorrect authorization. This vulnerability is uniqu
CVE-2025-40755 | Siemens SINEC NMS up to 4.0 Endpoint getTotalAndFilterCounts sql injection (ssa-318832)
A vulnerability, which was classified as critical, has been found in Siemens SINEC NMS up to 4.0. The impacted element is the function getTotalAndFilterCounts of the component Endpoint. Performing a manipulation results in sql injection. Th
CVE-2025-37147 | HPE ArubaOS up to 10.7.1.1 Secure Boot authentication spoofing
A vulnerability identified as critical has been detected in HPE ArubaOS up to 8.10.0.18/8.12.0.5/8.13.0.1/10.4.1.8/10.7.1.1. This impacts an unknown function of the component Secure Boot. Performing a manipulation results in authentication
CVE-2025-37138 | HPE ArubaOS up to 10.7.1.1 Command Line Interface command injection
A vulnerability identified as critical has been detected in HPE ArubaOS up to 8.10.0.18/8.12.0.5/8.13.0.1/10.4.1.8/10.7.1.1. Affected by this issue is some unknown functionality of the component Command Line Interface. The manipulation lead
CVE-2025-20717 | MediaTek MT7986 WLAN AP Driver stack-based overflow
A vulnerability marked as critical has been reported in MediaTek MT6890, MT7615, MT7622, MT7663, MT7915, MT7916, MT7981 and MT7986. The affected element is an unknown function of the component WLAN AP Driver. This manipulation causes stack-
CVE-2025-11720 | Mozilla Firefox up to 143 on Android Focus UI ui layer (WID-SEC-2025-2275)
A vulnerability classified as problematic has been found in Mozilla Firefox up to 143 on Android. This vulnerability affects unknown code of the component Focus UI. This manipulation causes improper restriction of rendered ui layers. This v
CVE-2025-11718 | Mozilla Firefox up to 143 on Android Address Bar clickjacking (WID-SEC-2025-2275)
A vulnerability, which was classified as problematic, was found in Mozilla Firefox up to 143 on Android. The affected element is an unknown function of the component Address Bar. Executing a manipulation can lead to clickjacking. This vulne
CVE-2025-11717 | Mozilla Firefox up to 143 on Android denial of service (WID-SEC-2025-2275)
A vulnerability, which was classified as problematic, has been found in Mozilla Firefox up to 143 on Android. Impacted is an unknown function. Performing a manipulation results in denial of service. This vulnerability is known as CVE-2025-1
CVE-2025-10242 | Ivanti Endpoint Manager Mobile prior 12.4.0.4/12.5.0.4/12.6.0.2 os command injection (EUVD-2025-34213 / Nessus ID 270691)
A vulnerability categorized as critical has been discovered in Ivanti Endpoint Manager Mobile. This issue affects some unknown processing. The manipulation results in os command injection. This vulnerability is identified as CVE-2025-10242.
CVE-2025-9713 | Ivanti Endpoint Manager path traversal (EUVD-2025-34088 / Nessus ID 275450)
A vulnerability, which was classified as critical, was found in Ivanti Endpoint Manager. Affected is an unknown function. Executing a manipulation can lead to path traversal. This vulnerability is tracked as CVE-2025-9713. The attack can be
CVE-2025-9626 | Page Blocks Plugin up to 1.1.0 on WordPress admin_process_widget_page_change cross-site request forgery (EUVD-2025-33848)
A vulnerability classified as problematic was found in Page Blocks Plugin up to 1.1.0 on WordPress. Affected by this vulnerability is the function admin_process_widget_page_change. The manipulation results in cross-site request forgery. Thi
CVE-2025-8593 | GSheetConnector for Gravity Forms Plugin up to 1.3.27 on WordPress Plugin Installation install_plugin authorization (EUVD-2025-33844)
A vulnerability classified as critical has been found in GSheetConnector for Gravity Forms Plugin up to 1.3.27 on WordPress. The impacted element is the function install_plugin of the component Plugin Installation Handler. Performing a mani
CVE-2025-37729 | Elastic Cloud Enterprise up to 3.8.1/4.0.1 Template Engine special elements in template engine (EUVD-2025-34069)
