Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 785 | 0,2 % |
| ≥50 % | 3.559 | 0,9 % |
| ≥10 % | 13.140 | 3,2 % |
| <10 % | 396.069 | 95,8 % |
CVE-2025-57069 | Tenda G3 15.11.0.17 getsinglepppuser pPppUser stack-based overflow
A vulnerability labeled as critical has been found in Tenda G3 15.11.0.17. This impacts the function getsinglepppuser. Such manipulation of the argument pPppUser leads to stack-based buffer overflow. This vulnerability is traded as CVE-2025
CVE-2025-57064 | Tenda G3 15.11.0.17 modifyDhcpRule bindDhcpIndex stack-based overflow
A vulnerability classified as critical was found in Tenda G3 15.11.0.17. The impacted element is the function modifyDhcpRule. Such manipulation of the argument bindDhcpIndex leads to stack-based buffer overflow. This vulnerability is refere
CVE-2025-57063 | Tenda G3 15.11.0.17 formDelPortMapping portMappingIndex stack-based overflow
A vulnerability identified as critical has been detected in Tenda G3 15.11.0.17. This affects the function formDelPortMapping. This manipulation of the argument portMappingIndex causes stack-based buffer overflow. This vulnerability appears
CVE-2025-57061 | Tenda G3 15.11.0.17 formIPMacBindModify ruleId/ip/mac/v6/remark stack-based overflow
A vulnerability classified as critical has been found in Tenda G3 15.11.0.17. The affected element is the function formIPMacBindModify. This manipulation of the argument ruleId/ip/mac/v6/remark causes stack-based buffer overflow. The identi
CVE-2025-57059 | Tenda G3 15.11.0.17 addDhcpRule dhcpIndex stack-based overflow
A vulnerability has been found in Tenda G3 15.11.0.17 and classified as critical. Impacted is the function addDhcpRule. Performing a manipulation of the argument dhcpIndex results in stack-based buffer overflow. This vulnerability is identi
CVE-2025-57058 | Tenda G3 15.11.0.17 formSetDebugCfg pEnable/pLevel/pModule stack-based overflow
A vulnerability, which was classified as critical, was found in Tenda G3 15.11.0.17. This issue affects the function formSetDebugCfg. Such manipulation of the argument pEnable/pLevel/pModule leads to stack-based buffer overflow. This vulner
CVE-2025-57057 | Tenda G3 15.11.0.17 ipMacBindListStore listStr stack-based overflow
A vulnerability has been found in Tenda G3 15.11.0.17 and classified as critical. Affected is the function ipMacBindListStore. The manipulation of the argument listStr leads to stack-based buffer overflow. This vulnerability is listed as CV
CVE-2025-52389 | Envasadora H2O Eireli Soda Cristal 40.20.4 HTTP Request resource injection
A vulnerability labeled as problematic has been found in Envasadora H2O Eireli Soda Cristal 40.20.4. Affected is an unknown function of the component HTTP Request Handler. Such manipulation leads to improper control of resource identifiers.
