Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 785 | 0,2 % |
| ≥50 % | 3.572 | 0,9 % |
| ≥10 % | 23.058 | 5,6 % |
| <10 % | 380.696 | 93,3 % |
OpenSSH flaw exploited in the wild just hours after disclosure (CVE-2026-123158)
An OpenSSH flaw that lets remote attackers log into passwordless accounts on Alpine Linux and other musl-based systems is being exploited, threat intelligence firm Previdian has warned. The flaw (CVE-2026-123158), nicknamed sshole by Wakefi
CVE-2025-59684 | DigiSign DigiSigner ONE 1.0.4.60 uncontrolled search path
A vulnerability marked as problematic has been reported in DigiSign DigiSigner ONE 1.0.4.60. This vulnerability affects unknown code. This manipulation causes uncontrolled search path. The identification of this vulnerability is CVE-2025-59
CVE-2025-57483 | tawk.to Chatbox Widget 4 cross site scripting
A vulnerability classified as problematic has been found in tawk.to Chatbox Widget 4. The affected element is an unknown function. The manipulation leads to cross site scripting. This vulnerability is referenced as CVE-2025-57483. Remote ex
CVE-2025-57275 | SPDK Storage Performance Development Kit 25.05 NVMe-oF Target buffer overflow
A vulnerability classified as critical was found in SPDK Storage Performance Development Kit 25.05. The affected element is an unknown function of the component NVMe-oF Target. Executing a manipulation can lead to buffer overflow. This vuln
CVE-2025-56449 | Obsidian Scheduler up to 6.3.0 REST API improper authentication (EUVD-2025-31578 / WID-SEC-2025-2158)
A vulnerability classified as critical was found in Obsidian Scheduler up to 6.3.0. This issue affects some unknown processing of the component REST API. Executing a manipulation can lead to improper authentication. This vulnerability is tr
CVE-2025-52042 | Frappe ERPNext 15.57.5 request_for_quotation.py get_rfq_containing_supplier txt sql injection
A vulnerability marked as critical has been reported in Frappe ERPNext 15.57.5. Affected by this vulnerability is the function get_rfq_containing_supplier of the file erpnext/buying/doctype/request_for_quotation/request_for_quotation.py. Th
CVE-2025-52041 | Frappe ERPNext 15.57.5 stock_reconciliation.py get_stock_balance_for inventory_dimensions_dict sql injection
A vulnerability classified as critical was found in Frappe ERPNext 15.57.5. This vulnerability affects the function get_stock_balance_for of the file erpnext/stock/doctype/stock_reconciliation/stock_reconciliation.py. Such manipulation of t
CVE-2025-52040 | Frappe ERPNext 15.57.5 queries.py get_blanket_orders blanket_order_type sql injection
A vulnerability described as critical has been identified in Frappe ERPNext 15.57.5. Affected by this issue is the function get_blanket_orders of the file erpnext/controllers/queries.py. The manipulation of the argument blanket_order_type r
CVE-2025-52039 | Frappe ERPNext 15.57.5 material_request.py get_material_requests_based_on_supplier txt sql injection
A vulnerability classified as critical has been found in Frappe ERPNext 15.57.5. This affects the function get_material_requests_based_on_supplier of the file erpnext/stock/doctype/material_request/material_request.py. This manipulation of
CVE-2025-39916 | Linux Kernel up to fd3e613a912bbb344ee18579cc2ad3329aacba41 damon_reclaim_apply_parameters divide by zero (EUVD-2025-31835 / Nessus ID 269681)
A vulnerability identified as critical has been detected in Linux Kernel up to 6.1.152/6.6.106/6.12.47/6.16.7/fd3e613a912bbb344ee18579cc2ad3329aacba41. This impacts the function damon_reclaim_apply_parameters. The manipulation leads to divi
CVE-2025-39891 | Linux Kernel up to 6.16.5 mwifiex_init_channel_scan_gap privilege escalation (Nessus ID 274583 / WID-SEC-2025-2170)
