Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 725 | 0,2 % |
| ≥50 % | 3.222 | 0,9 % |
| ≥10 % | 22.088 | 5,9 % |
| <10 % | 347.137 | 93,0 % |
Critical HPE Aruba AOS-8 Flaw Allows Hackers to Bypass SSH Authentication and Take Over Systems
Hewlett Packard Enterprise (HPE) has addressed a critical authentication-bypass vulnerability in the SSH daemon of its AOS-8 wireless operating system. This vulnerability, tracked as CVE-2026-79855, could let a remote, unauthenticated attac
CVE-2026-87911
Read this article This article has been indexed from Latest Bulletins Read the original article: CVE-2026-87911 The post CVE-2026-87911 appeared first on IT Security News. Weiterlesen
PHP2Shell: Exposure and Response with the CrowdStrike Falcon Platform
YouTube VideoPHP2Shell (CVE-2026-109618 and CVE-2026-109619) introduces two critical remote code execution vulnerabilities affecting PHP, making it important for security teams to identify affected systems, understand their exposure, and in
CVE-2026-79881 | HPE AOS-8 up to 8.10.0.23/8.13.3.0 improper authentication (WID-SEC-2026-4125)
A vulnerability has been found in HPE AOS-8 up to 8.10.0.23/8.13.3.0 and classified as critical. Affected by this issue is some unknown functionality. Performing a manipulation results in improper authentication. This vulnerability is repor
Did Ukraine's Drone Strikes Really Take Down Russian Bots? | Threat Wire
YouTube VideoDid Ukraine’s drone strikes on Russian data centers really knock bot traffic down by 90%—and what does that mean for online disinformation? This week on Hack5’s Threat Wire, Ali breaks down Cloudflare’s findings, revisits resea
CVE-2026-85788 – Issue with awslabs mysql-mcp-server
Read this article This article has been indexed from Latest Bulletins Read the original article: CVE-2026-85788 – Issue with awslabs mysql-mcp-server The post CVE-2026-85788 – Issue with awslabs mysql-mcp-server appeared first on IT Securit
CVE-2026-85787 – An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server to modify data beyond the read-only scope
Read this article This article has been indexed from Latest Bulletins Read the original article: CVE-2026-85787 – An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server to modify data b
CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server
Read this article This article has been indexed from Latest Bulletins Read the original article: CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and M
CVE-2022-47697 | Comfast CF-WR623N up to 2.3.0.1 password recovery (EUVD-2022-50456)
A vulnerability, which was classified as critical, has been found in Comfast CF-WR623N up to 2.3.0.1. This vulnerability affects unknown code. This manipulation causes weak password recovery. This vulnerability is handled as CVE-2022-47697.
CVE-2022-47696 | GNU Binutils up to 2.39.2 compare_symbols denial of service (EUVD-2022-50455 / Nessus ID 234873)
A vulnerability was found in GNU Binutils up to 2.39.2. It has been declared as problematic. This impacts the function compare_symbols. Executing a manipulation can lead to denial of service. This vulnerability is handled as CVE-2022-47696.
CVE-2022-47695 | GNU Binutils up to 2.39.2 objdump match-o.c bfd_mach_o_get_synthetic_symtab privilege escalation (EUVD-2022-50454)
A vulnerability identified as critical has been detected in GNU Binutils up to 2.39.2. This affects the function bfd_mach_o_get_synthetic_symtab of the file match-o.c of the component objdump. The manipulation leads to privilege escalation.
