Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 785 | 0,2 % |
| ≥50 % | 3.561 | 0,9 % |
| ≥10 % | 13.145 | 3,2 % |
| <10 % | 396.064 | 95,8 % |
Terminal2Shell: 55-Year-Old ‘Zero-Day’ Dating Back to 1971 Claims to Affect Billions of Devices
Terminal2Shell claims a critical flaw dating back to 1971 affects more than two billion devices, allowing anyone who opens a terminal to gain an interactive shell. However, the website is satire, not a confirmed vulnerability disclosure. It
Google Chrome 0-Day Vulnerability in the Wild to Execute Malicious Code Remotely
Google has fixed a Chrome zero-day that attackers are already using. The flaw is tracked as CVE-2026-125350, and it lets a remote attacker run malicious code in the browser. Google’s Stable channel update moves Chrome to version 157.0.8103.
Google Chrome: Sicherheitsupdate stopft aktiv ausgenutzte Zero-Day-Lücke
Google hat ein Update für den Desktop-Browser Chrome im Stable Channel veröffentlicht. Die neue Version 157.0.8103.50/.51 steht für Windows und macOS bereit, Linux-Nutzer erhalten die Version...Zum Beitrag: Google Chrome: Sicherheitsupdate
CVE-2026-100203 | Microsoft Windows up to Server 2025 Windows Update Service buffer overflow (WID-SEC-2026-3892)
A vulnerability, which was classified as very critical, has been found in Microsoft Windows. This issue affects some unknown processing of the component Windows Update Service. The manipulation leads to buffer overflow. This vulnerability i
CVE-2026-100202 | Microsoft Windows up to Server 2025 Queue Manager use after free (WID-SEC-2026-3892)
A vulnerability was found in Microsoft Windows. It has been rated as very critical. The impacted element is an unknown function of the component Queue Manager. Performing a manipulation results in use after free. This vulnerability was name
CVE-2026-100201 | Microsoft Windows up to Server 2025 Client License Service buffer overflow (WID-SEC-2026-3892)
A vulnerability classified as very critical was found in Microsoft Windows up to Server 2025. This vulnerability affects unknown code of the component Client License Service. Executing a manipulation can lead to buffer overflow. This vulner
CVE-2026-100200 | Microsoft Windows up to Server 2025 Windows Update Service use after free (WID-SEC-2026-3892)
A vulnerability classified as very critical has been found in Microsoft Windows up to Server 2025. This affects an unknown part of the component Windows Update Service. Performing a manipulation results in use after free. This vulnerability
CVE-2026-73974 | Linuxfabrik Monitoring Plugins/Linuxfabrik-lib Testing Helper deb-updates lib.lftest.test information disclosure
A vulnerability labeled as problematic has been found in Linuxfabrik Monitoring Plugins and Linuxfabrik-lib. This impacts the function lib.lftest.test of the file check-plugins/deb-updates/deb-updates of the component Testing Helper. Execut
CVE-2026-70800 | Oracle SDP Number Portability up to 12.2.15 Internal Operations improper authorization
A vulnerability, which was classified as critical, was found in Oracle SDP Number Portability up to 12.2.15. This affects an unknown part of the component Internal Operations. The manipulation results in improper authorization. This vulnera
CVE-2026-70799 | Oracle SDP Number Portability up to 12.2.15 Internal Operations improper authorization
A vulnerability was found in Oracle SDP Number Portability up to 12.2.15 and classified as problematic. This affects an unknown function of the component Internal Operations. Executing a manipulation can lead to improper authorization. This
CVE-2026-70709 | Oracle Agile Engineering Data Management 6.2.1 Engineering Communication Interface privileges management
A vulnerability, which was classified as critical, was found in Oracle Agile Engineering Data Management 6.2.1. Affected by this vulnerability is an unknown functionality of the component Engineering Communication Interface. Such manipulati
CVE-2026-70708 | Oracle Sales Foundation up to 12.2.15 Security API improper authorization
A vulnerability classified as critical has been found in Oracle Sales Foundation up to 12.2.15. Affected by this issue is some unknown functionality of the component Security API. The manipulation leads to improper authorization. This vulne
CVE-2026-62988 | Froxlor up to 2.3.7 API Command Customers.php password/data_2fa weak password hash
A vulnerability, which was classified as problematic, was found in Froxlor up to 2.3.7. Affected by this vulnerability is the function Customers.get/Customers.listing/Admins.get/Admins.listing/Ftps.get/Ftps.listing of the file lib/Froxlor/A
CVE-2026-55593 | Froxlor up to 2.3.7 CSRF Token Validation Ajax.php Ajax::editApiKey cross-site request forgery
