Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 784 | 0,2 % |
| ≥50 % | 3.558 | 0,9 % |
| ≥10 % | 13.141 | 3,2 % |
| <10 % | 395.489 | 95,8 % |
CVE-2025-57616 | rust-ffmpeg up to 0.3.0 Data Structure write_interleaved use after free (Issue 192)
A vulnerability was found in rust-ffmpeg up to 0.3.0. It has been declared as critical. Affected by this issue is the function write_interleaved of the component Data Structure Handler. Such manipulation leads to use after free. This vulner
CVE-2025-57615 | rust-ffmpeg 0.3.0 sws_allocVec usize null pointer dereference (Issue 192)
A vulnerability was found in rust-ffmpeg 0.3.0. It has been classified as problematic. Affected by this vulnerability is the function sws_allocVec. This manipulation of the argument usize causes null pointer dereference. This vulnerability
CVE-2025-57614 | rust-ffmpeg 0.3.0 Dimension Parameter denial of service (Issue 192)
A vulnerability was found in rust-ffmpeg 0.3.0 and classified as problematic. Affected is an unknown function of the component Dimension Parameter Handler. The manipulation results in denial of service. This vulnerability only affects produ
CVE-2025-57613 | rust-ffmpeg 0.3.0 avio_alloc_context null pointer dereference (Issue 192)
A vulnerability has been found in rust-ffmpeg 0.3.0 and classified as problematic. This impacts the function avio_alloc_context. The manipulation leads to null pointer dereference. This vulnerability only affects products that are no longer
CVE-2025-57612 | rust-ffmpeg 0.3.0 av_get_sample_fmt_name null pointer dereference (Issue 192)
A vulnerability, which was classified as problematic, was found in rust-ffmpeg 0.3.0. This affects the function av_get_sample_fmt_name. Executing a manipulation can lead to null pointer dereference. This vulnerability only affects products
CVE-2025-57611 | rust-ffmpeg 0.3.0 avfilter_graph_dump null pointer dereference (Issue 192)
A vulnerability, which was classified as problematic, has been found in rust-ffmpeg 0.3.0. The impacted element is the function avfilter_graph_dump. Performing a manipulation results in null pointer dereference. This vulnerability only affe
CVE-2025-55474 | Many Notes 0.10.1 Markdown File cross site scripting
A vulnerability classified as problematic has been found in Many Notes 0.10.1. Affected by this vulnerability is an unknown functionality of the component Markdown File Handler. The manipulation leads to cross site scripting. This vulnerabi
CVE-2025-55473 | Asian Arts Talents Foundation Website /ip.php X-Forwarded-For cross site scripting (EUVD-2025-26419)
A vulnerability, which was classified as problematic, was found in Asian Arts Talents Foundation Website. Affected by this vulnerability is an unknown functionality of the file /ip.php. The manipulation of the argument X-Forwarded-For resul
CVE-2025-55472 | Tirreno 0.9.5 API Endpoint /admin/loadUsers columns[0][data] sql injection (EUVD-2025-26417)
A vulnerability categorized as critical has been discovered in Tirreno 0.9.5. The affected element is an unknown function of the file /admin/loadUsers of the component API Endpoint. The manipulation of the argument columns[0][data] results
CVE-2025-55373 | Beakon Application up to 5.4.2 access control (EUVD-2025-26440)
A vulnerability was found in Beakon Application up to 5.4.2. It has been declared as critical. This issue affects some unknown processing. Executing a manipulation can lead to improper access controls. This vulnerability is handled as CVE-2
