Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 741 | 0,2 % |
| ≥50 % | 3.215 | 0,8 % |
| ≥10 % | 22.047 | 5,8 % |
| <10 % | 354.726 | 93,2 % |
CISA Warns of Active Attacks Exploiting Critical Node2Shell RCE Vulnerability in Node.js
CISA has added CVE-2026-111497, a critical vulnerability in Google Brotli that affects Node.js, to its Known Exploited Vulnerabilities catalog following confirmed evidence of exploitation. Added on October 27, 2026, this flaw allows unauthe
CISA Warns of VMWare ESX Logging Vulnerability Exploited in Attacks
The Cybersecurity and Infrastructure Security Agency has added a VMware ESX logging flaw to its Known Exploited Vulnerabilities catalog following evidence of exploitation. Tracked as CVE-2026-41709, the vulnerability allows an attacker with
China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a security flaw impacting Broadcom VMware ESX to its Known Exploited Vulnerabilities (KEV) catalog, after CrowdStrike revealed that it had been weaponized b
Cisco Secure Firewall 0-Day Vulnerability Exploited in the Wild to Crash SSL VPN Devices
Cisco released security updates for actively exploited CVE-2026-76418, a flaw in Secure Firewall ASA and FTD software that lets unauthenticated remote attackers force device restarts, causing denial of service and disrupting remote access.
Security Researchers Demonstrate Chrome Sandbox Escapes, Telegram Zero-Click Attacks and iOS Zero-Day Research
Security researchers at OffensiveCon Japan 2026 explored topics including Chrome sandbox escapes, zero-click attack surfaces in Telegram, and newly discovered iOS zero-day vulnerabilities. This two-day program took place on October 27–28. T
Fehler in OpenStack Manila lässt Fremde öffentliche Freigaben steuern
Angemeldete Nutzer eines beliebigen Projekts können in OpenStack Manila öffentliche Freigaben fremder Projekte manipulieren und etwa Zugriffsregeln ändern. Korrigiert sind die Versionen 20.0.3, 21.0.3, 22.0.2 und 23.0.1. (Bild: kentoh - s
Re: CVE-2026-109618: PHP-CGI Pointer Underflow → Remote Code Execution (CVSS 9.2)
Posted by fulldisclosure on Oct 28Am 21.10.26 um 07:23 schrieb jose: that is the CVE for the OOM RCE vulnerability in fpm and mod_php. Sure you got the right on? Best regards, Marius Weiterlesen
Hackers Exploit PHP2Shell to Root 25 Servers – Including US Government Affiliates
HOC Shorts | The Breaking Discovery: Cybersecurity researchers uncovered a campaign in which attackers chained the PHP2Shell remote code execution flaw with a Linux kernel privilege escalation exploit (Fragnesia, `CVE-2026-46300`) to compl
CVE-2026-105777 | GitLab up to 19.3.5/19.4.2/19.5.0 information disclosure (WID-SEC-2026-4115)
A vulnerability identified as problematic has been detected in GitLab up to 19.3.5/19.4.2/19.5.0. Affected by this issue is some unknown functionality. The manipulation leads to information disclosure. This vulnerability is listed as CVE-20
CVE-2026-105711 | GitLab up to 19.3.5/19.4.2/19.5.0 Fragment Cache Key information disclosure (WID-SEC-2026-4115)
A vulnerability, which was classified as problematic, was found in GitLab up to 19.3.5/19.4.2/19.5.0. Impacted is an unknown function of the component Fragment Cache Key. Executing a manipulation can lead to information disclosure. This vul
CVE-2026-110354 | HAProxy up to 3.4.5 Parser resource consumption (WID-SEC-2026-4114)
A vulnerability has been found in HAProxy up to 3.4.5 and classified as critical. This affects an unknown function of the component Parser. Performing a manipulation results in resource consumption. This vulnerability is cataloged as CVE-20
CVE-2026-103515 | GitLab up to 19.3.5/19.4.2/19.5.0 Admin Lock Enforcement Controls permission (WID-SEC-2026-4115)
A vulnerability classified as problematic has been found in GitLab up to 19.3.5/19.4.2/19.5.0. This affects an unknown part of the component Admin Lock Enforcement Controls. This manipulation causes permission issues. This vulnerability app
CVE-2026-110353 | HAProxy up to 3.4.5 H2 Frame src/mux_h2.c h2c_handle_ping resource consumption (WID-SEC-2026-4114)
A vulnerability labeled as critical has been found in HAProxy up to 3.4.5. This issue affects the function h2c_handle_ping of the file src/mux_h2.c of the component H2 Frame Handler. Executing a manipulation can lead to resource consumption
