Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 785 | 0,2 % |
| ≥50 % | 3.559 | 0,9 % |
| ≥10 % | 13.140 | 3,2 % |
| <10 % | 396.071 | 95,8 % |
SonicWall Warns of Actively Exploited SSL-VPN Vulnerability That Bypasses SAML and MFA Protection
SonicWall has urged customers to address an SSL-VPN authentication vulnerability that can bypass SAML controls, including associated multifactor authentication measures. This issue is tracked as CVE-2026-19868 and affects SonicOS deployment
CVE-2026-116592 | nodejs undici up to 7.30.1/8.12.3 Cache Interceptor redirect (Nessus ID 377484)
A vulnerability was found in nodejs undici up to 7.30.1/8.12.3. It has been declared as problematic. This vulnerability affects unknown code of the component Cache Interceptor. The manipulation results in open redirect. This vulnerability w
CVE-2026-109829 | OpenJS undici up to 7.30.0/8.12.1 Cache Interceptor cross-domain policy (Nessus ID 377484)
A vulnerability was found in OpenJS undici up to 7.30.0/8.12.1. It has been classified as problematic. The affected element is an unknown function of the component Cache Interceptor. Performing a manipulation results in permissive cross-dom
CVE-2026-123824 | SensioLabs Symfony up to 5.4.55/6.4.49/7.4.22/8.1.10 Config XmlUtils::parse xml external entity reference (Nessus ID 377485)
A vulnerability labeled as critical has been found in SensioLabs Symfony up to 5.4.55/6.4.49/7.4.22/8.1.10. This vulnerability affects the function XmlUtils::parse of the component Config. Such manipulation leads to xml external entity refe
CVE-2026-120474 | undici up to 7.30.1/8.12.3 Redirect Interceptor cross-domain policy (Nessus ID 377487)
A vulnerability, which was classified as problematic, has been found in undici up to 7.30.1/8.12.3. This impacts an unknown function of the component Redirect Interceptor. This manipulation causes permissive cross-domain policy with untrust
CVE-2024-30260 | nodejs undici up to 5.28.3/6.11.0 HTTP Header fetch Proxy-Authorization improper authorization (Nessus ID 377488)
A vulnerability was found in nodejs undici up to 5.28.3/6.11.0. It has been declared as critical. Affected by this issue is the function fetch of the component HTTP Header Handler. Such manipulation of the argument Proxy-Authorization leads
CVE-2026-123784 | Fluxbox up to 1.3.7 RootTheme RootTheme::reconfigTheme os command injection (Nessus ID 377489)
A vulnerability labeled as problematic has been found in Fluxbox up to 1.3.7. This issue affects the function RootTheme::reconfigTheme of the component RootTheme. The manipulation results in os command injection. This vulnerability is repor
CVE-2026-120415 | openjs undici up to 7.30.1/8.12.3 Redirect Interceptor information disclosure (Nessus ID 377488)
A vulnerability has been found in openjs undici up to 7.30.1/8.12.3 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Redirect Interceptor. Performing a manipulation results in inform
CVE-2026-102523 | MariaDB up to 13.0.1 Partition Name privileges management (Nessus ID 377490)
A vulnerability classified as critical has been found in MariaDB up to 10.11.18/11.4.12/11.8.8/12.3.2/13.0.1. Affected is an unknown function of the component Partition Name Handler. The manipulation leads to improper privilege management.
CVE-2026-97629 | F5 NGINX Plus/NGINX Open Source certificate validation (Nessus ID 377499)
A vulnerability has been found in F5 NGINX Plus and NGINX Open Source and classified as problematic. This affects an unknown function. The manipulation leads to improper certificate validation. This vulnerability is listed as CVE-2026-97629
CVE-2026-95101 | F5 NGINX Plus/NGINX Open Source ngx_http_v3_module injection (Nessus ID 377499)
A vulnerability described as problematic has been identified in F5 NGINX Plus and NGINX Open Source. This vulnerability affects unknown code of the component ngx_http_v3_module. The manipulation results in injection. This vulnerability was
CVE-2026-93479 | F5 NGINX Plus/NGINX Open Source Map Directive heap-based overflow (Nessus ID 377499)
A vulnerability labeled as critical has been found in F5 NGINX Plus and NGINX Open Source. Affected by this issue is some unknown functionality of the component Map Directive. Executing a manipulation can lead to heap-based buffer overflow.
