Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 739 | 0,2 % |
| ≥50 % | 3.222 | 0,8 % |
| ≥10 % | 22.086 | 5,8 % |
| <10 % | 354.682 | 93,2 % |
Critical GoAhead Web Server Flaw Allows Attackers to Bypass Client Certificate Authentication
A critical flaw in the GoAhead embedded web server lets revoked client certificates pass authentication checks, potentially restoring access to identities administrators have blocked. Tracked as CVE-2026-115881, the vulnerability carries a
Siemens Software Center wird zum Einfallstor für Schadcode
Siemens meldet aktive Angriffe auf das Software Center. Dafür brauchen Angreifer lokalen Zugriff und hohe Rechte, dennoch ist der Schweregrad hoch. Updates, Indicators of Compromise und Empfehlungen stehen bereit. (Bild: © Celt Studio - sto
Sweet Security Offers All Organizations Affected by HTTP2Shell Virtual Patching Protection at No Cost
New York, NY, October 27th, 2026, CyberNewswire The root-cause fix will take weeks; protection can’t wait Sweet Security today announced Sweet Safety Net, extending its runtime Virtual Patching protection to every organization affected by H
CVE-2026-5259 | AutohomeCorp frostmourne up to 1.0 Alarm Preview AlarmController.java server-side request forgery
A vulnerability labeled as critical has been found in AutohomeCorp frostmourne up to 1.0. The affected element is an unknown function of the file frostmourne-monitor/src/main/java/com/autohome/frostmourne/monitor/controller/AlarmController.
CVE-2026-5257 | code-projects Simple Laundry System 1.0 Parameter /delstaffinfo.php userid sql injection
A vulnerability categorized as critical has been discovered in code-projects Simple Laundry System 1.0. This issue affects some unknown processing of the file /delstaffinfo.php of the component Parameter Handler. Such manipulation of the ar
CVE-2026-5256 | code-projects Simple Laundry System 1.0 Parameter /modify.php firstName sql injection
A vulnerability was found in code-projects Simple Laundry System 1.0. It has been rated as critical. This vulnerability affects unknown code of the file /modify.php of the component Parameter Handler. This manipulation of the argument first
CVE-2026-27101 | Dell Secure Connect Gateway up to 5.0/5.28.00.xx/5.32.00.xx path traversal (dsa-2026-020)
A vulnerability was found in Dell Secure Connect Gateway up to 5.0/5.28.00.xx/5.32.00.xx. It has been declared as critical. Impacted is an unknown function. The manipulation results in path traversal. This vulnerability is reported as CVE-2
PHP2Shell: Suspected North Korean campaign targets 216 vulnerable PHP hosts
Cyfirma links PHP2Shell scans of 216 vulnerable hosts to a suspected North Korean campaign using AI to rank public exploits. On October 21, PHP released emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619
CVE-2026-113005 | Google Chrome up to 155.0.8059.84 Bluetooth memory corruption (WID-SEC-2026-4067)
A vulnerability, which was classified as critical, has been found in Google Chrome. The impacted element is an unknown function of the component Bluetooth. This manipulation causes memory corruption. This vulnerability is tracked as CVE-202
CVE-2026-113004 | Google Chrome up to 155.0.8059.84 Sync memory corruption (WID-SEC-2026-4067)
A vulnerability classified as problematic was found in Google Chrome. The affected element is an unknown function of the component Sync. The manipulation results in memory corruption. This vulnerability is identified as CVE-2026-113004. The
CVE-2026-113003 | Google Chrome up to 155.0.8059.84 HID memory corruption (WID-SEC-2026-4067)
A vulnerability classified as critical has been found in Google Chrome. Impacted is an unknown function of the component HID. The manipulation leads to memory corruption. This vulnerability is referenced as CVE-2026-113003. Remote exploitat
CVE-2026-87897 | Nextcloud Whiteboard up to 0.x server-side request forgery (WID-SEC-2026-4185)
A vulnerability was found in Nextcloud Whiteboard up to 0.x. It has been classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to server-side request forgery. This vulnerability is traded as
CVE-2026-113002 | Google Chrome up to 155.0.8059.84 Transactions Platform memory corruption (WID-SEC-2026-4067)