CVE-2026-28330 | SolarWinds Observability Self-Hosted cross site scripting (WID-SEC-2026-4162)
A vulnerability identified as problematic has been detected in SolarWinds Observability Self-Hosted. This issue affects some unknown processing. The manipulation leads to cross site scripting. This vulnerability is documented as CVE-2026-28
CVE-2026-77207 | Libreswan Project up to 5.3.2/5.4.0 PKCS#7 SEC_PKCS7GetCertificateList null pointer dereference (WID-SEC-2026-4183)
A vulnerability categorized as critical has been discovered in Libreswan Project Libreswan up to 5.3.2/5.4.0. Affected by this vulnerability is the function SEC_PKCS7GetCertificateList of the component PKCS#7 Handler. The manipulation resul
CVE-2026-114148 | Microsoft ASP.NET Core privileges management (WID-SEC-2026-4162)
A vulnerability was found in Microsoft ASP.NET Core. It has been rated as critical. Affected by this vulnerability is an unknown functionality. This manipulation causes improper privilege management. The identification of this vulnerability
CVE-2026-77206 | Libreswan up to 5.3.2/5.4/5.4.0 EAP null pointer dereference (WID-SEC-2026-4183)
A vulnerability identified as critical has been detected in Libreswan up to 5.3.2/5.4/5.4.0. Affected by this issue is some unknown functionality of the component EAP Handler. This manipulation causes null pointer dereference. This vulnerab
CVE-2026-77205 | Libreswan Project up to 5.3.2 add_decoded_cert denial of service (WID-SEC-2026-4183)
A vulnerability was found in Libreswan Project Libreswan up to 5.3.2. It has been rated as critical. This affects the function add_decoded_cert. This manipulation causes denial of service. This vulnerability appears as CVE-2026-77205. The a
CVE-2026-12887 | Octopus Deploy Octopus Server up to 2026.1.673/2026.2.972/2026.3.5838 NuGet unrestricted upload (WID-SEC-2026-4164)
A vulnerability, which was classified as problematic, was found in Octopus Deploy Octopus Server up to 2026.1.673/2026.2.972/2026.3.5838. Impacted is an unknown function of the component NuGet Handler. The manipulation results in unrestrict
CVE-2026-118803 | Bricks Plugin up to 2.4.3 Query Result Endpoint urlParams weak password hash (EUVD-2026-112502)
A vulnerability described as problematic has been identified in Bricks Plugin up to 2.4.3. Affected by this vulnerability is an unknown functionality of the component Query Result Endpoint. Executing a manipulation of the argument urlParams
CVE-2026-118804 | Bricks Builder Plugin up to 2.4.3 REST Endpoint query_result originalQueryVars access control (EUVD-2026-112503)
A vulnerability was found in Bricks Builder Plugin up to 2.4.3. It has been classified as problematic. This issue affects some unknown processing of the file /wp-json/bricks/v1/query_result of the component REST Endpoint. Performing a manip
CVE-2026-93851 | Mattermost up to 11.7.10/11.8.5/11.9.1 Mention Reminder cross-site request forgery (EUVD-2026-112505)
A vulnerability categorized as problematic has been discovered in Mattermost up to 11.7.10/11.8.5/11.9.1. Affected is an unknown function of the component Mention Reminder Component. Such manipulation leads to cross-site request forgery. Th
CVE-2026-118578 | maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8 Request Forwarder information disclosure (Issue 444 / EUVD-2026-112552)
A vulnerability categorized as problematic has been discovered in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. The affected element is an unknown function of the component Request Forwarder. The manipulation results in information disclosu
CVE-2026-118577 | maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8 Request Forwarder server-side request forgery (Issue 443 / EUVD-2026-112547)
A vulnerability was found in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. It has been rated as critical. Impacted is an unknown function of the component Request Forwarder. The manipulation leads to server-side request forgery. This vulner
CVE-2026-118585 | configuroweb inventariobasico Add Product Page addlist.php product name cross site scripting (EUVD-2026-112557)
A vulnerability, which was classified as problematic, was found in configuroweb inventariobasico c9377cdba474deb3eb5a0704d197b5733af16b47/f9db0c0a04d79ad931c218140df4fb23809d4fab. This vulnerability affects unknown code of the file addlist.
