Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 786 | 0,2 % |
| ≥50 % | 3.572 | 0,9 % |
| ≥10 % | 23.059 | 5,7 % |
| <10 % | 380.694 | 93,3 % |
Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It
A fix for CVE-2026-83844, a remote code execution flaw in Windows Paint, is now in the Microsoft Store. Paint gets this fix only through a Store update, not through Windows updates. The fixed build, 11.2609.401.0, was the newest Paint build
PHP2Shell: Das Patch-Fenster schrumpft
Kaum waren die Patches für die kritischen PHP-Lücken CVE-2026-109618 und CVE-2026-109619 veröffentlicht, hielt das BSI eine breite Ausnutzung binnen Stunden für wahrscheinlich. KI verkürzt den Weg vom Patch zum Exploit. Unternehmen brauchen
CVE-2025-57441 | Blackmagic ATEM Mini Pro 2.7 Telnet Service improper authentication
A vulnerability classified as critical has been found in Blackmagic ATEM Mini Pro 2.7. This affects an unknown part of the component Telnet Service. This manipulation causes improper authentication. This vulnerability is handled as CVE-2025
CVE-2025-57407 | S-Cart up to 10.0.3 Admin Log Viewer cross site scripting
A vulnerability categorized as problematic has been discovered in S-Cart up to 10.0.3. Affected by this issue is some unknown functionality of the component Admin Log Viewer. Such manipulation leads to cross site scripting. This vulnerabili
CVE-2025-57205 | iNiLabs School Express 6.2 /posts/edit/ cross site scripting
A vulnerability labeled as problematic has been found in iNiLabs School Express 6.2. Impacted is an unknown function of the file /posts/edit/. Executing a manipulation can lead to cross site scripting. The identification of this vulnerabili
CVE-2025-57204 | Stocky POS with Inventory Management & HRM 5.0 Products product name cross site scripting
A vulnerability marked as problematic has been reported in Stocky POS with Inventory Management &amp; HRM 5.0. The affected element is an unknown function of the component Products Module. The manipulation of the argument product name l
CVE-2025-57203 | MagicProject AI 9.1 Content Security Policy generate-stream cross site scripting
A vulnerability classified as problematic was found in MagicProject AI 9.1. Affected by this vulnerability is an unknown functionality of the file /dashboard/user/generator/generate-stream of the component Content Security Policy Handler. E
CVE-2025-55887 | ARD Meal Reservation Service transactionID cross site scripting
A vulnerability classified as problematic was found in ARD. Impacted is an unknown function of the component Meal Reservation Service. The manipulation of the argument transactionID results in cross site scripting. This vulnerability is cat
CVE-2025-39877 | Linux Kernel up to 6.17-rc5 state_show use after free (Nessus ID 265875 / WID-SEC-2025-2107)
A vulnerability has been found in Linux Kernel up to 6.1.152/6.6.106/6.12.47/6.16.7/6.17-rc5 and classified as critical. Affected by this issue is the function state_show. The manipulation leads to use after free. This vulnerability is docu
CVE-2025-25208 | Red Hat Connectivity Link rhcl-operator-container denial of service (EUVD-2025-17429)
A vulnerability labeled as problematic has been found in Red Hat Connectivity Link. Affected by this issue is some unknown functionality of the component rhcl-operator-container. Such manipulation leads to denial of service. This vulnerabil
CVE-2026-40802 | Pubjet Plugin up to 5.4.8 on WordPress privileges management (EUVD-2026-96539)
A vulnerability described as critical has been identified in Pubjet Plugin up to 5.4.8 on WordPress. Affected by this issue is some unknown functionality. The manipulation results in improper privilege management. This vulnerability is cata
CVE-2026-88800 | MDJM Event Management Plugin up to 1.7.8.7 on WordPress authorization (EUVD-2026-117969)
A vulnerability, which was classified as critical, has been found in MDJM Event Management Plugin and Mobile Events Manager Plugin up to 1.7.8.7 on WordPress. Affected by this vulnerability is an unknown functionality. This manipulation cau
CVE-2026-88799 | MDJM Event Management Plugin up to 1.7.8.7 on WordPress Client Profile Update authorization (EUVD-2026-117968)