CVE-2025-55372 | Beakon Application up to 5.4.2 unrestricted upload
A vulnerability marked as critical has been reported in Beakon Application up to 5.4.2. The affected element is an unknown function. This manipulation causes unrestricted upload. This vulnerability is tracked as CVE-2025-55372. The attack i
CVE-2025-57140 | rsbi-pom 4.7 DatasetService sql injection (EUVD-2025-26379)
A vulnerability was found in rsbi-pom 4.7 and classified as critical. This issue affects some unknown processing of the file /bi/service/model/DatasetService. Such manipulation leads to sql injection. This vulnerability is uniquely identifi
CVE-2025-56577 | Evope Core 1.1.3.20 hard-coded key
A vulnerability categorized as problematic has been discovered in Evope Core 1.1.3.20. Affected is an unknown function. Such manipulation leads to use of hard-coded cryptographic key . This vulnerability is referenced as CVE-2025-56577. The
CVE-2025-56254 | PHPGurukul Employee Leave Management System 2.1 leave-details.php leaveid resource injection (EUVD-2025-26376)
A vulnerability classified as problematic has been found in PHPGurukul Employee Leave Management System 2.1. The impacted element is an unknown function of the file leave-details.php. This manipulation of the argument leaveid causes imprope
CVE-2025-55763 | CivetWeb 1.14/1.15/1.16 URI Parser denial of service
A vulnerability was found in CivetWeb 1.14/1.15/1.16 and classified as problematic. This affects an unknown function of the component URI Parser. Executing a manipulation can lead to denial of service. The identification of this vulnerabili
CVE-2025-54599 | Bevy Event Service up to 2025-07-22 access control
A vulnerability was found in Bevy Event Service up to 2025-07-22. It has been rated as problematic. This affects an unknown part. Performing a manipulation results in improper access controls. This vulnerability was named CVE-2025-54599. Th
CVE-2025-54369 | Node-SAML improper authentication (EUVD-2025-22555)
A vulnerability marked as critical has been reported in Node-SAML. Affected by this issue is some unknown functionality. Performing a manipulation results in improper authentication. This vulnerability is cataloged as CVE-2025-54369. The at
CVE-2025-50757 | Wavlink WN535K3 20191010 set_sys_adm username command injection
A vulnerability identified as critical has been detected in Wavlink WN535K3 20191010. This issue affects the function set_sys_adm. The manipulation of the argument Username leads to command injection. This vulnerability is referenced as CVE
CVE-2025-50755 | Wavlink WN535K3 20191010 set_sys_cmd command command injection
A vulnerability categorized as critical has been discovered in Wavlink WN535K3 20191010. This vulnerability affects the function set_sys_cmd. Executing a manipulation of the argument command can lead to command injection. The identification
CVE-2025-46047 | Silverpeas 6.4.1/6.4.2 Endpoint ForgotPassword Login information disclosure
A vulnerability identified as problematic has been detected in Silverpeas 6.4.1/6.4.2. Affected by this issue is some unknown functionality of the file /CredentialsServlet/ForgotPassword of the component Endpoint. Performing a manipulation
CVE-2025-44033 | oa_system 1.1 AddressMapper.java allDirector sql injection
A vulnerability classified as critical was found in oa_system 1.1. This affects the function allDirector of the file src/main/java/cn/gson/oasys/mappers/AddressMapper.java. The manipulation results in sql injection. This vulnerability is re
Das hat mich einen ganzen Tag gekostet...
