Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 786 | 0,2 % |
| ≥50 % | 3.572 | 0,9 % |
| ≥10 % | 23.059 | 5,7 % |
| <10 % | 380.694 | 93,3 % |
Sicherheitslücke in der Firmware: PHP2Shell bleibt in Firewalls und Industriegeräten gefährlich
Bei Firewalls, Routern und Industrieanlagen können Admins verwundbares PHP oft nicht selbst patchen. Selbst nach einem Update bleibt deshalb Handlungsbedarf. Ein Ratgebertext von Steffen Zahn (Security, PHP) Weiterlesen
OpenSSH sshole Flaw Allows Hackers to Log Into Password-Disabled Linux Accounts Using 257-Character Passwords
A decade-old authentication bypass in OpenSSH on musl-based Linux lets attackers log into accounts that should never accept a password. The flaw, dubbed *sshole, is tracked as CVE-2026-123158. Any password between 257 and 1,024 characters w
Microsoft Paint Vulnerability Allows Hackers to Execute Malicious Code Remotely Without User Interaction
Microsoft has announced a vulnerability in Windows Paint that could let unauthenticated attackers execute malicious code remotely without any user interaction. This vulnerability is tracked as CVE-2026-83844 and was disclosed on October 13,
CVE-2026-109518 – APT package manager that affects Ubuntu and Debian operating systems
Bulletin ID: 2026-172-AWS Publication Date: 11/05/2026 20:00 PM PST Description: An issue in the APT package manager (CVE-2026-109518) affects Ubuntu and Debian operating systems. Under specific conditions, when APT is configured to use HTT
CVE-2026-91713 | Google Chrome up to 153.0.8010.36 Browser improper authorization (Nessus ID 349114 / WID-SEC-2026-3380)
A vulnerability categorized as problematic has been discovered in Google Chrome. Affected by this vulnerability is an unknown functionality of the component Browser. Executing a manipulation can lead to improper authorization. The identific
CVE-2026-91712 | Google Chrome up to 153.0.8010.36 Extensions race condition (Nessus ID 349114 / WID-SEC-2026-3380)
A vulnerability was found in Google Chrome. It has been declared as critical. This impacts an unknown function of the component Extensions. Such manipulation leads to race condition. This vulnerability is uniquely identified as CVE-2026-917
CVE-2026-91711 | Google Chrome up to 153.0.8010.36 ServiceWorker out-of-bounds write (Nessus ID 349114 / WID-SEC-2026-3380)
A vulnerability was found in Google Chrome. It has been rated as critical. Affected is an unknown function of the component ServiceWorker. Performing a manipulation results in out-of-bounds write. This vulnerability was named CVE-2026-91711
CVE-2026-91710 | Google Chrome up to 153.0.8010.36 WebAppInstalls use after free (Nessus ID 349114 / WID-SEC-2026-3380)
A vulnerability was found in Google Chrome. It has been classified as critical. This affects an unknown function of the component WebAppInstalls. This manipulation causes use after free. This vulnerability is handled as CVE-2026-91710. The
CVE-2026-91709 | Google Chrome up to 153.0.8010.36 ServiceWorker type confusion (Nessus ID 349114 / WID-SEC-2026-3380)
A vulnerability was found in Google Chrome and classified as critical. The impacted element is an unknown function of the component ServiceWorker. The manipulation results in type confusion. This vulnerability is known as CVE-2026-91709. It
CVE-2025-57296 | Tenda AC6 15.03.05.19 /goform/SetIPTVCfg formSetIptv vlanId command injection
A vulnerability classified as critical has been found in Tenda AC6 15.03.05.19. This impacts the function formSetIptv of the file /goform/SetIPTVCfg. The manipulation of the argument vlanId leads to command injection. This vulnerability is
CVE-2025-57293 | Comfast CF-XR11 2.7.2 POST Request /usr/bin/webmgnt system command injection
A vulnerability described as critical has been identified in Comfast CF-XR11 2.7.2. This issue affects the function system of the file /usr/bin/webmgnt of the component POST Request Handler. The manipulation results in command injection. Th
CVE-2025-55912 | ClipBucket up to 5.5.0 plupload Endpoint photo_uploader.php unrestricted upload (EUVD-2025-29853 / EDB-52435)