A vulnerability has been found in Elastic Cloud Enterprise up to 3.8.1/4.0.1 and classified as problematic. This affects an unknown part of the component Template Engine. The manipulation leads to improper neutralization of special elements
CVE-2025-31995 | HCL MaxAI Workbench input validation (KB0124425)
A vulnerability was found in HCL MaxAI Workbench and classified as critical. This affects an unknown function. Such manipulation leads to improper input validation. This vulnerability is traded as CVE-2025-31995. The attack may be launched
CVE-2025-11629 | RainyGao DocSys up to 2.02.36 /Manage/getUserList.do getUserList sql injection (EUVD-2025-33886)
A vulnerability was found in RainyGao DocSys up to 2.02.36. It has been declared as critical. This impacts the function getUserList of the file /Manage/getUserList.do. Such manipulation leads to sql injection. This vulnerability is referenc
CVE-2025-11611 | SourceCodester Simple Inventory System 1.0 /user.php uemail sql injection (EUVD-2025-33873)
A vulnerability, which was classified as critical, has been found in SourceCodester Simple Inventory System 1.0. Impacted is an unknown function of the file /user.php. This manipulation of the argument uemail causes sql injection. This vuln
CVE-2025-11597 | code-projects E-Commerce Website 1.0 product_add_qty.php prod_id sql injection (EUVD-2025-33860)
A vulnerability identified as critical has been detected in code-projects E-Commerce Website 1.0. The impacted element is an unknown function of the file /pages/product_add_qty.php. The manipulation of the argument prod_id leads to sql inje
CVE-2025-10375 | accessiBe Plugin up to 2.10 on WordPress Setting cross-site request forgery (EUVD-2025-33840)
A vulnerability, which was classified as problematic, has been found in accessiBe Plugin up to 2.10 on WordPress. This impacts the function accessibe_signup/accessibe_login/accessibe_license_trial/accessibe_modify_config/accessibe_add_verif
CVE-2026-105080 | C4illin ConvertX up to 0.18.x privileges management (EUVD-2026-91868)
A vulnerability has been found in C4illin ConvertX up to 0.18.x and classified as critical. The impacted element is an unknown function. The manipulation leads to improper privilege management. This vulnerability is referenced as CVE-2026-1
CVE-2026-79113 | aswf OpenAPV prior 1.1.1.0 privilege escalation (EUVD-2026-91869)
A vulnerability was found in aswf OpenAPV and classified as critical. This affects an unknown function. The manipulation results in privilege escalation. This vulnerability is identified as CVE-2026-79113. The attack can be executed remotel
CVE-2026-105083 | ImageMagick up to 6.9.13-56/7.1.2-31 Policy Cache policy.xml LoadPolicyCache access control (EUVD-2026-91870)
A vulnerability was found in ImageMagick up to 6.9.13-56/7.1.2-31. It has been classified as problematic. This impacts the function LoadPolicyCache of the file policy.xml of the component Policy Cache. This manipulation causes improper acce
CVE-2026-95865 | Beaver Builder Page Builder Plugin up to 2.11.0.5 on WordPress AJAX Endpoint fields[][value] sql injection (EUVD-2026-91875)
A vulnerability was found in Beaver Builder Page Builder Plugin up to 2.11.0.5 on WordPress. It has been rated as critical. Affected by this vulnerability is an unknown functionality of the component AJAX Endpoint. Performing a manipulation
CVE-2026-105090 | Formbricks up to 5.4.3/6.0.0 Survey-level Custom Head Scripts feature cross site scripting (EUVD-2026-91874)
A vulnerability was found in Formbricks up to 5.4.3/6.0.0. It has been declared as problematic. Affected is an unknown function of the component Survey-level Custom Head Scripts feature. Such manipulation leads to cross site scripting. This
CVE-2026-96270 | Ultimate Member Plugin up to 2.13.1 on WordPress Admin UI jQuery.html form_id cross site scripting (EUVD-2026-91876)