CVE-2026-118579 | D-Link DIR-505 1.10B02 Web Management CGI /secmark1524.cgi main accu/pass/code/hash/cmds backdoor (EUVD-2026-112555)
A vulnerability identified as critical has been detected in D-Link DIR-505 1.10B02. The impacted element is the function main of the file /secmark1524.cgi of the component Web Management CGI. This manipulation of the argument accu/pass/code
CVE-2026-118586 | dfm feedfinder2 up to 0.0.4 feedfinder2.py find_feeds server-side request forgery (Issue 16 / EUVD-2026-112558)
A vulnerability has been found in dfm feedfinder2 up to 0.0.4 and classified as problematic. This issue affects the function find_feeds of the file feedfinder2.py. Performing a manipulation results in server-side request forgery. This vulne
CVE-2026-118589 | nschloe meshio up to 5.3.5 VTK Reader meshio/_vtk_42.py DIMENSIONS memory allocation (Issue 1576 / EUVD-2026-112559)
A vulnerability was found in nschloe meshio up to 5.3.5 and classified as problematic. Impacted is an unknown function of the file meshio/_vtk_42.py of the component VTK Reader. Executing a manipulation of the argument DIMENSIONS can lead t
CVE-2026-95331 | Google Chrome up to 153.0.8010.52 ANGLE out-of-bounds write (Nessus ID 373227)
A vulnerability was found in Google Chrome. It has been classified as critical. This issue affects some unknown processing of the component ANGLE. Performing a manipulation results in out-of-bounds write. This vulnerability is identified as
CVE-2026-106304 | Google Chrome up to 154.0.8037.97 ANGLE out-of-bounds (Nessus ID 373227 / WID-SEC-2026-3761)
A vulnerability, which was classified as critical, was found in Google Chrome. This affects an unknown part of the component ANGLE. Executing a manipulation can lead to out-of-bounds read. The identification of this vulnerability is CVE-202
CVE-2026-106247 | Google Chrome up to 154.0.8037.97 ANGLE buffer overflow (Nessus ID 373227 / WID-SEC-2026-3761)
A vulnerability, which was classified as critical, was found in Google Chrome. This affects an unknown function of the component ANGLE. Executing a manipulation can lead to buffer overflow. This vulnerability appears as CVE-2026-106247. The
CVE-2026-95325 | Google Chrome up to 153.0.8010.52 ANGLE use after free (Nessus ID 373227)
A vulnerability, which was classified as critical, has been found in Google Chrome. Affected by this vulnerability is an unknown functionality of the component ANGLE. The manipulation leads to use after free. This vulnerability is uniquely
CVE-2023-54196 | Linux Kernel up to 5.15.112/6.1.80/6.3.3 ntfs3 null pointer dereference
A vulnerability marked as critical has been reported in Linux Kernel up to 5.15.112/6.1.80/6.3.3. Affected is an unknown function of the component ntfs3. The manipulation leads to null pointer dereference. This vulnerability is traded as CV
CVE-2023-54192 | Linux Kernel up to 6.1.28/6.2.15/6.3.2 f2fs __replace_atomic_write_block null pointer dereference (Nessus ID 281732)
A vulnerability has been found in Linux Kernel up to 6.1.28/6.2.15/6.3.2 and classified as critical. Impacted is the function __replace_atomic_write_block of the component f2fs. The manipulation leads to null pointer dereference. This vulne
CVE-2026-117466 | Octopus Deploy Octopus Server up to 2026.2.13468/2026.3.15862 privileges management (WID-SEC-2026-4164)
A vulnerability described as critical has been identified in Octopus Deploy Octopus Server up to 2026.2.13468/2026.3.15862. This affects an unknown function. Executing a manipulation can lead to improper privilege management. This vulnerabi
CVE-2026-117341 | Octopus Deploy Octopus Server Audit Event Log privileges management (WID-SEC-2026-4164)
A vulnerability marked as problematic has been reported in Octopus Deploy Octopus Server. The impacted element is an unknown function of the component Audit Event Log. Performing a manipulation results in improper privilege management. This
CVE-2026-116870 | Octopus Deploy Octopus Server up to 2026.1.11780/2026.2.13437/2026.3.15815 OIDC Token Issuer Validation improper authentication (WID-SEC-2026-4164)