CVE-2022-47673 | GNU Binutils up to 2.39.2 addr2line parse_module out-of-bounds (EUVD-2022-50432 / Nessus ID 234877)
A vulnerability categorized as problematic has been discovered in GNU Binutils up to 2.39.2. Affected by this issue is the function parse_module of the component addr2line. Executing a manipulation can lead to out-of-bounds read. This vulne
CVE-2022-47665 | Libde265 1.0.9 set_SliceAddrRS heap-based overflow (Issue 369 / EUVD-2022-50424)
A vulnerability was found in Libde265 1.0.9. It has been classified as critical. The affected element is the function de265_image::set_SliceAddrRS. This manipulation causes heap-based buffer overflow. This vulnerability appears as CVE-2022-
PHP Warns of New Code Execution Flaw Days After PHP2Shell Patches
PHP warns of a new, unlikely code execution flaw, CVE-2026-115560, and advises disabling session upload progress until a fix is released. PHP has warned of a new code execution vulnerability, tracked as CVE-2026-115560, just two days after
Oracle patches 1295 security vulnerabilities in October, including six scoring 10.0
Oracle has patched 1295 security vulnerabilities with its October Critical Patch Update Advisory; six of them scored the highest vulnerability rating of 10.0 on the CVSS version 3.1 scale. The company’s flagship Oracle E-Business Suite was
CVE-2025-68729 | Linux Kernel up to 6.17.12/6.18.1 wifi ath12k_hal_desc_reo_parse_err buffer overflow (Nessus ID 279834 / WID-SEC-2025-2920)
A vulnerability marked as critical has been reported in Linux Kernel up to 6.17.12/6.18.1. Affected by this issue is the function ath12k_hal_desc_reo_parse_err of the component wifi. This manipulation causes buffer overflow. This vulnerabil
CVE-2025-68374 | Linux Kernel up to 6.12.62/6.17.12/6.18.1 md_wakeup_thread use after free (Nessus ID 279706 / WID-SEC-2025-2920)
A vulnerability described as critical has been identified in Linux Kernel up to 6.12.62/6.17.12/6.18.1. Affected is the function md_wakeup_thread. The manipulation results in use after free. This vulnerability was named CVE-2025-68374. The
CVE-2025-68368 | Linux Kernel up to 6.18.1 md_run null pointer dereference (Nessus ID 279769 / WID-SEC-2025-2920)
A vulnerability was found in Linux Kernel up to 6.18.1. It has been classified as critical. Impacted is the function md_run. The manipulation leads to null pointer dereference. This vulnerability is traded as CVE-2025-68368. Access to the l
CVE-2025-68360 | Linux Kernel up to 6.17.12/6.18.1 wed_hif2 state issue (Nessus ID 279699 / WID-SEC-2025-2920)
A vulnerability classified as critical was found in Linux Kernel up to 6.17.12/6.18.1. This impacts the function wed_hif2. The manipulation results in state issue. This vulnerability is identified as CVE-2025-68360. The attack can only be p
CVE-2025-68359 | Linux Kernel up to 6.17.12/6.18.1 btrfs kfree double free (Nessus ID 279727 / WID-SEC-2025-2920)
A vulnerability was found in Linux Kernel up to 6.17.12/6.18.1. It has been declared as critical. This issue affects the function kfree of the component btrfs. The manipulation results in double free. This vulnerability is reported as CVE-2
CVE-2025-68356 | Linux Kernel up to 6.12.62/6.17.12/6.18.1 new_inode allocation of resources (Nessus ID 279734 / WID-SEC-2025-2920)
A vulnerability identified as critical has been detected in Linux Kernel up to 6.12.62/6.17.12/6.18.1. This vulnerability affects the function new_inode. The manipulation leads to allocation of resources. This vulnerability is referenced as
CVE-2025-68353 | Linux Kernel up to 6.18.1 net vxlan_xmit_one null pointer dereference (Nessus ID 279713 / WID-SEC-2025-2920)
A vulnerability has been found in Linux Kernel up to 6.18.1 and classified as critical. Affected by this issue is the function vxlan_xmit_one of the component net. This manipulation causes null pointer dereference. This vulnerability is han
CVE-2025-59529 | Avahi up to 0.9-rc2 server_work resource consumption (GHSA-73wf-3xmj-x82q / EUVD-2025-204402)
A vulnerability identified as problematic has been detected in Avahi up to 0.9-rc2. This affects the function server_work. The manipulation leads to resource consumption. This vulnerability is listed as CVE-2025-59529. The attack must be ca