CVE-2025-52322 | Open5GS up to 2.7.2 SMF denial of service
A vulnerability classified as problematic was found in Open5GS up to 2.7.2. Impacted is an unknown function of the component SMF. Executing a manipulation can lead to denial of service. This vulnerability appears as CVE-2025-52322. The atta
CVE-2025-52288 | Open5GS up to 2.7.5 AMF src/amf/ngap-build.c ngap_build_downlink_nas_transport assertion
A vulnerability described as problematic has been identified in Open5GS up to 2.7.5. Affected by this issue is the function ngap_build_downlink_nas_transport of the file src/amf/ngap-build.c of the component AMF. Executing a manipulation ca
CVE-2025-52277 | YesWiki 4.54 meta configuration robots cross site scripting
A vulnerability described as problematic has been identified in YesWiki 4.54. The affected element is an unknown function. Executing a manipulation of the argument meta configuration robots can lead to cross site scripting. This vulnerabili
CVE-2025-57285 | codeceptjs 3.7.3 lib/utils.js emptyFolder directoryPath command injection
A vulnerability classified as critical has been found in codeceptjs 3.7.3. This affects the function emptyFolder in the library lib/utils.js. The manipulation of the argument directoryPath leads to command injection. This vulnerability is r
CVE-2025-56630 | FoxCMS up to 1.2.5 Column.php column_model sql injection
A vulnerability was found in FoxCMS up to 1.2.5. It has been rated as critical. This issue affects some unknown processing of the file app/admin/controller/Column.php. Performing a manipulation of the argument column_model results in sql in
CVE-2025-56267 | Avigilon ACM 7.10.0.20 Excel File /id_profiles csv injection
A vulnerability was found in Avigilon ACM 7.10.0.20. It has been classified as problematic. This affects an unknown function of the file /id_profiles of the component Excel File Handler. The manipulation leads to csv injection. This vulnera
CVE-2025-56266 | Avigilon ACM 7.10.0.20 Header Host injection
A vulnerability was found in Avigilon ACM 7.10.0.20 and classified as critical. The impacted element is an unknown function of the component Header Handler. Executing a manipulation of the argument Host can lead to injection. This vulnerabi
CVE-2025-56265 | N8N 1.95.3/1.100.1/1.101.1 Chat Trigger unrestricted upload
A vulnerability identified as critical has been detected in N8N 1.95.3/1.100.1/1.101.1. This impacts an unknown function of the component Chat Trigger. This manipulation causes unrestricted upload. This vulnerability is handled as CVE-2025-
CVE-2025-55998 | Smart Search & Filter Shopify App 1.0 filter cross site scripting
A vulnerability was found in Smart Search &amp; Filter Shopify App 1.0. It has been declared as problematic. The affected element is an unknown function. Executing a manipulation of the argument filter can lead to cross site scripting.
CVE-2025-55849 | WeiPHP up to 5.0 SucaiController.class.php sql injection
A vulnerability marked as critical has been reported in WeiPHP up to 5.0. Affected by this vulnerability is an unknown functionality of the file SucaiController.class.php. Performing a manipulation results in sql injection. This vulnerabili
CVE-2025-51586 | PrestaShop up to 8.2.0 Reset Password AdminLoginController.php information disclosure
A vulnerability categorized as problematic has been discovered in PrestaShop up to 8.2.0. This affects an unknown function of the file controllers/admin/AdminLoginController.php of the component Reset Password Handler. The manipulation resu
CVE-2025-57576 | PHPGurukul Online Shopping Portal 2.1 /admin/updateorder.php cross site scripting (EUVD-2025-26736)
A vulnerability, which was classified as problematic, was found in PHPGurukul Online Shopping Portal 2.1. This issue affects some unknown processing of the file /admin/updateorder.php. The manipulation results in cross site scripting. This
CVE-2025-57263 | VX Guestbook 1.07 POST Parameter words.php word sql injection (EUVD-2025-26724)
A vulnerability has been found in VX Guestbook 1.07 and classified as critical. This impacts an unknown function of the file words.php of the component POST Parameter Handler. This manipulation of the argument word causes sql injection. Thi
CVE-2025-56803 | Figma Desktop 125.6.5 on Windows manifest.json child_process.exec build command injection