A vulnerability described as critical has been identified in Google Chrome. This issue affects some unknown processing of the component Transactions Platform. Executing a manipulation can lead to memory corruption. The identification of thi
CVE-2026-82986 | Nextcloud Tables up to 1.0.0 Link Sharing permission (WID-SEC-2026-4185)
A vulnerability, which was classified as critical, has been found in Nextcloud Tables up to 1.0.0. Affected by this vulnerability is an unknown functionality of the component Link Sharing. Performing a manipulation results in permission iss
CVE-2026-109999 | AI Marketing Expert Plugin up to 1.2.8 on WordPress Chatbot wp-admin/index.php name cross site scripting (EUVD-2026-111561)
A vulnerability categorized as problematic has been discovered in AI Marketing Expert Plugin up to 1.2.8 on WordPress. Impacted is an unknown function of the file wp-admin/index.php of the component Chatbot Module. Such manipulation of the
CVE-2026-97019 | mohammed_kaludi Amp for Wp Plugin up to 1.1.17 on WordPress Shortcode wp_filter_kses headline-* cross site scripting (EUVD-2026-111562)
A vulnerability classified as problematic was found in mohammed_kaludi Amp for Wp Plugin up to 1.1.17 on WordPress. Affected by this vulnerability is the function wp_filter_kses of the component Shortcode Handler. Such manipulation of the a
CVE-2026-111314 | cservit Affiliate-Toolkit Plugin up to 3.9.2 on WordPress AJAX handler atkp_product_producturl cross site scripting (EUVD-2026-111563)
A vulnerability marked as problematic has been reported in cservit Affiliate-Toolkit Plugin up to 3.9.2 on WordPress. This affects an unknown function of the component AJAX handler. The manipulation of the argument atkp_product_producturl l
CVE-2026-109209 | plugins360 All-in-One Video Gallery Plugin up to 4.9.7 on WordPress Input Sanitization save_meta_data embedcode cross site scripting (EUVD-2026-111564)
A vulnerability classified as problematic has been found in plugins360 All-in-One Video Gallery Plugin up to 4.9.7 on WordPress. Affected is the function save_meta_data of the component Input Sanitization. This manipulation of the argument
CVE-2026-118273 | a2ui-project a2ui up to 0.10.6 data-model.ts DataModel.set resource consumption (Issue 2386 / EUVD-2026-111566)
A vulnerability labeled as problematic has been found in a2ui-project a2ui up to 0.10.6. Affected by this vulnerability is the function DataModel.set of the file renderers/web_core/src/v0_9/state/data-model.ts. Executing a manipulation can
CVE-2026-107745 | tigroumeow AI Engine Plugin up to 3.8.4 on WordPress upload_file unrestricted upload (EUVD-2026-111565)
A vulnerability identified as critical has been detected in tigroumeow AI Engine Plugin up to 3.8.4 on WordPress. The affected element is the function upload_file. Performing a manipulation results in unrestricted upload. This vulnerability
CVE-2026-118274 | a2ui-project a2ui up to 0.10.6 Binder generic-binder.ts resource consumption (Issue 2387 / EUVD-2026-111567)
A vulnerability marked as problematic has been reported in a2ui-project a2ui up to 0.10.6. Affected by this issue is some unknown functionality of the file renderers/web_core/src/v0_9/rendering/generic-binder.ts of the component Binder. The
Critical UEFI Firmware Flaw Could Expose Millions of Servers to Pre-Boot Code Execution
A critical bug in open-source EDK II firmware lets a remote attacker run code on a machine before the operating system starts. The flaw is tracked as CVE-2026-97631. It sits in the network boot (PXE) driver and received a CVSS v4 score of 9
CVE-2026-118312 | Google Chrome up to 156.0.8078.47 Paint memory corruption (EUVD-2026-111473)
A vulnerability classified as critical was found in Google Chrome. Affected is an unknown function of the component Paint. The manipulation results in memory corruption. This vulnerability is reported as CVE-2026-118312. The attack can be l
CVE-2026-118338 | Google Chrome up to 156.0.8078.47 Animation use after free (EUVD-2026-111474)
A vulnerability has been found in Google Chrome and classified as critical. Impacted is an unknown function of the component Animation. The manipulation leads to use after free. This vulnerability is traded as CVE-2026-118338. It is possibl
