Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 785 | 0,2 % |
| ≥50 % | 3.559 | 0,9 % |
| ≥10 % | 13.139 | 3,2 % |
| <10 % | 396.070 | 95,8 % |
AI Found 948 Linux Kernel Bugs — Here's How OpenAI's Models Did It
Tags: #security #openai #linux #ai OpenAI's o3 and o4-mini reasoning models just changed what we thought AI could do in security research. Working alongside researchers, they surfaced 948 CVE-grade vulnerabilities in the Linux kernel —
CVE-2025-57644 | Accela Automation Platform 22.2.3.0.230103 Test Script Feature server-side request forgery
A vulnerability, which was classified as critical, has been found in Accela Automation Platform 22.2.3.0.230103. Affected by this vulnerability is an unknown functionality of the component Test Script Feature. This manipulation causes serve
CVE-2025-57528 | Tenda AC6 15.03.05.16_multi_TD01 formSetCfm funcname/funcpara1/funcpara2 denial of service
A vulnerability marked as critical has been reported in Tenda AC6 15.03.05.16_multi_TD01. The impacted element is the function formSetCfm. Performing a manipulation of the argument funcname/funcpara1/funcpara2 results in denial of service.
CVE-2025-57295 | H3C NX15V100R015 Administrative Interface /etc/shadow default credentials
A vulnerability identified as very critical has been detected in H3C NX15V100R015. This impacts an unknown function of the file /etc/shadow of the component Administrative Interface. This manipulation causes use of default credentials. The
CVE-2025-56869 | Sync In Server up to 1.1.1 files-manager.service.ts FilesManager.saveMultipart path traversal
A vulnerability classified as critical was found in Sync In Server up to 1.1.1. Affected is the function FilesManager.saveMultipart of the file backend/src/applications/files/services/files-manager.service.ts. The manipulation results in pa
CVE-2025-55888 | ARD Ajax Transaction Manager Endpoint accountName cross site scripting
A vulnerability identified as problematic has been detected in ARD. This issue affects some unknown processing of the component Ajax Transaction Manager Endpoint. This manipulation of the argument accountName causes cross site scripting. Th
CVE-2025-34200 | Vasion Print Virtual Appliance Host/Print Application /etc/issue cleartext storage (EUVD-2025-30260 / WID-SEC-2025-2103)
A vulnerability classified as problematic has been found in Vasion Print Virtual Appliance Host and Print Application. Affected is an unknown function of the file /etc/issue. This manipulation causes cleartext storage of sensitive informati
CVE-2025-57625 | CYRISMA Sensor up to 443 on Windows Cyrisma_Agent Service DataSpotliteAgent.exe permission
A vulnerability was found in CYRISMA Sensor up to 443 on Windows. It has been classified as critical. This impacts an unknown function of the file DataSpotliteAgent.exe of the component Cyrisma_Agent Service. This manipulation causes permis
CVE-2025-57624 | CYRISMA Agent up to 443 uncontrolled search path
A vulnerability labeled as problematic has been found in CYRISMA Agent up to 443. This vulnerability affects unknown code. The manipulation results in uncontrolled search path. This vulnerability was named CVE-2025-57624. The attack needs t
CVE-2025-56562 | Signify Wiz Connected 1.9.1 denial of service
A vulnerability categorized as problematic has been discovered in Signify Wiz Connected 1.9.1. Affected by this issue is some unknown functionality. Executing a manipulation can lead to denial of service. This vulnerability is handled as CV
CVE-2025-56557 | Tuya Smart Life App 5.6.1 Matter Protocol unnecessary privileges (EUVD-2025-29640)
A vulnerability identified as critical has been detected in Tuya Smart Life App 5.6.1. This affects an unknown part of the component Matter Protocol Handler. The manipulation leads to execution with unnecessary privileges. This vulnerabilit