A vulnerability was found in Figma Desktop 125.6.5 on Windows. It has been rated as critical. This impacts the function child_process.exec of the file manifest.json. This manipulation of the argument build causes command injection. This vul
CVE-2025-56761 | Memos 0.22 Upload Attachment cross site scripting
A vulnerability marked as problematic has been reported in Memos 0.22. This affects an unknown part of the component Upload Attachment Handler. The manipulation leads to cross site scripting. This vulnerability is referenced as CVE-2025-567
CVE-2025-56752 | Ruijie RG-ES ESW_1.0(1)B1P39 HTTP /user.cgi improper authentication
A vulnerability labeled as critical has been found in Ruijie RG-ES ESW_1.0(1)B1P39. This impacts an unknown function of the file /user.cgi of the component HTTP Handler. Such manipulation leads to improper authentication. This vulnerability
CVE-2025-56139 | LinkedIn Mobile App 4.1.1087.2 on Android Link Preview image/title/description ui wrong action
A vulnerability was found in LinkedIn Mobile App 4.1.1087.2 on Android. It has been declared as problematic. This affects an unknown function of the component Link Preview Handler. The manipulation of the argument image/title/description re
CVE-2025-52494 | AdaCore Ada Web Server up to 25.2 SSL length denial of service
A vulnerability was found in AdaCore Ada Web Server up to 25.2. It has been declared as problematic. Impacted is an unknown function of the component SSL Handler. Executing a manipulation of the argument length can lead to denial of service
CVE-2025-45805 | PHPGurukul Doctor Appointment Management System 1.0 cross site scripting
A vulnerability, which was classified as problematic, has been found in PHPGurukul Doctor Appointment Management System 1.0. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. This vu
CVE-2025-22956 | OPSI up to 4.2 ProductPropertyState state issue
A vulnerability, which was classified as problematic, was found in OPSI up to 4.2. The impacted element is an unknown function of the component ProductPropertyState Handler. Such manipulation leads to state issue. This vulnerability is docu
CVE-2025-57151 | PHPGurukul Complaint Management System 2.0 admin/userprofile.php fullname cross site scripting
A vulnerability has been found in PHPGurukul Complaint Management System 2.0 and classified as problematic. This issue affects some unknown processing of the file admin/userprofile.php. This manipulation of the argument fullname causes cros
CVE-2025-57150 | PHPGurukul Complaint Management System 2.0 admin/subcategory.php categoryName cross site scripting
A vulnerability, which was classified as problematic, was found in PHPGurukul Complaint Management System 2.0. This vulnerability affects unknown code of the file admin/subcategory.php. The manipulation of the argument categoryName results
CVE-2025-57149 | PHPGurukul Complaint Management System 2.0 /complaint-details.php cid sql injection
A vulnerability classified as critical has been found in PHPGurukul Complaint Management System 2.0. This affects an unknown function of the file /complaint-details.php. This manipulation of the argument cid causes sql injection. This vulne
CVE-2025-57148 | PHPGurukul Online Shopping Portal 2.0 insert-product.php unrestricted upload
A vulnerability, which was classified as critical, was found in PHPGurukul Online Shopping Portal 2.0. This impacts an unknown function of the file /admin/insert-product.php. Executing a manipulation can lead to unrestricted upload. This vu
CVE-2025-56760 | Memos 0.22 CreateResource Endpoint path traversal
A vulnerability, which was classified as critical, was found in Memos 0.22. This issue affects some unknown processing of the component CreateResource Endpoint. Such manipulation leads to path traversal. This vulnerability is documented as
CVE-2025-56689 | Quest One Identity 7.5.1.20903 MFA Page authentication spoofing
A vulnerability was found in Quest One Identity 7.5.1.20903. It has been rated as critical. The affected element is an unknown function of the component MFA Page. The manipulation leads to authentication bypass by spoofing. This vulnerabili
CVE-2025-56498 | PLDT PGN6401V 0.93.15 /boaform/formPing6 pingAddr os command injection