CVE-2022-24513 | Microsoft Visual Studio 2017 15.9/2019 16.11/2022 17.1 privilege escalation
A vulnerability was found in Microsoft Visual Studio 2017 15.9/2019 16.11/2022 17.1. It has been declared as critical. Affected is an unknown function. Such manipulation leads to privilege escalation. This vulnerability is uniquely identifi
PHP-Sicherheitslücke: Der „Schwarze Oktober“ offenbart die neue Verwundbarkeit im Internet
Sicherheitsbranche spricht vom „Schwarzen Oktober“. „Die Schwachstellen befinden sich direkt in PHP. Damit sind grundsätzlich alle Installationen ... Weiterlesen
CVE-2025-9824 | Mautic up to 4.4.16/5.2.7/6.0.4 response discrepancy
A vulnerability marked as problematic has been reported in Mautic up to 4.4.16/5.2.7/6.0.4. The affected element is an unknown function. The manipulation leads to observable response discrepancy. This vulnerability is documented as CVE-2025
CVE-2025-9823 | Mautic up to 4.4.16/5.2.7/6.0.4 ajax?action=lead:addLeadTags cross site scripting
A vulnerability classified as problematic has been found in Mautic up to 4.4.16/5.2.7/6.0.4. The affected element is an unknown function of the file /s/ajax?action=lead:addLeadTags. This manipulation causes cross site scripting. This vulner
CVE-2025-9822 | Mautic up to 4.4.16/5.2.7/6.0.4 Configuration unverified ownership (GHSA-438m-6mhw-hq5w / EUVD-2025-26505)
A vulnerability was found in Mautic up to 4.4.16/5.2.7/6.0.4. It has been classified as problematic. Affected by this vulnerability is an unknown functionality of the component Configuration Handler. The manipulation leads to unverified own
CVE-2025-9821 | Mautic up to 4.4.16/5.2.7/6.0.4 SummaryUsers server-side request forgery (GHSA-hj6f-7hp7-xg69 / EUVD-2025-26495)
A vulnerability labeled as critical has been found in Mautic up to 4.4.16/5.2.7/6.0.4. The impacted element is an unknown function of the component SummaryUsers. Executing a manipulation can lead to server-side request forgery. This vulnera
CVE-2025-8614 | NoMachine uncontrolled search path
A vulnerability marked as problematic has been reported in NoMachine. This impacts an unknown function. This manipulation causes uncontrolled search path. This vulnerability is registered as CVE-2025-8614. The attack needs to be launched lo
CVE-2025-58611 | Tickera Plugin up to 3.5.5.6 on WordPress cross-site request forgery
A vulnerability classified as problematic was found in Tickera Plugin up to 3.5.5.6 on WordPress. The impacted element is an unknown function. Such manipulation leads to cross-site request forgery. This vulnerability is documented as CVE-20
CVE-2025-58605 | WP Delicious Plugin up to 1.8.7 on WordPress cross site scripting
A vulnerability identified as problematic has been detected in WP Delicious Plugin up to 1.8.7 on WordPress. Affected is an unknown function. This manipulation causes cross site scripting. This vulnerability is tracked as CVE-2025-58605. Th
CVE-2025-58603 | Surfer Plugin up to 1.6.4.574 on WordPress authorization
A vulnerability was found in Surfer Plugin up to 1.6.4.574 on WordPress. It has been declared as problematic. The impacted element is an unknown function. Executing a manipulation can lead to missing authorization. The identification of thi
CVE-2025-58593 | Themeisle Orbit Fox Plugin up to 3.0.0 on WordPress cross site scripting
A vulnerability described as problematic has been identified in Themeisle Orbit Fox Plugin up to 3.0.0 on WordPress. Affected is an unknown function. Such manipulation leads to cross site scripting. This vulnerability is documented as CVE-2
CVE-2025-58351 | Outline up to 0.83.x cross site scripting (GHSA-gcj7-c9jv-fhgf)
A vulnerability labeled as problematic has been found in Outline up to 0.83.x. This vulnerability affects unknown code. The manipulation results in cross site scripting. This vulnerability was named CVE-2025-58351. The attack may be perform
CVE-2025-41000 | UXB London BoomCMS 9.1.4 ui layer (EUVD-2025-26496)
A vulnerability, which was classified as problematic, has been found in UXB London BoomCMS 9.1.4. Affected by this issue is some unknown functionality. Performing a manipulation results in improper restriction of rendered ui layers. This vu
CVE-2022-47664 | Libde265 1.0.9 ff_hevc_put_hevc_qpel_pixels_8_sse buffer overflow (Issue 368 / EUVD-2022-50423)