A vulnerability was found in Froxlor up to 2.3.7 and classified as problematic. Impacted is the function Ajax::editApiKey of the file lib/Froxlor/Ajax/Ajax.php of the component CSRF Token Validation. Executing a manipulation can lead to cro
CVE-2026-54543 | Froxlor up to 2.3.7 API Command DomainZones.php DomainZones.add record/type injection
A vulnerability classified as problematic has been found in Froxlor up to 2.3.7. This affects the function DomainZones.add of the file lib/Froxlor/Api/Commands/DomainZones.php of the component API Command. Performing a manipulation of the a
CVE-2026-54348 | Froxlor up to 2.3.7 API Command Handlers Admins.php ipaddress sql injection
A vulnerability, which was classified as problematic, has been found in Froxlor up to 2.3.7. Affected is an unknown function of the file lib/Froxlor/Api/Commands/Admins.php of the component API Command Handlers. The manipulation of the argu
CVE-2026-54347 | Froxlor up to 2.3.7 DNS TXT Record DomainZones.php Text::wordwrap cross site scripting
A vulnerability classified as problematic was found in Froxlor up to 2.3.7. This impacts the function Text::wordwrap of the file lib/Froxlor/Api/Commands/DomainZones.php of the component DNS TXT Record Handler. Executing a manipulation can
CVE-2026-48796 | CefSharp up to 148.0.89 FolderSchemeHandlerFactory FolderSchemeHandlerFactory.cs filePath.StartsWith path traversal
A vulnerability marked as problematic has been reported in CefSharp up to 148.0.89. This affects the function filePath.StartsWith of the file CefSharp/SchemeHandler/FolderSchemeHandlerFactory.cs of the component FolderSchemeHandlerFactory.
CVE-2026-21580 | Atlassian Confluence Data Center/Confluence Server cross site scripting
A vulnerability identified as problematic has been detected in Atlassian Confluence Data Center and Confluence Server. This impacts an unknown function. The manipulation leads to cross site scripting. This vulnerability is listed as CVE-202
CVE-2026-112314 | Red Hat Enterprise Linux RPC Client lib/rpc/clnt_tcp.c clnttcp_call memory leak (Nessus ID 377875)
A vulnerability identified as critical has been detected in Red Hat Enterprise Linux. This issue affects the function clnttcp_call of the file lib/rpc/clnt_tcp.c of the component RPC Client. Performing a manipulation results in memory leak.
CVE-2026-112323 | Red Hat Enterprise Linux 1.5.2 AUTH_GSSAPI handler svc_auth_gssapi.c memory allocation (Nessus ID 377876)
A vulnerability, which was classified as critical, has been found in Red Hat Enterprise Linux 1.5.2. The impacted element is an unknown function of the file lib/rpc/svc_auth_gssapi.c of the component AUTH_GSSAPI handler. This manipulation c
CVE-2026-125041 | Red Hat Enterprise Linux qtdemux out-of-bounds (Nessus ID 377877)
A vulnerability categorized as problematic has been discovered in Red Hat Enterprise Linux. Affected by this vulnerability is an unknown functionality of the component qtdemux. The manipulation results in out-of-bounds read. This vulnerabil
SonicWall releases patches for 7 flaws in its firewalls, most involving unauthenticated access
SonicWall on Monday updated its advisory about seven cybersecurity holes affecting its Gen 7 and Gen 8 firewalls, five of which allow unauthenticated remote attacks, to warn that it is aware of “potential” active exploitation of at least on
N-able Takes N-central Servers Offline Worldwide After 33 0-Day Vulnerabilities and Able2Shell Exploits
N-able took its hosted N-central environments offline on November 9, 2026, after an independent researcher published details of 33 alleged zero-day vulnerabilities and exploit code. The company also told customers running N-central on their
CVE-2026-71676 | Open5GS 2.7.0 NAS 5GS decoder buffer overflow
A vulnerability described as critical has been identified in Open5GS 2.7.0. This issue affects some unknown processing of the component NAS 5GS decoder. The manipulation results in buffer overflow. This vulnerability is identified as CVE-20
CVE-2026-57826 | openHiTLS up to 0.3.2 X.509 Certificate Chain Verification certificate validation
A vulnerability identified as problematic has been detected in openHiTLS up to 0.3.2. This issue affects some unknown processing of the component X.509 Certificate Chain Verification. The manipulation leads to improper certificate validatio
CVE-2026-52793 | Froxlor up to 2.3.6 API Authentication FroxlorRPC.php FroxlorRPC::validateAuth improper authentication
A vulnerability described as critical has been identified in Froxlor up to 2.3.6. The impacted element is the function FroxlorRPC::validateAuth of the file lib/Froxlor/Api/FroxlorRPC.php of the component API Authentication. Such manipulatio
CVE-2026-52739 | ZcashFoundation Zebra/Zebra State up to 4.4.x Non Finalized State chain.rs Chain::push assertion
