Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 777 | 0,2 % |
| ≥50 % | 3.489 | 0,9 % |
| ≥10 % | 22.838 | 5,7 % |
| <10 % | 374.789 | 93,3 % |
APT Vulnerability Lets a MITM Run Code as Root
Debian and Ubuntu patched CVE-2026-109518 on November 4, 2026, an apt vulnerability that lets a man-in-the-middle swap a package after verification and run code as root. I list the fixed releases across eight Ubuntu lines and four Debian se
CVE-2025-65670 | classroomio 0.1.13 resource injection
A vulnerability categorized as problematic has been discovered in classroomio 0.1.13. This issue affects some unknown processing. Such manipulation leads to improper control of resource identifiers. This vulnerability is documented as CVE-2
CVE-2025-65276 | henzljw hashtech 1.0 /admin_index.php access control
A vulnerability classified as critical has been found in henzljw hashtech 1.0. The affected element is an unknown function of the file /admin_index.php. The manipulation leads to improper access controls. This vulnerability is uniquely iden
CVE-2025-65239 | OpenCode USSD Gateway OC 6.13.11 /aux1/ocussd/trace access control
A vulnerability was found in OpenCode USSD Gateway OC 6.13.11. It has been rated as critical. Impacted is an unknown function of the file /aux1/ocussd/trace. This manipulation causes improper access controls. This vulnerability appears as C
CVE-2025-65238 | OpenCode USSD Gateway OC 6.13.11 getSubUsersByProvider access control
A vulnerability, which was classified as problematic, has been found in OpenCode USSD Gateway OC 6.13.11. This affects the function getSubUsersByProvider. Performing a manipulation results in improper access controls. This vulnerability is
CVE-2025-65237 | Opencode USSD Gateway OC cross site scripting
A vulnerability, which was classified as problematic, was found in Opencode USSD Gateway OC. This vulnerability affects unknown code. Executing a manipulation can lead to cross site scripting. This vulnerability is tracked as CVE-2025-65237
CVE-2025-50433 | imonnit 2025-04-24 password recovery
A vulnerability, which was classified as critical, was found in imonnit 2025-04-24. This issue affects some unknown processing. The manipulation results in weak password recovery. This vulnerability was named CVE-2025-50433. The attack may
CVE-2025-26155 | NCP Secure Enterprise Client untrusted search path
A vulnerability was found in NCP Secure Enterprise Client and Secure Entry Windows Client and classified as problematic. This affects an unknown function. Such manipulation leads to untrusted search path. This vulnerability is listed as CVE
CVE-2026-112892 | python-pillow Pillow up to 12.x MSP RLE decoder buffer overflow (Nessus ID 376140)
A vulnerability identified as problematic has been detected in python-pillow Pillow up to 12.x. Affected by this vulnerability is an unknown functionality of the component MSP RLE decoder. The manipulation leads to buffer overflow. This vul
CVE-2026-112406 | Pillow up to 12.x PDF Page PdfParser.rewrite_pages infinite loop (Nessus ID 376140)
A vulnerability categorized as problematic has been discovered in Pillow up to 12.x. Affected is the function PdfParser.rewrite_pages of the component PDF Page. Executing a manipulation can lead to infinite loop. This vulnerability is track
CVE-2026-112894 | python-pillow Pillow up to 12.x Pdf Parser PdfParser.next_object_id resource consumption (Nessus ID 376140)
A vulnerability, which was classified as problematic, was found in python-pillow Pillow up to 12.x. The impacted element is the function PdfParser.next_object_id of the component Pdf Parser. The manipulation results in resource consumption.