A vulnerability was found in Octopus Deploy Octopus Server up to 2026.1.11780/2026.2.13437/2026.3.15815. It has been rated as very critical. Affected by this vulnerability is an unknown functionality of the component OIDC Token Issuer Valid
CVE-2026-97255 | WProyal Royal Elementor Addons Plugin up to 1.7.1069 on WordPress authorization (WID-SEC-2026-4184)
A vulnerability labeled as problematic has been found in WProyal Royal Elementor Addons Plugin up to 1.7.1069 on WordPress. The affected element is an unknown function. The manipulation results in authorization bypass. This vulnerability is
CVE-2026-97254 | WProyal Royal Elementor Addons Plugin up to 1.7.1069 on WordPress cross site scripting (WID-SEC-2026-4184)
A vulnerability identified as problematic has been detected in WProyal Royal Elementor Addons Plugin up to 1.7.1069 on WordPress. Impacted is an unknown function. The manipulation leads to cross site scripting. This vulnerability is referen
CVE-2026-112865 | WProyal Royal Elementor Addons Plugin up to 1.7.1069 on WordPress cross site scripting (WID-SEC-2026-4184)
A vulnerability was found in WProyal Royal Elementor Addons Plugin up to 1.7.1069 on WordPress. It has been rated as problematic. This vulnerability affects unknown code. Performing a manipulation results in cross site scripting. This vulne
CVE-2026-107100 | Royal Addons for Elementor Plugin up to 1.7.1069 on WordPress information disclosure (WID-SEC-2026-4184)
A vulnerability was found in Royal Addons for Elementor Plugin up to 1.7.1069 on WordPress and classified as problematic. This affects an unknown part. The manipulation results in information disclosure. This vulnerability is cataloged as C
CVE-2023-7324 | Linux Kernel up to 6.2.2 scsi ses_enclosure_data_process out-of-bounds (Nessus ID 271972 / WID-SEC-2025-2441)
A vulnerability classified as critical was found in Linux Kernel up to 6.2.2. This issue affects the function ses_enclosure_data_process of the component scsi. Executing a manipulation can lead to out-of-bounds read. This vulnerability is r
CVE-2023-53733 | Linux Kernel up to 6.1.41/6.4.6 cls_u32 privilege escalation (Nessus ID 276910 / WID-SEC-2025-2407)
A vulnerability classified as critical has been found in Linux Kernel up to 6.1.41/6.4.6. Affected by this vulnerability is an unknown functionality of the component cls_u32. Performing a manipulation results in privilege escalation. This v
CVE-2023-53727 | Linux Kernel up to 5.10.194/5.15.131/6.1.53/6.5.3 fq_pie_timer privilege escalation (Nessus ID 276841 / WID-SEC-2025-2394)
A vulnerability labeled as critical has been found in Linux Kernel up to 5.10.194/5.15.131/6.1.53/6.5.3. The affected element is the function fq_pie_timer. The manipulation results in privilege escalation. This vulnerability is identified a
CVE-2023-49440 | AhnLab EPP 1.0.15 preview sql injection
A vulnerability was found in AhnLab EPP 1.0.15. It has been classified as critical. Affected is an unknown function. Performing a manipulation of the argument preview results in sql injection. This vulnerability was named CVE-2023-49440. Th
CVE-2023-43000 | Apple macOS/iOS/iPadOS/Safari Web Content use after free (Nessus ID 276570 / WID-SEC-2025-2657)
A vulnerability has been found in Apple macOS, iOS, iPadOS and Safari and classified as critical. This issue affects some unknown processing of the component Web Content Handler. The manipulation leads to use after free. This vulnerability
CVE-2023-37749 | HubSpot 1.29441 REST API Endpoint access control
A vulnerability was found in HubSpot 1.29441 and classified as critical. This impacts an unknown function of the component REST API Endpoint. Such manipulation leads to improper access controls. This vulnerability is uniquely identified as
CVE-2023-53726 | Linux Kernel up to 6.5.2 arm64 arch/arm64/lib/csum.c do_csum out-of-bounds (Nessus ID 297598 / WID-SEC-2025-2394)
A vulnerability, which was classified as critical, was found in Linux Kernel up to 5.10.194/5.15.131/6.1.52/6.4.15/6.5.2. This impacts the function do_csum in the library arch/arm64/lib/csum.c of the component arm64. Executing a manipulatio
CVE-2023-53725 | Linux Kernel up to 6.4.3 ttc_timer_probe memory leak (Nessus ID 276868 / WID-SEC-2025-2394)