YouTube VideoFreitagnachmittag kam eine Mail von unserem Hoster: Im Linux-Kernel steckt eine Lücke, die schon beim Aufbau einer TCP-Verbindung ausgenutzt werden kann, und er blockt den Verkehr dafür. Quellen zum Video: https://www.cve.org/
Building an Evidence Trail for CVE-2026-76466 Remediation
Building an Evidence Trail for CVE-2026-76466 Remediation The CVE-2026-76466 advisory names a clear outcome: unauthenticated remote command execution as root. It also names conditions that are easy to lose in a large patch program: Cisco Ex
Vulnerability Scans for Older Cisco IOS Vulnerability / Opt-Out Headers, (Thu, Nov 5th)
This morning, I was browsing our honeypot data for any new and existing PHP exploit attempts. Instead, I first ran into some GeoServer exploits, but found them to be too boring to write up. This Cisco IOS exploit attempt was a bit more inte
Hackers Exploit OpenSSH SSHole Flaw Within Hours
A newly disclosed OpenSSH vulnerability, nicknamed SSHole, is already being exploited in the wild. The flaw, tracked as CVE-2026-123158 and carrying a CVSS score of 8.1, lets unauthenticated attackers log in to certain Linux accounts that
CVE-2025-61464 | Gnuboard up to 4.36.04 bbs/search.php search_table sql injection
A vulnerability, which was classified as critical, was found in Gnuboard up to 4.36.04. The impacted element is the function search_table of the file bbs/search.php. The manipulation results in sql injection. This vulnerability was named CV
CVE-2025-61136 | axewater sharewarez 2.4.3 Password Reset url_for injection
A vulnerability marked as problematic has been reported in axewater sharewarez 2.4.3. Affected is the function url_for of the component Password Reset Handler. The manipulation leads to injection. This vulnerability is traded as CVE-2025-61
CVE-2025-61132 | levlaz braindump 0.4.14 Password Reset url_for injection
A vulnerability labeled as problematic has been found in levlaz braindump 0.4.14. This impacts the function url_for of the component Password Reset Handler. Executing a manipulation can lead to injection. This vulnerability appears as CVE-2
CVE-2025-60859 | Gnuboard 5.6.15 bbs/view_comment.php c_id cross site scripting
A vulnerability was found in Gnuboard 5.6.15. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file bbs/view_comment.php. Executing a manipulation of the argument c_id can lead to cross
CVE-2025-60852 | Instant Developer Foundation prior 25.0.9600 CSV Export csv injection
A vulnerability was found in Instant Developer Foundation. It has been declared as problematic. Impacted is an unknown function of the component CSV Export Handler. The manipulation results in csv injection. This vulnerability is cataloged
CVE-2025-60837 | MCMS 6.0.1 cross site scripting
A vulnerability identified as problematic has been detected in MCMS 6.0.1. This impacts an unknown function. The manipulation leads to cross site scripting. This vulnerability is listed as CVE-2025-60837. The attack may be initiated remotel
CVE-2025-57240 | 17gz International Student service system 1.0 Registration cross site scripting
A vulnerability categorized as problematic has been discovered in 17gz International Student service system 1.0. This affects an unknown function of the component Registration. Executing a manipulation can lead to cross site scripting. This
CVE-2025-62401 | Moodle Timed Assignment access control (EUVD-2025-35665 / Nessus ID 276867)
A vulnerability was found in Moodle. It has been rated as critical. Impacted is an unknown function of the component Timed Assignment Handler. Performing a manipulation results in improper access controls. This vulnerability is cataloged as
CVE-2025-62400 | Moodle Hidden Group Name information disclosure (EUVD-2025-35667 / Nessus ID 276838)
A vulnerability was found in Moodle. It has been declared as problematic. This issue affects some unknown processing of the component Hidden Group Name Handler. Such manipulation leads to information disclosure. This vulnerability is listed
CVE-2025-62399 | Moodle Mobile/Web excessive authentication (EUVD-2025-35668 / Nessus ID 276851)
