Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 725 | 0,2 % |
| ≥50 % | 3.222 | 0,9 % |
| ≥10 % | 22.088 | 5,9 % |
| <10 % | 347.122 | 93,0 % |
CVE-2026-85788 – Issue with awslabs mysql-mcp-server
Read this article This article has been indexed from Latest Bulletins Read the original article: CVE-2026-85788 – Issue with awslabs mysql-mcp-server The post CVE-2026-85788 – Issue with awslabs mysql-mcp-server appeared first on IT Securit
CVE-2026-85787 – An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server to modify data beyond the read-only scope
Read this article This article has been indexed from Latest Bulletins Read the original article: CVE-2026-85787 – An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server to modify data b
CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server
Read this article This article has been indexed from Latest Bulletins Read the original article: CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and M
CVE-2026-115812 and CVE-2026-115813: Issue in Amazon Web Services Multi Model Server
Bulletin ID: 2026-148-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/23/2026 10:30 AM PDT Description: Amazon Web Services Multi Model Server (MMS) is an open source tool for serving machine learning models
Oracle patches 1295 security vulnerabilities in October, including six scoring 10.0
Oracle has patched 1295 security vulnerabilities with its October Critical Patch Update Advisory; six of them scored the highest vulnerability rating of 10.0 on the CVSS version 3.1 scale. The company’s flagship Oracle E-Business Suite was
PHP-Sicherheitslücke: Der „Schwarze Oktober“ offenbart die neue Verwundbarkeit im Internet
Sicherheitsbranche spricht vom „Schwarzen Oktober“. „Die Schwachstellen befinden sich direkt in PHP. Damit sind grundsätzlich alle Installationen ... Weiterlesen
CVE-2022-47664 | Libde265 1.0.9 ff_hevc_put_hevc_qpel_pixels_8_sse buffer overflow (Issue 368 / EUVD-2022-50423)
A vulnerability was found in Libde265 1.0.9 and classified as critical. Impacted is the function ff_hevc_put_hevc_qpel_pixels_8_sse. The manipulation results in buffer overflow. This vulnerability is reported as CVE-2022-47664. The attacker
CVE-2022-47663 | GPAC 2.1-DEV-rev649-ga8f438d20 MP4box filters/reframe_h263.c h263dmx_process buffer overflow (Issue 2360 / EUVD-2022-50422)
A vulnerability has been found in GPAC 2.1-DEV-rev649-ga8f438d20 and classified as critical. This issue affects the function h263dmx_process of the file filters/reframe_h263.c of the component MP4box. This manipulation causes buffer overflo
CVE-2022-47662 | GPAC 2.1-DEV-rev649-ga8f438d20 MP4Box isomedia/media.c Media_GetSample recursion (Issue 2359 / EUVD-2022-50421)
A vulnerability, which was classified as problematic, was found in GPAC 2.1-DEV-rev649-ga8f438d20. This vulnerability affects the function Media_GetSample of the file isomedia/media.c of the component MP4Box. The manipulation results in unc
CVE-2022-47661 | GPAC 2.1-DEV-rev649-ga8f438d20 MP4Box media_tools/av_parsers.c gf_media_nalu_add_emulation_bytes buffer overflow (Issue 2358 / EUVD-2022-50420)
A vulnerability, which was classified as critical, has been found in GPAC 2.1-DEV-rev649-ga8f438d20. This affects the function gf_media_nalu_add_emulation_bytes of the file media_tools/av_parsers.c of the component MP4Box. The manipulation
Sicherheitslücke in Programmiersprache PHP durch Sicherheitsupdate vorerst geschlossen
... 23.10.2026 • 17:00 Uhr. schnell informiert · Cybersicherheit · IT · Sicherheitslücke · Facebook · WhatsApp; Teilen; Mail; Drucken. Zur Startseite. Weiterlesen
CVE-2022-47660 | GPAC 2.1-DEV-rev644-g5c4df2a67 MP4Box isomedia/isom_write.c integer overflow (Issue 2357 / EUVD-2022-50419)
A vulnerability classified as critical was found in GPAC 2.1-DEV-rev644-g5c4df2a67. Affected by this issue is some unknown functionality of the file isomedia/isom_write.c of the component MP4Box. Executing a manipulation can lead to integer
