Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 730 | 0,2 % |
| ≥50 % | 3.213 | 0,9 % |
| ≥10 % | 22.091 | 5,9 % |
| <10 % | 347.698 | 93,0 % |
CVE-2026-90163 | Linux Kernel up to 7.2.5 ksmbd smb/server module_init allocation of resources (WID-SEC-2026-3444)
A vulnerability described as problematic has been identified in Linux Kernel up to 7.2.5. This vulnerability affects the function module_init of the file smb/server of the component ksmbd. Executing a manipulation can lead to allocation of
CVE-2026-90162 | Linux Kernel up to 7.2.5 ksmbd smb2_lock use after free (WID-SEC-2026-3444)
A vulnerability marked as very critical has been reported in Linux Kernel up to 7.2.5. Impacted is the function smb2_lock of the component ksmbd. The manipulation leads to use after free. This vulnerability is uniquely identified as CVE-202
CVE-2026-90161 | Linux Kernel up to 6.18.51/7.2.5 erofs out-of-bounds (WID-SEC-2026-3444)
A vulnerability, which was classified as problematic, was found in Linux Kernel up to 6.18.51/7.2.5. The impacted element is an unknown function of the component erofs. Such manipulation leads to out-of-bounds read. This vulnerability is li
CVE-2026-90160 | Linux Kernel up to 7.2.5 lwt_bpf neigh_hh_output hard_header_len buffer overflow (WID-SEC-2026-3444)
A vulnerability marked as critical has been reported in Linux Kernel up to 7.2.5. This affects the function neigh_hh_output of the component lwt_bpf. Performing a manipulation of the argument hard_header_len results in buffer overflow. This
CVE-2026-90159 | Linux Kernel up to 6.12.109/6.18.51/7.2.5 BPF _bpf_setsockopt/_bpf_getsockopt race condition (WID-SEC-2026-3444)
A vulnerability, which was classified as very critical, has been found in Linux Kernel up to 6.12.109/6.18.51/7.2.5. The affected element is the function _bpf_setsockopt/_bpf_getsockopt of the component BPF. This manipulation causes race co
CVE-2026-90158 | Linux Kernel up to 6.6.156/6.12.109/6.18.51/7.2.5 nfcon nfcon_device deadlock (WID-SEC-2026-3444)
A vulnerability has been found in Linux Kernel up to 6.6.156/6.12.109/6.18.51/7.2.5 and classified as critical. Impacted is the function nfcon_device of the component nfcon. This manipulation causes deadlock. This vulnerability is registere
CVE-2026-90157 | Linux Kernel up to 7.2.5 BPF __cgroup_bpf_run_filter_getsockopt_kern optlen buffer overflow (WID-SEC-2026-3444)
A vulnerability, which was classified as very critical, was found in Linux Kernel up to 7.2.5. This issue affects the function __cgroup_bpf_run_filter_getsockopt_kern of the component BPF. The manipulation of the argument optlen results in
CVE-2026-90156 | Linux Kernel up to 7.2.5 ksmbd vfs_lock_file conn null pointer dereference (WID-SEC-2026-3444)
A vulnerability, which was classified as critical, was found in Linux Kernel up to 7.2.5. Affected by this issue is the function vfs_lock_file of the component ksmbd. Executing a manipulation of the argument conn can lead to null pointer de
CVE-2026-90155 | Linux Kernel up to 7.2.5 ksmbd __ksmbd_close_fd flc_blocked_requests use after free (WID-SEC-2026-3444)
A vulnerability was found in Linux Kernel up to 7.2.5 and classified as very critical. The affected element is the function __ksmbd_close_fd of the component ksmbd. Such manipulation of the argument flc_blocked_requests leads to use after f
CVE-2026-90154 | Linux Kernel ksmbd ksmbd_all_conn_set_status race condition (WID-SEC-2026-3444)
A vulnerability was found in Linux Kernel. It has been declared as very critical. This issue affects the function ksmbd_all_conn_set_status of the component ksmbd. The manipulation results in race condition. This vulnerability is known as C
CVE-2026-97841 | Microsoft Windows up to Server 2025 out-of-bounds (EUVD-2026-100442)
A vulnerability labeled as problematic has been found in Microsoft Windows. This impacts an unknown function. Executing a manipulation can lead to out-of-bounds read. This vulnerability appears as CVE-2026-97841. The attack may be performed
CVE-2026-97843 | Microsoft Windows up to Server 2025 DNS Server out-of-bounds (EUVD-2026-100444)
