Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 739 | 0,2 % |
| ≥50 % | 3.222 | 0,8 % |
| ≥10 % | 22.086 | 5,8 % |
| <10 % | 354.682 | 93,2 % |
Critical GoAhead Vulnerability Lets Attackers Authenticate Using Revoked Certificates
A critical vulnerability in GoAhead’s OpenSSL integration lets attackers with revoked client credentials complete mutual TLS authentication and retain access tied to those identities. Tracked as CVE-2026-115881 and GOAHEAD-SA-2026-0006, the
CVE-2026-4370 | Canonical Juju up to 3.6.19/4.0.3 certificate validation
A vulnerability categorized as critical has been discovered in Canonical Juju up to 3.6.19/4.0.3. The impacted element is an unknown function. Such manipulation leads to improper certificate validation. This vulnerability is traded as CVE-2
CVE-2026-23899 | Joomla CMS up to 5.4.3/6.0.3 access control
A vulnerability classified as critical was found in Joomla CMS up to 5.4.3/6.0.3. Impacted is an unknown function. Executing a manipulation can lead to improper access controls. The identification of this vulnerability is CVE-2026-23899. Th
CVE-2026-23898 | Joomla CMS up to 5.4.3/6.0.3 Autoupdate file inclusion
A vulnerability classified as problematic has been found in Joomla CMS up to 5.4.3/6.0.3. This issue affects some unknown processing of the component Autoupdate. Performing a manipulation results in file inclusion. This vulnerability was na
CVE-2026-21632 | Joomla CMS up to 5.4.3/6.0.3 Article Title cross site scripting
A vulnerability, which was classified as problematic, was found in Joomla CMS up to 5.4.3/6.0.3. The impacted element is an unknown function of the component Article Title Handler. The manipulation results in cross site scripting. This vuln
CVE-2026-21631 | Joomla CMS up to 5.4.3/6.0.3 Multilingual Associations cross site scripting
A vulnerability, which was classified as problematic, has been found in Joomla CMS up to 5.4.3/6.0.3. The affected element is an unknown function of the component Multilingual Associations. The manipulation leads to cross site scripting. Th
CVE-2026-21630 | Joomla CMS up to 5.4.3/6.0.3 Articles Webservice Endpoint sql injection
A vulnerability described as critical has been identified in Joomla CMS up to 5.4.3/6.0.3. This vulnerability affects unknown code of the component Articles Webservice Endpoint. Such manipulation leads to sql injection. This vulnerability i
CVE-2026-21629 | Joomla CMS up to 5.4.3/6.0.3 Administrative Area access control
A vulnerability labeled as critical has been found in Joomla CMS up to 5.4.3/6.0.3. Affected by this issue is some unknown functionality of the component Administrative Area. The manipulation results in improper access controls. This vulner
Critical UEFI Firmware Flaw Allows Attackers to Execute Code Before Windows or Linux Boots
A critical vulnerability in EDK II’s PXE network boot implementation could let unauthenticated attackers run arbitrary code before Windows or Linux loads. Tracked as CVE-2026-97631, the flaw affects ICMP error handling in the NetworkPkg PXE
Siemens Software Center wird zum Einfallstor für Schadcode
Siemens meldet aktive Angriffe auf das Software Center. Dafür brauchen Angreifer lokalen Zugriff und hohe Rechte, dennoch ist der Schweregrad hoch. Updates, Indicators of Compromise und Empfehlungen stehen bereit. (Bild: © Celt Studio - sto
CVE-2026-5259 | AutohomeCorp frostmourne up to 1.0 Alarm Preview AlarmController.java server-side request forgery
A vulnerability labeled as critical has been found in AutohomeCorp frostmourne up to 1.0. The affected element is an unknown function of the file frostmourne-monitor/src/main/java/com/autohome/frostmourne/monitor/controller/AlarmController.