A vulnerability categorized as critical has been discovered in ClipBucket up to 5.5.0. Affected is an unknown function of the file photo_uploader.php of the component plupload Endpoint. The manipulation results in unrestricted upload. This
CVE-2025-55911 | Clip Bucket 5.5.2 file_downloader.php file command injection (EUVD-2025-29929 / EDB-52434)
A vulnerability identified as critical has been detected in Clip Bucket 5.5.2. The affected element is an unknown function of the file file_downloader.php. The manipulation of the argument File leads to command injection. This vulnerability
CVE-2025-55910 | CmsEasy up to 7.7.8.0 database_admin.php denial of service
A vulnerability was found in CmsEasy up to 7.7.8.0. It has been classified as problematic. The impacted element is an unknown function of the file database_admin.php. This manipulation causes denial of service. This vulnerability is tracked
CVE-2025-39865 | Linux Kernel up to 6.17-rc4 tee tee_shm_put null pointer dereference (Nessus ID 265466 / WID-SEC-2025-2099)
A vulnerability categorized as critical has been discovered in Linux Kernel up to 6.17-rc4. The impacted element is the function tee_shm_put of the component tee. Such manipulation leads to null pointer dereference. This vulnerability is do
CVE-2025-39853 | Linux Kernel up to 6.17-rc4 i40e list_first_entry null pointer dereference (Nessus ID 265484 / WID-SEC-2025-2099)
A vulnerability labeled as critical has been found in Linux Kernel up to 6.17-rc4. The affected element is the function list_first_entry of the component i40e. Such manipulation leads to null pointer dereference. This vulnerability is trade
CVE-2025-39835 | Linux Kernel up to 6.17-rc3 xfs xfs_attr_leaf_get escape output (Nessus ID 265198 / WID-SEC-2025-2077)
A vulnerability classified as critical was found in Linux Kernel up to 6.17-rc3. Affected is the function xfs_attr_leaf_get of the component xfs. Such manipulation leads to escaping of output. This vulnerability is uniquely identified as CV
CVE-2025-39824 | Linux Kernel up to 6.17-rc3 HID_UP_UNDEFINED Usage Page hid_hw_start use after free (Nessus ID 265232 / WID-SEC-2025-2077)
A vulnerability was found in Linux Kernel up to 6.17-rc3. It has been classified as critical. Affected by this issue is the function hid_hw_start of the component HID_UP_UNDEFINED Usage Page. The manipulation leads to use after free. This v
CVE-2025-57104 | Teampel 5.1.6 /Common/login.aspx sql injection
A vulnerability classified as critical has been found in Teampel 5.1.6. The affected element is an unknown function of the file /Common/login.aspx. This manipulation causes sql injection. This vulnerability appears as CVE-2025-57104. The at
CVE-2025-52344 | Explorance Blue 8.1.2 Group name/Project Description cross site scripting
A vulnerability classified as problematic was found in Explorance Blue 8.1.2. The impacted element is an unknown function. Such manipulation of the argument Group name/Project Description leads to cross site scripting. This vulnerability is
CVE-2025-52053 | TOTOLINK X6000R 9.4.0cu.1360_B20241207 sub_417D74 file_name command injection
A vulnerability was found in TOTOLINK X6000R 9.4.0cu.1360_B20241207 and classified as critical. This vulnerability affects the function sub_417D74. Executing a manipulation of the argument file_name can lead to command injection. This vulne
CVE-2025-52048 | Frappe up to 14.96.9/15.71.x tag.py add_tag dt sql injection (GHSA-mggw-6xqj-rphj)
A vulnerability was found in Frappe up to 14.96.9/15.71.x. It has been classified as critical. This issue affects the function add_tag of the file frappe/desk/doctype/tag/tag.py. The manipulation of the argument dt leads to sql injection. T
CVE-2025-50110 | AVTECH EagleEyes Lite 2.0.0 Query Parameter push.lite.avtech.com.AvtechLib.GetHttpsResponse information disclosure
A vulnerability was found in AVTECH EagleEyes Lite 2.0.0 and classified as problematic. This impacts the function GetHttpsResponse in the library push.lite.avtech.com.AvtechLib.GetHttpsResponse of the component Query Parameter Handler. Exec
CVE-2025-46408 | AVTECH EagleEyes 2.0.0 getNewHttpClient certificate host validation