A vulnerability marked as problematic has been reported in Microsoft Windows. Affected is an unknown function of the component DNS Server. The manipulation leads to out-of-bounds read. This vulnerability is traded as CVE-2026-97843. It is p
CVE-2026-97842 | Microsoft Windows up to Server 2025 DNS Server out-of-bounds (EUVD-2026-100443)
A vulnerability described as problematic has been identified in Microsoft Windows. Affected by this vulnerability is an unknown functionality of the component DNS Server. The manipulation results in out-of-bounds read. This vulnerability is
CVE-2026-97844 | Microsoft Windows up to Server 2025 out-of-bounds (EUVD-2026-100445)
A vulnerability classified as problematic has been found in Microsoft Windows. Affected by this issue is some unknown functionality. This manipulation causes out-of-bounds read. This vulnerability is handled as CVE-2026-97844. The attack ca
CVE-2026-115635 | ash-project ash_postgres up to 2.15.1 DataLayer do_bulk_create/upsert improper authorization (EUVD-2026-109568)
A vulnerability marked as problematic has been reported in ash-project ash_postgres up to 2.15.1. The affected element is the function do_bulk_create/upsert of the component DataLayer. The manipulation leads to improper authorization. This
CVE-2026-114214 | Ash-Project Ash up to 3.34.6 Relationships relationships.ex lateral_join? improper authorization (EUVD-2026-109567)
A vulnerability labeled as problematic has been found in Ash-Project Ash up to 3.34.6. Impacted is the function lateral_join? of the file lib/ash/actions/read/relationships.ex of the component Relationships. Executing a manipulation can lea
CVE-2026-108127 | Microsoft Windows up to Server 2025 DNS Server out-of-bounds (EUVD-2026-100446)
A vulnerability, which was classified as problematic, was found in Microsoft Windows. Affected by this vulnerability is an unknown functionality of the component DNS Server. Such manipulation leads to out-of-bounds read. This vulnerability
CVE-2026-116094 | EyouCMS up to 1.8.3 application/function.php remote_file_to_local server-side request forgery (EUVD-2026-109573)
A vulnerability classified as critical was found in EyouCMS up to 1.8.3. This impacts the function remote_file_to_local of the file application/function.php. Executing a manipulation can lead to server-side request forgery. This vulnerabili
CVE-2026-115627 | ash-project ash_postgres up to 2.15.1 Lateral Join lateral_join_query/through_step_queries improper authorization (EUVD-2026-109569)
A vulnerability identified as problematic has been detected in ash-project ash_postgres up to 2.15.1. This issue affects the function lateral_join_query/through_step_queries of the component Lateral Join. Performing a manipulation results i
CVE-2026-116095 | smg-project smg up to 1.10.1 llm-multimodal jpeg_turbo.rs decode_jpeg_rgb memory allocation (Issue 2361 / EUVD-2026-109575)
A vulnerability, which was classified as problematic, has been found in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1. Affected is the function jpeg_turbo::decode_jpeg_rgb of the file crates/multimodal/src/jpeg_turbo.rs of the component l
CVE-2026-112242 | Cozmoslabs Profile Builder Plugin up to 4.0.4 on WordPress privileges management (EUVD-2026-108067)
A vulnerability was found in Cozmoslabs Profile Builder Plugin up to 4.0.4 on WordPress and classified as critical. Affected is an unknown function. The manipulation results in improper privilege management. This vulnerability is identified
CVE-2026-73636 | Apache HTTP Server up to 2.4.68 mod_auth_digest improper authentication (Nessus ID 371929 / WID-SEC-2026-3703)
A vulnerability labeled as critical has been found in Apache HTTP Server up to 2.4.68. Affected is an unknown function of the component mod_auth_digest. Such manipulation leads to improper authentication. This vulnerability is referenced as
CVE-2026-46729 | Apache HTTP Server up to 2.4.68 mod_heartmonitor null pointer dereference (Nessus ID 371929 / WID-SEC-2026-3703)
A vulnerability was found in Apache HTTP Server up to 2.4.68. It has been classified as critical. This affects an unknown part of the component mod_heartmonitor. This manipulation causes null pointer dereference. This vulnerability is handl