CVE-2022-47659 | GPAC 2.1-DEV-rev644-g5c4df2a67 MP4box gf_bs_read_data buffer overflow (Issue 2354 / EUVD-2022-50418)
A vulnerability classified as critical has been found in GPAC 2.1-DEV-rev644-g5c4df2a67. Affected by this vulnerability is the function gf_bs_read_data of the component MP4box. Performing a manipulation results in buffer overflow. This vuln
CVE-2022-47658 | GPAC 2.1-DEV-rev644-g5c4df2a67 MP4Box media_tools/av_parsers.c gf_hevc_read_vps_bs_internal buffer overflow (Issue 2356 / EUVD-2022-50417)
A vulnerability described as critical has been identified in GPAC 2.1-DEV-rev644-g5c4df2a67. Affected is the function gf_hevc_read_vps_bs_internal of the file media_tools/av_parsers.c of the component MP4Box. Such manipulation leads to buff
CVE-2022-47657 | GPAC 2.1-DEV-rev644-g5c4df2a67 MP4Box media_tools/av_parsers.c hevc_parse_vps_extension buffer overflow (Issue 2355 / EUVD-2022-50416)
A vulnerability marked as critical has been reported in GPAC 2.1-DEV-rev644-g5c4df2a67. This impacts the function hevc_parse_vps_extension of the file media_tools/av_parsers.c of the component MP4Box. This manipulation causes buffer overflo
CVE-2026-109618: Critical PHP2Shell Vulnerability Could Allow Remote Code Execution
A new critical security vulnerability, CVE-2026-109618, has been reported in PHP. It is part of the PHP2Shell security issue and could allow attackers to run malicious code on vulnerable servers. The vulnerability has a CVSS score of 9.2 ou
A backup plugin with wrong file permissions turns shared hosting into root
A backup plugin with wrong file permissions turns shared hosting into root CVE-2026-87886 is a local privilege escalation caused by insecure file permissions in Acronis backup integrations for three hosting control panels. NVD records a CVS
CVE-2022-47656 | GPAC 2.1-DEV-rev617-g85ce76efd MP4box media_tools/av_parsers.c gf_hevc_read_sps_bs_internal buffer overflow (Issue 2353 / EUVD-2022-50415)
A vulnerability labeled as critical has been found in GPAC 2.1-DEV-rev617-g85ce76efd. This affects the function gf_hevc_read_sps_bs_internal of the file media_tools/av_parsers.c of the component MP4box. The manipulation results in buffer ov
CVE-2022-47655 | Libde265 1.0.9 void buffer overflow (Issue 367 / EUVD-2022-50414)
A vulnerability was found in Libde265 1.0.9. It has been declared as critical. The impacted element is the function void. Executing a manipulation can lead to buffer overflow. This vulnerability is registered as CVE-2022-47655. The attack r
CVE-2022-47654 | GPAC 2.1-DEV-rev593-g007bf61a0 MP4box media_tools/av_parsers.c gf_hevc_read_sps_bs_internal buffer overflow (Issue 2350 / EUVD-2022-50413)
A vulnerability identified as critical has been detected in GPAC 2.1-DEV-rev593-g007bf61a0. The impacted element is the function gf_hevc_read_sps_bs_internal of the file media_tools/av_parsers.c of the component MP4box. The manipulation lea
CVE-2022-47653 | GPAC 2.1-DEV-rev593-g007bf61a0 MP4box media_tools/av_parsers.c eac3_update_channels buffer overflow (Issue 2349 / EUVD-2022-50412)
A vulnerability categorized as critical has been discovered in GPAC 2.1-DEV-rev593-g007bf61a0. The affected element is the function eac3_update_channels of the file media_tools/av_parsers.c of the component MP4box. Executing a manipulation
Qilin and INC Exploit Palo Alto VPN Flaw in Ransomware Attacks
Qilin and INC ransomware operators exploit a PAN-OS vulnerability (CVE-2026-0257) to gain VPN access, then steal domain credentials… This article has been indexed from Hackread – Cybersecurity News, Data Breaches, AI and More Read the origi
CVE-2026-79861 | HPE up to 10.4.1.13/10.7.2.6/10.8.1.1 privilege escalation (WID-SEC-2026-4125)
A vulnerability labeled as critical has been found in HPE up to 10.4.1.13/10.7.2.6/10.8.1.1. The impacted element is an unknown function. Such manipulation leads to privilege escalation. This vulnerability is listed as CVE-2026-79861. The a