CVE-2025-63593 | grav 1.7.49.4 cross site scripting
A vulnerability was found in grav 1.7.49.4. It has been classified as problematic. This vulnerability affects unknown code. Performing a manipulation results in cross site scripting. This vulnerability was named CVE-2025-63593. The attack m
CVE-2025-63453 | Car-Booking-System-PHP 1.0 /carlux/contact.php sql injection
A vulnerability labeled as critical has been found in Car-Booking-System-PHP 1.0. This issue affects some unknown processing of the file /carlux/contact.php. Executing a manipulation can lead to sql injection. This vulnerability appears as
CVE-2025-63452 | Car-Booking-System-PHP 1.0 /carlux/forgot-pass.php sql injection
A vulnerability marked as critical has been reported in Car-Booking-System-PHP 1.0. Impacted is an unknown function of the file /carlux/forgot-pass.php. The manipulation leads to sql injection. This vulnerability is traded as CVE-2025-63452
CVE-2025-63442 | Simple User Management System 1.0 Profile Section cross site scripting
A vulnerability identified as problematic has been detected in Simple User Management System 1.0. This vulnerability affects unknown code of the component Profile Section. Performing a manipulation results in cross site scripting. This vuln
CVE-2025-63423 | Each Italy WIRELESS-N 300M 20190211 Administrator Password information disclosure
A vulnerability categorized as problematic has been discovered in Each Italy WIRELESS-N 300M 20190211. This vulnerability affects unknown code of the component Administrator Password Handler. Such manipulation leads to information disclosur
CVE-2025-63294 | Codecanyon/WorkDo HRM SaaS HR and Payroll Tool 8.1 permission
A vulnerability classified as critical has been found in Codecanyon/WorkDo HRM SaaS HR and Payroll Tool 8.1. This vulnerability affects unknown code. The manipulation leads to permission issues. This vulnerability is traded as CVE-2025-6329
CVE-2025-63293 | FairSketch RISE Ultimate Project Manager & CRM 3.9.4 API authorization
A vulnerability classified as critical was found in FairSketch RISE Ultimate Project Manager &amp; CRM 3.9.4. This impacts an unknown function of the component API. Executing a manipulation can lead to missing authorization. This vulner
CVE-2025-61141 | sqls 0.2.28 Environment Variable openEditor EDITOR command injection
A vulnerability, which was classified as critical, has been found in sqls 0.2.28. This issue affects the function openEditor of the component Environment Variable Handler. The manipulation of the argument Committer leads to command injectio
CVE-2025-60503 | UltimateFosters UltimatePOS 4.8 Admin Log Panel Page reference No cross site scripting
A vulnerability, which was classified as problematic, has been found in UltimateFosters UltimatePOS 4.8. Affected by this issue is some unknown functionality of the component Admin Log Panel Page. The manipulation of the argument reference
CVE-2025-50735 | NextChat up to 2.16.0 WebDAV Endpoint path traversal
A vulnerability, which was classified as critical, was found in NextChat up to 2.16.0. Affected by this vulnerability is an unknown functionality of the component WebDAV Endpoint. The manipulation results in path traversal. This vulnerabili
CVE-2025-12695 | DSPy isolation (jfsa-2025-001495)
A vulnerability described as problematic has been identified in DSPy. This affects an unknown part. Executing a manipulation can lead to improper isolation or compartmentalization. This vulnerability appears as CVE-2025-12695. The attack ma
CVE-2025-11953 | Metro Development Server up to 19.x Endpoint os command injection (EUVD-2025-37505 / Nessus ID 298225)
A vulnerability, which was classified as critical, has been found in Metro Development Server up to 19.x. This impacts an unknown function of the component Endpoint. Performing a manipulation results in os command injection. This vulnerabil
CVE-2026-124508 | floci-io Floci up to 2.4.0 Artifact CodeBuildJsonHandler.java BuildspecParser.parseArtifacts buildspecOverride.artifacts.base-directory path traversal (GHSA-4hjc-ww34-35c4 / EUVD-2026-119769)