CVE-2026-104016 | FasterXML jackson-dataformat-protobuf Protobuf Parser _finishShortText len heap-based overflow (EUVD-2026-111529)
A vulnerability, which was classified as problematic, has been found in FasterXML jackson-dataformat-protobuf. This impacts the function _finishShortText of the component Protobuf Parser. This manipulation of the argument len causes heap-ba
CVE-2026-110747 | FasterXML jackson-dataformat-protobuf ProtobufParser._readStringKey integer overflow (EUVD-2026-111531)
A vulnerability was found in FasterXML jackson-dataformat-protobuf and classified as problematic. Affected by this issue is the function ProtobufParser._readStringKey. Executing a manipulation can lead to integer overflow. This vulnerabilit
CVE-2026-104895 | FasterXML jackson-dataformat-smile Asynchronous Smile Parser _decodeVInt allocation of resources (EUVD-2026-111530)
A vulnerability, which was classified as problematic, was found in FasterXML jackson-dataformat-smile. Affected is the function _decodeVInt of the component Asynchronous Smile Parser. Such manipulation leads to allocation of resources. This
CVE-2026-110879 | FasterXML jackson-databind Generic Argument Validation DatabindContext._resolveAndValidateGeneric deserialization (EUVD-2026-111532)
A vulnerability has been found in FasterXML jackson-databind and classified as critical. Affected by this vulnerability is the function DatabindContext._resolveAndValidateGeneric of the component Generic Argument Validation. Performing a ma
CVE-2026-114255 | oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 User Account Management admin_class.php save_user name/username/password/type/id sql injection (EUVD-2026-107325)
A vulnerability labeled as critical has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This impacts the function save_user of the file admin_class.php of the component User Account Managem
CVE-2026-113798 | Electron up to 42.11.8/43.7.5/44.4.x/45.0.0-alpha.12 PointerLock session.setPermissionRequestHandler isMainFrame cross-domain policy (EUVD-2026-107374)
A vulnerability was found in Electron up to 42.11.8/43.7.5/44.4.x/45.0.0-alpha.12 and classified as problematic. This issue affects the function session.setPermissionRequestHandler of the component PointerLock. The manipulation of the argum
CVE-2026-113790 | py-pdf pypdf up to 6.20.x resource consumption (EUVD-2026-107330)
A vulnerability, which was classified as problematic, has been found in py-pdf pypdf up to 6.20.x. This impacts an unknown function. This manipulation causes resource consumption. This vulnerability appears as CVE-2026-113790. The attack ma
CVE-2026-114258 | oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 File Management files.php fid/id sql injection (EUVD-2026-107390)
A vulnerability classified as critical has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this issue is some unknown functionality of the file files.php of the component File M
CVE-2026-114122 | Electron up to 42.11.5/43.7.2/44.4.2/45.0.0-alpha.8 GPU Process webContents.beginFrameSubscription out-of-bounds (EUVD-2026-107362)
A vulnerability, which was classified as problematic, was found in Electron up to 42.11.5/43.7.2/44.4.2/45.0.0-alpha.8. This affects the function webContents.beginFrameSubscription of the component GPU Process. Executing a manipulation can
CVE-2026-89035 | MikroTik RouterOS up to 7.23.6/7.24.5 WebFig libucrypto.so makeSessionKey authentication replay (EUVD-2026-107400)
A vulnerability was found in MikroTik RouterOS up to 7.23.6/7.24.5. It has been rated as critical. This affects the function makeSessionKey of the file libucrypto.so of the component WebFig. This manipulation causes authentication bypass by
CVE-2026-118271 | a2ui-project a2ui up to 0.10.6 data-context Resolver data-context.ts resource consumption (Issue 2384 / EUVD-2026-111537)
A vulnerability categorized as problematic has been discovered in a2ui-project a2ui up to 0.10.6. This impacts an unknown function of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component data-context Resolver. Suc
CVE-2026-114130 | Nuxt up to 4.5.99 NuxtLink/no-pages router cross site scripting (EUVD-2026-107413)