A vulnerability classified as critical has been found in PLDT PGN6401V 0.93.15. This impacts an unknown function of the file /boaform/formPing6. Performing a manipulation of the argument pingAddr results in os command injection. This vulner
CVE-2025-56435 | FoxCMS up to 1.2.6 /DataBackup.php id sql injection
A vulnerability categorized as critical has been discovered in FoxCMS up to 1.2.6. The impacted element is an unknown function of the file /DataBackup.php. The manipulation of the argument ID results in sql injection. This vulnerability was
CVE-2025-55944 | Slink 1.4.9 SVG File Upload cross site scripting
A vulnerability identified as problematic has been detected in Slink 1.4.9. Affected by this vulnerability is an unknown functionality of the component SVG File Upload. Performing a manipulation results in cross site scripting. This vulnera
CVE-2025-55852 | Tenda AC8 16.03.34.06 formWifiBasicSet buffer overflow
A vulnerability categorized as critical has been discovered in Tenda AC8 16.03.34.06. Affected is the function formWifiBasicSet. Such manipulation leads to buffer overflow. This vulnerability is uniquely identified as CVE-2025-55852. The at
CVE-2026-123776 | RRD::CGI::Image up to 0.01 normalize_params tz locking (EUVD-2026-119210)
A vulnerability was found in RRD::CGI::Image up to 0.01 and classified as problematic. This issue affects the function normalize_params. Such manipulation of the argument tz leads to improper locking. This vulnerability is referenced as CVE
CVE-2026-121265 | SQL::Abstract 1.90_01/2.000001_03/2.000001_04 insert/update/values/generate column sql injection (EUVD-2026-119134)
A vulnerability classified as critical was found in SQL::Abstract 1.90_01/2.000001_03/2.000001_04. Affected by this vulnerability is the function insert/update/values/generate. Executing a manipulation of the argument column can lead to sql
CVE-2026-119516 | Mamunur Rashid Radius Booking Plugin up to 1.0.20 on WordPress deserialization (EUVD-2026-117999)
A vulnerability classified as critical was found in Mamunur Rashid Radius Booking Plugin up to 1.0.20 on WordPress. This affects an unknown part. Such manipulation leads to deserialization. This vulnerability is traded as CVE-2026-119516. T
CVE-2026-120531 | wedevs Subscribe2 Plugin up to 10.47 on WordPress data[ip] cross site scripting (EUVD-2026-119330)
A vulnerability marked as problematic has been reported in wedevs Subscribe2 Plugin up to 10.47 on WordPress. Affected by this issue is some unknown functionality. The manipulation of the argument data[ip] leads to cross site scripting. Thi
CVE-2026-124059 | TOTOLINK CA300-PoE 6.2c.884 /cgi-bin/cstecgi.cgi setWiFiWdsAddConfig ApCliKeyStr buffer overflow (EUVD-2026-119326)
A vulnerability has been found in TOTOLINK CA300-PoE 6.2c.884 and classified as very critical. Affected by this vulnerability is the function setWiFiWdsAddConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ApCliKeyStr
CVE-2026-124058 | TOTOLINK CA300-PoE 6.2c.884 /cgi-bin/cstecgi.cgi setWiFiRepeaterConfig ApCliKeyStr buffer overflow (EUVD-2026-119325)
A vulnerability, which was classified as very critical, was found in TOTOLINK CA300-PoE 6.2c.884. Affected is the function setWiFiRepeaterConfig of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument ApCliKeyStr can lead
CVE-2026-99283 | Linux Kernel up to 6.18.60 conntrack state issue (EUVD-2026-119327)
A vulnerability identified as critical has been detected in Linux Kernel up to 6.18.60. Affected is an unknown function of the component conntrack. Performing a manipulation results in state issue. This vulnerability is identified as CVE-20
CVE-2026-124060 | TOTOLINK CA300-PoE 6.2c.884 /cgi-bin/cstecgi.cgi UploadCustomModule File buffer overflow (EUVD-2026-119328)
A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884 and classified as very critical. Affected by this issue is the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument File results in buffer ov
CVE-2026-99284 | Linux Kernel up to 6.18.60/7.2.14/7.3.1 skbuff skb_zerocopy privileges management (EUVD-2026-119329)
A vulnerability labeled as very critical has been found in Linux Kernel up to 6.18.60/7.2.14/7.3.1. Affected by this vulnerability is the function skb_zerocopy of the component skbuff. Executing a manipulation can lead to improper privilege
CVE-2026-119923 | Amazon Babelfish for PostgreSQL TDS prelogin parser buffer overflow (EUVD-2026-118415)