CVE-2025-56295 | code-projects Computer Laboratory System 1.0 unrestricted upload
A vulnerability was found in code-projects Computer Laboratory System 1.0. It has been classified as critical. Impacted is an unknown function. Performing a manipulation results in unrestricted upload. This vulnerability was named CVE-2025-
CVE-2025-56293 | code-projects Human Resource Integrated System 1.0 Add Child Information Section Childs Name cross site scripting
A vulnerability was found in code-projects Human Resource Integrated System 1.0 and classified as problematic. The impacted element is an unknown function of the component Add Child Information Section. Executing a manipulation of the argum
CVE-2025-56280 | code-projects Food Ordering Review System 1.0 cross site scripting
A vulnerability has been found in code-projects Food Ordering Review System 1.0 and classified as problematic. The affected element is an unknown function. Performing a manipulation results in cross site scripting. This vulnerability is kno
CVE-2025-57117 | Rems Employee Management System 1.0 Add Department department.php Department Name cross site scripting
A vulnerability, which was classified as problematic, was found in Rems Employee Management System 1.0. Impacted is an unknown function of the file department.php of the component Add Department Handler. Executing a manipulation of the argu
CVE-2025-56710 | PHPGurukul Student Result Management System 2.0 Profile Page /create-class.php cross-site request forgery
A vulnerability has been found in PHPGurukul Student Result Management System 2.0 and classified as problematic. This affects an unknown function of the file /create-class.php of the component Profile Page. Performing a manipulation results
CVE-2025-56448 | Positron PX360BT 8 authentication replay
A vulnerability described as critical has been identified in Positron PX360BT 8. The affected element is an unknown function. Executing a manipulation can lead to authentication bypass by capture-replay. The identification of this vulnerabi
CVE-2025-56274 | SourceCodester Web-based Pharmacy Product Management System 1.0 access control
A vulnerability, which was classified as critical, was found in SourceCodester Web-based Pharmacy Product Management System 1.0. This affects an unknown part. Such manipulation leads to improper access controls. This vulnerability is docume
CVE-2025-56252 | ServitiumCRM 2.10 URL mobile cross site scripting
A vulnerability labeled as problematic has been found in ServitiumCRM 2.10. This impacts an unknown function of the component URL Handler. Executing a manipulation of the argument mobile can lead to cross site scripting. The identification
CVE-2025-55834 | JeeWMS up to 3.7 logController.do cross site scripting
A vulnerability was found in JeeWMS up to 3.7. It has been declared as problematic. This vulnerability affects unknown code of the file logController.do. Such manipulation leads to cross site scripting. This vulnerability is referenced as C
CVE-2025-52044 | Frappe ERPNext 15.57.5 erpnext/stock/utils.py get_stock_balance inventory_dimensions_dict sql injection
A vulnerability has been found in Frappe ERPNext 15.57.5 and classified as critical. This affects the function get_stock_balance of the file erpnext/stock/utils.py. Performing a manipulation of the argument inventory_dimensions_dict results
CVE-2025-50944 | AVTECH EagleEyes 2.0.0 checkServerTrusted certificate validation
A vulnerability was found in AVTECH EagleEyes 2.0.0. It has been classified as critical. Affected is the function checkServerTrusted. The manipulation leads to improper certificate validation. This vulnerability is listed as CVE-2025-50944.