A vulnerability marked as problematic has been reported in Ultimate Member Plugin up to 2.13.1 on WordPress. This issue affects the function jQuery.html of the component Admin UI. This manipulation of the argument form_id causes cross site
CVE-2026-94378 | psmplugins SupportCandy Plugin up to 3.5.3 on WordPress name cross site scripting (EUVD-2026-91878)
A vulnerability classified as problematic has been found in psmplugins SupportCandy Plugin up to 3.5.3 on WordPress. The affected element is an unknown function. Performing a manipulation of the argument Name results in cross site scripting
CVE-2026-100180 | jegtheme Jeg Kit for Elementor Plugin up to 3.2.19 on WordPress cross site scripting (EUVD-2026-91877)
A vulnerability identified as problematic has been detected in jegtheme Jeg Kit for Elementor Plugin up to 3.2.19 on WordPress. This affects an unknown part. The manipulation leads to cross site scripting. This vulnerability is documented a
CVE-2026-94539 | psmplugins SupportCandy Plugin up to 3.5.3 on WordPress sort_by sql injection (EUVD-2026-91879)
A vulnerability categorized as critical has been discovered in psmplugins SupportCandy Plugin up to 3.5.3 on WordPress. Affected by this issue is some unknown functionality. Executing a manipulation of the argument sort_by can lead to sql i
CVE-2026-92243 | vinod-dalvi Ivory Search Plugin up to 5.5.18 on WordPress cross site scripting (EUVD-2026-91880)
A vulnerability described as problematic has been identified in vinod-dalvi Ivory Search Plugin up to 5.5.18 on WordPress. Impacted is an unknown function. Such manipulation of the argument s leads to cross site scripting. This vulnerabilit
CVE-2026-93428 | Ultimate Member Plugin up to 2.13.1 on WordPress authorization (EUVD-2026-91881)
A vulnerability labeled as problematic has been found in Ultimate Member Plugin up to 2.13.1 on WordPress. This vulnerability affects unknown code. The manipulation results in authorization bypass. This vulnerability is reported as CVE-2026
Citrix NetScaler Keeps Rebooting Following the 0-Day Patch
Citrix NetScaler customers are reporting repeated appliance reboots after installing build 14.1-73.37, the emergency update released for two zero-day flaws under active attack. The failures appear linked to crafted SAML authentication traff
CVE-2026-39919 | Artifex Ghostscript up to 10.7.x JPEG 2000 Output Adapter base/sjpx_openjpeg.c buffer overflow (Nessus ID 350696 / WID-SEC-2026-3408)
A vulnerability was found in Artifex Ghostscript up to 10.7.x. It has been classified as critical. This affects an unknown part of the file base/sjpx_openjpeg.c of the component JPEG 2000 Output Adapter. Performing a manipulation results in
CVE-2026-15806 | PSF Python up to 3.15.x urllib.request HTTPPasswordMgr missing encryption (EUVD-2026-61013 / WID-SEC-2026-2924)
A vulnerability classified as problematic was found in PSF Python up to 3.15.x. The affected element is the function HTTPPasswordMgr of the component urllib.request. Executing a manipulation can lead to missing encryption of sensitive data.
CVE-2026-63578 | Legion of the Bouncy Castle bc-csharp up to 2.6.x Password-Based Decryption PbeUtilities.GenerateCipherParameters allocation of resources (WID-SEC-2026-3713)
A vulnerability classified as problematic has been found in Legion of the Bouncy Castle bc-csharp up to 2.6.x. The impacted element is the function PbeUtilities.GenerateCipherParameters of the component Password-Based Decryption. Performing
CVE-2026-63577 | Legion of the Bouncy Castle bc-csharp up to 2.6.x DirectoryName Name-Constraint Check PkixNameConstraintValidator.WithinDNSubtree certificate validation (WID-SEC-2026-3713)
A vulnerability categorized as problematic has been discovered in Legion of the Bouncy Castle bc-csharp up to 2.6.x. This affects the function PkixNameConstraintValidator.WithinDNSubtree of the component DirectoryName Name-Constraint Check.