A vulnerability has been found in Linux Kernel up to 6.16.5 and classified as problematic. Affected by this vulnerability is the function mwifiex_init_channel_scan_gap. Performing a manipulation results in privilege escalation. This vulnera
[UPDATE] [mittel] Keycloak: Schwachstelle ermöglicht Erlangen von Administratorrechten
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Keycloak ausnutzen, um Administratorrechte zu erlangen. Weiterlesen
[UPDATE] [hoch] SuiteCRM: Schwachstelle ermöglicht SQL-Injection
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in SuiteCRM ausnutzen, um einen SQL-Injection Angriff durchzuführen. Weiterlesen
[UPDATE] [mittel] dbus: Schwachstelle ermöglicht Denial of Service
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in dbus ausnutzen, um einen Denial of Service Angriff durchzuführen. Weiterlesen
[NEU] [mittel] QT: Schwachstelle ermöglicht Offenlegung von Informationen
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in QT ausnutzen, um Informationen offenzulegen. Weiterlesen
[NEU] [mittel] Angular: Schwachstelle ermöglicht Offenlegung von Informationen
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Angular ausnutzen, um Informationen offenzulegen. Weiterlesen
[NEU] [mittel] LibreOffice: Schwachstelle ermöglicht Denial-of-Service
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in LibreOffice ausnutzen, um einen Denial-of-Service-Angriff durchzuführen. Weiterlesen
[NEU] [UNGEPATCHT] [mittel] Ansible: Schwachstelle ermöglicht Offenlegung von Informationen
Ein lokaler Angreifer kann eine Schwachstelle in Ansible ausnutzen, um Informationen offenzulegen. Weiterlesen
[NEU] [mittel] Langflow: Schwachstelle ermöglicht Denial of Service
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Langflow ausnutzen, um einen Denial of Service Angriff durchzuführen. Weiterlesen
[NEU] [hoch] MariaDB: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in MariaDB ausnutzen, um Sicherheitsvorkehrungen zu umgehen, und Dateien zu manipulieren oder Informationen offenzulegen. Weiterlesen
Microsoft Paint: RCE-Fix kommt nur über Store-Update
LONDON (IT BOLTWISE) – Für Microsoft Paint ist ein Fix für eine Remote-Code-Execution-Lücke jetzt im Microsoft Store verfügbar. Windows Update liefert den Patch offenbar nicht automatisch, weil Paint als Store-App getrennt aktualisiert wird
CVE-2026-119178 | shark986 Smart Cookie Kit Plugin up to 2.3.2 on WordPress comment cross site scripting (EUVD-2026-118197)
A vulnerability, which was classified as problematic, has been found in shark986 Smart Cookie Kit Plugin up to 2.3.2 on WordPress. Impacted is an unknown function. This manipulation of the argument Comment causes cross site scripting. This
CVE-2026-107658 | themekraft BuddyForms Plugin up to 2.10.5 on WordPress Customize Changeset bf_post_type/buddyforms_form_content cross site scripting (EUVD-2026-118198)
A vulnerability has been found in themekraft BuddyForms Plugin up to 2.10.5 on WordPress and classified as problematic. The impacted element is an unknown function of the component Customize Changeset. Performing a manipulation of the argum
CVE-2026-120035 | meIsle RSS Aggregator Plugin up to 5.2.13 on WordPress item_title cross site scripting (EUVD-2026-118199)
A vulnerability was found in meIsle RSS Aggregator Plugin up to 5.2.13 on WordPress. It has been declared as problematic. Affected is an unknown function. The manipulation of the argument item_title results in cross site scripting. This vul
CVE-2026-103908 | mohammed_kaludi AMP for WP Plugin up to 1.1.18 on WordPress Shortcode Execution do_shortcode ampforwp-cat-description code injection (EUVD-2026-118200)
A vulnerability described as critical has been identified in mohammed_kaludi AMP for WP Plugin up to 1.1.18 on WordPress. This affects the function do_shortcode of the component Shortcode Execution. Executing a manipulation of the argument