CVE-2026-115797 | Tenda F6 12.02.01.73 Web Management Interface ecos_pw cleartext transmission
A vulnerability labeled as problematic has been found in Tenda F6 12.02.01.73. Affected is an unknown function of the component Web Management Interface. Executing a manipulation of the argument ecos_pw can lead to cleartext transmission of
CVE-2026-115796 | Tenda F6 12.02.01.73 Web Management Interface cross-site request forgery
A vulnerability identified as problematic has been detected in Tenda F6 12.02.01.73. This impacts an unknown function of the component Web Management Interface. Performing a manipulation results in cross-site request forgery. This vulnerabi
CVE-2022-47637 | XAMPP up to 8.1.12 Installer C:\xampp privileges management (DVRT-2023-0001 / EUVD-2022-50396)
A vulnerability labeled as critical has been found in XAMPP up to 8.1.12. Affected is an unknown function of the file C:\xampp of the component Installer. The manipulation results in improper privilege management. This vulnerability is cata
CVE-2022-47636 | OutSystems Service Studio 11 11.53.30 Build 61739 av_libGLESv2.dll uncontrolled search path (Exploit 51678 / EUVD-2022-50395)
A vulnerability was found in OutSystems Service Studio 11 11.53.30 Build 61739 and classified as problematic. This impacts an unknown function in the library av_libGLESv2.dll. Such manipulation leads to uncontrolled search path. This vulner
CVE-2022-47635 | Wildix WMS ZohoClient.php server-side request forgery (EUVD-2022-50394)
A vulnerability identified as critical has been detected in Wildix WMS. This affects an unknown part of the file ZohoClient.php. The manipulation leads to server-side request forgery. This vulnerability is traded as CVE-2022-47635. Access t
CVE-2022-47634 | Isode M-Link up to 17.0v23 Archive Server (EUVD-2022-50393)
A vulnerability has been found in Isode M-Link up to 17.0v23 and classified as problematic. The affected element is an unknown function of the component Archive Server. The manipulation leads to an unknown weakness. This vulnerability is un
CVE-2022-47632 | Razer Synapse 2.20.15.1104/3/3.7.0228.022817 on Windows bin access control (ID 170772 / EUVD-2022-50392)
A vulnerability categorized as critical has been discovered in Razer Synapse 2.20.15.1104/3/3.7.0228.022817 on Windows. The affected element is an unknown function of the file %PROGRAMDATA%\Razer\Synapse3\Service\bin. The manipulation resul
GitLab Patches Second 10.0 RCE Flaw in October, Forcing Another Security Update
GitLab's latest critical RCE patch fixes CVE-2026-110264, leaving servers updated on October 12 exposed. Check affected versions and security guidance. This article has been indexed from eSecurityPlanet Read the original article: GitLa
CVE-2026-79846 | HPE up to 8.10.0.23/8.13.3.0 input validation (WID-SEC-2026-4125)
A vulnerability, which was classified as very critical, has been found in HPE up to 8.10.0.23/8.13.3.0. This vulnerability affects unknown code. This manipulation causes improper input validation. This vulnerability is handled as CVE-2026-7
CVE-2026-79845 | code-projects Simple Inventory System 1.0 edit.php id sql injection (WID-SEC-2026-4125)
A vulnerability was found in code-projects Simple Inventory System 1.0. It has been classified as critical. This vulnerability affects unknown code of the file /InventoryManagement/edit.php. The manipulation of the argument ID leads to sql
Critical Okta Access Gateway Flaw Lets Attackers With Admin Access Execute System Commands
Okta has disclosed a critical security flaw in Okta Access Gateway that lets an authenticated administrator run system commands through the appliance’s Admin Console. Tracked as CVE-2026-115547, the vulnerability affects versions before 202
CVE-2026-114654 | MongoDB C# Driver up to 3.12.x BSON type conversion (WID-SEC-2026-4126)