A vulnerability was found in AVTECH EagleEyes 2.0.0. It has been declared as critical. Affected by this vulnerability is the function getNewHttpClient. The manipulation results in certificate with host mismatch. This vulnerability is catalo
CVE-2025-39823 | Linux Kernel up to 6.17-rc3 KVM array_index_nospec memory corruption (Nessus ID 265253 / WID-SEC-2025-2077)
A vulnerability classified as critical was found in Linux Kernel up to 6.17-rc3. This affects the function array_index_nospec of the component KVM. Executing a manipulation can lead to memory corruption. This vulnerability is handled as CVE
CVE-2025-39819 | Linux Kernel up to 6.17-rc3 smb2_compound_op control flow (Nessus ID 265199 / WID-SEC-2025-2077)
A vulnerability has been found in Linux Kernel up to 6.1.149/6.6.103/6.12.44/6.16.4/6.17-rc3 and classified as critical. This affects the function smb2_compound_op. The manipulation leads to incorrect control flow. This vulnerability is ref
CVE-2025-39813 | Linux Kernel up to 6.17-rc2 ftrace_dump_one return value (Nessus ID 265231 / WID-SEC-2025-2077)
A vulnerability classified as critical has been found in Linux Kernel up to 6.17-rc2. This impacts the function ftrace_dump_one. This manipulation causes unchecked return value. This vulnerability is handled as CVE-2025-39813. The attack ca
CVE-2025-39808 | Linux Kernel up to 6.17-rc3 /dev/uhid ntrig_report_version hdev memory corruption (EUVD-2025-29606 / Nessus ID 265215)
A vulnerability identified as critical has been detected in Linux Kernel up to 6.17-rc3. Impacted is the function ntrig_report_version of the file /dev/uhid. Performing a manipulation of the argument hdev results in memory corruption. This
Node.js Security Releases: Patching Node2Shell (CVE-2026-111497) & High Risks
HOC Shorts | Node.js security issuing updates across active release channels (v22.x, v24.x, and v26.x), patching multiple vulnerabilities… This article has been indexed from Hackers Online Club Read the original article: Node.js Security Re
CVE-2026-76027 | Google Chrome up to 156.0.8078.73 CacheStorage memory corruption (Nessus ID 376449)
A vulnerability marked as critical has been reported in Google Chrome. This issue affects some unknown processing of the component CacheStorage. Performing a manipulation results in memory corruption. This vulnerability is reported as CVE-2
CVE-2026-76026 | Google Chrome up to 156.0.8078.73 Autofill memory corruption (Nessus ID 376449)
A vulnerability was found in Google Chrome. It has been rated as critical. Affected by this vulnerability is an unknown functionality of the component Autofill. The manipulation leads to memory corruption. This vulnerability is listed as CV
CVE-2026-76025 | Google Chrome up to 156.0.8078.73 FileSystem use after free (Nessus ID 376449)
A vulnerability was found in Google Chrome and classified as critical. This affects an unknown function of the component FileSystem. Such manipulation leads to use after free. This vulnerability is referenced as CVE-2026-76025. It is possib
CVE-2026-76024 | Google Chrome up to 156.0.8078.73 MediaStream memory corruption (Nessus ID 376449)
A vulnerability was found in Google Chrome. It has been classified as critical. This impacts an unknown function of the component MediaStream. Performing a manipulation results in memory corruption. This vulnerability is identified as CVE-2
CVE-2026-112257 | GIMP PSD Thumbnail Resource Loader out-of-bounds (Nessus ID 376450)
A vulnerability described as critical has been identified in GIMP. This vulnerability affects unknown code of the component PSD Thumbnail Resource Loader. Such manipulation leads to out-of-bounds read. This vulnerability is documented as CV
CVE-2025-45586 | Audi UTR Universal Traffic Recorder 2.0 PUT Request unrestricted upload (EUVD-2025-29080)
A vulnerability identified as critical has been detected in Audi UTR Universal Traffic Recorder 2.0. This affects an unknown function of the component PUT Request Handler. This manipulation causes unrestricted upload. This vulnerability is
CVE-2025-39801 | Linux Kernel up to 6.17-rc2 dwc3 denial of service (EUVD-2025-29185 / Nessus ID 265710)