Ubuntu users blast Canonical for slow kernel security fix
Canonical is fixing a critical Linux kernel flaw in Ubuntu, weeks after Debian and other distros did – and users aren’t happy about the wait. As of 3 November, patched kernels for CVE-2026-98432 are in testing for Ubuntu 22.04, 24.04 and 26
CVE-2025-65647 | PHPGurukul Online Shopping Portal 2.1 Track Order Function oid authorization
A vulnerability was found in PHPGurukul Online Shopping Portal 2.1. It has been classified as problematic. Affected is an unknown function of the component Track Order Function. This manipulation of the argument oid causes authorization byp
CVE-2025-65236 | Opencode USSD Gateway OC index.php Session ID sql injection
A vulnerability classified as critical has been found in Opencode USSD Gateway OC. Affected by this vulnerability is an unknown functionality of the file /occontrolpanel/index.php. This manipulation of the argument Session ID causes sql inj
CVE-2025-65235 | OpenCode USSD Gateway OC 6.13.11 getSubUsersByProvider ID sql injection
A vulnerability has been found in OpenCode USSD Gateway OC 6.13.11 and classified as critical. This issue affects the function getSubUsersByProvider. The manipulation of the argument ID leads to sql injection. This vulnerability is listed a
CVE-2025-64067 | Primakon Primakon Pi Portal 1.0.18 API Endpoint user_id/project_id information disclosure
A vulnerability marked as problematic has been reported in Primakon Primakon Pi Portal 1.0.18. Affected is an unknown function of the component API Endpoint. Performing a manipulation of the argument user_id/project_id results in informatio
CVE-2025-64065 | Primakon Pi Portal 1.0.18 /api/V2/pp_udfv_admin access control
A vulnerability, which was classified as critical, has been found in Primakon Pi Portal 1.0.18. Affected by this vulnerability is an unknown functionality of the file /api/V2/pp_udfv_admin. The manipulation leads to improper access controls
CVE-2025-64064 | Primakon Pi Portal 1.0.18 PATCH Request /api/v2/pp_users PP_SECURITY_PROFILE_ID access control
A vulnerability was found in Primakon Pi Portal 1.0.18. It has been classified as critical. This issue affects some unknown processing of the file /api/v2/pp_users of the component PATCH Request Handler. Performing a manipulation of the arg
CVE-2025-64063 | Primakon Pi Portal 1.0.18 API Endpoint direct request
A vulnerability classified as critical was found in Primakon Pi Portal 1.0.18. Affected is an unknown function of the component API Endpoint. Executing a manipulation can lead to direct request. This vulnerability appears as CVE-2025-64063.
CVE-2025-51742 | jishenghua JSH_ERP 2.3.1 Endpoint getMaterialEnableSerialNumberList parseObject query deserialization
A vulnerability was found in jishenghua JSH_ERP 2.3.1. It has been declared as critical. Affected by this vulnerability is the function parseObject of the file /material/getMaterialEnableSerialNumberList of the component Endpoint. Such mani
CVE-2025-50402 | FAST FAC1200R F400_FAC1200R_Q sub_80435780 fac_password buffer overflow
A vulnerability has been found in FAST FAC1200R F400_FAC1200R_Q and classified as critical. Affected by this issue is the function sub_80435780. Performing a manipulation of the argument fac_password results in buffer overflow. This vulnera
CVE-2025-50399 | FAST FAC1200R F400_FAC1200R_Q sub_80435780 password buffer overflow