CVE-2026-5257 | code-projects Simple Laundry System 1.0 Parameter /delstaffinfo.php userid sql injection
A vulnerability categorized as critical has been discovered in code-projects Simple Laundry System 1.0. This issue affects some unknown processing of the file /delstaffinfo.php of the component Parameter Handler. Such manipulation of the ar
CVE-2026-5256 | code-projects Simple Laundry System 1.0 Parameter /modify.php firstName sql injection
A vulnerability was found in code-projects Simple Laundry System 1.0. It has been rated as critical. This vulnerability affects unknown code of the file /modify.php of the component Parameter Handler. This manipulation of the argument first
CVE-2026-27101 | Dell Secure Connect Gateway up to 5.0/5.28.00.xx/5.32.00.xx path traversal (dsa-2026-020)
A vulnerability was found in Dell Secure Connect Gateway up to 5.0/5.28.00.xx/5.32.00.xx. It has been declared as critical. Impacted is an unknown function. The manipulation results in path traversal. This vulnerability is reported as CVE-2
PHP2Shell: Suspected North Korean campaign targets 216 vulnerable PHP hosts
Cyfirma links PHP2Shell scans of 216 vulnerable hosts to a suspected North Korean campaign using AI to rank public exploits. On October 21, PHP released emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619
CVE-2026-113005 | Google Chrome up to 155.0.8059.84 Bluetooth memory corruption (WID-SEC-2026-4067)
A vulnerability, which was classified as critical, has been found in Google Chrome. The impacted element is an unknown function of the component Bluetooth. This manipulation causes memory corruption. This vulnerability is tracked as CVE-202
CVE-2026-113004 | Google Chrome up to 155.0.8059.84 Sync memory corruption (WID-SEC-2026-4067)
A vulnerability classified as problematic was found in Google Chrome. The affected element is an unknown function of the component Sync. The manipulation results in memory corruption. This vulnerability is identified as CVE-2026-113004. The
CVE-2026-113003 | Google Chrome up to 155.0.8059.84 HID memory corruption (WID-SEC-2026-4067)
A vulnerability classified as critical has been found in Google Chrome. Impacted is an unknown function of the component HID. The manipulation leads to memory corruption. This vulnerability is referenced as CVE-2026-113003. Remote exploitat
CVE-2026-87897 | Nextcloud Whiteboard up to 0.x server-side request forgery (WID-SEC-2026-4185)
A vulnerability was found in Nextcloud Whiteboard up to 0.x. It has been classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to server-side request forgery. This vulnerability is traded as
CVE-2026-113002 | Google Chrome up to 155.0.8059.84 Transactions Platform memory corruption (WID-SEC-2026-4067)
A vulnerability described as critical has been identified in Google Chrome. This issue affects some unknown processing of the component Transactions Platform. Executing a manipulation can lead to memory corruption. The identification of thi
CVE-2026-82986 | Nextcloud Tables up to 1.0.0 Link Sharing permission (WID-SEC-2026-4185)
A vulnerability, which was classified as critical, has been found in Nextcloud Tables up to 1.0.0. Affected by this vulnerability is an unknown functionality of the component Link Sharing. Performing a manipulation results in permission iss
CVE-2026-109999 | AI Marketing Expert Plugin up to 1.2.8 on WordPress Chatbot wp-admin/index.php name cross site scripting (EUVD-2026-111561)
A vulnerability categorized as problematic has been discovered in AI Marketing Expert Plugin up to 1.2.8 on WordPress. Impacted is an unknown function of the file wp-admin/index.php of the component Chatbot Module. Such manipulation of the
CVE-2026-97019 | mohammed_kaludi Amp for Wp Plugin up to 1.1.17 on WordPress Shortcode wp_filter_kses headline-* cross site scripting (EUVD-2026-111562)
A vulnerability classified as problematic was found in mohammed_kaludi Amp for Wp Plugin up to 1.1.17 on WordPress. Affected by this vulnerability is the function wp_filter_kses of the component Shortcode Handler. Such manipulation of the a
CVE-2026-111314 | cservit Affiliate-Toolkit Plugin up to 3.9.2 on WordPress AJAX handler atkp_product_producturl cross site scripting (EUVD-2026-111563)
A vulnerability marked as problematic has been reported in cservit Affiliate-Toolkit Plugin up to 3.9.2 on WordPress. This affects an unknown function of the component AJAX handler. The manipulation of the argument atkp_product_producturl l