CVE-2026-103002 | GPUStack up to 2.2.1 cluster_apiserver_proxy privileges management (EUVD-2026-117177)
A vulnerability labeled as very critical has been found in GPUStack up to 2.2.1. This affects an unknown function of the component cluster_apiserver_proxy. Such manipulation leads to improper privilege management. This vulnerability is uniq
CVE-2026-102894 | GPUStack up to 2.2.1 SAML Callback authentication replay (EUVD-2026-117125)
A vulnerability identified as critical has been detected in GPUStack up to 2.2.1. The impacted element is an unknown function of the component SAML Callback. This manipulation causes authentication bypass by capture-replay. This vulnerabili
CVE-2026-85627 | Apache OFBiz up to 24.09.7 Template Engine special elements in template engine (EUVD-2026-117467)
A vulnerability marked as critical has been reported in Apache OFBiz up to 24.09.7. The impacted element is an unknown function of the component Template Engine. This manipulation causes improper neutralization of special elements used in a
CVE-2022-4138 | GitLab Community Edition/Enterprise Edition Project cross-site request forgery (Issue 383709 / EUVD-2022-51500)
A vulnerability was found in GitLab Community Edition and Enterprise Edition. It has been rated as problematic. Affected by this vulnerability is an unknown functionality of the component Project Handler. The manipulation leads to cross-sit
CVE-2022-4136 | qmpaas leadshop routine (EUVD-2022-51499)
A vulnerability described as problematic has been identified in qmpaas leadshop. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to exposed dangerous routine. The identification of this vulnerab
CVE-2022-4131 | GitLab Community Edition/Enterprise Edition up to 15.5.6/15.6.3/15.7.1 User-Agent Parser denial of service (Issue 383598 / EUVD-2022-51496)
A vulnerability, which was classified as problematic, was found in GitLab Community Edition and Enterprise Edition up to 15.5.6/15.6.3/15.7.1. Affected is an unknown function of the component User-Agent Parser. The manipulation results in d
Version 1.0: OpenSSH - Schwachstelle gefährdet Alpine Linux und weitere Produkte
Weiterlesen
CVE-2025-59362 | Squid Web Proxy up to 7.1 lib/snmplib/asn1.c asn_build_objid encoding error (EUVD-2025-31363 / Nessus ID 266118)
A vulnerability was found in Squid Web Proxy up to 7.1 and classified as problematic. The affected element is the function asn_build_objid in the library lib/snmplib/asn1.c. Executing a manipulation can lead to encoding error. The identific
CVE-2025-58385 | DOXENSE WATCHDOC prior 6.1.0.5094 Active Directory hard-coded credentials
A vulnerability described as critical has been identified in DOXENSE WATCHDOC. Affected by this vulnerability is an unknown functionality of the component Active Directory Handler. Executing a manipulation can lead to hard-coded credentials
CVE-2025-57428 | Each Italy Wireless Mini Router WIRELESS-N 300M 20190211 Telnet Service default credentials (EUVD-2025-31573)
A vulnerability marked as critical has been reported in Each Italy Wireless Mini Router WIRELESS-N 300M 20190211. Affected by this issue is some unknown functionality of the component Telnet Service. This manipulation causes use of default
CVE-2025-57292 | Todoist 8484 Avatar cross site scripting
A vulnerability was found in Todoist 8484. It has been rated as problematic. This impacts an unknown function of the component Avatar Handler. This manipulation causes cross site scripting. This vulnerability is tracked as CVE-2025-57292. T
CVE-2025-56463 | Mercusys MW305R up to 3.30 TLS certificate validation
A vulnerability has been found in Mercusys MW305R up to 3.30 and classified as critical. Impacted is an unknown function of the component TLS Handler. Performing a manipulation results in improper certificate validation. This vulnerability
