Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 741 | 0,2 % |
| ≥50 % | 3.215 | 0,8 % |
| ≥10 % | 22.048 | 5,8 % |
| <10 % | 354.725 | 93,2 % |
Cisco Patches Actively Exploited SSL VPN Vulnerability Affecting ASA and FTD Firewalls
Cisco has released security updates that address a critical vulnerability in the Remote Access SSL VPN service on its Secure Firewall Adaptive Security Appliance (ASA) and Threat Defense (FTD) software. This vulnerability, tracked as CVE-20
Gasheizung: Test deckt eine Schwachstelle bei 4 von 5 Geräten auf
Ein Test aus den Niederlanden zeigt, wie Gaskessel auf eine zu niedrige Netzspannung reagieren. Bei vier von fünf Geräten lief die Umwälzpumpe schwerer. Weiterlesen
Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities (KEV) catalog, citin
Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
CVE-2026-41709 allows attackers with administrative privileges to perform operations without being logged. The post Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day appeared first on SecurityWeek. Weiterlesen
CVE-2025-65136 | manikandan580 School-management-system 1.0 POST Parameter contact-us.php pagedes cross site scripting
A vulnerability labeled as problematic has been found in manikandan580 School-management-system 1.0. The affected element is an unknown function of the file /studentms/admin/contact-us.php of the component POST Parameter Handler. Such manip
CVE-2024-13362 | Advanced Scrollbar Plugin on WordPress Parameter url cross site scripting
A vulnerability identified as problematic has been detected in Advanced Scrollbar Plugin on WordPress. Affected is an unknown function of the component Parameter Handler. The manipulation of the argument url leads to cross site scripting. T
Lumen Uncovers Secret Chinese Hacking Network Behind Years of Zero-Day Attacks on U.S. Infrastructure
Black Lotus Labs has uncovered Silent Train, a covert hacking network used by Chinese state-sponsored threat group Volt Typhoon to attack strategically important U.S. organizations. Researchers tracked the operation for three years, issuing
ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws
The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week. Oracle patched all three under a single identifier, CVE-2026-35273, in
PHP2Shell: Aktive Ausnutzung von CVE-2026-109618/109619 trifft öffentlich erreichbare PAN-OS-Management-Interfaces
LONDON (IT BOLTWISE) – Angreifer nutzen laut Anbieterhinweis die kürzlich gepatchten PHP2Shell-Schwachstellen CVE-2026-109618 und CVE-2026-109619 aktiv gegen ins Internet gestellte Management-Interfaces. Die Lücken ermöglichen eine nicht au
China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a security flaw impacting Broadcom VMware ESX to its Known Exploited Vulnerabilities (KEV) catalog, after CrowdStrike revealed that it had been weaponized b
Security Researchers Demonstrate Chrome Sandbox Escapes, Telegram Zero-Click Attacks and iOS Zero-Day Research
Security researchers at OffensiveCon Japan 2026 explored topics including Chrome sandbox escapes, zero-click attack surfaces in Telegram, and newly discovered iOS zero-day vulnerabilities. This two-day program took place on October 27–28. T
CVE-2026-97324 | YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08 Demo-order Payment Callback PayDemoOrderController.java updateDemoOrderPaid improper authorization
A vulnerability classified as critical has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected is the function updateDemoOrderPaid of the file yudao-module-pay/src/main/java/cn/iocoder/yudao/module/pay/controller/admin/
CVE-2026-2701 | Progress ShareFile Storage Zones Controller up to 5.12.3 unrestricted upload
A vulnerability was found in Progress ShareFile Storage Zones Controller up to 5.12.3. It has been declared as critical. The impacted element is an unknown function of the component File Handler. Such manipulation leads to unrestricted uplo
CVE-2026-2699 | Progress ShareFile Storage Zones Controller up to 5.12.3 redirect
A vulnerability was found in Progress ShareFile Storage Zones Controller up to 5.12.3. It has been declared as very critical. This issue affects some unknown processing. The manipulation results in execution after redirect. This vulnerabili