A vulnerability marked as critical has been reported in ZcashFoundation Zebra and Zebra State up to 4.4.x. Affected by this vulnerability is the function Chain::push of the file zebra-state/src/service/non_finalized_state/chain.rs of the co
CVE-2026-52738 | ZcashFoundation Zebra up to 4.4.x Finalized State Writer transparent.rs uncaught exception
A vulnerability was found in ZcashFoundation Zebra up to 4.4.x. It has been declared as problematic. The affected element is an unknown function of the file zebra-state/src/service/finalized_state/zebra_db/transparent.rs of the component Fi
CVE-2026-52737 | ZcashFoundation Zebra/Zebra consensus up to 4.4.9 Sync Downloads downloads.rs handle_block_response resource consumption
A vulnerability classified as problematic has been found in ZcashFoundation Zebra and Zebra consensus up to 4.4.9. This affects the function handle_block_response of the file zebrad/src/components/sync/downloads.rs of the component Sync Dow
CVE-2026-52733 | ZcashFoundation Zebra up to 4.4.x zebra-state chain.rs Chain::pop_tip state issue
A vulnerability, which was classified as critical, was found in ZcashFoundation Zebra up to 4.4.x. This affects the function Chain::pop_tip of the file zebra-state/src/service/non_finalized_state/chain.rs of the component zebra-state. The m
CVE-2026-52731 | ZcashFoundation Zebra up to 4.4.x RPC Long Poll long_poll.rs LongPollId::from_str out-of-bounds
A vulnerability labeled as problematic has been found in ZcashFoundation Zebra up to 4.4.x. Affected is the function LongPollId::from_str of the file zebra-rpc/src/methods/types/long_poll.rs of the component RPC Long Poll. Such manipulation
CVE-2026-47720 | frangoteam FUXA up to 1.3.1 TDengine DAQ storage connector index.js escapeTdString sids sql injection
A vulnerability marked as critical has been reported in frangoteam FUXA up to 1.3.1. This vulnerability affects the function escapeTdString of the file server/runtime/storage/tdengine/index.js of the component TDengine DAQ storage connector
CVE-2026-107243 | Versa VOS up to 21.2.3 express-session server.js hard-coded credentials (EUVD-2026-120673)
A vulnerability described as critical has been identified in Versa VOS up to 21.2.3. This impacts an unknown function of the file server.js of the component express-session. Such manipulation leads to hard-coded credentials. This vulnerabil
CVE-2026-107242 | Versa VOS up to 21.2.3 Node.js Web Service random values (EUVD-2026-120628)
A vulnerability, which was classified as problematic, was found in Versa VOS up to 21.2.3. This affects an unknown part of the component Node.js Web Service. The manipulation results in insufficiently random values. This vulnerability is re
CVE-2026-107240 | Versa VOS up to 21.2.3 Zero Touch Provisioning child_process.exec username/password os command injection (EUVD-2026-120629)
A vulnerability categorized as very critical has been discovered in Versa VOS up to 21.2.3. This affects the function child_process.exec of the component Zero Touch Provisioning. Such manipulation of the argument username/password leads to
CVE-2026-107246 | WebPros Site Import up to 1.13.1 path traversal (EUVD-2026-120631)
A vulnerability, which was classified as very critical, has been found in WebPros Site Import up to 1.13.1. This impacts an unknown function. Performing a manipulation results in path traversal. This vulnerability is reported as CVE-2026-10
CVE-2026-107245 | Versa VOS up to 21.2.3/23.1.1 IPsec buffer overflow (EUVD-2026-120630)
A vulnerability has been found in Versa VOS up to 21.2.3/23.1.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the component IPsec. The manipulation leads to buffer overflow. This vulnerability is
CVE-2026-89119 | SAP Web Dispatcher/Internet Communication Manager up to XS_ADVANCED_RUNTIME 1.00 cross-site request forgery (EUVD-2026-120665)
A vulnerability marked as problematic has been reported in SAP Web Dispatcher and Internet Communication Manager up to XS_ADVANCED_RUNTIME 1.00. Impacted is an unknown function. The manipulation leads to cross-site request forgery. This vul
CVE-2026-69137 | SuiteCRM up to 7.15.1/8.10.1 Calendar action_testConnection server_url server-side request forgery (EDB-52686)
A vulnerability marked as problematic has been reported in SuiteCRM up to 7.15.1/8.10.1. The impacted element is the function CalendarAccount::action_testConnection of the component Calendar. The manipulation of the argument server_url lead
CVE-2026-103629 | Google Chrome up to 154.0.8037.92 Skia integer overflow (Nessus ID 377752)
A vulnerability categorized as problematic has been discovered in Google Chrome. Impacted is an unknown function of the component Skia. Executing a manipulation can lead to integer overflow. This vulnerability is handled as CVE-2026-103629.