CVE-2025-44034 | oa_system oasys 1.1 AddrController alph sql injection
A vulnerability, which was classified as critical, was found in oa_system oasys 1.1. The impacted element is an unknown function of the file src/main/Java/cn/gson/oasys/controller/address/AddrController. Such manipulation of the argument al
CVE-2026-17211 | IBM API Connect up to 10.0.8.12/12.1.1.2 denial of service (EUVD-2026-118655)
A vulnerability, which was classified as problematic, has been found in IBM API Connect up to 10.0.8.12/12.1.1.2. This issue affects some unknown processing. The manipulation leads to denial of service. This vulnerability is listed as CVE-2
CVE-2026-110283 | IBM Db2 Genius Hub 1.1.2/1.1.3/1.1.4/1.1.5 resource consumption (EUVD-2026-117104)
A vulnerability classified as problematic was found in IBM Db2 Genius Hub 1.1.2/1.1.3/1.1.4/1.1.5. The affected element is an unknown function. Such manipulation leads to resource consumption. This vulnerability is listed as CVE-2026-110283
CVE-2026-108838 | IBM Db2 Genius Hub 1.1.2/1.1.3/1.1.4/1.1.5 resource consumption (EUVD-2026-117108)
A vulnerability categorized as critical has been discovered in IBM Db2 Genius Hub 1.1.2/1.1.3/1.1.4/1.1.5. This vulnerability affects unknown code. Executing a manipulation can lead to resource consumption. This vulnerability is handled as
CVE-2026-19128 | IBM API Connect up to 12.1.1.2 server-side request forgery (EUVD-2026-118799)
A vulnerability, which was classified as problematic, has been found in IBM API Connect up to 12.1.1.2. This issue affects some unknown processing. Performing a manipulation results in server-side request forgery. This vulnerability is repo
CVE-2026-17202 | IBM API Connect up to 12.1.1.2 information exposure (EUVD-2026-118654)
A vulnerability classified as problematic was found in IBM API Connect up to 12.1.1.2. This impacts an unknown function. Such manipulation leads to information exposure through discrepancy. This vulnerability is referenced as CVE-2026-17202
CVE-2026-17098 | IBM API Connect up to 10.0.8.12/12.1.1.2 information exposure (EUVD-2026-118628)
A vulnerability was found in IBM API Connect up to 10.0.8.12/12.1.1.2. It has been rated as problematic. This issue affects some unknown processing. This manipulation causes information exposure through error message. This vulnerability is
CVE-2026-114713 | UnrealIRCd up to 6.2.7 labeled-response module injection (EUVD-2026-119377)
A vulnerability labeled as critical has been found in UnrealIRCd. Impacted is an unknown function of the component labeled-response module. Executing a manipulation can lead to injection. This vulnerability appears as CVE-2026-114713. The a
CVE-2022-4184 | Google Chrome up to 107.0.5304.121 Autofill Remote Code Execution (EUVD-2022-51545)
A vulnerability marked as critical has been reported in Google Chrome. Affected by this vulnerability is an unknown functionality of the component Autofill. Performing a manipulation results in Remote Code Execution. This vulnerability was
CVE-2022-4183 | Google Chrome up to 107.0.5304.121 Popup Blocker Remote Code Execution (EUVD-2022-51544)
A vulnerability labeled as critical has been found in Google Chrome. Affected is an unknown function of the component Popup Blocker. Such manipulation leads to Remote Code Execution. This vulnerability is uniquely identified as CVE-2022-418
CVE-2022-4182 | Google Chrome up to 107.0.5304.121 Fenced Frames Remote Code Execution (EUVD-2022-51543)
A vulnerability identified as critical has been detected in Google Chrome. This impacts an unknown function of the component Fenced Frames. This manipulation causes Remote Code Execution. This vulnerability is handled as CVE-2022-4182. The
CVE-2022-4181 | Google Chrome up to 107.0.5304.121 Forms use after free (EUVD-2022-51542)
A vulnerability categorized as critical has been discovered in Google Chrome. This affects an unknown function of the component Forms. The manipulation results in use after free. This vulnerability is known as CVE-2022-4181. It is possible
CVE-2022-4180 | Google Chrome up to 107.0.5304.121 Mojo use after free (EUVD-2022-51541)