A vulnerability classified as critical has been found in MDJM Event Management Plugin and Mobile Events Manager Plugin up to 1.7.8.7 on WordPress. This impacts an unknown function of the component Client Profile Update. The manipulation lea
CVE-2026-88801 | MDJM Event Management Plugin up to 1.7.8.7 on WordPress cross site scripting (EUVD-2026-117970)
A vulnerability classified as problematic was found in MDJM Event Management Plugin and Mobile Events Manager Plugin up to 1.7.8.7 on WordPress. Affected is an unknown function. The manipulation results in cross site scripting. This vulnera
CVE-2026-118423 | WP Libre Form Plugin up to 1.5.0.1 on WordPress unrestricted upload (EUVD-2026-117971)
A vulnerability labeled as critical has been found in WP Libre Form Plugin up to 1.5.0.1 on WordPress. The affected element is an unknown function. Such manipulation leads to unrestricted upload. This vulnerability is documented as CVE-2026
CVE-2026-118166 | MC4WP Mailchimp Plugin up to 4.14.x on WordPress Dynamic Content Tag injection (EUVD-2026-117972)
A vulnerability, which was classified as critical, was found in MC4WP Mailchimp Plugin up to 4.14.x on WordPress. Affected by this issue is some unknown functionality of the component Dynamic Content Tag. Such manipulation leads to injectio
CVE-2026-121633 | Order Tracking Plugin up to 3.5.x on WordPress data authenticity (EUVD-2026-117973)
A vulnerability described as problematic has been identified in Order Tracking Plugin up to 3.5.x on WordPress. This affects an unknown function. Executing a manipulation can lead to insufficient verification of data authenticity. This vuln
CVE-2026-121636 | Quick Event Manager Plugin up to 9.18 on WordPress data authenticity (EUVD-2026-117974)
A vulnerability marked as problematic has been reported in Quick Event Manager Plugin up to 9.18 on WordPress. The impacted element is an unknown function. Performing a manipulation results in insufficient verification of data authenticity.
CVE-2026-91718 | Google Chrome up to 153.0.8010.36 Core use after free (Nessus ID 349114 / WID-SEC-2026-3380)
A vulnerability classified as critical has been found in Google Chrome. Impacted is an unknown function of the component Core. Performing a manipulation results in use after free. This vulnerability is cataloged as CVE-2026-91718. It is pos
CVE-2026-91716 | Google Chrome up to 153.0.8010.36 Auth use after free (Nessus ID 349114 / WID-SEC-2026-3380)
A vulnerability labeled as critical has been found in Google Chrome. This affects an unknown part of the component Auth. The manipulation results in use after free. This vulnerability is identified as CVE-2026-91716. The attack can be execu
CVE-2026-91715 | Google Chrome up to 153.0.8010.36 ServiceWorker type confusion (Nessus ID 349114 / WID-SEC-2026-3380)
A vulnerability identified as critical has been detected in Google Chrome. Affected by this issue is some unknown functionality of the component ServiceWorker. The manipulation leads to type confusion. This vulnerability is referenced as CV
CVE-2026-91714 | Google Chrome up to 153.0.8010.36 Fonts information disclosure (Nessus ID 349114 / WID-SEC-2026-3380)
A vulnerability classified as problematic was found in Google Chrome. This vulnerability affects unknown code of the component Fonts. Such manipulation leads to information disclosure. This vulnerability is documented as CVE-2026-91714. The
CVE-2026-123158 | OpenBSD OpenSSH up to 10.6p1 sshd improper authentication (WID-SEC-2026-4365)
A vulnerability categorized as very critical has been discovered in OpenBSD OpenSSH up to 10.6p1. Impacted is an unknown function of the component sshd. The manipulation results in improper authentication. This vulnerability is reported as
CVE-2026-97848 | Red Hat Keycloak Token Sanitization improper authorization (EUVD-2026-117923)
A vulnerability was found in Red Hat Keycloak. It has been rated as problematic. Affected by this vulnerability is an unknown functionality of the component Token Sanitization. Performing a manipulation results in improper authorization. Th
CVE-2026-97367 | Red Hat Keycloak Account REST API improper authentication (EUVD-2026-117922)
A vulnerability classified as critical was found in Red Hat Keycloak. The impacted element is an unknown function of the component Account REST API. Executing a manipulation can lead to improper authentication. This vulnerability is handled