A vulnerability was found in Linux Kernel up to 6.4.3. It has been classified as critical. This issue affects the function ttc_timer_probe. Performing a manipulation results in memory leak. This vulnerability is known as CVE-2023-53725. Acc
CVE-2023-53724 | Linux Kernel up to 6.2.2 mfd pcf50633_adc_async_read return value (Nessus ID 276847 / WID-SEC-2025-2394)
A vulnerability was found in Linux Kernel up to 6.2.2 and classified as critical. This vulnerability affects the function pcf50633_adc_async_read of the component mfd. Such manipulation leads to unchecked return value. This vulnerability is
CVE-2023-53723 | Linux Kernel up to 6.3.2 sdma_v4_0_ip denial of service (EUVD-2023-60005 / Nessus ID 276826)
A vulnerability was found in Linux Kernel up to 6.3.2. It has been classified as critical. The impacted element is the function sdma_v4_0_ip. The manipulation leads to denial of service. This vulnerability is traded as CVE-2023-53723. Acces
CVE-2023-53722 | Linux Kernel up to 6.5.4 md raid1_remove_disk out-of-bounds (Nessus ID 276794 / WID-SEC-2025-2394)
A vulnerability has been found in Linux Kernel up to 6.5.4 and classified as critical. This affects the function raid1_remove_disk of the component md. This manipulation causes out-of-bounds read. This vulnerability appears as CVE-2023-5372
CVE-2023-53719 | Linux Kernel up to 6.3.3 serial arc_uart.c arc_serial_probe memory leak (Nessus ID 284758 / WID-SEC-2025-2394)
A vulnerability, which was classified as critical, was found in Linux Kernel up to 6.3.3. Affected by this issue is the function arc_serial_probe of the file drivers/tty/serial/arc_uart.c of the component serial. The manipulation results in
CVE-2023-53718 | Linux Kernel up to 5.10.191/5.15.127/6.1.46/6.4.11 cpu_buffer null pointer dereference (Nessus ID 297090 / WID-SEC-2025-2394)
A vulnerability has been found in Linux Kernel up to 5.10.191/5.15.127/6.1.46/6.4.11 and classified as critical. Impacted is the function cpu_buffer. Performing a manipulation results in null pointer dereference. This vulnerability is repor
CVE-2023-53717 | Linux Kernel up to 6.2.2 ath9k_wmi_rsp_callback out-of-bounds write (Nessus ID 276910 / WID-SEC-2025-2394)
A vulnerability, which was classified as critical, was found in Linux Kernel up to 6.2.2. This issue affects the function ath9k_wmi_rsp_callback. Such manipulation leads to out-of-bounds write. This vulnerability is documented as CVE-2023-5
CVE-2023-53716 | Linux Kernel up to 6.3.4 __skb_tstamp_tx memory leak (Nessus ID 284758 / WID-SEC-2025-2394)
A vulnerability was found in Linux Kernel up to 6.3.4. It has been declared as critical. This affects the function __skb_tstamp_tx. Such manipulation leads to memory leak. This vulnerability is uniquely identified as CVE-2023-53716. The att
CVE-2023-53715 | Linux Kernel up to 6.3.3 uninitialized pointer (Nessus ID 276910 / WID-SEC-2025-2394)
A vulnerability classified as critical has been found in Linux Kernel up to 6.3.3. The affected element is an unknown function. This manipulation causes uninitialized pointer. This vulnerability is registered as CVE-2023-53715. The attack r
CVE-2023-53712 | Linux Kernel up to 5.15.132/6.1.54/6.5.4 machine_crash_nonpanic_core denial of service (Nessus ID 302439 / WID-SEC-2025-2394)
A vulnerability classified as critical was found in Linux Kernel up to 5.15.132/6.1.54/6.5.4. Affected is the function machine_crash_nonpanic_core. Executing a manipulation can lead to denial of service. This vulnerability is registered as
CVE-2023-53707 | Linux Kernel up to 6.1.46/6.4.11 amdgpu amdgpu_cs_pass1 integer overflow (EUVD-2023-60021 / Nessus ID 276910)
A vulnerability classified as critical has been found in Linux Kernel up to 6.1.46/6.4.11. Affected by this issue is the function amdgpu_cs_pass1 of the component amdgpu. The manipulation leads to integer overflow. This vulnerability is lis
CVE-2023-53705 | Linux Kernel up to 6.3.4 ipv6 ipv6_find_tlv out-of-bounds (Nessus ID 276910 / WID-SEC-2025-2394)
A vulnerability described as critical has been identified in Linux Kernel up to 6.3.4. Affected by this vulnerability is the function ipv6_find_tlv of the component ipv6. Executing a manipulation can lead to out-of-bounds read. This vulnera