Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 725 | 0,2 % |
| ≥50 % | 3.220 | 0,9 % |
| ≥10 % | 22.091 | 5,9 % |
| <10 % | 347.648 | 93,0 % |
CVE-2025-61581 | Apache Traffic Control Traffic Router redos
A vulnerability has been found in Apache Traffic Control and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Traffic Router. Performing a manipulation results in inefficient regular exp
CVE-2025-58963 | 7oroof Medcity Plugin up to 1.1.9 on WordPress unrestricted upload
A vulnerability described as critical has been identified in 7oroof Medcity Plugin up to 1.1.9 on WordPress. This impacts an unknown function. Such manipulation leads to unrestricted upload. This vulnerability is listed as CVE-2025-58963. T
CVE-2025-58958 | ThemeMove SmilePure Plugin up to 1.8.5 on WordPress php file inclusion
A vulnerability classified as critical was found in ThemeMove SmilePure Plugin up to 1.8.5 on WordPress. The affected element is an unknown function. Executing a manipulation can lead to improper control of filename for include/require stat
CVE-2025-58955 | designervily Karzo Plugin up to 2.6 on WordPress php file inclusion (EUVD-2025-35452)
A vulnerability marked as critical has been reported in designervily Karzo Plugin up to 2.6 on WordPress. The affected element is an unknown function. Performing a manipulation results in improper control of filename for include/require sta
CVE-2025-49936 | xtemos WoodMart Plugin up to 8.3.2 on WordPress cross site scripting
A vulnerability was found in xtemos WoodMart Plugin up to 8.3.2 on WordPress. It has been declared as problematic. Impacted is an unknown function. Such manipulation leads to cross site scripting. This vulnerability is referenced as CVE-202
CVE-2025-49935 | xtemos WoodMart Plugin up to 8.3.2 on WordPress php file inclusion
A vulnerability categorized as critical has been discovered in xtemos WoodMart Plugin up to 8.3.2 on WordPress. This vulnerability affects unknown code. The manipulation results in improper control of filename for include/require statement
CVE-2025-49901 | quantumcloud Simple Link Directory Plugin up to 14.8.1 on WordPress authentication bypass
A vulnerability was found in quantumcloud Simple Link Directory Plugin up to 14.8.1 on WordPress. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to authentication bypass using alternate cha
CVE-2025-11715 | Mozilla Thunderbird up to 143 memory corruption (EUVD-2025-34200 / Nessus ID 270625)
A vulnerability classified as critical has been found in Mozilla Thunderbird up to 143. Affected by this vulnerability is an unknown functionality. The manipulation leads to memory corruption. This vulnerability is traded as CVE-2025-11715.
Gefährliche PHP-Sicherheitslücke: Experte warnt vor Vorteil für Hacker | Nachrichten.at
Die schwerwiegende Sicherheitslücke in der Programmiersprache PHP ist nach Ansicht eines Experten der Cyberagentur des Bundes in Deutschland ein ... Weiterlesen
CVE-2025-40774 | Siemens SiPass integrated up to 2.x password recoverable (ssa-599451)
A vulnerability has been found in Siemens SiPass integrated up to 2.x and classified as problematic. This impacts an unknown function. The manipulation leads to storing passwords in a recoverable format. This vulnerability is referenced as
CVE-2025-40771 | Siemens SIMATIC CP 1542SP-1 prior 2.4.24 missing authentication (ssa-486936)
A vulnerability classified as critical was found in Siemens SIMATIC CP 1542SP-1, SIMATIC CP 1542SP-1 IRC, SIMATIC CP 1543SP-1, SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL, SIPLUS ET 200SP CP 1543SP-1 ISEC and SIPLUS ET 200SP CP 1543SP-1 ISEC TX
CVE-2025-11573 | Amazon Amazon.IonDotnet up to 1.3.1 improper validation of syntactic correctness of input (GHSA-q5r6-9qwq-g2wj)
A vulnerability identified as problematic has been detected in Amazon Amazon.IonDotnet up to 1.3.1. This affects an unknown part. The manipulation leads to improper validation of syntactic correctness of input. This vulnerability is documen