CVE-2026-63292 | Apache HTTP Server up to 2.4.68 mod_vhost_alias buffer overflow (Nessus ID 371929 / WID-SEC-2026-3703)
A vulnerability identified as very critical has been detected in Apache HTTP Server up to 2.4.68. This impacts an unknown function of the component mod_vhost_alias. This manipulation causes buffer overflow. The identification of this vulner
CVE-2026-106073 | Node.js prior 22.23.3/24.22.0/26.12.0 Permission Model fs.realpathSync permission (Nessus ID 371933)
A vulnerability was found in Node.js and classified as problematic. Affected is the function fs.realpathSync of the component Permission Model. Such manipulation leads to permission issues. This vulnerability is documented as CVE-2026-10607
CVE-2026-106071 | Node.js up to 26.12.0 Permission Model privileges management (Nessus ID 371933)
A vulnerability classified as problematic has been found in Node.js up to 26.12.0. Impacted is an unknown function of the component Permission Model. Performing a manipulation results in improper privilege management. This vulnerability is
CVE-2026-106074 | Node.js up to 22.23.2/24.21.0/26.11.0 Crypto random values (Nessus ID 371933)
A vulnerability identified as problematic has been detected in Node.js up to 22.23.2/24.21.0/26.11.0. This issue affects the function crypto.randomUUID/crypto.randomUUIDv7/crypto.randomInt of the component Crypto. This manipulation causes i
CVE-2026-106070 | Node.js 26.x ZipFile zlib.ZipFile information disclosure (Nessus ID 371933)
A vulnerability was found in Node.js 26.x. It has been declared as problematic. Affected by this issue is the function zlib.ZipFile of the component ZipFile. Executing a manipulation can lead to information disclosure. This vulnerability ap
CVE-2026-106072 | Node.js up to 22.23.3/24.22.0/26.12.0 TLS Hostname Verification tls.checkServerIdentity certificate validation (Nessus ID 371933)
A vulnerability was found in Node.js up to 22.23.3/24.22.0/26.12.0. It has been classified as problematic. Affected by this vulnerability is the function tls.checkServerIdentity of the component TLS Hostname Verification. Performing a manip
CVE-2026-105481 | Node.js up to 22.23.3/24.22.0/26.12.0 HTTP Agent improper synchronization (Nessus ID 371933)
A vulnerability classified as critical was found in Node.js up to 22.23.3/24.22.0/26.12.0. The affected element is an unknown function of the component HTTP Agent. Executing a manipulation can lead to improper synchronization. This vulnerab
CVE-2026-106069 | Node.js prior 22.23.3/24.22.0/26.12.0 Hostname Verification tls.checkServerIdentity certificate validation (Nessus ID 371933)
A vulnerability, which was classified as problematic, has been found in Node.js. The impacted element is the function tls.checkServerIdentity of the component Hostname Verification. The manipulation leads to improper certificate validation.
CVE-2026-105483 | Node.js up to 24.22.0/26.12.0 TLS Hostname Verification tls.checkServerIdentity certificate validation (Nessus ID 371933)
A vulnerability has been found in Node.js up to 24.22.0/26.12.0 and classified as problematic. This impacts the function tls.checkServerIdentity of the component TLS Hostname Verification. This manipulation causes improper certificate valid
CVE-2022-48006 | taocms 3.0.2 Upload.php upext unrestricted upload (Issue 35 / EUVD-2022-50720)
A vulnerability labeled as critical has been found in taocms 3.0.2. Affected is an unknown function of the file /include/Model/Upload.php. The manipulation of the argument upext results in unrestricted upload. This vulnerability was named C
CVE-2022-47968 | Heimdall Application Dashboard up to 2.5.4 Application Name Page/Add Application Page cross site scripting (Issue 1086 / EUVD-2022-50686)
A vulnerability was found in Heimdall Application Dashboard up to 2.5.4. It has been classified as problematic. This impacts an unknown function of the component Application Name Page/Add Application Page. This manipulation causes cross sit
CVE-2022-47952 | lxc up to 5.0.1 lxc-user-nic exposure of resource (EUVD-2022-50682)
A vulnerability was found in lxc up to 5.0.1. It has been declared as very critical. This impacts an unknown function of the component lxc-user-nic. Such manipulation leads to exposure of resource. This vulnerability is referenced as CVE-20