CVE-2026-109209 | plugins360 All-in-One Video Gallery Plugin up to 4.9.7 on WordPress Input Sanitization save_meta_data embedcode cross site scripting (EUVD-2026-111564)
A vulnerability classified as problematic has been found in plugins360 All-in-One Video Gallery Plugin up to 4.9.7 on WordPress. Affected is the function save_meta_data of the component Input Sanitization. This manipulation of the argument
CVE-2026-118273 | a2ui-project a2ui up to 0.10.6 data-model.ts DataModel.set resource consumption (Issue 2386 / EUVD-2026-111566)
A vulnerability labeled as problematic has been found in a2ui-project a2ui up to 0.10.6. Affected by this vulnerability is the function DataModel.set of the file renderers/web_core/src/v0_9/state/data-model.ts. Executing a manipulation can
CVE-2026-107745 | tigroumeow AI Engine Plugin up to 3.8.4 on WordPress upload_file unrestricted upload (EUVD-2026-111565)
A vulnerability identified as critical has been detected in tigroumeow AI Engine Plugin up to 3.8.4 on WordPress. The affected element is the function upload_file. Performing a manipulation results in unrestricted upload. This vulnerability
CVE-2026-118274 | a2ui-project a2ui up to 0.10.6 Binder generic-binder.ts resource consumption (Issue 2387 / EUVD-2026-111567)
A vulnerability marked as problematic has been reported in a2ui-project a2ui up to 0.10.6. Affected by this issue is some unknown functionality of the file renderers/web_core/src/v0_9/rendering/generic-binder.ts of the component Binder. The
CVE-2026-118312 | Google Chrome up to 156.0.8078.47 Paint memory corruption (EUVD-2026-111473)
A vulnerability classified as critical was found in Google Chrome. Affected is an unknown function of the component Paint. The manipulation results in memory corruption. This vulnerability is reported as CVE-2026-118312. The attack can be l
CVE-2026-118338 | Google Chrome up to 156.0.8078.47 Animation use after free (EUVD-2026-111474)
A vulnerability has been found in Google Chrome and classified as critical. Impacted is an unknown function of the component Animation. The manipulation leads to use after free. This vulnerability is traded as CVE-2026-118338. It is possibl
CVE-2026-104016 | FasterXML jackson-dataformat-protobuf Protobuf Parser _finishShortText len heap-based overflow (EUVD-2026-111529)
A vulnerability, which was classified as problematic, has been found in FasterXML jackson-dataformat-protobuf. This impacts the function _finishShortText of the component Protobuf Parser. This manipulation of the argument len causes heap-ba
CVE-2026-110747 | FasterXML jackson-dataformat-protobuf ProtobufParser._readStringKey integer overflow (EUVD-2026-111531)
A vulnerability was found in FasterXML jackson-dataformat-protobuf and classified as problematic. Affected by this issue is the function ProtobufParser._readStringKey. Executing a manipulation can lead to integer overflow. This vulnerabilit
CVE-2026-104895 | FasterXML jackson-dataformat-smile Asynchronous Smile Parser _decodeVInt allocation of resources (EUVD-2026-111530)
A vulnerability, which was classified as problematic, was found in FasterXML jackson-dataformat-smile. Affected is the function _decodeVInt of the component Asynchronous Smile Parser. Such manipulation leads to allocation of resources. This
CVE-2026-110879 | FasterXML jackson-databind Generic Argument Validation DatabindContext._resolveAndValidateGeneric deserialization (EUVD-2026-111532)
A vulnerability has been found in FasterXML jackson-databind and classified as critical. Affected by this vulnerability is the function DatabindContext._resolveAndValidateGeneric of the component Generic Argument Validation. Performing a ma
CVE-2026-114255 | oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 User Account Management admin_class.php save_user name/username/password/type/id sql injection (EUVD-2026-107325)
A vulnerability labeled as critical has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This impacts the function save_user of the file admin_class.php of the component User Account Managem
CVE-2026-113798 | Electron up to 42.11.8/43.7.5/44.4.x/45.0.0-alpha.12 PointerLock session.setPermissionRequestHandler isMainFrame cross-domain policy (EUVD-2026-107374)
A vulnerability was found in Electron up to 42.11.8/43.7.5/44.4.x/45.0.0-alpha.12 and classified as problematic. This issue affects the function session.setPermissionRequestHandler of the component PointerLock. The manipulation of the argum