A vulnerability was found in Google Chrome. It has been rated as critical. The impacted element is an unknown function of the component Mojo. The manipulation leads to use after free. This vulnerability is traded as CVE-2022-4180. It is pos
CVE-2022-4179 | Google Chrome up to 107.0.5304.121 Audio use after free (EUVD-2022-51540)
A vulnerability was found in Google Chrome. It has been declared as critical. The affected element is an unknown function of the component Audio. Executing a manipulation can lead to use after free. This vulnerability appears as CVE-2022-41
CVE-2022-4177 | Google Chrome up to 107.0.5304.121 Extensions use after free (EUVD-2022-51538)
A vulnerability was found in Google Chrome and classified as critical. This issue affects some unknown processing of the component Extensions. Such manipulation leads to use after free. This vulnerability is documented as CVE-2022-4177. The
CVE-2022-4176 | Google Chrome up to 107.0.5304.121 Lacros Graphics out-of-bounds write (EUVD-2022-51537)
A vulnerability has been found in Google Chrome and classified as critical. This vulnerability affects unknown code of the component Lacros Graphics. This manipulation causes out-of-bounds write. This vulnerability is registered as CVE-2022
CVE-2022-4175 | Google Chrome up to 107.0.5304.121 Camera Capture use after free (EUVD-2022-51536)
A vulnerability, which was classified as critical, was found in Google Chrome. This affects an unknown part of the component Camera Capture. The manipulation results in use after free. This vulnerability is cataloged as CVE-2022-4175. The a
CVE-2022-4174 | Google Chrome up to 107.0.5304.121 V8 type confusion (EUVD-2022-51535)
A vulnerability, which was classified as critical, has been found in Google Chrome. Affected by this issue is some unknown functionality of the component V8. The manipulation leads to type confusion. This vulnerability is listed as CVE-2022
CVE-2022-4172 | QEMU ERST Device read_erst_record/write_erst_record integer overflow (Issue 1268 / EUVD-2022-51533)
A vulnerability classified as critical was found in QEMU. This impacts the function read_erst_record/write_erst_record of the component ERST Device Handler. Executing a manipulation can lead to integer overflow. The identification of this v
CVE-2025-59361 | chaos-mesh up to 2.7.2 Chaos Controller Manager os command injection
A vulnerability has been found in chaos-mesh up to 2.7.2 and classified as critical. This impacts an unknown function of the component Chaos Controller Manager. This manipulation causes os command injection. This vulnerability appears as CV
CVE-2025-59360 | chaos-mesh up to 2.7.2 Chaos Controller Manager os command injection
A vulnerability, which was classified as critical, was found in chaos-mesh up to 2.7.2. This affects an unknown function of the component Chaos Controller Manager. The manipulation results in os command injection. This vulnerability is repo
CVE-2025-57579 | Totolink Wi-Fi 6 Router Series Device X2000R-Gh 2.0.0 default password
A vulnerability was found in Totolink Wi-Fi 6 Router Series Device X2000R-Gh 2.0.0. It has been classified as critical. This issue affects some unknown processing. Performing a manipulation results in use of default password. This vulnerabi
CVE-2025-57578 | H3C Magic M Device M2V100R006 default password
A vulnerability has been found in H3C Magic M Device M2V100R006 and classified as critical. This affects an unknown part. This manipulation causes use of default password. The identification of this vulnerability is CVE-2025-57578. It is po
CVE-2025-56467 | AXIS Bank Mobile App 9.9 information disclosure
A vulnerability classified as problematic has been found in AXIS Bank Mobile App 9.9. This impacts an unknown function. Performing a manipulation results in information disclosure. This vulnerability is known as CVE-2025-56467. Attacking lo
CVE-2025-55835 | SueamCMS 0.1.2 unrestricted upload
A vulnerability marked as critical has been reported in SueamCMS 0.1.2. Affected is an unknown function. Performing a manipulation results in unrestricted upload. This vulnerability is reported as CVE-2025-55835. The attack is possible to b