CVE-2026-102325 | Google Chrome up to 154.0.8037.57 Skia uninitialized resource (Nessus ID 377752 / WID-SEC-2026-3648)
A vulnerability labeled as problematic has been found in Google Chrome. The affected element is an unknown function of the component Skia. Executing a manipulation can lead to uninitialized resource. This vulnerability is handled as CVE-202
CVE-2026-112319 | Red Hat Enterprise Linux GSS-RPC memory allocation (Nessus ID 377777)
A vulnerability was found in Red Hat Enterprise Linux and classified as critical. Affected is an unknown function of the component GSS-RPC. Executing a manipulation can lead to uncontrolled memory allocation. The identification of this vuln
CVE-2026-65693 | Microweber up to 2.0.20 Twig TwigView::render special elements in template engine
A vulnerability, which was classified as problematic, was found in Microweber up to 2.0.20. This affects the function TwigView::render of the component Twig. Such manipulation leads to improper neutralization of special elements used in a t
CVE-2026-64254 | Linux Kernel up to 7.1.2 epf mm/vmalloc.c ntb_epf_pci_remove memory corruption (Nessus ID 330014)
A vulnerability classified as problematic has been found in Linux Kernel up to 6.1.176/6.6.143/6.12.94/6.18.37/7.1.2. Affected is the function ntb_epf_pci_remove of the file mm/vmalloc.c of the component epf. The manipulation leads to memor
CVE-2026-64253 | Linux Kernel up to 6.12.94/6.18.37/7.1.2 fork copy_process null pointer dereference
A vulnerability described as very critical has been identified in Linux Kernel up to 6.12.94/6.18.37/7.1.2. This impacts the function copy_process of the component fork. Executing a manipulation can lead to null pointer dereference. This vu
CVE-2026-64251 | Linux Kernel up to 6.12.94/6.18.37/7.1.2 pwrseq pwrseq_debugfs_seq_next use after free
A vulnerability marked as critical has been reported in Linux Kernel up to 6.12.94/6.18.37/7.1.2. This affects the function pwrseq_debugfs_seq_next of the component pwrseq. Performing a manipulation results in use after free. This vulnerabi
CVE-2026-64250 | Linux Kernel up to 7.1.2 RCU kernel/irq_work.c stop_this_cpu use after free
A vulnerability categorized as problematic has been discovered in Linux Kernel up to 6.1.177/6.6.144/6.12.94/6.18.37/7.1.2. Impacted is the function stop_this_cpu of the file kernel/irq_work.c of the component RCU. The manipulation results
CVE-2026-64249 | Linux Kernel up to 7.1.2 FPGA Region child_regions_with_firmware use after free (Nessus ID 330014)
A vulnerability labeled as very critical has been found in Linux Kernel up to 7.1.2. The impacted element is the function child_regions_with_firmware of the component FPGA Region. Such manipulation leads to use after free. This vulnerabilit
CVE-2026-64248 | Linux Kernel up to 7.1.2 RCU kernel/irq_work.c stop_this_cpu use after free
A vulnerability was found in Linux Kernel up to 6.1.177/6.6.144/6.12.94/6.18.37/7.1.2. It has been rated as problematic. This issue affects the function stop_this_cpu of the file kernel/irq_work.c of the component RCU. The manipulation lead
CVE-2026-64247 | Linux Kernel up to 6.6.143/6.12.94/6.18.37/7.1.2 Hyper-V Sparse Bank hv_is_vp_in_sparse_set use after free
A vulnerability, which was classified as very critical, has been found in Linux Kernel up to 6.6.143/6.12.94/6.18.37/7.1.2. Affected by this issue is the function hv_is_vp_in_sparse_set of the component Hyper-V Sparse Bank Handler. This man