A vulnerability, which was classified as very critical, was found in Amazon Babelfish for PostgreSQL and Aurora PostgreSQL with Babelfish. This issue affects some unknown processing of the component TDS prelogin parser. The manipulation res
CVE-2026-119924 | AWS/Amazon Babelfish for PostgreSQL TDS RPC procedure-name parser out-of-bounds (EUVD-2026-118419)
A vulnerability described as critical has been identified in AWS/Amazon Babelfish for PostgreSQL and Aurora PostgreSQL with Babelfish. Affected by this vulnerability is an unknown functionality of the component TDS RPC procedure-name parser
CVE-2026-98276 Linux kernel UDP socket flaw: kernel update for CloudLinux
📋 TL;DR — last updated November 7, 2026, 22:30 UTC CVE-2026-98276 (CVSS 7.0, Moderate per Red Hat) is a use-after-free vulnerability in the Linux kernel’s UDP socket code that lets any local user crash the server or become root. Our enginee
CVE-2025-57147 | PHPGurukul Complaint Management System 2.0 user/registration.php fullname/email/contactno sql injection
A vulnerability was found in PHPGurukul Complaint Management System 2.0 and classified as critical. This affects an unknown function of the file user/registration.php. Executing a manipulation of the argument fullname/email/contactno can le
CVE-2025-57146 | PHPGurukul Complaint Management System 2.0 user/reset-password.php mobileno sql injection
A vulnerability has been found in PHPGurukul Complaint Management System 2.0 and classified as critical. Affected is an unknown function of the file user/reset-password.php. The manipulation of the argument mobileno leads to sql injection.
CVE-2025-56608 | SourceCodester Corona Virus Tracker App India 1.0 on Android OkHttpClientWrapper.java handleDigest authentication replay
A vulnerability, which was classified as critical, has been found in SourceCodester Corona Virus Tracker App India 1.0 on Android. This vulnerability affects the function handleDigest of the file OkHttpClientWrapper.java. This manipulation
CVE-2025-55824 | ModStartCMS 9.5.0 information disclosure
A vulnerability described as problematic has been identified in ModStartCMS 9.5.0. Affected is an unknown function. Executing a manipulation can lead to information disclosure. This vulnerability is tracked as CVE-2025-55824. The attack is
CVE-2025-55476 | FireShare FileShare 1.2.25 /api/videos/public sort sql injection (Issue 311 / EUVD-2025-26442)
A vulnerability identified as critical has been detected in FireShare FileShare 1.2.25. The impacted element is an unknown function of the file /api/videos/public. This manipulation of the argument sort causes sql injection. The identificat
CVE-2025-51966 | uTools up to 7.1.1 PDF File Parser cross site scripting (EUVD-2025-26422)
A vulnerability marked as problematic has been reported in uTools up to 7.1.1. This impacts an unknown function of the component PDF File Parser. Performing a manipulation results in cross site scripting. This vulnerability is identified as
CVE-2025-50565 | Doubo ERP 1.0 sql injection (EUVD-2025-26423)
A vulnerability labeled as critical has been found in Doubo ERP 1.0. This affects an unknown function. Such manipulation leads to sql injection. This vulnerability is referenced as CVE-2025-50565. It is possible to launch the attack remotel
CVE-2025-32100 | Samsung Mobile Processor Exynos up to 9110 ROHC Packet out-of-bounds write (EUVD-2025-26420)
A vulnerability, which was classified as critical, has been found in Samsung Mobile Processor Exynos up to 9110. Affected is an unknown function of the component ROHC Packet Handler. The manipulation leads to out-of-bounds write. This vulne
CVE-2025-32098 | Samsung Magician up to 8.3 on Windows Update privileges management (EUVD-2025-26421)
A vulnerability classified as critical has been found in Samsung Magician up to 8.3 on Windows. This affects an unknown function of the component Update Handler. Performing a manipulation results in improper privilege management. This vulne
CVE-2025-26210 | DeepSeek R1 up to 3.1 cross site scripting (EUVD-2025-26507)
A vulnerability has been found in DeepSeek R1 up to 3.1 and classified as problematic. This impacts an unknown function. Performing a manipulation results in cross site scripting. This vulnerability was named CVE-2025-26210. The attack may