A vulnerability, which was classified as problematic, has been found in floci-io Floci up to 2.4.0. Impacted is the function BuildspecParser.parseArtifacts of the file src/main/java/io/github/hectorvent/floci/services/codebuild/CodeBuildJso
CVE-2026-124507 | conductor-oss conductor up to 3.32.4/3.33.0/3.34.0-rc3/4.0.0-alpha.1 PLANNER_CONTEXT_FETCH Task PlannerContextFetchTask.java WorkflowSystemTask.start url server-side request forgery (GHSA-cx7c-4mp7-rhcj / EUVD-2026-119768)
A vulnerability classified as problematic was found in conductor-oss conductor up to 3.32.4/3.33.0/3.34.0-rc3/4.0.0-alpha.1. This issue affects the function WorkflowSystemTask.start of the file PlannerContextFetchTask.java of the component
CVE-2026-116501 | IBM Qiskit SDK up to 2.6.1 out-of-bounds write (EUVD-2026-119683)
A vulnerability labeled as critical has been found in IBM Qiskit SDK up to 2.6.1. This affects an unknown function. Executing a manipulation can lead to out-of-bounds write. This vulnerability is handled as CVE-2026-116501. It is possible t
CVE-2026-116499 | IBM Qiskit SDK up to 2.6.2 deserialization (EUVD-2026-119685)
A vulnerability marked as problematic has been reported in IBM Qiskit SDK up to 2.6.2. This impacts an unknown function. The manipulation leads to deserialization. This vulnerability is uniquely identified as CVE-2026-116499. Local access i
CVE-2026-124509 | floci-io Floci up to 2.1.0 S3 Destination Configuration DeliveryStreamDescription.java S3Destination.bucketName BucketARN path traversal (Issue 4281 / EUVD-2026-119770)
A vulnerability, which was classified as critical, was found in floci-io Floci up to 2.1.0. The affected element is the function S3Destination.bucketName of the file services/firehose/model/DeliveryStreamDescription.java of the component S3
CVE-2026-110273 | IBM TRIRIGA Application Platform up to 5.0.9 os command injection (EUVD-2026-119691)
A vulnerability was found in IBM TRIRIGA Application Platform up to 5.0.9 and classified as critical. Affected is an unknown function. Such manipulation leads to os command injection. This vulnerability is documented as CVE-2026-110273. The
CVE-2026-124555 | JeecgBoot 3.9.5 Table Dictionary API getTableDictList JimuFormApiService.getTableDictList searchSql sql injection (EUVD-2026-119777)
A vulnerability was found in JeecgBoot 3.9.5. It has been declared as critical. This vulnerability affects the function JimuFormApiService.getTableDictList of the file /jeecg-boot/jmreport/form/getTableDictList of the component Table Dictio
CVE-2026-124554 | JeecgBoot 3.9.5 JimuBI getAllChartData params sql injection (EUVD-2026-119776)
A vulnerability was found in JeecgBoot 3.9.5. It has been classified as critical. This affects an unknown part of the file /jeecg-boot/drag/onlDragDatasetHead/getAllChartData of the component JimuBI. Performing a manipulation of the argumen
CVE-2026-124556 | kekingcn kkFileView up to 5.0.3 BaseUrlFilter.java BaseUrlFilter.getBaseUrl X-Base-Url redirect (GHSA-wrm9-r4fj-f8q5 / EUVD-2026-119778)
A vulnerability was found in kekingcn kkFileView up to 5.0.3. It has been rated as problematic. This issue affects the function BaseUrlFilter.getBaseUrl of the file server/src/main/java/cn/keking/web/filter/BaseUrlFilter.java. The manipulat
CVE-2026-124557 | OtterMind Chat2DB up to 5.3.8 Class Generator DbMybatisGenerateServiceImpl.java DbMybatisGenerateServiceImpl.generateClass tableName path traversal (EUVD-2026-119779)
A vulnerability categorized as critical has been discovered in OtterMind Chat2DB up to 5.3.8. Impacted is the function DbMybatisGenerateServiceImpl.generateClass of the file DbMybatisGenerateServiceImpl.java of the component Class Generator
CVE-2025-63608 | CSZ CSZ-CMS up to 1.3.0 Form Builder View field sql injection
A vulnerability, which was classified as critical, has been found in CSZ CSZ-CMS up to 1.3.0. This affects an unknown function of the component Form Builder View. The manipulation of the argument Field leads to sql injection. This vulnerabi
CVE-2025-61876 | Inforcer Platform 2.0.153 API Endpoint /tenants/ resource injection