A vulnerability was found in FAST FAC1200R F400_FAC1200R_Q. It has been declared as critical. This issue affects the function sub_80435780. The manipulation of the argument Password results in buffer overflow. This vulnerability is reported
CVE-2025-46174 | y_project RuoYi 4.8.0 SysUserController.java resetPwd access control (EUVD-2025-199729)
A vulnerability was found in y_project RuoYi 4.8.0 and classified as critical. This affects the function resetPwd of the file SysUserController.java. Executing a manipulation can lead to improper access controls. This vulnerability is regis
CVE-2025-45311 | fail2ban-client 0.11.2 permission (EUVD-2025-199734 / Nessus ID 276966)
A vulnerability, which was classified as critical, has been found in fail2ban-client 0.11.2. Affected is an unknown function. This manipulation causes permission issues. This vulnerability is tracked as CVE-2025-45311. The attack is only po
CVE-2025-65955 | ImageMagick up to 6.9.13-33/7.1.2-8 Magick++ Layer Options::fontFamily double free (GHSA-q3hc-j9x5-mp9m / EUVD-2025-200466)
A vulnerability was found in ImageMagick up to 6.9.13-33/7.1.2-8. It has been classified as critical. The impacted element is the function Options::fontFamily of the component Magick++ Layer. Performing a manipulation results in double free
CVE-2025-65896 | long2ice assyncmy up to 0.2.10 Dict Key sql injection
A vulnerability was found in long2ice assyncmy up to 0.2.10 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Dict Key Handler. Executing a manipulation can lead to sql injection. The id
CVE-2025-65657 | FeehiCMS 2.1.1 unrestricted upload (Issue 78)
A vulnerability, which was classified as critical, has been found in FeehiCMS 2.1.1. This vulnerability affects unknown code. The manipulation leads to unrestricted upload. This vulnerability is traded as CVE-2025-65657. It is possible to i
CVE-2025-65380 | PHPGurukul Billing System 1.0 /admin/index.php username sql injection (EUVD-2025-200326)
A vulnerability, which was classified as critical, was found in PHPGurukul Billing System 1.0. This issue affects some unknown processing of the file /admin/index.php. The manipulation of the argument Username results in sql injection. This
CVE-2025-13502 | WebKitGTK/WPE WebKit GLib Remote Inspector Server integer overflow (EUVD-2025-199556 / Nessus ID 276745)
A vulnerability has been found in WebKitGTK and WPE WebKit and classified as problematic. The impacted element is an unknown function of the component GLib Remote Inspector Server. Performing a manipulation results in integer overflow. This
CVE-2025-10230 | Samba WINS Server Hook Script command injection (EUVD-2025-38301 / Nessus ID 270677)
A vulnerability has been found in Samba and classified as critical. This affects an unknown part of the component WINS Server Hook Script. Performing a manipulation results in command injection. This vulnerability is reported as CVE-2025-10
CVE-2024-3019 | PCP 4.3.4 pmproxy Configuration exposure of resource (RHSA-2024:2566 / Nessus ID 208212)
A vulnerability was found in PCP 4.3.4. It has been rated as problematic. This vulnerability affects unknown code of the component pmproxy Configuration. The manipulation leads to exposure of resource. This vulnerability is listed as CVE-20
CVE-2023-5824 | Squid Web Proxy up to 6.3 HTTP Response Cache structural elements (GHSA-543m-w2m2-g255 / EUVD-2023-58107)
A vulnerability was found in Squid Web Proxy up to 6.3. It has been rated as critical. This vulnerability affects unknown code of the component HTTP Response Cache Handler. The manipulation leads to improper handling of structural elements.