CVE-2023-7339 | Softing pnGate stack-based overflow
A vulnerability classified as critical has been found in Softing pnGate, epGate, mbGate, smartLink HW-DP and smartLink HW-PN. This issue affects some unknown processing. This manipulation causes stack-based buffer overflow. This vulnerabili
CVE-2026-14288 | GitLab 17.4/19.3.5/19.4.2/19.5.0 Approval Rule Synchronization access control (WID-SEC-2026-4115)
A vulnerability was found in GitLab 17.4/19.3.5/19.4.2/19.5.0. It has been declared as problematic. This impacts an unknown function of the component Approval Rule Synchronization. Such manipulation leads to improper access controls. This v
CVE-2026-13319 | GitLab up to 19.3.5/19.4.2/19.5.0 Group Milestones API improper authorization (WID-SEC-2026-4115)
A vulnerability was found in GitLab up to 19.3.5/19.4.2/19.5.0. It has been classified as problematic. This affects an unknown function of the component Group Milestones API. This manipulation causes improper authorization. The identificati
CVE-2026-12664 | GitLab up to 19.3.5/19.4.2/19.5.0 GraphQL Field privileges management (WID-SEC-2026-4115)
A vulnerability, which was classified as critical, has been found in GitLab up to 19.3.5/19.4.2/19.5.0. This issue affects some unknown processing of the component GraphQL Field. Performing a manipulation results in improper privilege manag
CVE-2026-112378 | GitLab up to 19.3.5/19.4.2/19.5.0 Billing Eligibility Checks privileges management (WID-SEC-2026-4115)
A vulnerability was found in GitLab up to 19.3.5/19.4.2/19.5.0. It has been rated as problematic. Affected is an unknown function of the component Billing Eligibility Checks. Performing a manipulation results in improper privilege managemen
CVE-2026-112326 | GitLab up to 19.3.5/19.4.2/19.5.0 Vulnerability Record Cleanup privileges management (WID-SEC-2026-4115)
A vulnerability was found in GitLab up to 19.3.5/19.4.2/19.5.0 and classified as problematic. The impacted element is an unknown function of the component Vulnerability Record Cleanup. The manipulation results in improper privilege manageme
CVE-2026-112212 | GitLab up to 19.3.5/19.4.2/19.5.0 OAuth/OIDC Discovery redirect (WID-SEC-2026-4115)
A vulnerability classified as problematic was found in GitLab up to 19.3.5/19.4.2/19.5.0. This vulnerability affects unknown code of the component OAuth/OIDC Discovery. Such manipulation leads to open redirect. This vulnerability is traded
CVE-2026-110610 | YunaiV ruoyi-vue-pro up to 2026.09 Image Service HttpUtil.downloadBytes referImageUrl server-side request forgery (Issue 1178)
A vulnerability labeled as critical has been found in YunaiV ruoyi-vue-pro up to 2026.09. The affected element is the function HttpUtil.downloadBytes of the component Image Service. Executing a manipulation of the argument referImageUrl can
CVE-2026-97320 | YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08 AI Knowledge AiKnowledgeDocumentServiceImpl.java AiKnowledgeDocumentServiceImpl.readUrl url server-side request forgery (Issue 1176)
A vulnerability identified as critical has been detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The affected element is the function AiKnowledgeDocumentServiceImpl.readUrl of the file AiKnowledgeDocumentServiceImpl.java of the
China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a security flaw impacting Broadcom VMware ESX to its Known Exploited Vulnerabilities (KEV) catalog, after CrowdStrike revealed that it had been weaponized b
Security Researchers Demonstrate Chrome Sandbox Escapes, Telegram Zero-Click Attacks and iOS Zero-Day Research
Security researchers at OffensiveCon Japan 2026 explored topics including Chrome sandbox escapes, zero-click attack surfaces in Telegram, and newly discovered iOS zero-day vulnerabilities. This two-day program took place on October 27–28. T
Fehler in OpenStack Manila lässt Fremde öffentliche Freigaben steuern
Angemeldete Nutzer eines beliebigen Projekts können in OpenStack Manila öffentliche Freigaben fremder Projekte manipulieren und etwa Zugriffsregeln ändern. Korrigiert sind die Versionen 20.0.3, 21.0.3, 22.0.2 und 23.0.1. (Bild: kentoh - s
CVE-2026-114173 | Canva Ortto Plugin up to 1.0.24 information disclosure (EUVD-2026-112570)