A vulnerability was found in MongoDB C# Driver up to 3.12.x. It has been classified as critical. This vulnerability affects unknown code of the component BSON Handler. This manipulation causes incorrect type conversion. This vulnerability i
CVE-2026-114653 | MongoDB C# Driver up to 3.12.x Client-Side Encryption Schema Construction missing encryption (WID-SEC-2026-4126)
A vulnerability categorized as problematic has been discovered in MongoDB C# Driver up to 3.12.x. The affected element is an unknown function of the component Client-Side Encryption Schema Construction. Executing a manipulation can lead to
CVE-2026-114652 | MongoDB C# Driver up to 3.12.x Update-Statement Construction code injection (WID-SEC-2026-4126)
A vulnerability was found in MongoDB C# Driver up to 3.12.x. It has been rated as problematic. This affects an unknown part of the component Update-Statement Construction. This manipulation causes code injection. This vulnerability appears
CVE-2026-114651 | MongoDB C# Driver up to 3.12.x BSON Deserialization information disclosure (WID-SEC-2026-4126)
A vulnerability labeled as problematic has been found in MongoDB C# Driver up to 3.12.x. This affects an unknown part of the component BSON Deserialization. Such manipulation leads to information disclosure. This vulnerability is uniquely i
CVE-2026-100886 | Seetong T8108/T8108P/T8116/T8232 4.6.1.4-build202604241011 Debug Service improper authentication
A vulnerability was found in Seetong T8108, T8108P, T8116 and T8232 4.6.1.4-build202604241011 and classified as very critical. The affected element is an unknown function of the component Debug Service. Such manipulation leads to improper a
CVE-2026-63843 | Linux Kernel up to 6.12.90/6.18.32/7.0.9 Drm Amdgpu Jpeg drm amdgpu jpeg unusual condition
A vulnerability classified as very critical has been found in Linux Kernel up to 6.12.90/6.18.32/7.0.9. The affected element is an unknown function of the file drm amdgpu jpeg of the component Drm Amdgpu Jpeg. This manipulation causes impro
CVE-2026-63842 | Linux Kernel up to 6.12.90/6.18.32/7.0.9 Drm Amdgpu Jpeg drm amdgpu jpeg unusual condition
A vulnerability described as very critical has been identified in Linux Kernel up to 6.12.90/6.18.32/7.0.9. Impacted is an unknown function of the file drm amdgpu jpeg of the component Drm Amdgpu Jpeg. The manipulation results in improper c
CVE-2026-63841 | Linux Kernel up to 6.18.32/7.0.9 Amdgpu Jpeg drm/amdgpu/jpeg user_fence unusual condition
A vulnerability marked as critical has been reported in Linux Kernel up to 6.18.32/7.0.9. This issue affects some unknown processing of the file drm/amdgpu/jpeg of the component Amdgpu Jpeg. The manipulation of the argument user_fence leads
CVE-2026-63840 | Linux Kernel up to 7.0.9 Drm Amdgpu Jpeg /amdgpu/jpeg input validation
A vulnerability labeled as very critical has been found in Linux Kernel up to 7.0.9. This vulnerability affects unknown code of the file /amdgpu/jpeg of the component Drm Amdgpu Jpeg. Executing a manipulation can lead to improper input vali
CVE-2026-15574 | Red Hat OpenShift AI vllm-orchestrator-gateway information disclosure
A vulnerability categorized as problematic has been discovered in Red Hat OpenShift AI. This affects an unknown function of the component vllm-orchestrator-gateway. Such manipulation leads to information disclosure. This vulnerability is tr
CVE-2019-15598 | treekill on Windows code injection
A vulnerability was found in treekill on Windows. It has been classified as critical. This issue affects some unknown processing. This manipulation causes code injection. This vulnerability is handled as CVE-2019-15598. The attack can be in
ZDI-CAN-33367: Linux Kernel Local Root Zero-Day, Mitigation for CloudLinux