A vulnerability marked as problematic has been reported in Nuxt up to 4.5.99. The affected element is an unknown function of the component NuxtLink/no-pages router. The manipulation leads to cross site scripting. This vulnerability is refer
CVE-2026-117866 | Mozilla Firefox up to 115.43/153.5/158 Canvas2D use after free (Nessus ID 372630)
A vulnerability was found in Mozilla Firefox up to 115.43/153.5/158. It has been classified as critical. Affected by this vulnerability is an unknown functionality of the component Canvas2D. The manipulation leads to use after free. This vu
CVE-2026-109705 | Mozilla Firefox up to 153.4/157 Networking use after free (Nessus ID 372630)
A vulnerability marked as critical has been reported in Mozilla Firefox up to 153.4/157. This impacts an unknown function of the component Networking. This manipulation causes use after free. This vulnerability is tracked as CVE-2026-109705
CVE-2026-114267 | SourceCodester Food Order Management System 1.0 Admin Endpoint authorization (EUVD-2026-107494)
A vulnerability categorized as critical has been discovered in SourceCodester Food Order Management System 1.0. Affected is an unknown function of the component Admin Endpoint. The manipulation results in missing authorization. This vulnera
CVE-2026-114264 | ProjectWorlds Advanced Library Management System 1.0 edit_member.php firstname/middlename/lastname/address/branch/type sql injection (EUVD-2026-107415)
A vulnerability was found in ProjectWorlds Advanced Library Management System 1.0. It has been classified as problematic. The impacted element is an unknown function of the file edit_member.php. Performing a manipulation of the argument fir
CVE-2026-106013 | Artbees Jupiter X Core Plugin up to 4.61.0 on WordPress Twitter/X Social Login verify_twitter_callback improper authentication (EUVD-2026-111538)
A vulnerability was found in Artbees Jupiter X Core Plugin up to 4.61.0 on WordPress. It has been classified as critical. This affects the function verify_twitter_callback of the component Twitter/X Social Login Handler. The manipulation le
CVE-2026-114438 | Red Hat Keycloak/Single Sign-On Update User Locale improper authorization (EUVD-2026-107540)
A vulnerability, which was classified as critical, has been found in Red Hat Keycloak and Single Sign-On. Affected by this vulnerability is an unknown functionality of the component Update User Locale. The manipulation leads to improper aut
CVE-2026-114139 | getsentry sentry-javascript up to 9.47.1/10.75.1/11.0.0-rc.0 Webpack Integration improper authorization (EUVD-2026-107549)
A vulnerability was found in getsentry sentry-javascript up to 9.47.1/10.75.1/11.0.0-rc.0. It has been declared as critical. Impacted is an unknown function of the component Webpack Integration. Executing a manipulation can lead to improper
CVE-2026-114379 | EKKOLearnAI ekko-studio up to 1.0.6 Media Generation API media.ts saveGeneratedImages output_path file inclusion (Issue 3319 / EUVD-2026-107558)
A vulnerability has been found in EKKOLearnAI ekko-studio up to 1.0.6 and classified as problematic. This vulnerability affects the function saveGeneratedImages of the file packages/server/src/modules/studio/controllers/media.ts of the comp
CVE-2026-5254 | welovemedia FFmate up to 2.0.15 Webhook AppJsonTreeView.vue cross site scripting
A vulnerability was found in welovemedia FFmate up to 2.0.15. It has been classified as problematic. Affected by this issue is some unknown functionality of the file /ui/app/components/AppJsonTreeView.vue of the component Webhook Handler. T
CVE-2026-33994 | locutusjs locutus up to 3.0.24 Query prototype pollution
A vulnerability was found in locutusjs locutus up to 3.0.24. It has been classified as problematic. This affects an unknown function of the component Query Handler. The manipulation leads to improperly controlled modification of object prot
CVE-2026-33993 | locutusjs locutus up to 3.0.24 unserialize prototype pollution
A vulnerability marked as problematic has been reported in locutusjs locutus up to 3.0.24. Affected by this vulnerability is the function unserialize. Performing a manipulation results in improperly controlled modification of object prototy
CVE-2026-33989 | mobile-next mobile-mcp up to 0.0.48 Fileystem Operation saveTo/output path traversal (GHSA-3p2m-h2v6-g9mx)