CVE-2022-47946 | Linux Kernel up to 5.10.154 fs/io_uring.c io_sqpoll_wait_sq denial of service (EUVD-2022-50678 / Nessus ID 236642)
A vulnerability identified as problematic has been detected in Linux Kernel up to 5.10.154. The impacted element is the function io_sqpoll_wait_sq of the file fs/io_uring.c. Performing a manipulation results in denial of service. This vulne
CVE-2022-47940 | Linux Kernel up to 5.18.17 ksmbd fs/ksmbd/smb2pdu.c smb2_write information disclosure (EUVD-2022-50673 / Nessus ID 249854)
A vulnerability classified as critical was found in Linux Kernel up to 5.18.17. Affected by this vulnerability is the function smb2_write of the file fs/ksmbd/smb2pdu.c of the component ksmbd. The manipulation results in information disclos
CVE-2022-47939 | Linux Kernel up to 5.19.1 ksmbd fs/ksmbd/smb2pdu.c smb2_tree_disconnect use after free (EUVD-2022-50672 / Nessus ID 239841)
A vulnerability classified as critical has been found in Linux Kernel up to 5.19.1. Affected is the function smb2_tree_disconnect of the file fs/ksmbd/smb2pdu.c of the component ksmbd. The manipulation leads to use after free. This vulnerab
Microsofts Oktober-Update: 1.413 Sicherheitslücken und ein aktiver Zero-Day
Die Schwachstellen ziehen sich durch weite Teile der Produktpalette: Betroffen sind Windows, Microsoft 365, Office, SharePoint Server, SQL Server, ... Weiterlesen
Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 25)
CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems. This article has been indexed from Unit 42 Read the original article: Threat Brief: Critical Vulner
PHP-Sicherheitslücke: Hacker im Vorteil - VOL.AT
Hacker haben wegen PHP-Lücke derzeit einen VorteilAPA/AFP/Kirill KUDRYAVTSEV. Die schwerwiegende ... Weiterlesen
CVE-2025-67591 | jegtheme JNews Paywall Plugin up to 12.0.1 on WordPress cross-site request forgery
A vulnerability identified as problematic has been detected in jegtheme JNews Paywall Plugin up to 12.0.1 on WordPress. The impacted element is an unknown function. The manipulation leads to cross-site request forgery. This vulnerability is
CVE-2025-67573 | ThimPress Sailing Plugin up to 4.4.6 on WordPress authorization
A vulnerability, which was classified as critical, was found in ThimPress Sailing Plugin up to 4.4.6 on WordPress. This issue affects some unknown processing. Executing a manipulation can lead to missing authorization. This vulnerability ap
CVE-2025-67572 | PenciDesign PenNews Plugin up to 6.7.4 on WordPress authorization
A vulnerability, which was classified as critical, has been found in PenciDesign PenNews Plugin up to 6.7.4 on WordPress. This vulnerability affects unknown code. Performing a manipulation results in missing authorization. This vulnerabilit
CVE-2025-67562 | WebCodingPlace Image Caption Hover Pro Plugin up to 20.0 on WordPress authorization
A vulnerability categorized as critical has been discovered in WebCodingPlace Image Caption Hover Pro Plugin up to 20.0 on WordPress. The impacted element is an unknown function. Such manipulation leads to missing authorization. This vulner
CVE-2025-67544 | Get Bowtied Shopkeeper Extender Plugin up to 7.0 on WordPress cross site scripting
A vulnerability categorized as problematic has been discovered in Get Bowtied Shopkeeper Extender Plugin up to 7.0 on WordPress. This affects an unknown function. Executing a manipulation can lead to cross site scripting. This vulnerability
CVE-2025-67539 | Select-Themes Select Core Plugin up to 2.6 on WordPress cross site scripting
A vulnerability, which was classified as problematic, has been found in Select-Themes Select Core Plugin up to 2.6 on WordPress. This issue affects some unknown processing. The manipulation leads to cross site scripting. This vulnerability
CVE-2025-67538 | jegtheme JNews Gallery Plugin up to 12.0.1 on WordPress cross site scripting
A vulnerability was found in jegtheme JNews Gallery Plugin up to 12.0.1 on WordPress. It has been classified as problematic. Impacted is an unknown function. This manipulation causes cross site scripting. This vulnerability appears as CVE-2