📋 TL;DR: last updated 23 October 2026, 14:59 UTCZDI-CAN-33367 (no CVE assigned) is a flaw in the Linux kernel networking stack that lets any local user rewrite files they can only read, which leads to root. A public exploit exists. A Kernel
CVE-2026-115752 | Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URLs. Attackers publishing npm packages with Signal K keywords can make servers request loopback, vessel network, or cloud metadata endpoints, storing image-typed responses served back via the admin UI.
Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URLs. Attackers publishing npm packages with Signal K keywords can make
CVE-2026-115751 | Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist using trailing-dot hostnames. Attackers who control an OpenAPI spec URL or redirect target can append a root dot to a blocked hostname to fetch content from operator-blocked hosts.
Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist using trailing-dot hostnames. Attackers who control an OpenAPI spec URL
CVE-2026-115750 | mcp-from-openapi from 2.5.0 before 2.9.0 contains a credential exposure vulnerability that allows attackers to capture Authorization and Cookie headers because safeFetch() forwards them on cross-origin redirects. Attackers controlling a spec host or abusing an open redirect can redirect fromURL() spec requests to their own origin to steal bearer tokens or cookies.
mcp-from-openapi from 2.5.0 before 2.9.0 contains a credential exposure vulnerability that allows attackers to capture Authorization and Cookie headers because safeFetch() forwards them on cross-origin redirects. Attackers controlling a spe
CVE-2026-115749 | hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an arbitrary module import vulnerability via the ray_pkg_version OmegaConf resolver passing input to importlib.import_module(). Attackers controlling configuration values or command-line overrides can supply a ray_pkg_version interpolation to import any installed module, triggering its import-time side effects in the application process.
hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an arbitrary module import vulnerability via the ray_pkg_version OmegaConf resolver passing input to importlib.import_module(). Attackers controlling configu
CVE-2026-112859 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16.
Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16.
CVE-2026-112858 | Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a through 1.3.3.
Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a through 1.3.3.
CVE-2026-112857 | Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a through 1.0.8.
Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a through 1.0.8.
CVE-2026-112856 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10.
Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10.
CVE-2026-112855 | Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.This issue affects Redy: from n/a through 1.3.5.
Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.This issue affects Redy: from n/a through 1.3.5.
CVE-2026-112854 | Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic Center: from n/a through 1.2.6.
Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic Center: from n/a through 1.2.6.
CVE-2026-112853 | Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1.
Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1.
CVE-2026-112852 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a through 1.1.12.
Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a through 1.1.12.
CVE-2026-112851 | Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9.
Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9.
CVE-2026-112850 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Your Dress your-dress allows PHP Local File Inclusion.This issue affects Your Dress: from n/a through 1.4.1.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Your Dress your-dress allows PHP Local File Inclusion.This issue affects Your Dress: from n/a through 1.4.