CVE-2023-5557 | tracker-miners sandbox (EUVD-2023-57857 / Nessus ID 242769)
A vulnerability marked as critical has been reported in tracker-miners. This affects an unknown function. Performing a manipulation results in sandbox issue. This vulnerability is known as CVE-2023-5557. Remote exploitation of the attack is
CVE-2026-112397 | python-pillow Pillow up to 12.x Morphology ImageMorph.MorphOp.apply buffer overflow (Nessus ID 376140)
A vulnerability described as problematic has been identified in python-pillow Pillow up to 12.x. The affected element is the function ImageMorph.MorphOp.apply of the component Morphology. Executing a manipulation can lead to buffer overflow
CVE-2022-4013 | Hospital Management Center appointment.php cross-site request forgery (EUVD-2022-51394)
A vulnerability was found in Hospital Management Center. It has been declared as problematic. Affected by this issue is some unknown functionality of the file appointment.php. The manipulation results in cross-site request forgery. This vul
CVE-2022-4012 | Hospital Management Center patient-info.php pt_id sql injection (EUVD-2022-51393)
A vulnerability was found in Hospital Management Center. It has been classified as critical. Affected by this vulnerability is an unknown functionality of the file patient-info.php. The manipulation of the argument pt_id leads to sql inject
CVE-2022-4011 | Simple History Plugin on WordPress Header X-Forwarded-For neutralization for logs (EUVD-2022-51392)
A vulnerability was found in Simple History Plugin on WordPress and classified as critical. Affected is an unknown function of the component Header Handler. Executing a manipulation of the argument X-Forwarded-For can lead to improper outpu
CVE-2022-4009 | Octopus Deploy Offline Package code injection (EUVD-2022-51390)
A vulnerability described as critical has been identified in Octopus Deploy. The impacted element is an unknown function of the component Offline Package Handler. Executing a manipulation can lead to code injection. This vulnerability is ha
CVE-2022-4008 | Octopus Deploy ZIP File denial of service (EUVD-2022-51389)
A vulnerability was found in Octopus Deploy. It has been declared as problematic. Affected by this issue is some unknown functionality of the component ZIP File Handler. The manipulation results in denial of service. This vulnerability is k
plex2scan
Find Plex Media Servers affected by Plex2Shell (CVE-2026-96652 and three more) Weiterlesen
Hackers Target Alpine Linux GitLab Server in Attempted Critical RCE Attack
Alpine Linux has rebuilt its GitLab server and reset all user passwords after hackers attempted to exploit a critical remote code execution (RCE) vulnerability in its development infrastructure. The attacks targeted a maximum-severity vuln
Two Barracuda ESG Flaws Could Be Combined for Full Root Access; Patches Released
Barracuda patched two flaws that can be chained to give attackers root access to Email Security Gateway appliances. Barracuda has patched two vulnerabilities that can be chained to gain root access to its Email Security Gateway (ESG) applia
Zyxel fixes zero-day exploited to hack nearly 1,000 network switches
Zyxel has patched a zero-day vulnerability in its GS1900 series network switches that hackers exploited to compromise nearly 1,000 devices worldwide and steal configuration files and credentials. [...] Weiterlesen
CVE-2025-70023 | transloadit uppy 0.25.6 type confusion
A vulnerability classified as problematic has been found in transloadit uppy 0.25.6. The impacted element is an unknown function. Performing a manipulation results in type confusion. This vulnerability was named CVE-2025-70023. The attack n
CVE-2025-67841 | Nordic Semiconductor IronSide SE for nRF54H20 up to 23.0.2 algorithmic complexity
A vulnerability labeled as problematic has been found in Nordic Semiconductor IronSide SE for nRF54H20 up to 23.0.2. The impacted element is an unknown function. The manipulation results in inefficient algorithmic complexity. This vulnerabi
CVE-2025-67259 | ClassroomIO 0.1.13 PostgREST Endpoint /rest/v1/course access control (ID 642)
A vulnerability was found in ClassroomIO 0.1.13 and classified as critical. This affects an unknown part of the file /rest/v1/course of the component PostgREST Endpoint. Executing a manipulation can lead to improper access controls. This vu
CVE-2025-65135 | manikandan580 School-Management-System up to 1.0 POST Parameter between-date-reprtsdetails.php fromdate sql injection
A vulnerability marked as critical has been reported in manikandan580 School-Management-System up to 1.0. This impacts an unknown function of the file /studentms/admin/between-date-reprtsdetails.php of the component POST Parameter Handler.