A vulnerability was found in Moodle and classified as problematic. This affects an unknown part of the component Mobile/Web. The manipulation results in improper restriction of excessive authentication attempts. This vulnerability is identi
CVE-2025-62398 | Moodle MFA improper authentication (EUVD-2025-35669 / Nessus ID 276869)
A vulnerability has been found in Moodle and classified as critical. Affected by this issue is some unknown functionality of the component MFA. The manipulation leads to improper authentication. This vulnerability is referenced as CVE-2025-
CVE-2025-62397 | Moodle 404 Router information disclosure (Nessus ID 276830)
A vulnerability, which was classified as problematic, has been found in Moodle 404. Affected is an unknown function of the component Router. Performing a manipulation results in information disclosure. This vulnerability was named CVE-2025-
CVE-2025-62395 | Moodle External Cohort Search information disclosure (EUVD-2025-35666 / Nessus ID 276846)
A vulnerability, which was classified as problematic, was found in Moodle. Affected by this vulnerability is an unknown functionality of the component External Cohort Search. Executing a manipulation can lead to information disclosure. The
CVE-2025-62394 | Moodle Quiz Notifications information disclosure (EUVD-2025-35672 / Nessus ID 276837)
A vulnerability was found in Moodle. It has been classified as problematic. This vulnerability affects unknown code of the component Quiz Notifications. This manipulation causes information disclosure. This vulnerability is tracked as CVE-2
CVE-2025-62393 | Moodle Course Access course_output_fragment_course_overview permission (EUVD-2025-35673 / Nessus ID 276845)
A vulnerability classified as critical has been found in Moodle. This affects the function course_output_fragment_course_overview of the component Course Access. This manipulation causes permission issues. This vulnerability is handled as C
CVE-2025-60343 | Tenda AC6 15.03.06.50 AdvSetMacMtuWan buffer overflow
A vulnerability classified as critical has been found in Tenda AC6 15.03.06.50. This issue affects the function AdvSetMacMtuWan. The manipulation of the argument wanMTU/wanSpeed/cloneType/mac/serviceName/serverName/wanMTU2/wanSpeed2/cloneTy
CVE-2025-60340 | Tenda AC6 15.03.06.50 SetClientState limitSpeed/deviceId/limitSpeedUp buffer overflow
A vulnerability marked as critical has been reported in Tenda AC6 15.03.06.50. This issue affects the function SetClientState. Performing a manipulation of the argument limitSpeed/deviceId/limitSpeedUp results in buffer overflow. This vulne
CVE-2025-60339 | Tenda AC6 15.03.06.50 openSchedWifi schedStartTime/schedEndTime buffer overflow
A vulnerability was found in Tenda AC6 15.03.06.50. It has been classified as critical. Affected by this issue is the function openSchedWifi. The manipulation of the argument schedStartTime/schedEndTime leads to buffer overflow. This vulner
CVE-2025-60336 | TOTOLINK N600R 4.3.0cu.7866_B20220506 HTTP sub_41773C null pointer dereference
A vulnerability, which was classified as critical, has been found in TOTOLINK N600R 4.3.0cu.7866_B20220506. This issue affects the function sub_41773C of the component HTTP Handler. This manipulation causes null pointer dereference. This vu
CVE-2023-3397 | Linux Kernel JFS lmLogClose use after free
A vulnerability has been found in Linux Kernel and classified as problematic. This affects the function lmLogClose of the component JFS. The manipulation leads to use after free. This vulnerability is documented as CVE-2023-3397. The attack
CVE-2020-27792 | GhostScript PDF gdevlp8k.c lp8000_print_page heap-based overflow (DLA 3096-1 / Nessus ID 235015)
A vulnerability was found in GhostScript. It has been classified as critical. Affected by this vulnerability is the function lp8000_print_page of the file gdevlp8k.c of the component PDF Handler. The manipulation leads to heap-based buffer
SonicWall CVE-2026-19868: SSL-VPN SAML MFA Bypass Exploited in the Wild
TL;DR what: SonicWall disclosed CVE-2026-19868, an SSL-VPN authentication bypass in SonicOS that lets attackers with valid credentials for an alternate authentication method skip SAML controls, and CISA has confirmed it is exploited in the