A vulnerability was found in Inforcer Platform 2.0.153 and classified as problematic. Affected by this issue is some unknown functionality of the file /tenants/ of the component API Endpoint. The manipulation results in improper control of
CVE-2025-61234 | Dataphone A920 2025.07.161103 access control
A vulnerability classified as critical was found in Dataphone A920 2025.07.161103. This affects an unknown part. Executing a manipulation can lead to improper access controls. This vulnerability is tracked as CVE-2025-61234. The attack is o
CVE-2025-61117 | Senza Keto & Fasting App 2.10.15 on Android API Endpoint access control
A vulnerability, which was classified as critical, was found in Senza Keto &amp; Fasting App 2.10.15 on Android. This issue affects some unknown processing of the component API Endpoint. Executing a manipulation can lead to improper acc
CVE-2025-61115 | ABC Fine Wine & Spirits App up to 11.27.5 on Android com.cta.abcfinewineandspirits improper authentication
A vulnerability classified as critical has been found in ABC Fine Wine &amp; Spirits App up to 11.27.5 on Android. Affected by this issue is some unknown functionality of the component com.cta.abcfinewineandspirits. This manipulation ca
CVE-2025-60898 | Halo CMS 2.21 Endpoint server-side request forgery
A vulnerability, which was classified as critical, has been found in Halo CMS 2.21. This vulnerability affects unknown code of the component Endpoint. The manipulation leads to server-side request forgery. This vulnerability is listed as CV
CVE-2025-60320 | memoQ up to 10.1.13.ef1b2b52aae memoQauhlp101 unquoted search path
A vulnerability was found in memoQ up to 10.1.13.ef1b2b52aae. It has been rated as problematic. This issue affects some unknown processing of the component memoQauhlp101. Performing a manipulation results in unquoted search path. This vulne
CVE-2025-57227 | Kingosoft Kingo ROOT 1.5.8.3353 unquoted search path (Exploit 51707 / EDB-51707)
A vulnerability identified as problematic has been detected in Kingosoft Kingo ROOT 1.5.8.3353. The affected element is an unknown function. The manipulation leads to unquoted search path. This vulnerability is traded as CVE-2025-57227. An
CVE-2025-50739 | iib0011 omni-tools 0.4.0 JSON deserialization
A vulnerability classified as critical was found in iib0011 omni-tools 0.4.0. Affected is an unknown function of the component JSON Handler. The manipulation results in deserialization. This vulnerability is reported as CVE-2025-50739. The
CVE-2025-50736 | Byaidu PDFMathTranslate 1.9.9 /gradio_api file redirect (EUVD-2025-37013)
A vulnerability was found in Byaidu PDFMathTranslate 1.9.9. It has been rated as problematic. This vulnerability affects unknown code of the file /gradio_api. The manipulation of the argument File leads to open redirect. This vulnerability
CVE-2025-50574 | Hiruna Gallage Glamour Salon Management System 1.0 blog-details.php blog comment section cross site scripting
A vulnerability was found in Hiruna Gallage Glamour Salon Management System 1.0. It has been declared as problematic. This affects an unknown part of the file blog-details.php. Executing a manipulation of the argument blog comment section c
CVE-2024-56426 | Samsung Mobile Processor/Wearable Processor Exynos up to 2400 USB Packet out-of-bounds write
A vulnerability was found in Samsung Mobile Processor and Wearable Processor Exynos up to 2400. It has been declared as critical. Impacted is an unknown function of the component USB Packet Handler. Executing a manipulation can lead to out-
CVE-2024-47866 | Ceph RGW Module denial of service (Nessus ID 275346 / WID-SEC-2025-2584)
A vulnerability classified as problematic has been found in Ceph. The affected element is an unknown function of the component RGW Module. This manipulation causes denial of service. This vulnerability is tracked as CVE-2024-47866. The atta
CVE-2024-45161 | Blu-Castle BCUM221E 1.0.0P2205 Image cross-site request forgery
A vulnerability has been found in Blu-Castle BCUM221E 1.0.0P2205 and classified as problematic. The impacted element is an unknown function of the component Image Handler. This manipulation causes cross-site request forgery. This vulnerabil
CVE-2024-44655 | PHPGurukul Complaint Management System 2.0 user-search.php search cross site scripting