CVE-2025-11184 | qwc-services qwc-registration-gui up to 2025.03.31 cross site scripting (ntcf-2025-7724)
A vulnerability classified as problematic has been found in qwc-services qwc-registration-gui up to 2025.03.31. This impacts an unknown function. This manipulation causes cross site scripting. This vulnerability is tracked as CVE-2025-11184
CVE-2025-54289 | Canonical LXD up to 5.21.3/6.4 Operations API missing origin validation in websockets (EUVD-2025-32096 / Nessus ID 270713)
A vulnerability labeled as problematic has been found in Canonical LXD up to 5.21.3/6.4. This vulnerability affects unknown code of the component Operations API. Such manipulation leads to missing origin validation in websockets. This vulne
CVE-2025-10537 | Mozilla Firefox up to 142 memory corruption (EUVD-2025-29557 / Nessus ID 265341)
A vulnerability was found in Mozilla Firefox. It has been classified as critical. The impacted element is an unknown function. Performing a manipulation results in memory corruption. This vulnerability is identified as CVE-2025-10537. The a
CVE-2025-10536 | Mozilla Firefox up to 142 information disclosure (Nessus ID 265350 / WID-SEC-2025-2074)
A vulnerability was found in Mozilla Firefox up to 142 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation results in information disclosure. This vulnerability was named CVE-2025-10536. The
CVE-2025-10533 | Mozilla Firefox up to 142 integer overflow (Nessus ID 265350 / WID-SEC-2025-2074)
A vulnerability classified as problematic was found in Mozilla Firefox up to 142. This affects an unknown function. Such manipulation leads to integer overflow. This vulnerability is traded as CVE-2025-10533. Access to the local network is
CVE-2025-10532 | Mozilla Firefox up to 142 unusual condition (Nessus ID 265341 / WID-SEC-2025-2074)
A vulnerability, which was classified as problematic, has been found in Mozilla Firefox up to 142. This impacts an unknown function. Performing a manipulation results in improper check for unusual conditions. This vulnerability is known as
CVE-2025-10529 | Mozilla Firefox up to 142 cross-domain policy (Nessus ID 265341 / WID-SEC-2025-2074)
A vulnerability described as problematic has been identified in Mozilla Firefox up to 142. The affected element is an unknown function. The manipulation results in permissive cross-domain policy with untrusted domains. This vulnerability is
CVE-2025-10528 | Mozilla Firefox up to 142 protection mechanism (Nessus ID 265341 / WID-SEC-2025-2074)
A vulnerability marked as problematic has been reported in Mozilla Firefox up to 142. Impacted is an unknown function. The manipulation leads to protection mechanism failure. This vulnerability is documented as CVE-2025-10528. The attack re
CVE-2025-10527 | Mozilla Firefox up to 142 use after free (Nessus ID 265341 / WID-SEC-2025-2074)
A vulnerability labeled as problematic has been found in Mozilla Firefox up to 142. This issue affects some unknown processing. Executing a manipulation can lead to use after free. This vulnerability is registered as CVE-2025-10527. The att
CVE-2023-32391 | Apple watchOS up to 9.4 Shortcuts access control (HT213764 / EUVD-2023-36635)
A vulnerability was found in Apple watchOS up to 9.4. It has been classified as problematic. The impacted element is an unknown function of the component Shortcuts. The manipulation leads to improper access controls. This vulnerability is u
BeyondTrust-Lücke: CVSS 9,3, seit August ausgenutzt [2026] - shattered.io
Weitere Warnmeldungen bündelt die Rubrik Cybersicherheit. Cisco Secure Email Gateway: Zweiter Zero-Day in einer Woche. Am 14. Oktober 2026 ... Weiterlesen
CVE-2026-105164 | NASA cFS up to 7.0.1 cfe_fs_api.c CFE_FS_ParseInputFileNameEx out-of-bounds (Issue 893 / EUVD-2026-92130)
A vulnerability has been found in NASA cFS up to 7.0.1 and classified as problematic. This issue affects the function CFE_FS_ParseInputFileNameEx of the file cfe/modules/fs/fsw/src/cfe_fs_api.c. This manipulation causes out-of-bounds read.