A vulnerability was found in Canva Ortto Plugin up to 1.0.24. It has been declared as problematic. This vulnerability affects unknown code. Executing a manipulation can lead to information disclosure. This vulnerability is handled as CVE-20
CVE-2026-66088 | Apereo openEQUELLA up to 2026.0 Scripting Engine system.execute os command injection (EUVD-2026-112564)
A vulnerability classified as critical has been found in Apereo openEQUELLA up to 2026.0. Affected is the function system.execute of the component Scripting Engine. The manipulation leads to os command injection. This vulnerability is liste
CVE-2026-16889 | Apereo openEQUELLA up to 2026.0 Image Upload Endpoint image name cross site scripting (EUVD-2026-112563)
A vulnerability marked as problematic has been reported in Apereo openEQUELLA up to 2026.0. This affects an unknown function of the file /api/preloginnotice/image of the component Image Upload Endpoint. Performing a manipulation of the argu
CVE-2026-113409 | Canva Ortto Plugin up to 1.0.24 cross site scripting (EUVD-2026-112571)
A vulnerability labeled as problematic has been found in Canva Ortto Plugin up to 1.0.24. The impacted element is an unknown function. Such manipulation leads to cross site scripting. This vulnerability is referenced as CVE-2026-113409. It
CVE-2026-66090 | Apereo openEQUELLA up to 2026.0 XML parser /api/item server-side request forgery (EUVD-2026-112566)
A vulnerability was found in Apereo openEQUELLA up to 2026.0. It has been rated as critical. This issue affects some unknown processing of the file /api/item of the component XML parser. The manipulation leads to server-side request forgery
CVE-2026-66089 | Apereo openEQUELLA up to 2026.0 SOAP API server-side request forgery (EUVD-2026-112565)
A vulnerability identified as critical has been detected in Apereo openEQUELLA up to 2026.0. The affected element is an unknown function of the component SOAP API. This manipulation causes server-side request forgery. The identification of
CVE-2026-66091 | Apereo openEQUELLA up to 2026.0 userinfobackup uniqueId authorization (EUVD-2026-112567)
A vulnerability described as problematic has been identified in Apereo openEQUELLA up to 2026.0. This impacts an unknown function of the file /api/userquery/userinfobackup. Executing a manipulation of the argument uniqueId can lead to missi
CVE-2026-66092 | Apereo openEQUELLA up to 2026.1 Pre-Login Notice /api/preloginnotice cross site scripting (EUVD-2026-112568)
A vulnerability classified as problematic was found in Apereo openEQUELLA up to 2026.1. Affected by this vulnerability is an unknown functionality of the file /api/preloginnotice of the component Pre-Login Notice. The manipulation results i
CVE-2026-96741 | mlfactory DSGVO All in one for WP Plugin up to 5.0 on WordPress Comment Content cross site scripting (EUVD-2026-112585)
A vulnerability identified as problematic has been detected in mlfactory DSGVO All in one for WP Plugin up to 5.0 on WordPress. This impacts an unknown function of the component Comment Content. Performing a manipulation results in cross si
CVE-2026-96669 | wpscripts Food Store Plugin up to 1.5.5 on WordPress Cookie service_type/type cross site scripting (EUVD-2026-112586)
A vulnerability marked as problematic has been reported in wpscripts Food Store Plugin up to 1.5.5 on WordPress. Affected by this vulnerability is an unknown functionality of the component Cookie Handler. The manipulation of the argument se
CVE-2026-109516 | guruteam Bot for Telegram Plugin up to 1.3.0 on WordPress REST Endpoint main bftow_get_user_system_id tgId improper authentication (EUVD-2026-112584)
A vulnerability was found in guruteam Bot for Telegram Plugin up to 1.3.0 on WordPress. It has been rated as critical. The impacted element is the function bftow_get_user_system_id of the file /wp-json/woo-telegram/v1/main of the component
CVE-2026-93904 | dejanmarkovic Social Web Suite Plugin up to 4.1.12 on WordPress exclude_posts sql injection (EUVD-2026-112588)
A vulnerability labeled as critical has been found in dejanmarkovic Social Web Suite Plugin up to 4.1.12 on WordPress. Affected is an unknown function. Executing a manipulation of the argument exclude_posts can lead to sql injection. The id