A vulnerability, which was classified as critical, was found in Linux Kernel up to 6.17-rc2. Affected by this vulnerability is an unknown functionality of the component dwc3. Such manipulation leads to denial of service. This vulnerability
CVE-2025-39795 | Linux Kernel up to 6.16.1 block blk_stack_limits buffer overflow (Nessus ID 264709 / WID-SEC-2025-2051)
A vulnerability was found in Linux Kernel up to 6.16.1 and classified as critical. Affected by this vulnerability is the function blk_stack_limits of the component block. The manipulation results in buffer overflow. This vulnerability is id
CVE-2025-39794 | Linux Kernel up to 6.16.1 ARM denial of service (Nessus ID 264712 / WID-SEC-2025-2051)
A vulnerability has been found in Linux Kernel up to 6.16.1 and classified as critical. Affected is an unknown function of the component ARM. The manipulation leads to denial of service. This vulnerability is referenced as CVE-2025-39794. T
CVE-2025-39784 | Linux Kernel up to 6.16.3 PCI pcie_failed_link_retrain privilege escalation (Nessus ID 264757 / WID-SEC-2025-2040)
A vulnerability identified as critical has been detected in Linux Kernel up to 6.16.3. Affected by this vulnerability is the function pcie_failed_link_retrain of the component PCI. The manipulation leads to privilege escalation. This vulner
CVE-2025-39782 | Linux Kernel up to 6.17-rc2 jbd2_log_do_checkpoint buffer overflow (Nessus ID 264753 / WID-SEC-2025-2040)
A vulnerability classified as critical was found in Linux Kernel up to 6.17-rc2. This affects the function jbd2_log_do_checkpoint. The manipulation results in buffer overflow. This vulnerability is cataloged as CVE-2025-39782. The attack mu
CVE-2025-39772 | Linux Kernel up to 6.17-rc2 hibnc_hw_init null pointer dereference (Nessus ID 264739 / WID-SEC-2025-2040)
A vulnerability was found in Linux Kernel up to 6.17-rc2 and classified as critical. The affected element is the function hibnc_hw_init. The manipulation results in null pointer dereference. This vulnerability is known as CVE-2025-39772. Ac
CVE-2025-39765 | Linux Kernel up to 6.12.43/6.16.3/6.17-rc2 lib/idr.c snd_utimer_create allocation of resources (Nessus ID 264744 / WID-SEC-2025-2040)
A vulnerability classified as critical has been found in Linux Kernel up to 6.12.43/6.16.3/6.17-rc2. The impacted element is the function snd_utimer_create in the library lib/idr.c. The manipulation leads to allocation of resources. This vu
CVE-2025-39764 | Linux Kernel up to 6.16.1/6.17-rc1 netfilter refcount_inc_not_zero memory leak (Nessus ID 264746 / WID-SEC-2025-2040)
A vulnerability was found in Linux Kernel up to 6.16.1/6.17-rc1 and classified as critical. Affected by this issue is the function refcount_inc_not_zero of the component netfilter. Executing a manipulation can lead to memory leak. This vuln
SonicWall Won’t Patch EoL GMS Flaws That Could Expose Files, Alter Database Records
SonicWall has warned of two vulnerabilities impacting end-of-life Global Management System (GMS) systems that it said will not be patched. Details of the security flaws, which affect SonicWall GMS 9.5.2 and earlier versions, are below – CVE
CVE-2026-92543 | Docker/Moby Docker Engine Registry Hostname Validation loadInsecureRegistries certificate validation (WID-SEC-2026-3808)
A vulnerability marked as problematic has been reported in Docker/Moby Docker Engine. This issue affects the function loadInsecureRegistries of the component Registry Hostname Validation. This manipulation causes improper certificate valida
CVE-2026-97032 | Go http2 HPACK encoder race condition (ID 847188 / EUVD-2026-95429)
A vulnerability, which was classified as problematic, was found in Go http2. This vulnerability affects unknown code of the component HPACK encoder. The manipulation results in race condition. This vulnerability is cataloged as CVE-2026-970
CVE-2026-97030 | Go html/template up to 1.26.8/1.27.1 Template cross site scripting (EUVD-2026-95416 / WID-SEC-2026-3841)
A vulnerability marked as problematic has been reported in Go html and template up to 1.26.8/1.27.1. This impacts an unknown function of the component Template. This manipulation causes cross site scripting. The identification of this vulne