CVE-2026-96547 | Red Hat Keycloak/Single Sign-On Dynamic Client Registration privileges management (EUVD-2026-117921)
A vulnerability classified as problematic has been found in Red Hat Keycloak and Single Sign-On. The affected element is an unknown function of the component Dynamic Client Registration. Performing a manipulation results in improper privile
CVE-2026-121139 | Rapid7 Metasploit Framework up to 6.5.8 REST API /api/v1/users ApiToken#authenticate missing authentication (EUVD-2026-117544)
A vulnerability has been found in Rapid7 Metasploit Framework up to 6.5.8 and classified as critical. Affected by this vulnerability is the function ApiToken#authenticate of the file /api/v1/users of the component REST API. This manipulatio
CVE-2026-123151 | Red Hat Enterprise Linux GDB stack-based overflow (Nessus ID 376647)
A vulnerability was found in Red Hat Enterprise Linux. It has been declared as critical. The affected element is an unknown function of the component GDB. The manipulation results in stack-based buffer overflow. This vulnerability is catalo
CVE-2026-18142 | IBM MQ up to 10.0.0.5 integer overflow (WID-SEC-2026-4343)
A vulnerability classified as problematic has been found in IBM MQ up to 9.2.0.44/9.3.0.42/9.4.0.26/9.4.5.1/10.0.0.5. The impacted element is an unknown function. This manipulation causes integer overflow. This vulnerability is registered a
CVE-2026-14252 | IBM MQ information disclosure (WID-SEC-2026-4343)
A vulnerability was found in IBM MQ. It has been declared as problematic. The affected element is an unknown function. Executing a manipulation can lead to information disclosure. This vulnerability is handled as CVE-2026-14252. It is possi
CVE-2026-13292 | IBM MQ os command injection (WID-SEC-2026-4343)
A vulnerability marked as very critical has been reported in IBM MQ. This affects an unknown function. This manipulation causes os command injection. This vulnerability is tracked as CVE-2026-13292. The attack is possible to be carried out
CVE-2026-13289 | IBM MQ up to 10.0.0.5 xml external entity reference (WID-SEC-2026-4343)
A vulnerability, which was classified as critical, has been found in IBM MQ up to 9.2.0.44/9.3.0.42/9.4.0.26/9.4.5.1/10.0.0.5. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. Th
CVE-2026-13284 | IBM MQ up to 10.0.0.5 xml external entity reference (WID-SEC-2026-4343)
A vulnerability, which was classified as critical, was found in IBM MQ up to 9.2.0.44/9.3.0.42/9.4.0.26/9.4.5.1/10.0.0.5. This affects an unknown part. The manipulation results in xml external entity reference. This vulnerability is reporte
CVE-2026-13271 | IBM MQ up to 10.0.0.5 Managed File Transfer xml external entity reference (WID-SEC-2026-4343)
A vulnerability identified as critical has been detected in IBM MQ up to 9.2.0.44/9.3.0.42/9.4.0.26/9.4.5.1/10.0.0.5. The affected element is an unknown function of the component Managed File Transfer. The manipulation leads to xml external
CVE-2026-12550 | IBM MQ up to 10.0.0.5 input validation (WID-SEC-2026-4343)
A vulnerability labeled as critical has been found in IBM MQ up to 9.2.0.44/9.3.0.42/9.4.0.26/9.4.5.1/10.0.0.5. The impacted element is an unknown function. The manipulation results in improper input validation. This vulnerability is identi
CVE-2026-12538 | IBM MQ Appliance up to 9.4.0.26/9.4.5.3/10.0.0.5 input validation (WID-SEC-2026-4343)
A vulnerability classified as critical has been found in IBM MQ Appliance up to 9.4.0.26/9.4.5.3/10.0.0.5. Affected is an unknown function. Performing a manipulation results in improper input validation. This vulnerability is cataloged as C
CVE-2026-12356 | IBM MQ up to 10.0.0.5 command injection (WID-SEC-2026-4343)
A vulnerability categorized as very critical has been discovered in IBM MQ up to 9.2.0.44/9.3.0.42/9.4.0.26/9.4.5.1/10.0.0.5. Impacted is an unknown function. Executing a manipulation can lead to command injection. The identification of thi
CVE-2026-11724 | IBM MQ up to 10.0.0.5 Managed File Transfer input validation (WID-SEC-2026-4343)
A vulnerability was found in IBM MQ up to 9.2.0.44/9.3.0.42/9.4.0.26/9.4.5.1/10.0.0.5 and classified as very critical. Affected by this issue is some unknown functionality of the component Managed File Transfer. The manipulation results in