CVE-2025-61255 | PHPGurukul Bank Locker Management System /search cross site scripting
A vulnerability classified as problematic has been found in PHPGurukul Bank Locker Management System. This impacts an unknown function of the file /search. The manipulation of the argument Search leads to cross site scripting. This vulnerab
CVE-2025-60334 | Totolink N600R 4.3.0cu.7866_B20220506 setWiFiBasicConfig ssid denial of service
A vulnerability has been found in Totolink N600R 4.3.0cu.7866_B20220506 and classified as problematic. This affects the function setWiFiBasicConfig. The manipulation of the argument ssid leads to denial of service. This vulnerability is doc
CVE-2025-60333 | Totolink N600R 4.3.0cu.7866_B20220506 setWiFiMultipleConfig wepkey2 denial of service
A vulnerability, which was classified as problematic, has been found in Totolink N600R 4.3.0cu.7866_B20220506. The affected element is the function setWiFiMultipleConfig. Performing a manipulation of the argument wepkey2 results in denial o
CVE-2025-60332 | D-Link DIR-823G A1 1.0.2B05 SetWLanRadioSettings null pointer dereference
A vulnerability has been found in D-Link DIR-823G A1 1.0.2B05 and classified as problematic. The affected element is the function SetWLanRadioSettings. The manipulation leads to null pointer dereference. This vulnerability is listed as CVE-
CVE-2025-60331 | D-Link DIR-823G A1 1.0.2B05 /EXCU_SHELL FillMacCloneMac denial of service
A vulnerability classified as problematic was found in D-Link DIR-823G A1 1.0.2B05. This affects an unknown function of the file /EXCU_SHELL. Executing a manipulation of the argument FillMacCloneMac can lead to denial of service. This vulne
CVE-2025-56447 | TM2 Monitoring 3.04 improper authentication
A vulnerability described as critical has been identified in TM2 Monitoring 3.04. Affected by this issue is some unknown functionality. The manipulation results in improper authentication. This vulnerability was named CVE-2025-56447. The at
CVE-2025-61220 | AutoBizLine com.mysecondline.app 1.2.91 improper authorization
A vulnerability categorized as critical has been discovered in AutoBizLine com.mysecondline.app 1.2.91. The impacted element is an unknown function. Such manipulation leads to improper authorization. This vulnerability is traded as CVE-2025
CVE-2025-61194 | daicuocms 1.3.13 Builder.php sql injection
A vulnerability labeled as critical has been found in daicuocms 1.3.13. Affected by this issue is some unknown functionality of the file library\think\db\Builder.php. The manipulation results in sql injection. This vulnerability is known as
CVE-2025-61181 | daicuocms 1.3.13 Image unrestricted upload
A vulnerability marked as critical has been reported in daicuocms 1.3.13. Impacted is an unknown function of the component Image Handler. Performing a manipulation results in unrestricted upload. This vulnerability is known as CVE-2025-6118
CVE-2025-60933 | HR Performance Solutions Performance Pro 3.19.17 cross site scripting
A vulnerability described as problematic has been identified in HR Performance Solutions Performance Pro 3.19.17. The impacted element is an unknown function. Such manipulation of the argument Goal Name/Goal Notes/Action Step Name/Action St
CVE-2025-60932 | HR Performance Solutions Performance Pro 3.19.17 cross site scripting
A vulnerability classified as problematic has been found in HR Performance Solutions Performance Pro 3.19.17. This affects an unknown function. Performing a manipulation of the argument Goal Name/Goal Notes/Action Step Name/Action Step Desc
CVE-2025-60772 | Netlink HG322G 1.0.00-231017 HTTP Request improper authentication
A vulnerability was found in Netlink HG322G 1.0.00-231017 and classified as critical. This vulnerability affects unknown code of the component HTTP Request Handler. Executing a manipulation can lead to improper authentication. This vulnerab
CVE-2025-60511 | OpenAI Chat Block Plugin 3.0.1 on Moodle completion.php blockId authorization
A vulnerability categorized as critical has been discovered in OpenAI Chat Block Plugin 3.0.1 on Moodle. This issue affects some unknown processing of the file /blocks/openai_chat/api/completion.php. The manipulation of the argument blockId