A vulnerability was found in mobile-next mobile-mcp up to 0.0.48 and classified as critical. The impacted element is the function mobile_save_screenshot/mobile_start_screen_recording of the component Fileystem Operation Handler. Executing a
CVE-2026-22063 | NetApp ONTAP certificate validation (EUVD-2026-111406)
A vulnerability described as problematic has been identified in NetApp ONTAP, StorageGRID and E-Series SANtricity OS Controller Software. Impacted is an unknown function. Such manipulation leads to improper certificate validation. This vuln
CVE-2026-118358 | Google Chrome up to 156.0.8078.47 WebAudio memory corruption (EUVD-2026-111447)
A vulnerability described as critical has been identified in Google Chrome. The affected element is an unknown function of the component WebAudio. Executing a manipulation can lead to memory corruption. This vulnerability is tracked as CVE-
CVE-2026-118357 | Google Chrome up to 156.0.8078.47 FileSystem use after free (EUVD-2026-111427)
A vulnerability labeled as critical has been found in Google Chrome. This issue affects some unknown processing of the component FileSystem. Such manipulation leads to use after free. This vulnerability is referenced as CVE-2026-118357. It
CVE-2026-118359 | Google Chrome up to 156.0.8078.47 V8 memory corruption (EUVD-2026-111451)
A vulnerability marked as critical has been reported in Google Chrome. Impacted is an unknown function of the component V8. Performing a manipulation results in memory corruption. This vulnerability is identified as CVE-2026-118359. The att
CVE-2026-103995 | Python Software Foundation up to 3.15.x HTTP Response Parsing input validation (EUVD-2026-111382)
A vulnerability described as critical has been identified in Python Software Foundation Python up to 3.15.x. Affected is an unknown function of the component HTTP Response Parsing. Executing a manipulation can lead to improper input validat
CVE-2026-109708 | Mozilla Firefox up to 153.4/157 Networking sandbox (Nessus ID 372630)
A vulnerability has been found in Mozilla Firefox up to 153.4/157 and classified as critical. This issue affects some unknown processing of the component Networking. This manipulation causes sandbox issue. This vulnerability appears as CVE-
CVE-2026-117863 | Mozilla Firefox up to 115.43/153.5/158 Audio Video uninitialized variable (Nessus ID 372631)
A vulnerability classified as critical was found in Mozilla Firefox up to 115.43/153.5/158. The affected element is an unknown function of the component Audio Video. The manipulation results in use of uninitialized variable. This vulnerabil
CVE-2026-117862 | Mozilla Firefox up to 115.43/153.5/158 Networking privileges management (Nessus ID 372631)
A vulnerability was found in Mozilla Firefox up to 115.43/153.5/158 and classified as critical. Affected is an unknown function of the component Networking. Executing a manipulation can lead to improper privilege management. This vulnerabil
CVE-2026-117861 | Mozilla Firefox Navigation sandbox (Nessus ID 372631)
A vulnerability, which was classified as critical, has been found in Mozilla Firefox. The impacted element is an unknown function of the component Navigation Component. This manipulation causes sandbox issue. This vulnerability is registere
CVE-2022-48074 | NoMachine up to 8.2.2 NXS File privilege escalation (EUVD-2022-50788)
A vulnerability marked as problematic has been reported in NoMachine up to 8.2.2. This vulnerability affects unknown code of the component NXS File Handler. The manipulation leads to privilege escalation. This vulnerability is documented as
CVE-2022-48073 | Phicomm K2 22.6.534.263 Admin Password missing encryption (EUVD-2022-50787)
A vulnerability marked as problematic has been reported in Phicomm K2 22.6.534.263. This impacts an unknown function of the component Admin Password Handler. Performing a manipulation results in missing encryption of sensitive data. This vu
CVE-2022-48072 | Phicomm K2G 22.6.3.20 Automatic Upgrade autoUpTime command injection (EUVD-2022-50786)
A vulnerability classified as critical was found in Phicomm K2G 22.6.3.20. Affected by this issue is some unknown functionality of the component Automatic Upgrade Handler. The manipulation of the argument autoUpTime results in command injec