Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 780 | 0,2 % |
| ≥50 % | 3.517 | 0,9 % |
| ≥10 % | 22.972 | 5,7 % |
| <10 % | 377.768 | 93,3 % |
Oracle WebLogic ermöglicht Datenzugriff ohne Anmeldung
Eine kritische Sicherheitslücke in Oracle WebLogic Server ermöglicht Angreifern, über HTTP ohne Anmeldung Daten zu lesen, zu verändern oder zu löschen. Sie betrifft vier unterstützte Versionen von Oracle WebLogic Server, Updates stehen bere
CVE-2026-80939 | Linux Kernel up to 7.2.3 rtw89 rtw89_ops_rfkill_poll improper synchronization (WID-SEC-2026-3321)
A vulnerability, which was classified as problematic, has been found in Linux Kernel up to 7.2.3. Affected by this vulnerability is the function rtw89_ops_rfkill_poll of the component rtw89. This manipulation causes improper synchronization
CVE-2026-80934 | Linux Kernel up to 6.18.49/7.2.3 MT7996 Driver mt76_connac_txp_skb_unmap memory leak (WID-SEC-2026-3321)
A vulnerability categorized as critical has been discovered in Linux Kernel up to 6.18.49/7.2.3. Affected by this issue is the function mt76_connac_txp_skb_unmap of the component MT7996 Driver. Executing a manipulation can lead to memory le
CVE-2026-120756 | HDF Group HDF5 up to 2.2.x Object Header Decoding src/H5Ocache.c H5O__chunk_deserialize heap-based overflow (Nessus ID 376181)
A vulnerability described as problematic has been identified in HDF Group HDF5 up to 2.2.x. The affected element is the function H5O__chunk_deserialize of the file src/H5Ocache.c of the component Object Header Decoding. Executing a manipula
CVE-2026-120956 | MongoDB C Driver up to 1.30.14/2.5.7 uninitialized resource (Nessus ID 376183)
A vulnerability was found in MongoDB C Driver up to 1.30.14/2.5.7 and classified as critical. This vulnerability affects unknown code. Such manipulation leads to uninitialized resource. This vulnerability is uniquely identified as CVE-2026-
CVE-2026-120955 | MongoDB C Driver up to 1.30.14/2.5.7 GridFS exceptional condition (Nessus ID 376182)
A vulnerability has been found in MongoDB C Driver up to 1.30.14/2.5.7 and classified as critical. This affects an unknown part of the component GridFS. This manipulation causes handling of exceptional conditions. This vulnerability is hand
CVE-2026-121520 | Moby BuildKit up to 0.34.0 Build Request privileges management (Nessus ID 376184)
A vulnerability was found in Moby BuildKit up to 0.34.0. It has been declared as very critical. This affects an unknown function of the component Build Request. Such manipulation leads to improper privilege management. This vulnerability is
Hackers Exploit Zyxel GS1900 Zero-Day RCE Flaw to Compromise Nearly 1,000 Network Switches
Zyxel has patched an unauthenticated out-of-bounds write in the web management interface of its GS1900 series switches. The flaw, tracked as CVE-2026-107441, allows pre-authentication OS command execution through crafted HTTP requests and a
Hackers Exploit Zyxel GS1900 Zero-Day Vulnerability to Compromise Nearly 1,000 Network Switches
Attackers used a pre-authentication remote code execution exploit against Zyxel GS1900 switches. They compromised nearly 1,000 devices before Zyxel patched the flaw. Binarly researchers found that the exploit abused a previously unknown bug
Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a medium-severity security flaw impacting multiple Apple operating systems to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active
CVE-2025-59701 | Entrust nShield Connect XC/nShield 5c/nShield HSMi up to 13.6.11/13.7 Appliance SSD information disclosure
A vulnerability, which was classified as problematic, has been found in Entrust nShield Connect XC, nShield 5c and nShield HSMi up to 13.6.11/13.7. Affected is an unknown function of the component Appliance SSD. This manipulation causes inf
CVE-2025-59700 | Entrust nShield Connect XC/nShield 5c/nShield HSMi up to 13.6.11/13.7 Recovery Partition data authenticity (EUVD-2025-200254)
A vulnerability classified as critical has been found in Entrust nShield Connect XC, nShield 5c and nShield HSMi up to 13.6.11/13.7. This affects an unknown function of the component Recovery Partition. The manipulation leads to insufficien