CVE-2026-93855 | brewlabs SendPress Newsletters Plugin up to 1.26.1.20 on WordPress Shortcode subscriberid sql injection (EUVD-2026-112587)
A vulnerability categorized as critical has been discovered in brewlabs SendPress Newsletters Plugin up to 1.26.1.20 on WordPress. This affects an unknown function of the component Shortcode Handler. Such manipulation of the argument subscr
CVE-2026-96666 | Schema App Structured Data Plugin up to 2.3.2 on WordPress Remove Microdata Output Filter cross site scripting (EUVD-2026-112589)
A vulnerability described as problematic has been identified in Schema App Structured Data Plugin up to 2.3.2 on WordPress. Affected by this issue is some unknown functionality of the component Remove Microdata Output Filter. The manipulati
CVE-2026-96228 | sslplugins SSL Wireless SMS Notification Plugin up to 3.8.1 on WordPress Login final_login_ajax_action sslcare_login_phone/cap_data improper authentication (EUVD-2026-112590)
A vulnerability was found in sslplugins SSL Wireless SMS Notification Plugin up to 3.8.1 on WordPress. It has been declared as critical. The affected element is the function final_login_ajax_action of the component Login Handler. The manipu
CVE-2026-93757 | Wild Apricot Login Plugin up to 1.0.18 on WordPress SSO Authentication Module.php syncWaContact improper authentication (EUVD-2026-112591)
A vulnerability was found in Wild Apricot Login Plugin up to 1.0.18 on WordPress. It has been classified as critical. Impacted is the function UserSynchronizer::syncWaContact of the file Module.php of the component SSO Authentication. The m
Hackers Exploit PHP2Shell to Root 25 Servers – Including US Government Affiliates
HOC Shorts | The Breaking Discovery: Cybersecurity researchers uncovered a campaign in which attackers chained the PHP2Shell remote code execution flaw with a Linux kernel privilege escalation exploit (Fragnesia, `CVE-2026-46300`) to compl
CVE-2023-54227 | Linux Kernel up to 6.5.4 /mnt nr_hw_queues memory leak (Nessus ID 319348 / WID-SEC-2025-2941)
A vulnerability identified as critical has been detected in Linux Kernel up to 6.5.4. This vulnerability affects the function nr_hw_queues of the file /mnt. This manipulation causes memory leak. This vulnerability is registered as CVE-2023-
CVE-2026-115417 | AWS aws-c-mqtt up to 0.16.1 MQTT 3.1.1 Compatibility Adapter denial of service (EUVD-2026-108508)
A vulnerability, which was classified as problematic, was found in AWS aws-c-mqtt up to 0.16.1. This issue affects some unknown processing of the component MQTT 3.1.1 Compatibility Adapter. Such manipulation leads to denial of service. This
CVE-2026-90732 | Dell PowerProtect Data Domain up to 8.6.1.20 stack-based overflow (EUVD-2026-110812)
A vulnerability identified as problematic has been detected in Dell PowerProtect Data Domain up to 7.7.1.0/LTS 2026/7.13.1.80/8.3.1.40/8.6.1.20. Affected by this vulnerability is an unknown functionality. The manipulation leads to stack-bas
CVE-2026-90731 | Dell PowerProtect Data Domain up to 8.7 stack-based overflow (EUVD-2026-110814)
A vulnerability was found in Dell PowerProtect Data Domain up to 8.7. It has been rated as problematic. This impacts an unknown function. Performing a manipulation results in stack-based buffer overflow. This vulnerability is identified as
CVE-2026-106484 | Google chrome-devtools-mcp up to 1.4.x Policy Enforcement privileges management (EUVD-2026-112366)
A vulnerability described as problematic has been identified in Google chrome-devtools-mcp up to 1.4.x. This issue affects some unknown processing of the component Policy Enforcement. Executing a manipulation can lead to improper privilege
CVE-2026-117341 | Octopus Deploy Octopus Server Audit Event Log privileges management (WID-SEC-2026-4164)
A vulnerability marked as problematic has been reported in Octopus Deploy Octopus Server. The impacted element is an unknown function of the component Audit Event Log. Performing a manipulation results in improper privilege management. This
CVE-2026-97255 | WProyal Royal Elementor Addons Plugin up to 1.7.1069 on WordPress authorization (WID-SEC-2026-4184)
A vulnerability labeled as problematic has been found in WProyal Royal Elementor Addons Plugin up to 1.7.1069 on WordPress. The affected element is an unknown function. The manipulation results in authorization bypass. This vulnerability is