CVE-2026-113790 | py-pdf pypdf up to 6.20.x resource consumption (EUVD-2026-107330)
A vulnerability, which was classified as problematic, has been found in py-pdf pypdf up to 6.20.x. This impacts an unknown function. This manipulation causes resource consumption. This vulnerability appears as CVE-2026-113790. The attack ma
CVE-2026-114258 | oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 File Management files.php fid/id sql injection (EUVD-2026-107390)
A vulnerability classified as critical has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this issue is some unknown functionality of the file files.php of the component File M
CVE-2026-114122 | Electron up to 42.11.5/43.7.2/44.4.2/45.0.0-alpha.8 GPU Process webContents.beginFrameSubscription out-of-bounds (EUVD-2026-107362)
A vulnerability, which was classified as problematic, was found in Electron up to 42.11.5/43.7.2/44.4.2/45.0.0-alpha.8. This affects the function webContents.beginFrameSubscription of the component GPU Process. Executing a manipulation can
CVE-2026-89035 | MikroTik RouterOS up to 7.23.6/7.24.5 WebFig libucrypto.so makeSessionKey authentication replay (EUVD-2026-107400)
A vulnerability was found in MikroTik RouterOS up to 7.23.6/7.24.5. It has been rated as critical. This affects the function makeSessionKey of the file libucrypto.so of the component WebFig. This manipulation causes authentication bypass by
CVE-2026-118271 | a2ui-project a2ui up to 0.10.6 data-context Resolver data-context.ts resource consumption (Issue 2384 / EUVD-2026-111537)
A vulnerability categorized as problematic has been discovered in a2ui-project a2ui up to 0.10.6. This impacts an unknown function of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component data-context Resolver. Suc
CVE-2026-114130 | Nuxt up to 4.5.99 NuxtLink/no-pages router cross site scripting (EUVD-2026-107413)
A vulnerability marked as problematic has been reported in Nuxt up to 4.5.99. The affected element is an unknown function of the component NuxtLink/no-pages router. The manipulation leads to cross site scripting. This vulnerability is refer
CVE-2026-117866 | Mozilla Firefox up to 115.43/153.5/158 Canvas2D use after free (Nessus ID 372630)
A vulnerability was found in Mozilla Firefox up to 115.43/153.5/158. It has been classified as critical. Affected by this vulnerability is an unknown functionality of the component Canvas2D. The manipulation leads to use after free. This vu
CVE-2026-109705 | Mozilla Firefox up to 153.4/157 Networking use after free (Nessus ID 372630)
A vulnerability marked as critical has been reported in Mozilla Firefox up to 153.4/157. This impacts an unknown function of the component Networking. This manipulation causes use after free. This vulnerability is tracked as CVE-2026-109705
CVE-2026-114267 | SourceCodester Food Order Management System 1.0 Admin Endpoint authorization (EUVD-2026-107494)
A vulnerability categorized as critical has been discovered in SourceCodester Food Order Management System 1.0. Affected is an unknown function of the component Admin Endpoint. The manipulation results in missing authorization. This vulnera
CVE-2026-114264 | ProjectWorlds Advanced Library Management System 1.0 edit_member.php firstname/middlename/lastname/address/branch/type sql injection (EUVD-2026-107415)
A vulnerability was found in ProjectWorlds Advanced Library Management System 1.0. It has been classified as problematic. The impacted element is an unknown function of the file edit_member.php. Performing a manipulation of the argument fir
CVE-2026-106013 | Artbees Jupiter X Core Plugin up to 4.61.0 on WordPress Twitter/X Social Login verify_twitter_callback improper authentication (EUVD-2026-111538)
A vulnerability was found in Artbees Jupiter X Core Plugin up to 4.61.0 on WordPress. It has been classified as critical. This affects the function verify_twitter_callback of the component Twitter/X Social Login Handler. The manipulation le
CVE-2026-114438 | Red Hat Keycloak/Single Sign-On Update User Locale improper authorization (EUVD-2026-107540)
A vulnerability, which was classified as critical, has been found in Red Hat Keycloak and Single Sign-On. Affected by this vulnerability is an unknown functionality of the component Update User Locale. The manipulation leads to improper aut
CVE-2026-114139 | getsentry sentry-javascript up to 9.47.1/10.75.1/11.0.0-rc.0 Webpack Integration improper authorization (EUVD-2026-107549)