CVE-2025-59695 | Entrust nShield Connect XC/nShield 5c/nShield HSMi Chassis Management Board improper authentication
A vulnerability marked as critical has been reported in Entrust nShield Connect XC, nShield 5c and nShield HSMi. The affected element is an unknown function of the component Chassis Management Board. Performing a manipulation results in imp
Debian and Ubuntu Linux APT Vulnerability Allows Attackers to Execute Malicious Code With Root Privileges
A vulnerability in the APT package manager lets attackers intercept communications between Linux systems and package repositories, install malicious packages, and execute code with root privileges. This flaw, tracked as CVE-2026-109518, aff
CVE-2026-121522 | Moby BuildKit up to 0.34.1 input validation (Nessus ID 376185)
A vulnerability was found in Moby BuildKit up to 0.34.1. It has been classified as critical. The impacted element is an unknown function. This manipulation causes improper input validation. This vulnerability is registered as CVE-2026-12152
CVE-2026-19029 | HDF Group HDF5 up to 2.2.0 Scale-Offset Filter src/H5Zscaleoffset.c H5Z__filter_scaleoffset heap-based overflow (EUVD-2026-93981 / Nessus ID 376187)
A vulnerability was found in HDF Group HDF5 up to 2.2.0 and classified as critical. This affects the function H5Z__filter_scaleoffset of the file src/H5Zscaleoffset.c of the component Scale-Offset Filter. Such manipulation leads to heap-bas
CVE-2026-120754 | HDF Group HDF5 up to 2.2.0 Scale-Offset Filter src/H5Zscaleoffset.c H5Z__filter_scaleoffset uninitialized pointer (Nessus ID 376187)
A vulnerability categorized as problematic has been discovered in HDF Group HDF5 up to 2.2.0. The impacted element is the function H5Z__filter_scaleoffset of the file src/H5Zscaleoffset.c of the component Scale-Offset Filter. Such manipulat
CVE-2025-65858 | Calibre-Web 0.6.25 /ajax/listusers username cross site scripting (EUVD-2025-200242)
A vulnerability identified as problematic has been detected in Calibre-Web 0.6.25. This issue affects some unknown processing of the file /ajax/listusers. This manipulation of the argument Username causes cross site scripting. This vulnerab
CVE-2025-65836 | PublicCMS 5.202506.b Chat Interface SimpleAiAdminController server-side request forgery
A vulnerability categorized as critical has been discovered in PublicCMS 5.202506.b. This impacts the function SimpleAiAdminController of the component Chat Interface. The manipulation results in server-side request forgery. This vulnerabil
CVE-2025-51683 | mJobtime 15.7.2 update_profile_Server sql injection
A vulnerability, which was classified as critical, has been found in mJobtime 15.7.2. Affected is an unknown function of the file /Default.aspx/update_profile_Server. Performing a manipulation results in sql injection. This vulnerability is
CVE-2025-65403 | LightFTP 2.0 g_cfg.MaxUsers buffer overflow
A vulnerability classified as problematic has been found in LightFTP 2.0. Impacted is an unknown function of the component g_cfg.MaxUsers. The manipulation leads to buffer overflow. This vulnerability is traded as CVE-2025-65403. Access to
CVE-2025-64030 | Eximbills Enterprise 4.1.5 WSTrxManager TMPL_INFO cross site scripting
A vulnerability classified as problematic has been found in Eximbills Enterprise 4.1.5. This affects an unknown part of the file /EximBillWeb/servlets/WSTrxManager. Performing a manipulation of the argument TMPL_INFO results in cross site s
CVE-2025-63535 | Blood Bank Management System 1.0 abs.php search sql injection
A vulnerability classified as critical was found in Blood Bank Management System 1.0. Affected by this vulnerability is an unknown functionality of the file abs.php. Such manipulation of the argument Search leads to sql injection. This vuln
CVE-2025-63534 | Blood Bank Management System 1.0 login.php error cross site scripting
A vulnerability, which was classified as problematic, was found in Blood Bank Management System 1.0. This affects an unknown part of the file login.php. Executing a manipulation of the argument Error can lead to cross site scripting. The id
CVE-2025-63532 | Blood Bank Management System 1.0 cancel.php search sql injection