Oktober 2026: Erneuter Rekord-Patchday mit 1.415 Microsoft-CVEs - B2B Cyber Security
... Server, Network Policy Server, Windows Error Reporting und Remote Desktop Gateway. Anzeige. Die wichtigsten Microsoft-Schwachstellen. CVE-2026-96951 ... Weiterlesen
CVE-2026-90106 | Linux Kernel up to 7.2.5 Net Bridge ARP ND Proxy race condition (WID-SEC-2026-3444)
A vulnerability marked as very critical has been reported in Linux Kernel up to 7.2.5. This impacts an unknown function of the component Net Bridge ARP ND Proxy. The manipulation leads to race condition. This vulnerability is listed as CVE-
CVE-2026-90105 | Linux Kernel up to 7.2.5 vxlan arp/neigh_reduce race condition (WID-SEC-2026-3444)
A vulnerability categorized as very critical has been discovered in Linux Kernel up to 7.2.5. The affected element is the function arp/neigh_reduce of the component vxlan. Such manipulation leads to race condition. This vulnerability is ref
CVE-2026-90104 | Linux Kernel up to 7.2.5 NFSv4 Callback Decoding decode_cb_sequence_args uninitialized variable (WID-SEC-2026-3444)
A vulnerability was found in Linux Kernel up to 7.2.5. It has been classified as very critical. This vulnerability affects the function decode_cb_sequence_args of the component NFSv4 Callback Decoding. The manipulation leads to use of unini
CVE-2026-90103 | Linux Kernel up to 7.2.5 NFSv4.2 encode_layoutstats buffer overflow (WID-SEC-2026-3444)
A vulnerability was found in Linux Kernel up to 7.2.5 and classified as critical. This affects the function encode_layoutstats of the component NFSv4.2. Executing a manipulation can lead to buffer overflow. This vulnerability is handled as
CVE-2026-90101 | Linux Kernel up to 6.12.109/6.18.51/7.2.5 bnxt_en hwmon_notify_event input validation (WID-SEC-2026-3444)
A vulnerability classified as critical was found in Linux Kernel up to 6.12.109/6.18.51/7.2.5. Affected by this issue is the function hwmon_notify_event of the component bnxt_en. Such manipulation leads to improper input validation. This vu
CVE-2026-90100 | Linux Kernel up to 6.18.51/7.2.5 ptp net_timer_enable_perout period divide by zero (WID-SEC-2026-3444)
A vulnerability, which was classified as critical, was found in Linux Kernel up to 6.18.51/7.2.5. This affects the function net_timer_enable_perout of the component ptp. The manipulation of the argument period results in divide by zero. Thi
CVE-2026-90099 | Linux Kernel up to 7.2.5 Network Scheduler Classifier cls_api.c tcf_exts_init_ex/u32_init_knode/basic_change allocation of resources (WID-SEC-2026-3444)
A vulnerability classified as problematic was found in Linux Kernel up to 7.2.5. This vulnerability affects the function tcf_exts_init_ex/u32_init_knode/basic_change of the file cls_api.c of the component Network Scheduler Classifier. Such
CVE-2026-90098 | Linux Kernel up to 7.2.5 sparx5 kernel/locking/mutex.c sparx5_set_rx_mode (WID-SEC-2026-3444)
A vulnerability was found in Linux Kernel up to 7.2.5. It has been declared as critical. This impacts the function sparx5_set_rx_mode of the file kernel/locking/mutex.c of the component sparx5. Such manipulation leads to improper locking. T
CVE-2026-90097 | Linux Kernel up to 6.18.51/7.2.5 vmbus hv_acpi_init initialization (WID-SEC-2026-3444)
A vulnerability classified as problematic has been found in Linux Kernel up to 6.18.51/7.2.5. This affects the function hv_acpi_init of the component vmbus. This manipulation causes improper initialization. This vulnerability appears as CVE
CVE-2026-90096 | Linux Kernel FUSE fuse_direct_write_iter ki_pos information disclosure (WID-SEC-2026-3444)
A vulnerability classified as problematic was found in Linux Kernel. The affected element is the function fuse_direct_write_iter of the component FUSE. Executing a manipulation of the argument ki_pos can lead to information disclosure. This
CVE-2026-90095 | Linux Kernel FUSE fuse_uring_cmd deadlock (WID-SEC-2026-3444)
A vulnerability was found in Linux Kernel. It has been classified as problematic. This affects the function fuse_uring_cmd of the component FUSE. This manipulation causes deadlock. The identification of this vulnerability is CVE-2026-90095.