CVE-2026-11376 | IBM MQ up to 10.0.0.5 integer overflow (WID-SEC-2026-4343)
A vulnerability was found in IBM MQ up to 9.2.0.44/9.3.0.42/9.4.0.26/9.4.5.1/10.0.0.5. It has been rated as very critical. This issue affects some unknown processing. Performing a manipulation results in integer overflow. This vulnerability
CVE-2026-10859 | IBM MQ up to 10.0.0.5 deserialization (WID-SEC-2026-4343)
A vulnerability has been found in IBM MQ up to 9.2.0.44/9.3.0.42/9.4.0.26/9.4.5.1/10.0.0.5 and classified as very critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to deserialization. This vulnerab
CVE-2026-116606 | Barracuda Email Security Gateway prior 9.4.0.030 Configuration Import improper authorization (WID-SEC-2026-4295)
A vulnerability, which was classified as problematic, was found in Barracuda Email Security Gateway. This affects an unknown part of the component Configuration Import. The manipulation results in improper authorization. This vulnerability
CVE-2026-111560 | Barracuda Application Delivery Controller Timezone Configuration os command injection (WID-SEC-2026-4295)
A vulnerability, which was classified as critical, has been found in Barracuda Application Delivery Controller, Email Security Gateway, Load Balancer, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway.
Urgent Security Update | APT Download Verification Bypass — Please Update Now
Dear deepin users and community members, A vulnerability has been discovered in APT, the package manager, that allows package integrity verification to be bypassed. Under specific conditions, an attacker positioned on the network path can s
CVE-2026-73472 | GStreamer gst-plugins-good up to 1.28.5 Superindex/Subindex Parsers integer overflow (EUVD-2026-117925)
A vulnerability was found in GStreamer gst-plugins-good up to 1.28.5. It has been classified as critical. Affected by this issue is some unknown functionality of the component Superindex/Subindex Parsers. Performing a manipulation results i
CVE-2026-73471 | GStreamer gst-plugins-good up to 1.28.5 Nikon metadata tag parser out-of-bounds (EUVD-2026-117924)
A vulnerability was found in GStreamer gst-plugins-good up to 1.28.5 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Nikon metadata tag parser. Such manipulation leads to out-of-bou
CVE-2026-73473 | gst-plugins-good up to 1.28.5 Subindex Parser denial of service (EUVD-2026-117926)
A vulnerability has been found in gst-plugins-good up to 1.28.5 and classified as problematic. Affected is an unknown function of the component Subindex Parser. This manipulation causes denial of service. The identification of this vulnerab
CVE-2026-15562 | Red Hat jboss-remoting MessageReader integer overflow (EUVD-2026-55986)
A vulnerability, which was classified as problematic, was found in Red Hat jboss-remoting. This impacts the function MessageReader. Executing a manipulation can lead to integer overflow. This vulnerability is tracked as CVE-2026-15562. The
CVE-2026-19729 | Red Hat Build of Keycloak/Single Sign-On Key Provider information disclosure (EUVD-2026-74756)
A vulnerability marked as problematic has been reported in Red Hat Build of Keycloak and Single Sign-On. Impacted is an unknown function of the component Key Provider. The manipulation leads to information disclosure. This vulnerability is
CVE-2025-57682 | Papermark up to 0.20.0 API get-presigned-get-url-proxy path traversal
A vulnerability, which was classified as critical, has been found in Papermark up to 0.20.0. This impacts an unknown function of the file /api/file/s3/get-presigned-get-url-proxy of the component API. The manipulation leads to path traversa
CVE-2025-57438 | 2wcom IP-4c 2.15.5 Endpoint access control
A vulnerability was found in 2wcom IP-4c 2.15.5. It has been declared as critical. The affected element is an unknown function of the component Endpoint. The manipulation results in improper access controls. This vulnerability is cataloged
CVE-2025-57437 | Blackmagic Web Presenter HD 3.3 Telnet Service improper authentication
A vulnerability, which was classified as critical, has been found in Blackmagic Web Presenter HD 3.3. This issue affects some unknown processing of the component Telnet Service. Performing a manipulation results in improper authentication.