A vulnerability classified as critical has been found in Blood Bank Management System 1.0. Affected is an unknown function of the file cancel.php. This manipulation of the argument Search causes sql injection. This vulnerability is handled
CVE-2025-63095 | Tempus Ex hello-video-codec 0.1.0 write_bits denial of service
A vulnerability was found in Tempus Ex hello-video-codec 0.1.0. It has been declared as problematic. This impacts the function BitstreamWriter::write_bits. Executing a manipulation can lead to denial of service. This vulnerability is tracke
CVE-2025-57489 | Shirt Pocket SuperDuper 3.10 SDAgent access control
A vulnerability has been found in Shirt Pocket SuperDuper 3.10 and classified as critical. The affected element is an unknown function of the component SDAgent. This manipulation causes improper access controls. The identification of this v
CVE-2026-91453 | Oracle Java SE/GraalVM for JDK/GraalVM Enterprise Edition Lightweight HTTP Server improper authorization (Nessus ID 376139)
A vulnerability was found in Oracle Java SE, GraalVM for JDK and GraalVM Enterprise Edition. It has been declared as problematic. Impacted is an unknown function of the component Lightweight HTTP Server. Such manipulation leads to improper
CVE-2026-91452 | Oracle GraalVM Enterprise Edition/GraalVM for JDK/Java SE Networking improper authorization (Nessus ID 376139)
A vulnerability was found in Oracle GraalVM Enterprise Edition, GraalVM for JDK and Java SE. It has been rated as problematic. The affected element is an unknown function of the component Networking. Performing a manipulation results in imp
CVE-2026-91451 | Oracle Java SE/GraalVM for JDK/GraalVM Enterprise Edition Networking access control (Nessus ID 376139)
A vulnerability, which was classified as problematic, was found in Oracle Java SE, GraalVM for JDK and GraalVM Enterprise Edition. This vulnerability affects unknown code of the component Networking. Executing a manipulation can lead to imp
CVE-2026-91418 | Oracle Java SE ImageIO resource consumption (Nessus ID 376139)
A vulnerability, which was classified as problematic, has been found in Oracle Java SE, JavaFX, GraalVM for JDK and GraalVM Enterprise Edition. This issue affects some unknown processing of the component ImageIO. Performing a manipulation r
CVE-2026-91333 | Oracle Java SE 21.0.12.1/25.0.4.1/27 Security privileges management (Nessus ID 376139)
A vulnerability, which was classified as problematic, was found in Oracle Java SE 21.0.12.1/25.0.4.1/27. Affected by this vulnerability is an unknown functionality of the component Security. Executing a manipulation can lead to improper pri
CVE-2026-87291 | Oracle Java SE 21.0.12.1/25.0.4.1/27 Networking information disclosure (Nessus ID 376139)
A vulnerability classified as problematic was found in Oracle Java SE 21.0.12.1/25.0.4.1/27. This vulnerability affects unknown code of the component Networking. Such manipulation leads to information disclosure. This vulnerability is liste
CVE-2022-4051 | Hostel Searching Project view-property.php property_id sql injection (EUVD-2022-51428)
A vulnerability was found in Hostel Searching Project. It has been rated as critical. This vulnerability affects unknown code of the file view-property.php. Performing a manipulation of the argument property_id results in sql injection. Thi
CVE-2022-4037 | GitLab Community Edition/Enterprise Edition up to 15.5.6/15.6.3/15.7.1 Email race condition (Issue 382957 / EUVD-2022-51416)
A vulnerability classified as problematic has been found in GitLab Community Edition and Enterprise Edition up to 15.5.6/15.6.3/15.7.1. Affected is an unknown function of the component Email Handler. The manipulation leads to race condition
CVE-2022-4025 | Google Chrome up to 97.0.4692.99 Paint cross-domain policy (EUVD-2022-51404)
A vulnerability identified as critical has been detected in Google Chrome. Affected is an unknown function of the component Paint. The manipulation leads to permissive cross-domain policy with untrusted domains. This vulnerability is refere
CVE-2022-4015 | Sports Club Management System 119 admin/make_payments.php m_id/plan sql injection (EUVD-2022-51395)
A vulnerability categorized as critical has been discovered in Sports Club Management System 119. This vulnerability affects unknown code of the file admin/make_payments.php. Such manipulation of the argument m_id/plan leads to sql injectio