CVE-2025-52074 | PHPGurukul Online Shopping Portal 2.1 quantity cross site scripting
A vulnerability, which was classified as problematic, was found in PHPGurukul Online Shopping Portal 2.1. Affected by this issue is some unknown functionality. The manipulation of the argument quantity results in cross site scripting. This
CVE-2025-57278 | LB-Link BL-CPE300M AX300 4G LTE Router 01.01.02P42U user session
A vulnerability classified as critical was found in LB-Link BL-CPE300M AX300 4G LTE Router 01.01.02P42U. Impacted is an unknown function. Such manipulation leads to manage user sessions. This vulnerability is uniquely identified as CVE-2025
CVE-2025-57060 | Tenda G3 15.11.0.17 dns_forward_rule_store rules stack-based overflow
A vulnerability was found in Tenda G3 15.11.0.17. It has been declared as critical. This affects the function dns_forward_rule_store. The manipulation of the argument rules results in stack-based buffer overflow. This vulnerability is catal
CVE-2025-56556 | Subrion CMS 4.2.1 SQL Query Feature authorization bypass through user-controlled sql primary key (Issue 913 / EUVD-2025-28990)
A vulnerability, which was classified as critical, was found in Subrion CMS 4.2.1. Impacted is an unknown function of the component SQL Query Feature. The manipulation results in authorization bypass through user-controlled sql primary key.
CVE-2025-55996 | Viber Desktop 25.6.0 Message Interface text cross site scripting
A vulnerability was found in Viber Desktop 25.6.0. It has been declared as problematic. Impacted is an unknown function of the component Message Interface. Executing a manipulation of the argument text can lead to basic cross site scripting
CVE-2025-44595 | Halo up to 2.20.17 /halo_host/archives/ cross site scripting
A vulnerability was found in Halo up to 2.20.17. It has been declared as problematic. Affected by this issue is some unknown functionality of the file /halo_host/archives/. Executing a manipulation can lead to cross site scripting. The iden
CVE-2025-44594 | halo up to 2.20.17 upload-from-url server-side request forgery
A vulnerability categorized as critical has been discovered in halo up to 2.20.17. Affected by this vulnerability is an unknown functionality of the file /apis/uc.api.storage.halo.run/v1alpha1/attachments/-/upload-from-url. Executing a mani
CVE-2025-44593 | Halo up to 2.20.12 unrestricted upload
A vulnerability labeled as critical has been found in Halo up to 2.20.12. This issue affects some unknown processing. The manipulation results in unrestricted upload. This vulnerability is reported as CVE-2025-44593. The attack can be launc
CVE-2026-90436 | Apache Axis up to 1.4 deserialization (Nessus ID 377523)
A vulnerability, which was classified as critical, was found in Apache Axis up to 1.4. This affects an unknown part. Such manipulation leads to deserialization. This vulnerability only affects products that are no longer supported by the ma
CVE-2026-73860 | checkpoint-restore Criu up to 4.2.0 rseq redirect (Nessus ID 377522)
A vulnerability labeled as problematic has been found in checkpoint-restore Criu up to 4.2.0. The impacted element is an unknown function of the component rseq. The manipulation results in open redirect. This vulnerability is known as CVE-2
CVE-2025-57540 | Proxmox Virtual Environment 8.4 WebAuthn Relying Party cross site scripting
A vulnerability was found in Proxmox Virtual Environment 8.4. It has been rated as problematic. This issue affects some unknown processing. The manipulation of the argument WebAuthn Relying Party leads to cross site scripting. This vulnerab
CVE-2025-57539 | Proxmox Virtual Environment 8.4 U2F Origin cross site scripting
A vulnerability was found in Proxmox Virtual Environment 8.4. It has been classified as problematic. This affects an unknown part. Performing a manipulation of the argument U2F Origin results in cross site scripting. This vulnerability is i
CVE-2025-57538 | Proxmox Virtual Environment 8.4 Datacenter Configuration Panel cross site scripting
A vulnerability has been found in Proxmox Virtual Environment 8.4 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Datacenter Configuration Panel. This manipulation causes cross site