CVE-2025-57434 | Creacast Creabox Manager improper authentication
A vulnerability has been found in Creacast Creabox Manager and classified as critical. The affected element is an unknown function. The manipulation leads to improper authentication. This vulnerability is referenced as CVE-2025-57434. The a
CVE-2025-57431 | Sound4 PULSE-ECO AES67 1.22 Web-based Management Interface manual.sh code download
A vulnerability classified as problematic has been found in Sound4 PULSE-ECO AES67 1.22. Affected is an unknown function of the file manual.sh of the component Web-based Management Interface. The manipulation leads to download of code witho
CVE-2025-55885 | Alpes Recherche et Developpement ARD GEC en Lign prior 2025-04-23 GET Parameter index.php sql injection
A vulnerability classified as critical was found in Alpes Recherche et Developpement ARD GEC en Lign. Affected by this vulnerability is an unknown functionality of the file index.php of the component GET Parameter Handler. The manipulation
CVE-2025-43953 | 2wcom IP-4c 2.16 Web Interface ping/traceroute command injection
A vulnerability described as critical has been identified in 2wcom IP-4c 2.16. The impacted element is an unknown function of the component Web Interface. Executing a manipulation of the argument ping/traceroute can lead to command injectio
CVE-2026-121996 | Red Hat Enterprise Linux up to 10 Agent Expression Parser heap-based overflow (Nessus ID 376648)
A vulnerability marked as critical has been reported in Red Hat Enterprise Linux 6/7/8/9/10. Affected by this vulnerability is an unknown functionality of the component Agent Expression Parser. The manipulation leads to heap-based buffer ov
CVE-2026-121997 | Red Hat Enterprise Linux/Hardened Images QTDPsrc packet handler heap-based overflow (Nessus ID 376649)
A vulnerability was found in Red Hat Enterprise Linux and Hardened Images. It has been rated as critical. The impacted element is an unknown function of the component QTDPsrc packet handler. This manipulation causes heap-based buffer overfl
CVE-2026-121994 | Red Hat Enterprise Linux Remote Protocol fetch_register_using_p stack-based overflow (Nessus ID 376650)
A vulnerability, which was classified as very critical, has been found in Red Hat Enterprise Linux. This issue affects the function fetch_register_using_p of the component Remote Protocol Handler. Performing a manipulation results in stack-
CVE-2026-121995 | Red Hat Enterprise Linux Tracepoint Upload stack-based overflow (Nessus ID 376651)
A vulnerability categorized as critical has been discovered in Red Hat Enterprise Linux. Affected by this vulnerability is an unknown functionality of the component Tracepoint Upload Handler. Executing a manipulation can lead to stack-based
CVE-2025-56075 | PHPGurukul Park Ticketing Management System 2.0 POST Request normal-bwdates-reports-details.php fromdate/todate sql injection
A vulnerability was found in PHPGurukul Park Ticketing Management System 2.0. It has been classified as critical. Affected is an unknown function of the file normal-bwdates-reports-details.php of the component POST Request Handler. This man