CVE-2025-65202 | TRENDnet TEW-657BRM 1.00.1 HTTP Parameter setup.cgi command/todo/next_file os command injection
A vulnerability, which was classified as critical, was found in TRENDnet TEW-657BRM 1.00.1. This impacts an unknown function of the file setup.cgi of the component HTTP Parameter Handler. Such manipulation of the argument command/todo/next_
CVE-2025-63525 | Blood Bank Management System 1.0 Request delete.php privilege escalation (EUVD-2025-200000)
A vulnerability classified as critical has been found in Blood Bank Management System 1.0. The impacted element is an unknown function of the file delete.php of the component Request Handler. The manipulation leads to privilege escalation.
CVE-2025-63522 | FeehiCMS 2.1.1 reverse tabnabbing (Issue 76)
A vulnerability was found in FeehiCMS 2.1.1. It has been rated as critical. Affected is an unknown function. The manipulation leads to use of web link to untrusted target with window.opener access. This vulnerability is listed as CVE-2025-6
CVE-2025-63520 | FeehiCMS 2.1.1 User Update id cross site scripting (Issue 74)
A vulnerability identified as problematic has been detected in FeehiCMS 2.1.1. Affected by this issue is some unknown functionality of the component User Update Handler. This manipulation of the argument ID causes cross site scripting. This
CVE-2026-122049 | Campcodes Bitcoin Wallet System 1.0 ForgotPasswordController.php random_int excessive authentication (EUVD-2026-117196)
A vulnerability identified as problematic has been detected in Campcodes Bitcoin Wallet System 1.0. This affects the function random_int of the file core/app/Http/Controllers/Auth/ForgotPasswordController.php. This manipulation causes impro
CVE-2026-71364 | Red Hat Ansible Automation Platform Archive Extraction project_archive path traversal (EUVD-2026-64918 / Nessus ID 339184)
A vulnerability was found in Red Hat Ansible Automation Platform. It has been declared as very critical. The affected element is the function project_archive of the component Archive Extraction. Executing a manipulation can lead to path tra
CVE-2026-71365 | Red Hat Ansible Automation Platform Webhook Status Callback server-side request forgery (EUVD-2026-61015 / Nessus ID 339184)
A vulnerability, which was classified as problematic, has been found in Red Hat Ansible Automation Platform. Affected is an unknown function of the component Webhook Status Callback. This manipulation causes server-side request forgery. The
CVE-2026-71366 | Red Hat Ansible Automation Platform Notification Backend server-side request forgery (EUVD-2026-64923 / Nessus ID 339184)
A vulnerability was found in Red Hat Ansible Automation Platform and classified as problematic. The impacted element is an unknown function of the component Notification Backend. Executing a manipulation can lead to server-side request forg
CVE-2026-75092 | Red Hat Enterprise Linux/OpenStack Platform scan_mysql actor mysqld-auto.cnf dlopen privileges management (EUVD-2026-78326)
A vulnerability was found in Red Hat Enterprise Linux and OpenStack Platform. It has been declared as very critical. Affected by this vulnerability is the function dlopen of the file mysqld-auto.cnf of the component scan_mysql actor. Execut
CVE-2025-65670 | classroomio 0.1.13 resource injection
A vulnerability categorized as problematic has been discovered in classroomio 0.1.13. This issue affects some unknown processing. Such manipulation leads to improper control of resource identifiers. This vulnerability is documented as CVE-2
CVE-2025-65276 | henzljw hashtech 1.0 /admin_index.php access control
A vulnerability classified as critical has been found in henzljw hashtech 1.0. The affected element is an unknown function of the file /admin_index.php. The manipulation leads to improper access controls. This vulnerability is uniquely iden
CVE-2025-50433 | imonnit 2025-04-24 password recovery
A vulnerability, which was classified as critical, was found in imonnit 2025-04-24. This issue affects some unknown processing. The manipulation results in weak password recovery. This vulnerability was named CVE-2025-50433. The attack may