CVE-2025-54748 | RomanCode MapSVG Plugin up to 8.6.12 on WordPress path traversal
A vulnerability was found in RomanCode MapSVG Plugin up to 8.6.12 on WordPress. It has been rated as critical. Affected by this issue is some unknown functionality. Performing a manipulation results in path traversal. This vulnerability is
CVE-2025-14714 | LibreOffice up to 25.2.3 on macOS authentication bypass (EUVD-2025-203361 / Nessus ID 279100)
A vulnerability was found in LibreOffice up to 25.2.3 on macOS. It has been rated as critical. This impacts an unknown function. The manipulation leads to authentication bypass using alternate channel. This vulnerability is referenced as CV
CVE-2022-47934 | Brave Browser up to 1.43.87 ipfs Scheme denial of service (Issue 24211 / EUVD-2022-50668)
A vulnerability was found in Brave Browser up to 1.43.87 and classified as problematic. This affects an unknown function of the component ipfs Scheme Handler. Such manipulation leads to denial of service. This vulnerability is uniquely iden
CVE-2022-47933 | Brave Browser up to 1.42.50 ipfs Scheme ipfs_redirect_network_delegate_helper.cc OnBeforeURLRequest_IPFSRedirectWork denial of service (Issue 23646 / EUVD-2022-50667)
A vulnerability has been found in Brave Browser up to 1.42.50 and classified as problematic. The impacted element is the function ipfs::OnBeforeURLRequest_IPFSRedirectWork of the file ipfs_redirect_network_delegate_helper.cc of the componen
CVE-2022-47932 | Brave Browser up to 1.43.33 ipfs Scheme denial of service (Issue 24093 / EUVD-2022-50666)
A vulnerability, which was classified as problematic, was found in Brave Browser up to 1.43.33. The affected element is an unknown function of the component ipfs Scheme Handler. The manipulation results in denial of service. This vulnerabil
CVE-2022-47929 | Linux Kernel up to 6.1.5 Traffic Control Subsystem net/sched/sch_api.c qdisc_graft null pointer dereference (EUVD-2022-50665)
A vulnerability labeled as problematic has been found in Linux Kernel up to 6.1.5. This affects the function qdisc_graft of the file net/sched/sch_api.c of the component Traffic Control Subsystem. Such manipulation leads to null pointer der
CVE-2022-47927 | MediaWiki up to 1.35.8/1.38.4/1.39.0 SQLite File permission (FEDORA-2023-30a7a812f0 / EUVD-2022-50663)
A vulnerability, which was classified as critical, has been found in MediaWiki up to 1.35.8/1.38.4/1.39.0. This affects an unknown function of the component SQLite File Handler. This manipulation causes permission issues. The identification
CVE-2022-47926 | AyaCMS 3.1.2 fst_del.inc.php denial of service (EUVD-2022-50662)
A vulnerability was found in AyaCMS 3.1.2. It has been declared as problematic. The affected element is an unknown function of the file /aya/module/admin/fst_del.inc.php. Such manipulation leads to denial of service. This vulnerability is r
CVE-2022-47908 | V-Server up to 4.0.12.0 Project File stack-based overflow (EUVD-2022-50653)
A vulnerability was found in V-Server up to 4.0.12.0. It has been classified as critical. The impacted element is an unknown function of the component Project File Handler. Performing a manipulation results in stack-based buffer overflow. T
CVE-2022-47881 | Foxit PDF Reader/PDF Editor up to 11.2.1.53537 out-of-bounds (EUVD-2022-50638)
A vulnerability classified as problematic was found in Foxit PDF Reader and PDF Editor up to 11.2.1.53537. The impacted element is an unknown function. Such manipulation leads to out-of-bounds read. This vulnerability is listed as CVE-2022-
CVE-2022-47877 | Jedox 2020.2.5 Logs Page cross site scripting (ID 172153 / EUVD-2022-50634)
A vulnerability labeled as problematic has been found in Jedox 2020.2.5. Affected by this issue is some unknown functionality of the component Logs Page. Such manipulation leads to cross site scripting. This vulnerability is listed as CVE-2
CVE-2022-47876 | Jedox 2020.2.5 Groovy Script privilege escalation (ID 172155 / EUVD-2022-50633)
A vulnerability was found in Jedox 2020.2.5. It has been rated as critical. This impacts an unknown function of the component Groovy Script Handler. The manipulation leads to privilege escalation. This vulnerability is referenced as CVE-202