A vulnerability was found in Libde265 1.0.9 and classified as critical. Impacted is the function ff_hevc_put_hevc_qpel_pixels_8_sse. The manipulation results in buffer overflow. This vulnerability is reported as CVE-2022-47664. The attacker
CVE-2022-47663 | GPAC 2.1-DEV-rev649-ga8f438d20 MP4box filters/reframe_h263.c h263dmx_process buffer overflow (Issue 2360 / EUVD-2022-50422)
A vulnerability has been found in GPAC 2.1-DEV-rev649-ga8f438d20 and classified as critical. This issue affects the function h263dmx_process of the file filters/reframe_h263.c of the component MP4box. This manipulation causes buffer overflo
CVE-2022-47662 | GPAC 2.1-DEV-rev649-ga8f438d20 MP4Box isomedia/media.c Media_GetSample recursion (Issue 2359 / EUVD-2022-50421)
A vulnerability, which was classified as problematic, was found in GPAC 2.1-DEV-rev649-ga8f438d20. This vulnerability affects the function Media_GetSample of the file isomedia/media.c of the component MP4Box. The manipulation results in unc
CVE-2022-47661 | GPAC 2.1-DEV-rev649-ga8f438d20 MP4Box media_tools/av_parsers.c gf_media_nalu_add_emulation_bytes buffer overflow (Issue 2358 / EUVD-2022-50420)
A vulnerability, which was classified as critical, has been found in GPAC 2.1-DEV-rev649-ga8f438d20. This affects the function gf_media_nalu_add_emulation_bytes of the file media_tools/av_parsers.c of the component MP4Box. The manipulation
Sicherheitslücke in Programmiersprache PHP durch Sicherheitsupdate vorerst geschlossen
... 23.10.2026 • 17:00 Uhr. schnell informiert · Cybersicherheit · IT · Sicherheitslücke · Facebook · WhatsApp; Teilen; Mail; Drucken. Zur Startseite. Weiterlesen
CVE-2022-47660 | GPAC 2.1-DEV-rev644-g5c4df2a67 MP4Box isomedia/isom_write.c integer overflow (Issue 2357 / EUVD-2022-50419)
A vulnerability classified as critical was found in GPAC 2.1-DEV-rev644-g5c4df2a67. Affected by this issue is some unknown functionality of the file isomedia/isom_write.c of the component MP4Box. Executing a manipulation can lead to integer
CVE-2022-47659 | GPAC 2.1-DEV-rev644-g5c4df2a67 MP4box gf_bs_read_data buffer overflow (Issue 2354 / EUVD-2022-50418)
A vulnerability classified as critical has been found in GPAC 2.1-DEV-rev644-g5c4df2a67. Affected by this vulnerability is the function gf_bs_read_data of the component MP4box. Performing a manipulation results in buffer overflow. This vuln
CVE-2022-47658 | GPAC 2.1-DEV-rev644-g5c4df2a67 MP4Box media_tools/av_parsers.c gf_hevc_read_vps_bs_internal buffer overflow (Issue 2356 / EUVD-2022-50417)
A vulnerability described as critical has been identified in GPAC 2.1-DEV-rev644-g5c4df2a67. Affected is the function gf_hevc_read_vps_bs_internal of the file media_tools/av_parsers.c of the component MP4Box. Such manipulation leads to buff
CVE-2022-47657 | GPAC 2.1-DEV-rev644-g5c4df2a67 MP4Box media_tools/av_parsers.c hevc_parse_vps_extension buffer overflow (Issue 2355 / EUVD-2022-50416)
A vulnerability marked as critical has been reported in GPAC 2.1-DEV-rev644-g5c4df2a67. This impacts the function hevc_parse_vps_extension of the file media_tools/av_parsers.c of the component MP4Box. This manipulation causes buffer overflo
KI und Cybersicherheit: Wie gefährlich ist die neue PHP-Sicherheitslücke? - Regio TV
KI und Cybersicherheit: Wie gefährlich ist die neue PHP-Sicherheitslücke? | Eine kritische Sicherheitslücke in der Programmiersprache PHP bringt ... Weiterlesen
A backup plugin with wrong file permissions turns shared hosting into root
A backup plugin with wrong file permissions turns shared hosting into root CVE-2026-87886 is a local privilege escalation caused by insecure file permissions in Acronis backup integrations for three hosting control panels. NVD records a CVS
CVE-2022-47656 | GPAC 2.1-DEV-rev617-g85ce76efd MP4box media_tools/av_parsers.c gf_hevc_read_sps_bs_internal buffer overflow (Issue 2353 / EUVD-2022-50415)
A vulnerability labeled as critical has been found in GPAC 2.1-DEV-rev617-g85ce76efd. This affects the function gf_hevc_read_sps_bs_internal of the file media_tools/av_parsers.c of the component MP4box. The manipulation results in buffer ov
CVE-2022-47655 | Libde265 1.0.9 void buffer overflow (Issue 367 / EUVD-2022-50414)