CVE-2025-26155 | NCP Secure Enterprise Client untrusted search path
A vulnerability was found in NCP Secure Enterprise Client and Secure Entry Windows Client and classified as problematic. This affects an unknown function. Such manipulation leads to untrusted search path. This vulnerability is listed as CVE
CVE-2026-112892 | python-pillow Pillow up to 12.x MSP RLE decoder buffer overflow (Nessus ID 376140)
A vulnerability identified as problematic has been detected in python-pillow Pillow up to 12.x. Affected by this vulnerability is an unknown functionality of the component MSP RLE decoder. The manipulation leads to buffer overflow. This vul
CVE-2026-112406 | Pillow up to 12.x PDF Page PdfParser.rewrite_pages infinite loop (Nessus ID 376140)
A vulnerability categorized as problematic has been discovered in Pillow up to 12.x. Affected is the function PdfParser.rewrite_pages of the component PDF Page. Executing a manipulation can lead to infinite loop. This vulnerability is track
CVE-2026-112894 | python-pillow Pillow up to 12.x Pdf Parser PdfParser.next_object_id resource consumption (Nessus ID 376140)
A vulnerability, which was classified as problematic, was found in python-pillow Pillow up to 12.x. The impacted element is the function PdfParser.next_object_id of the component Pdf Parser. The manipulation results in resource consumption.
Ubuntu users blast Canonical for slow kernel security fix
Canonical is fixing a critical Linux kernel flaw in Ubuntu, weeks after Debian and other distros did – and users aren’t happy about the wait. As of 3 November, patched kernels for CVE-2026-98432 are in testing for Ubuntu 22.04, 24.04 and 26
CVE-2026-116639 | A vulnerability was detected in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to a8902bf64575e325f6d6bf93a55f7bd273ec58cd. Affected is an unknown function of the file chat.php. Performing a manipulation of the argument ID results in cross site scripting. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for aff
A vulnerability was detected in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to a8902bf64575e325f6d6bf93a55f7bd273ec58cd. Affected is an unknown function of the file chat.php. Performing a manipulation of the argument ID results in
CVE-2026-116839 | A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to make unauthorized changes and execute a Denial of Service (DoS) attack on the device.
A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to make unauthorized changes and execute a Denial of Service (DoS) attack on the
CVE-2026-116838 | A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to execute a Command Injection on the device.
A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to execute a Command Injection on the device.
CVE-2026-116623 | A vulnerability was detected in code-projects Simple Content Management System 1.0. Impacted is an unknown function of the file /web/admin/welcome.php of the component Admin Interface. The manipulation of the argument addnews results in missing authorization. The attack can be launched remotely. The exploit is now public and may be used.
A vulnerability was detected in code-projects Simple Content Management System 1.0. Impacted is an unknown function of the file /web/admin/welcome.php of the component Admin Interface. The manipulation of the argument addnews results in mis
CVE-2026-116837 | A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, SolarPoint, and SolarSwitch devices to execute arbitrary code on the device.
A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, SolarPoint, and SolarSwitch devices to execute arbitrary code on the device.
CVE-2026-116844 | Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerability because TransferOpen checks only the transferTLS flag set by PROT, not whether the prepared data connection uses TLS. When a client sends PROT P after PASV or PORT, file contents and directory listings cross the network unencrypted, even with mandatory encryption, letting on-path attackers read or modify them.
Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerability because TransferOpen checks only the transferTLS flag set by PROT, not whether the prepared data connection uses TLS. When a client sends PROT P after PAS