CVE-2026-63576 | Legion of the Bouncy Castle bc-csharp up to 2.6.x PkixNameConstraintValidator PkixNameConstraintValidator.ExtractHostFromURL certificate validation (WID-SEC-2026-3713)
A vulnerability, which was classified as problematic, has been found in Legion of the Bouncy Castle bc-csharp up to 2.6.x. The affected element is the function PkixNameConstraintValidator.ExtractHostFromURL of the component PkixNameConstrai
CVE-2026-63575 | Legion of the Bouncy Castle bc-csharp up to 2.6.x PKCS#12 Key Derivation Pkcs12Store.Load infinite loop (WID-SEC-2026-3713)
A vulnerability described as problematic has been identified in Legion of the Bouncy Castle bc-csharp up to 2.6.x. The affected element is the function Pkcs12Store.Load of the component PKCS#12 Key Derivation. Such manipulation leads to inf
CVE-2026-63574 | Legion of the Bouncy Castle bc-csharp up to 2.6.x OpenPGP Subpacket Parsers memory allocation (WID-SEC-2026-3713)
A vulnerability was found in Legion of the Bouncy Castle bc-csharp up to 2.6.x. It has been declared as problematic. Affected by this vulnerability is the function SignatureSubpacketsParser.ReadPacket/UserAttributeSubpacketsParser.ReadPacke
CVE-2026-63573 | Legion of the Bouncy Castle bc-csharp up to 2.6.x KeyTransRecipientInformation.UnwrapKey random values (WID-SEC-2026-3713)
A vulnerability was found in Legion of the Bouncy Castle bc-csharp up to 2.6.x. It has been rated as problematic. Affected by this issue is the function KeyTransRecipientInformation.UnwrapKey. Performing a manipulation results in insufficie
CVE-2025-60006 | Juniper Junos OS Evolved prior 24.2R1/24.2R2-S2-EVO/24.4R2-EVO CLI os command injection (JSA103163 / EUVD-2025-33362)
A vulnerability classified as critical has been found in Juniper Junos OS Evolved. Affected by this vulnerability is an unknown functionality of the component CLI. The manipulation leads to os command injection. This vulnerability is unique
CVE-2025-21065 | Samsung Retail Mode up to 5.59.10 input validation
A vulnerability was found in Samsung Retail Mode up to 5.59.10. It has been declared as critical. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to improper input validation. The identification
CVE-2025-21060 | Samsung Smart Switch 3.7.64.10 cleartext storage
A vulnerability classified as problematic was found in Samsung Smart Switch 3.7.64.10. Impacted is an unknown function. Executing a manipulation can lead to cleartext storage of sensitive information. This vulnerability appears as CVE-2025-
CVE-2025-11583 | code-projects Online Job Search Engine 1.0 /postjob.php txtjobID sql injection (EUVD-2025-33774)
A vulnerability labeled as critical has been found in code-projects Online Job Search Engine 1.0. Impacted is an unknown function of the file /postjob.php. Executing a manipulation of the argument txtjobID can lead to sql injection. The ide
CVE-2025-11554 | Portabilis i-Educar up to 2.9.10 User Type AccessLevelController.php insecure inherited permissions (EUVD-2025-33561)
A vulnerability, which was classified as critical, has been found in Portabilis i-Educar up to 2.9.10. Affected by this issue is some unknown functionality of the file app/Http/Controllers/AccessLevelController.php of the component User Typ
CVE-2025-61913 | FlowiseAI Flowise up to 3.0.7 WriteFileTool/ReadFileTool path traversal (GHSA-j44m-5v8f-gc9c / EUVD-2025-33322)
A vulnerability was found in FlowiseAI Flowise up to 3.0.7 and classified as critical. The affected element is an unknown function of the component WriteFileTool/ReadFileTool. Such manipulation leads to path traversal. This vulnerability is
CVE-2025-59990 | Juniper Junos Space up to 24.1R3 cross site scripting (JSA103140)
A vulnerability labeled as problematic has been found in Juniper Junos Space up to 24.1R3. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to cross site scripting. This vulnerability appears as
CVE-2025-59988 | Juniper Junos Space up to 24.1R3 cross site scripting (JSA103140)
A vulnerability categorized as problematic has been discovered in Juniper Junos Space up to 24.1R3. This vulnerability affects unknown code. Executing a manipulation can lead to cross site scripting. This vulnerability appears as CVE-2025-5