A vulnerability was found in Libde265 1.0.9. It has been declared as critical. The impacted element is the function void. Executing a manipulation can lead to buffer overflow. This vulnerability is registered as CVE-2022-47655. The attack r
CVE-2022-47654 | GPAC 2.1-DEV-rev593-g007bf61a0 MP4box media_tools/av_parsers.c gf_hevc_read_sps_bs_internal buffer overflow (Issue 2350 / EUVD-2022-50413)
A vulnerability identified as critical has been detected in GPAC 2.1-DEV-rev593-g007bf61a0. The impacted element is the function gf_hevc_read_sps_bs_internal of the file media_tools/av_parsers.c of the component MP4box. The manipulation lea
CVE-2022-47653 | GPAC 2.1-DEV-rev593-g007bf61a0 MP4box media_tools/av_parsers.c eac3_update_channels buffer overflow (Issue 2349 / EUVD-2022-50412)
A vulnerability categorized as critical has been discovered in GPAC 2.1-DEV-rev593-g007bf61a0. The affected element is the function eac3_update_channels of the file media_tools/av_parsers.c of the component MP4box. Executing a manipulation
Qilin and INC Exploit Palo Alto VPN Flaw in Ransomware Attacks
Qilin and INC ransomware operators exploit a PAN-OS vulnerability (CVE-2026-0257) to gain VPN access, then steal domain credentials… This article has been indexed from Hackread – Cybersecurity News, Data Breaches, AI and More Read the origi
CVE-2026-79861 | HPE up to 10.4.1.13/10.7.2.6/10.8.1.1 privilege escalation (WID-SEC-2026-4125)
A vulnerability labeled as critical has been found in HPE up to 10.4.1.13/10.7.2.6/10.8.1.1. The impacted element is an unknown function. Such manipulation leads to privilege escalation. This vulnerability is listed as CVE-2026-79861. The a
CVE-2026-77363 | obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback
obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback
CVE-2026-77362 | obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields
obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields
CVE-2026-115797 | Tenda F6 12.02.01.73 Web Management Interface ecos_pw cleartext transmission
A vulnerability labeled as problematic has been found in Tenda F6 12.02.01.73. Affected is an unknown function of the component Web Management Interface. Executing a manipulation of the argument ecos_pw can lead to cleartext transmission of
CVE-2026-115796 | Tenda F6 12.02.01.73 Web Management Interface cross-site request forgery
A vulnerability identified as problematic has been detected in Tenda F6 12.02.01.73. This impacts an unknown function of the component Web Management Interface. Performing a manipulation results in cross-site request forgery. This vulnerabi
CVE-2026-112342 | Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_helper.py that allows authenticated users to retain stale group-based permissions across different spaces by exploiting a cache key keyed only on user id while omitting the active space, with the cached entry's TTL refreshed on every request. Attackers can create their own space to obtain an admin group designation, then switch their active space to a victim spac
Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_helper.py that allows authenticated users to retain stale group-based permissions across different spaces by exploiting a cache key keyed only
CVE-2026-115570 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6, Electron does not block compromised eMudhra intermediate certificates in Chromium networking, Node.js tls, Node.js https, or Node.js fetch. An attacker who holds a certificate issued through one of these intermediates and can intercept network traffic can impersonate a TLS server to an affected applicat
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6, Electron does not block compromised eMudhra intermediate certificates in Chromium
CVE-2026-115569 | Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root through absolute paths, parent segments, dot-prefixed wildcard globs, or symlinks. In version 3.33.1, the same behavior also affects Vitest test.projects paths, Vitest inline-project extends paths, and symlinked script --config paths. Fallow parses the outside files as test-runner conf
Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root through absolute paths, parent segments, dot-prefixed wildcard g