CVE-2025-52970 | Fortinet FortiWeb up to 7.0.10/7.2.10/7.4.7/7.6.3 parameters (FG-IR-25-448 / WID-SEC-2025-1805)
A vulnerability categorized as critical has been discovered in Fortinet FortiWeb up to 7.0.10/7.2.10/7.4.7/7.6.3. Affected by this issue is some unknown functionality. The manipulation results in improper handling of parameters. This vulner
CVE-2022-4130 | Red Hat Satellite HTTP Header Referer server-side request forgery (EUVD-2022-51495)
A vulnerability was found in Red Hat Satellite. It has been rated as critical. The impacted element is an unknown function of the component HTTP Header Handler. Performing a manipulation of the argument Referer results in server-side reques
CVE-2022-4129 | Linux Kernel L2TP net/l2tp/l2tp_core.c sk_user_data null pointer dereference (FEDORA-2022-24041b1667 / EUVD-2022-51494)
A vulnerability, which was classified as problematic, has been found in Linux Kernel. This vulnerability affects the function sk_user_data of the file net/l2tp/l2tp_core.c of the component L2TP Handler. The manipulation leads to null pointe
CVE-2022-4128 | Linux Kernel MPTCP Protocol null pointer dereference (EUVD-2022-51493)
A vulnerability described as problematic has been identified in Linux Kernel. Affected by this vulnerability is an unknown functionality of the component MPTCP Protocol Handler. Such manipulation leads to null pointer dereference. This vuln
USN-9003-1: Linux kernel (NVIDIA) vulnerabilities
It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds con
CISA Warns Hackers Are Exploiting 18-Year-Old WordPress Core Vulnerability
CVE-2026-119977 lets hackers hijack WordPress sites during core updates. CISA confirms exploitation as users are told to patch… Weiterlesen
USN-9002-1: Linux kernel (NVIDIA Tegra) vulnerabilities
It was discovered that the io_uring subsystem in the Linux kernel did not properly handle canceled task work when processing certain wait operations, leading to the operation being performed in the wrong task context. A local attacker could
CVE-2026-75029 | ISC BIND up to 9.21.25 resource consumption (Nessus ID 362910 / WID-SEC-2026-3420)
A vulnerability, which was classified as critical, has been found in ISC BIND up to 9.18.50/9.18.50-S1/9.20.27/9.20.27-S1/9.21.25. This issue affects some unknown processing. The manipulation leads to resource consumption. This vulnerabilit
CVE-2026-19941 | ISC BIND up to 9.20.27-S1 named input validation (Nessus ID 362910 / WID-SEC-2026-3420)
A vulnerability classified as problematic has been found in ISC BIND up to 9.18.50/9.20.27/9.21.25/9.18.50-S1/9.20.27-S1. This issue affects some unknown processing of the component named. Performing a manipulation results in improper input
CVE-2026-19668 | ISC BIND up to 9.18.50/9.20.27/9.21.25 Recursive Resolver resource consumption (Nessus ID 362910 / WID-SEC-2026-3420)
A vulnerability identified as critical has been detected in ISC BIND up to 9.18.50/9.20.27/9.21.25. This impacts an unknown function of the component Recursive Resolver. The manipulation leads to resource consumption. This vulnerability is
CVE-2026-19662 | ISC BIND up to 9.18.50/9.20.27 named use after free (Nessus ID 362910 / WID-SEC-2026-3420)
A vulnerability classified as critical was found in ISC BIND up to 9.18.50/9.20.27. Impacted is an unknown function of the component named. Executing a manipulation can lead to use after free. This vulnerability is handled as CVE-2026-19662
CVE-2026-19033 | ISC BIND up to 9.21.25 Zone Transfer improper authentication (Nessus ID 362910 / WID-SEC-2026-3420)
A vulnerability classified as very critical has been found in ISC BIND up to 9.18.50/9.18.50-S1/9.20.27/9.20.27-S1/9.21.25. This affects an unknown part of the component Zone Transfer. Performing a manipulation results in improper authentic