CVE-2026-64246 | Linux Kernel up to 7.1.2 Linkstation Poweroff linkstation_poweroff_init use after free (Nessus ID 330014 / WID-SEC-2026-2527)
A vulnerability labeled as very critical has been found in Linux Kernel up to 7.1.2. This issue affects the function linkstation_poweroff_init of the component Linkstation Poweroff. The manipulation results in use after free. This vulnerabi
CVE-2026-64245 | Linux Kernel up to 6.6.143/6.12.94/6.18.37/7.1.2 fbdev/modedb modedb.c fb_find_mode mode_option use after free (WID-SEC-2026-2527)
A vulnerability was found in Linux Kernel up to 6.6.143/6.12.94/6.18.37/7.1.2. It has been classified as very critical. Affected is the function fb_find_mode of the file drivers/video/fbdev/core/modedb.c of the component fbdev/modedb. This
CVE-2026-125402 | Ettercap up to 0.8.4.1 SSL SNI src/ec_sslwrap.c sslw_get_clienthello_sni out-of-bounds (EUVD-2026-120565)
A vulnerability labeled as critical has been found in Ettercap up to 0.8.4.1. This impacts the function sslw_get_clienthello_sni of the file src/ec_sslwrap.c of the component SSL SNI Handler. The manipulation results in out-of-bounds read.
CVE-2026-125401 | Ettercap up to 0.8.4.1 Gadu-Gadu Dissector src/dissectors/ec_gg.c gg_get_version heap-based overflow (EUVD-2026-120564)
A vulnerability labeled as critical has been found in Ettercap up to 0.8.4.1. The affected element is the function gg_get_version of the file src/dissectors/ec_gg.c of the component Gadu-Gadu Dissector. Executing a manipulation can lead to
CVE-2026-125404 | Ettercap up to 0.8.4.1 src/ec_encryption_ccmp.c ccmp_decrypt integer underflow (EUVD-2026-120567)
A vulnerability identified as very critical has been detected in Ettercap up to 0.8.4.1. This affects the function ccmp_decrypt of the file src/ec_encryption_ccmp.c. The manipulation leads to integer underflow. This vulnerability is listed
CVE-2026-125403 | Ettercap up to 0.8.4.1 src/ec_sslwrap.c sslw_remove_sts out-of-bounds (EUVD-2026-120566)
A vulnerability has been found in Ettercap up to 0.8.4.1 and classified as critical. This affects the function sslw_remove_sts of the file src/ec_sslwrap.c. The manipulation leads to out-of-bounds read. This vulnerability is uniquely identi
CVE-2026-125405 | Ettercap up to 0.8.4.1 HTTP Dissector src/dissectors/ec_http.c Parse_NTLM_Auth out-of-bounds (EUVD-2026-120568)
A vulnerability marked as critical has been reported in Ettercap up to 0.8.4.1. Affected is the function Parse_NTLM_Auth of the file src/dissectors/ec_http.c of the component HTTP Dissector. This manipulation causes out-of-bounds read. This
CVE-2026-125406 | Ettercap up to 0.8.4.1 Telnet Dissector ec_telnet.c stack-based overflow (EUVD-2026-120569)
A vulnerability was found in Ettercap up to 0.8.4.1 and classified as very critical. The affected element is an unknown function of the file src/dissectors/ec_telnet.c of the component Telnet Dissector. Such manipulation leads to stack-base
CVE-2026-81816 | Apache OFBiz up to 24.09.7 ContentWorker renderContentAsText xml external entity reference (EUVD-2026-117482)
A vulnerability classified as critical was found in Apache OFBiz up to 24.09.7. Impacted is the function renderContentAsText of the component ContentWorker. Such manipulation leads to xml external entity reference. This vulnerability is ref