A vulnerability was found in PHPGurukul Complaint Management System 2.0. It has been rated as problematic. Impacted is an unknown function of the file user-search.php. This manipulation of the argument Search causes cross site scripting. Th
CVE-2024-44654 | PHPGurukul Complaint Management System 2.0 reset-password.php email/mobileno sql injection
A vulnerability was found in PHPGurukul Complaint Management System 2.0. It has been declared as critical. Affected by this issue is some unknown functionality of the file reset-password.php. Executing a manipulation of the argument email/m
CVE-2024-44651 | Kashipara Ecommerce Website 1.0 user_password_recover.php recover_email sql injection
A vulnerability has been found in Kashipara Ecommerce Website 1.0 and classified as critical. This impacts an unknown function of the file user_password_recover.php. This manipulation of the argument recover_email causes sql injection. This
CVE-2024-44644 | PHPGurukul Small CRM 3.0 manage-tickets.php frm_id/aremark sql injection
A vulnerability has been found in PHPGurukul Small CRM 3.0 and classified as critical. The affected element is an unknown function of the file manage-tickets.php. The manipulation of the argument frm_id/aremark leads to sql injection. This
SSHole: A long password could bypass SSH authentication on affected Alpine Linux systems
A recent OpenSSH security issue caught my attention, especially because of how unusual the authentication bypass is. The vulnerability, known as SSHole (CVE-2026-123158), affects certain Linux systems running OpenSSH with musl libc and with
CVE-2026-97193 | Secure Custom Fields Plugin up to 6.9.7 on WordPress Bidirectional Relationship Synchronization authorization (EUVD-2026-119462)
A vulnerability labeled as problematic has been found in Secure Custom Fields Plugin up to 6.9.7 on WordPress. This affects an unknown function of the component Bidirectional Relationship Synchronization. The manipulation results in authori
CVE-2026-97192 | Secure Custom Fields Plugin up to 6.9.7 on WordPress Field Group Location Rules access control (EUVD-2026-119461)
A vulnerability classified as critical has been found in Secure Custom Fields Plugin up to 6.9.7 on WordPress. This affects an unknown function of the component Field Group Location Rules. This manipulation causes improper access controls.
CVE-2026-97195 | Secure Custom Fields Plugin up to 6.9.7 on WordPress Field Definition cross site scripting (EUVD-2026-119464)
A vulnerability was found in Secure Custom Fields Plugin up to 6.9.7 on WordPress and classified as problematic. This affects an unknown part of the component Field Definition. The manipulation results in cross site scripting. This vulnerab
CVE-2026-97194 | Secure Custom Fields Plugin up to 6.9.7 on WordPress Relational Fields information disclosure (EUVD-2026-119463)
A vulnerability, which was classified as problematic, has been found in Secure Custom Fields Plugin up to 6.9.7 on WordPress. Affected is an unknown function of the component Relational Fields. Performing a manipulation results in informati
CVE-2026-96961 | Pie Register Plugin up to 3.8.4.15 on WordPress Request authorization (EUVD-2026-119466)
A vulnerability has been found in Pie Register Plugin up to 3.8.4.15 on WordPress and classified as critical. This issue affects some unknown processing of the component Request Handler. This manipulation causes missing authorization. The i
CVE-2026-103375 | Antom Payments Plugin up to 2.0.11 on WordPress authorization (EUVD-2026-119465)
A vulnerability classified as problematic was found in Antom Payments Plugin up to 2.0.11 on WordPress. Affected by this issue is some unknown functionality. Executing a manipulation can lead to authorization bypass. This vulnerability is h
CVE-2026-96963 | Pie Register Plugin up to 3.8.4.15 on WordPress authorization (EUVD-2026-119467)
A vulnerability was found in Pie Register Plugin up to 3.8.4.15 on WordPress. It has been classified as critical. The affected element is an unknown function. Performing a manipulation results in missing authorization. This vulnerability is