A vulnerability was found in getsentry sentry-javascript up to 9.47.1/10.75.1/11.0.0-rc.0. It has been declared as critical. Impacted is an unknown function of the component Webpack Integration. Executing a manipulation can lead to improper
CVE-2026-114379 | EKKOLearnAI ekko-studio up to 1.0.6 Media Generation API media.ts saveGeneratedImages output_path file inclusion (Issue 3319 / EUVD-2026-107558)
A vulnerability has been found in EKKOLearnAI ekko-studio up to 1.0.6 and classified as problematic. This vulnerability affects the function saveGeneratedImages of the file packages/server/src/modules/studio/controllers/media.ts of the comp
CVE-2026-5254 | welovemedia FFmate up to 2.0.15 Webhook AppJsonTreeView.vue cross site scripting
A vulnerability was found in welovemedia FFmate up to 2.0.15. It has been classified as problematic. Affected by this issue is some unknown functionality of the file /ui/app/components/AppJsonTreeView.vue of the component Webhook Handler. T
CVE-2026-33994 | locutusjs locutus up to 3.0.24 Query prototype pollution
A vulnerability was found in locutusjs locutus up to 3.0.24. It has been classified as problematic. This affects an unknown function of the component Query Handler. The manipulation leads to improperly controlled modification of object prot
CVE-2026-33993 | locutusjs locutus up to 3.0.24 unserialize prototype pollution
A vulnerability marked as problematic has been reported in locutusjs locutus up to 3.0.24. Affected by this vulnerability is the function unserialize. Performing a manipulation results in improperly controlled modification of object prototy
CVE-2026-33989 | mobile-next mobile-mcp up to 0.0.48 Fileystem Operation saveTo/output path traversal (GHSA-3p2m-h2v6-g9mx)
A vulnerability was found in mobile-next mobile-mcp up to 0.0.48 and classified as critical. The impacted element is the function mobile_save_screenshot/mobile_start_screen_recording of the component Fileystem Operation Handler. Executing a
CVE-2026-116639 | A vulnerability was detected in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to a8902bf64575e325f6d6bf93a55f7bd273ec58cd. Affected is an unknown function of the file chat.php. Performing a manipulation of the argument ID results in cross site scripting. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for aff
A vulnerability was detected in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to a8902bf64575e325f6d6bf93a55f7bd273ec58cd. Affected is an unknown function of the file chat.php. Performing a manipulation of the argument ID results in
CVE-2026-116839 | A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to make unauthorized changes and execute a Denial of Service (DoS) attack on the device.
A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to make unauthorized changes and execute a Denial of Service (DoS) attack on the
CVE-2026-116838 | A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to execute a Command Injection on the device.
A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to execute a Command Injection on the device.
CVE-2026-116623 | A vulnerability was detected in code-projects Simple Content Management System 1.0. Impacted is an unknown function of the file /web/admin/welcome.php of the component Admin Interface. The manipulation of the argument addnews results in missing authorization. The attack can be launched remotely. The exploit is now public and may be used.
A vulnerability was detected in code-projects Simple Content Management System 1.0. Impacted is an unknown function of the file /web/admin/welcome.php of the component Admin Interface. The manipulation of the argument addnews results in mis
CVE-2026-116837 | A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, SolarPoint, and SolarSwitch devices to execute arbitrary code on the device.
A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, SolarPoint, and SolarSwitch devices to execute arbitrary code on the device.
CVE-2026-116844 | Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerability because TransferOpen checks only the transferTLS flag set by PROT, not whether the prepared data connection uses TLS. When a client sends PROT P after PASV or PORT, file contents and directory listings cross the network unencrypted, even with mandatory encryption, letting on-path attackers read or modify them.
Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerability because TransferOpen checks only the transferTLS flag set by PROT, not whether the prepared data connection uses TLS. When a client sends PROT P after PAS