CVE-2025-65134 | manikandan580 School-management-system 1.0 POST Parameter contact-us.php email cross site scripting
A vulnerability classified as problematic has been found in manikandan580 School-management-system 1.0. This impacts an unknown function of the file /studentms/admin/contact-us.php of the component POST Parameter Handler. The manipulation o
CVE-2025-65133 | manikandan580 School Management System 1.0 Endpoint sql injection
A vulnerability was found in manikandan580 School Management System 1.0 and classified as critical. This affects an unknown function of the component Endpoint. The manipulation results in sql injection. This vulnerability is cataloged as CV
CVE-2025-63939 | anirudhkannan Grocery Store Management System 1.0 POST Parameter search_products_itname.php sitem_name sql injection
A vulnerability was found in anirudhkannan Grocery Store Management System 1.0. It has been rated as critical. This affects an unknown function of the file /Grocery/search_products_itname.php of the component POST Parameter Handler. This ma
CVE-2025-61872 | Mahara up to 24.04.10/25.04.1 Elasticsearch7 Search Plugin Elasticsearch query cross site scripting
A vulnerability categorized as problematic has been discovered in Mahara up to 24.04.10/25.04.1. This impacts the function Elasticsearch of the component Elasticsearch7 Search Plugin. The manipulation of the argument Query results in cross
CVE-2025-59308 | Mahara up to 24.04.9/25.04.0 access control
A vulnerability was found in Mahara up to 24.04.9/25.04.0. It has been rated as problematic. Impacted is an unknown function. This manipulation causes improper access controls. This vulnerability is registered as CVE-2025-59308. The attack
CVE-2026-55409 | filamentphp filament up to 3.3.52 cross site scripting (GHSA-m9cv-24rx-8mv7)
A vulnerability has been found in filamentphp filament up to 3.3.52 and classified as problematic. The affected element is an unknown function. The manipulation leads to cross site scripting. This vulnerability is documented as CVE-2026-554
CVE-2026-50021 | pnpm up to 10.33.x/11.3.x pnpm-lock.yaml integrity integrity check
A vulnerability was found in pnpm up to 10.33.x/11.3.x and classified as problematic. Impacted is an unknown function of the file pnpm-lock.yaml. Executing a manipulation of the argument Integrity can lead to improper validation of integrit
CVE-2026-49278 | RocketChat Rocket.Chat up to 8.4.x visitors.info improper authorization (GHSA-cqj7-h8cj-jmf2)
A vulnerability has been found in RocketChat Rocket.Chat up to 8.4.x and classified as critical. This impacts an unknown function of the component visitors.info. Performing a manipulation results in improper authorization. This vulnerabilit
CVE-2026-48946 | getk2 K2 Extension 1.0-2.26 on Joomla Attachment Upload unrestricted upload
A vulnerability was found in getk2 K2 Extension 1.0-2.26 on Joomla and classified as critical. This issue affects some unknown processing of the component Attachment Upload Handler. Such manipulation leads to unrestricted upload. This vulne
CVE-2026-45689 | RocketChat Rocket.Chat up to 8.4.x OAuth Access Token /oauth/token data query logic injection (GHSA-8p25-fm45-pjrw)
A vulnerability identified as critical has been detected in RocketChat Rocket.Chat up to 8.4.x. This issue affects some unknown processing of the file /oauth/token of the component OAuth Access Token Handler. Performing a manipulation resul
CVE-2026-45688 | RocketChat Rocket.Chat up to 8.4.x data query logic injection (GHSA-rr54-jf4h-6cj9)
A vulnerability was found in RocketChat Rocket.Chat up to 8.4.x. It has been rated as critical. Affected by this issue is some unknown functionality. The manipulation leads to improper neutralization of special elements in data query logic.
USN-8999-1: Pillow vulnerabilities
It was discovered that Pillow incorrectly handled map stride values when loading certain McIdas AREA images. An attacker could possibly use this issue to obtain sensitive information or cause a denial of service. (CVE-2026-54058) It was dis
CVE-2026-116639 | A vulnerability was detected in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to a8902bf64575e325f6d6bf93a55f7bd273ec58cd. Affected is an unknown function of the file chat.php. Performing a manipulation of the argument ID results in cross site scripting. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for aff
A vulnerability was detected in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to a8902bf64575e325f6d6bf93a55f7bd273ec58cd. Affected is an unknown function of the file chat.php. Performing a manipulation of the argument ID results in