CVE-2025-59402 | Flock Safety Bravo Edge AI Compute Device BRAVO_00.00_local_20241017 EDL/QDL incomplete identification of uploaded file variables (EUVD-2025-31164)
A vulnerability described as critical has been identified in Flock Safety Bravo Edge AI Compute Device BRAVO_00.00_local_20241017. Impacted is an unknown function of the component EDL/QDL. Such manipulation leads to incomplete identificatio
CVE-2025-57632 | libsmb2 6.2 SMB2 chained PDU smb2_add_iovector out-of-bounds write (EUVD-2025-31154 / Nessus ID 266116)
A vulnerability classified as critical was found in libsmb2 6.2. This issue affects the function smb2_add_iovector of the component SMB2 chained PDU Handler. Such manipulation leads to out-of-bounds write. This vulnerability is traded as CV
CVE-2025-57446 | O-RAN Near Realtime RIC ric-plt-submgr Subscription Manager API denial of service
A vulnerability classified as problematic has been found in O-RAN Near Realtime RIC ric-plt-submgr. Impacted is an unknown function of the component Subscription Manager API. This manipulation causes denial of service. This vulnerability is
CVE-2025-55560 | PyTorch 2.7.0 torch.Tensor.to_sparse denial of service (Issue 151522 / Nessus ID 266115)
A vulnerability has been found in PyTorch 2.7.0 and classified as problematic. This impacts the function torch.Tensor.to_sparse. The manipulation leads to denial of service. This vulnerability is referenced as CVE-2025-55560. The attack nee
CVE-2025-29155 | petstore 1.0.7 DELETE Endpoint command injection (EUVD-2025-31142)
A vulnerability classified as critical has been found in petstore 1.0.7. Affected by this vulnerability is an unknown functionality of the component DELETE Endpoint. The manipulation leads to command injection. This vulnerability is traded
Sicherheitsrisiko Smartphonewechsel: TU Graz deckt Schwachstelle auf - DerStandard
Zu dieser Erkenntnis sind IT-Sicherheitsforschende der TU Graz und des Zentrums für sichere Informationstechnologie A-SIT in Wien gekommen. Weiterlesen
CVE-2026-123036 | Red Hat ansible-core up to 2.22.x Stdout Callback _task.py CallbackBase._handle_exception information disclosure (Nessus ID 376798)
A vulnerability classified as problematic has been found in Red Hat ansible-core up to 2.22.x. Affected by this vulnerability is the function CallbackBase._handle_exception of the file lib/ansible/_internal/_task.py of the component Stdout
CVE-2026-122127 | CESNET ipfixcol2 up to 2.8.x Lz4 Decoder Lz4Decoder.cpp buffer_size/decompressed_size buffer overflow (Nessus ID 376799)
A vulnerability classified as critical has been found in CESNET ipfixcol2 up to 2.8.x. This affects an unknown part of the file Lz4Decoder.cpp of the component Lz4 Decoder. The manipulation of the argument buffer_size/decompressed_size lead
CVE-2026-120421 | Eclipse Mojarra up to 4.0.28/4.1.19/5.0.0-M11 Client Window jfwid/jakarta.faces.ClientWindow cross site scripting (Nessus ID 376800)
A vulnerability was found in Eclipse Mojarra up to 4.0.28/4.1.19/5.0.0-M11. It has been classified as problematic. The affected element is an unknown function of the component Client Window. This manipulation of the argument jfwid/jakarta.f
CVE-2026-122130 | CESNET ipfixcol2 up to 2.8.x Forwarder output plugin integer overflow (Nessus ID 376803)
A vulnerability was found in CESNET ipfixcol2 up to 2.8.x and classified as critical. The impacted element is an unknown function of the component Forwarder output plugin. Executing a manipulation can lead to integer overflow. This vulnerab
CVE-2026-103653 | Qt up to 5.12.x/6.8.8/6.11.2 CoAP createFromFrame out-of-bounds (Nessus ID 376802)
A vulnerability was found in Qt up to 5.12.x/6.8.8/6.11.2. It has been declared as critical. The impacted element is the function QCoapInternalReply::createFromFrame of the component CoAP Module. Such manipulation leads to out-of-bounds rea