CVE-2026-90094 | Linux Kernel up to 6.18.51/7.2.5 arm64 information disclosure (WID-SEC-2026-3444)
A vulnerability classified as problematic has been found in Linux Kernel up to 6.18.51/7.2.5. Impacted is an unknown function of the component arm64. Performing a manipulation results in information disclosure. This vulnerability is reporte
CVE-2026-90093 | Linux Kernel up to 7.2.5 L2CAP l2cap_sock.c l2cap_sock_setsockopt use after free (WID-SEC-2026-3444)
A vulnerability was found in Linux Kernel up to 7.2.5 and classified as very critical. The impacted element is the function l2cap_sock_setsockopt of the file l2cap_sock.c of the component L2CAP. The manipulation results in use after free. T
CVE-2026-90092 | Linux Kernel up to 7.2.5 L2CAP l2cap_sock_new_connection_cb use after free (WID-SEC-2026-3444)
A vulnerability described as very critical has been identified in Linux Kernel up to 6.1.187/6.6.156/6.12.109/6.18.51/7.2.5. This issue affects the function l2cap_sock_new_connection_cb of the component L2CAP. Such manipulation leads to use
CVE-2026-90091 | Linux Kernel up to 7.2.5 L2CAP l2cap_sock_cleanup_listen null pointer dereference (WID-SEC-2026-3444)
A vulnerability has been found in Linux Kernel up to 6.1.187/6.6.156/6.12.109/6.18.51/7.2.5 and classified as very critical. The affected element is the function l2cap_sock_cleanup_listen of the component L2CAP. The manipulation leads to nu
CVE-2026-90089 | Linux Kernel up to 6.18.51/7.2.5 btnxpuart nxp_process_fw_dump out-of-bounds (WID-SEC-2026-3444)
A vulnerability labeled as very critical has been found in Linux Kernel up to 6.18.51/7.2.5. This affects the function nxp_process_fw_dump of the component btnxpuart. The manipulation results in out-of-bounds read. This vulnerability is cat
CVE-2026-90087 | Linux Kernel up to 7.2.5 Bluetooth create_le_conn_complete allocation of resources (WID-SEC-2026-3444)
A vulnerability identified as critical has been detected in Linux Kernel up to 7.2.5. Affected by this issue is the function create_le_conn_complete of the component Bluetooth. The manipulation leads to allocation of resources. This vulnera
CVE-2026-90086 | Linux Kernel up to 6.18.51/7.2.5 xsk xsk_tx_metadata_request state issue (WID-SEC-2026-3444)
A vulnerability categorized as very critical has been discovered in Linux Kernel up to 6.18.51/7.2.5. Affected by this vulnerability is the function xsk_tx_metadata_request of the component xsk. Executing a manipulation can lead to state is
CVE-2026-90085 | Linux Kernel up to 6.12.109/6.18.51/7.2.5 octeontx2-af tm_tree rvu_dbg_nix_tm_tree_display sq_ctx null pointer dereference (WID-SEC-2026-3444)
A vulnerability, which was classified as problematic, has been found in Linux Kernel up to 6.12.109/6.18.51/7.2.5. This issue affects the function rvu_dbg_nix_tm_tree_display of the file /sys/kernel/debug/octeontx2/nix/tm_tree of the compon
CVE-2026-106432 | MongoDB PHP Driver up to 1.21.10/2.1.10/2.5.3 BSON encoder heap-based overflow (Nessus ID 371747 / WID-SEC-2026-3830)
A vulnerability identified as very critical has been detected in MongoDB PHP Driver up to 1.21.10/2.1.10/2.5.3. Affected is an unknown function of the component BSON encoder. Performing a manipulation results in heap-based buffer overflow.
CVE-2026-114629 | Web::Simple up to 0.034 ParamParser get_unpacked_body_from buffer overflow (EUVD-2026-109295 / Nessus ID 371748)
A vulnerability was found in Web::Simple up to 0.034. It has been classified as critical. Impacted is the function Web::Dispatch::ParamParser::get_unpacked_body_from of the component ParamParser. Performing a manipulation results in buffer
CVE-2026-106436 | MongoDB PHP Driver up to 1.21.10/2.1.10/2.5.3 BSON Encoder return value (Nessus ID 371747 / WID-SEC-2026-3830)
A vulnerability categorized as critical has been discovered in MongoDB PHP Driver up to 1.21.10/2.1.10/2.5.3. This impacts an unknown function of the component BSON Encoder. Such manipulation leads to unchecked return value. This vulnerabil
CVE-2026-93577 | GitLab up to 19.2.6/19.3.2/19.4.0 Regular Expression Compilation integer overflow (Nessus ID 371749)
A vulnerability was found in GitLab up to 19.2.6/19.3.2/19.4.0. It has been classified as critical. Affected by this issue is some unknown functionality of the component Regular Expression Compilation. This manipulation causes integer overf
CVE-2026-89078 | GitLab up to 19.2.6/19.3.2/19.4.0 Regular Expression Parsing double free (Nessus ID 371750)
A vulnerability classified as critical has been found in GitLab up to 19.2.6/19.3.2/19.4.0. The affected element is an unknown function of the component Regular Expression Parsing. This manipulation causes double free. This vulnerability is
CVE-2026-116020 | BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments by ID. Attackers with attachment permissions can enumerate sequential attachment IDs to download, rename, relink, or replace files on another user's unpublished draft pages.
BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments by ID. Attackers with attachment permissions can enumerate sequ
CVE-2026-116019 | Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-*@ directives with unset-name@ or integer keys. Attackers with page-edit permission can embed crafted fields in Flex form overrides in page frontmatter to call methods like Folder::delete or Utils::download, deleting directories, overwriting files, or reading files outside the page tree.
Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-*@ directives with unset-name@ or integer keys. Attackers with page-edit permission c
CVE-2026-116018 | ONEARMY community-platform before 2.165.2 contains an insecure direct object reference vulnerability that allows authenticated users to mark other users' notifications as read via POST /api/notifications/:id/read. Attackers can iterate sequential notification IDs to suppress unread indicators of users in the same tenant, causing them to miss replies, comments and new-content notices.
ONEARMY community-platform before 2.165.2 contains an insecure direct object reference vulnerability that allows authenticated users to mark other users' notifications as read via POST /api/notifications/:id/read. Attackers can iterate sequ
CVE-2026-116017 | Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows authenticated users to read other users' device address books. Attackers with a normal or self-registered account can request /device/address-book/{macAddress} with another user's device MAC to obtain contact MACs, aliases, call permissions, and owner user IDs.
Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows authenticated users to read other users' device address books. Attackers wit
CVE-2026-116016 | yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a data-permission-enable header set to false. Attackers can add this header to /admin-api requests, which DataPermissionRpcWebFilter trusts, to read or modify other departments' and users' records within the same tenant.
yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a data-permission-enable header set to false. Attackers can add this header to
CVE-2026-116015 | yudao-cloud through 2026.09 contains an insecure direct object reference vulnerability in the mall trade module that allows authenticated members to read other members' after-sale operation logs by supplying arbitrary afterSaleId values. Attackers can enumerate sequential after-sale IDs against GET /app-api/trade/after-sale-log/list to expose refund amounts, status transitions and timestamps belonging to other members.
yudao-cloud through 2026.09 contains an insecure direct object reference vulnerability in the mall trade module that allows authenticated members to read other members' after-sale operation logs by supplying arbitrary afterSaleId values. At
CVE-2026-116014 | open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions. A malicious OPC UA server can supply DataType definitions via UA_Client_getRemoteDataTypes(), causing decodeBinaryStructure() to overflow the heap, crashing clients or enabling code execution.
open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions. A malicious OPC UA server can supply DataType definitions via UA
CVE-2026-116013 | OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parse_section() and _decode_name() that fails to check resource record lengths against the received message. Attackers controlling or spoofing a queried nameserver can send truncated record headers or RDATA, raising uncaught Lua exceptions in resolver:query() that abort requests and break name resolution.
OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parse_section() and _decode_name() that fails to check resource record lengths against the received message. Attackers controlling or spoofing a quer
CVE-2026-116012 | Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that stores 64-bit string lengths in 32-bit variables. Attackers can supply a crafted packed stream, such as a malicious .sla file, to inject attributes into the decompiler's input or crash the decompiler process.
Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that stores 64-bit string lengths in 32-bit variables. Attackers can supply a crafted packed stream, such
CVE-2026-116011 | Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhaust the worker thread stack, terminating the process and dropping all connections.
Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nes
CVE-2026-116010 | RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying arbitrary student IDs. Attackers can modify the st_arr, values, or attendance POST arrays in MakeReferral.php, EnterEligibility.php, InputFinalGrades.php, and TakeAttendance.php to create referrals, eligibility codes, attendance and final grades for any student in the school.
RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying arbitrary student IDs. Attackers can modify the st_arr, values