CVE-2026-97254 | WProyal Royal Elementor Addons Plugin up to 1.7.1069 on WordPress cross site scripting (WID-SEC-2026-4184)
A vulnerability identified as problematic has been detected in WProyal Royal Elementor Addons Plugin up to 1.7.1069 on WordPress. Impacted is an unknown function. The manipulation leads to cross site scripting. This vulnerability is referen
CVE-2026-112865 | WProyal Royal Elementor Addons Plugin up to 1.7.1069 on WordPress cross site scripting (WID-SEC-2026-4184)
A vulnerability was found in WProyal Royal Elementor Addons Plugin up to 1.7.1069 on WordPress. It has been rated as problematic. This vulnerability affects unknown code. Performing a manipulation results in cross site scripting. This vulne
CVE-2026-107100 | Royal Addons for Elementor Plugin up to 1.7.1069 on WordPress information disclosure (WID-SEC-2026-4184)
A vulnerability was found in Royal Addons for Elementor Plugin up to 1.7.1069 on WordPress and classified as problematic. This affects an unknown part. The manipulation results in information disclosure. This vulnerability is cataloged as C
CVE-2026-116639 | A vulnerability was detected in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to a8902bf64575e325f6d6bf93a55f7bd273ec58cd. Affected is an unknown function of the file chat.php. Performing a manipulation of the argument ID results in cross site scripting. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for aff
A vulnerability was detected in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to a8902bf64575e325f6d6bf93a55f7bd273ec58cd. Affected is an unknown function of the file chat.php. Performing a manipulation of the argument ID results in
CVE-2026-116839 | A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to make unauthorized changes and execute a Denial of Service (DoS) attack on the device.
A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to make unauthorized changes and execute a Denial of Service (DoS) attack on the
CVE-2026-116838 | A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to execute a Command Injection on the device.
A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to execute a Command Injection on the device.
CVE-2026-116623 | A vulnerability was detected in code-projects Simple Content Management System 1.0. Impacted is an unknown function of the file /web/admin/welcome.php of the component Admin Interface. The manipulation of the argument addnews results in missing authorization. The attack can be launched remotely. The exploit is now public and may be used.
A vulnerability was detected in code-projects Simple Content Management System 1.0. Impacted is an unknown function of the file /web/admin/welcome.php of the component Admin Interface. The manipulation of the argument addnews results in mis
CVE-2026-116837 | A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, SolarPoint, and SolarSwitch devices to execute arbitrary code on the device.
A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, SolarPoint, and SolarSwitch devices to execute arbitrary code on the device.
CVE-2026-116844 | Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerability because TransferOpen checks only the transferTLS flag set by PROT, not whether the prepared data connection uses TLS. When a client sends PROT P after PASV or PORT, file contents and directory listings cross the network unencrypted, even with mandatory encryption, letting on-path attackers read or modify them.
Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerability because TransferOpen checks only the transferTLS flag set by PROT, not whether the prepared data connection uses TLS. When a client sends PROT P after PAS
CVE-2026-116843 | Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by defining git filter drivers in an untrusted repository's .git/config. When started with --worktree, git worktree add applies .gitattributes and runs filter smudge, clean, or process commands before the trusted-folder check, executing attacker commands with user privileges.
Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by defining git filter drivers in an untrusted repository's .git/config. When started with --worktree, git worktree add applies .