CVE-2026-94448 | Google html/template up to 1.26.8/1.27.1 Template Literal Expression cross site scripting (EUVD-2026-95415 / WID-SEC-2026-3841)
A vulnerability labeled as problematic has been found in Google html and template up to 1.26.8/1.27.1. This affects an unknown function of the component Template Literal Expression. The manipulation results in cross site scripting. This vul
CVE-2026-94447 | Google cmd/go up to 1.26.8/1.27.1 GOMODPROXY go.sum integrity check (EUVD-2026-95418 / WID-SEC-2026-3841)
A vulnerability was found in Google cmd and go up to 1.26.8/1.27.1. It has been classified as critical. This vulnerability affects unknown code of the file go.sum of the component GOMODPROXY Handler. This manipulation causes improper valida
CVE-2026-94444 | cmd go up to 1.26.8/1.27.1 GOMODPROXY integrity check (EUVD-2026-95417 / WID-SEC-2026-3841)
A vulnerability was found in cmd go up to 1.26.8/1.27.1. It has been declared as critical. This issue affects some unknown processing of the component GOMODPROXY Handler. Such manipulation leads to improper validation of integrity check val
CVE-2026-94439 | Google nethttp up to 1.26.8/1.27.1 HTTP Server request smuggling (EUVD-2026-95428 / WID-SEC-2026-3841)
A vulnerability was found in Google nethttp up to 1.26.8/1.27.1 and classified as problematic. This affects an unknown part of the component HTTP Server Handler. The manipulation results in http request smuggling. This vulnerability is repo
CVE-2026-78660 | Google Go net-http-internal-http2-x-net-http2 request smuggling (EUVD-2026-95425 / WID-SEC-2026-3841)
A vulnerability identified as problematic has been detected in Google Go. The impacted element is an unknown function of the component net-http-internal-http2-x-net-http2. The manipulation leads to http request smuggling. This vulnerability
CVE-2025-39724 | Linux Kernel up to 6.16.3 serial8250_do_startup buffer overflow (EUVD-2025-31503 / Nessus ID 261631)
A vulnerability labeled as critical has been found in Linux Kernel up to 6.16.3. Affected is the function serial8250_do_startup. Executing a manipulation can lead to buffer overflow. This vulnerability appears as CVE-2025-39724. The attacke
CVE-2025-39721 | Linux Kernel up to 6.6.102/6.12.43/6.16.3 qat_4xxx use after free (Nessus ID 261633 / WID-SEC-2025-1988)
A vulnerability has been found in Linux Kernel up to 6.6.102/6.12.43/6.16.3 and classified as critical. The affected element is the function qat_4xxx. The manipulation leads to use after free. This vulnerability is referenced as CVE-2025-39
CVE-2025-39713 | Linux Kernel up to 6.16.3 media rain_interrupt race condition (EUVD-2025-31514 / Nessus ID 261613)
A vulnerability has been found in Linux Kernel up to 6.16.3 and classified as critical. Affected by this vulnerability is the function rain_interrupt of the component media. This manipulation causes race condition. This vulnerability is tra
CVE-2025-39701 | Linux Kernel up to 6.17-rc2 ACPI pfr_update privilege escalation (Nessus ID 261617 / WID-SEC-2025-1988)
A vulnerability categorized as critical has been discovered in Linux Kernel up to 6.1.148/6.6.102/6.12.43/6.16.3/6.17-rc2. Affected is the function pfr_update of the component ACPI. Such manipulation leads to privilege escalation. This vuln
CVE-2016-2141 | JGroups up to 3.x Node Join access control (RHSA-2016:1328 / EUVD-2022-5146)
A vulnerability, which was classified as critical, was found in JGroups up to 3.x. The impacted element is an unknown function of the component Node Join Handler. The manipulation results in improper access controls. This vulnerability is c
CVE-2022-4096 | appsmith up to 1.8.1 server-side request forgery (EUVD-2022-51466)
A vulnerability classified as critical was found in appsmith up to 1.8.1. The affected element is an unknown function. Such manipulation leads to server-side request forgery. This vulnerability is listed as CVE-2022-4096. The attack may be
CVE-2022-4095 | Linux Kernel up to 5.19.1 rtl8712_cmd.c cmd_hdl_filter use after free (EUVD-2022-51465 / Nessus ID 236642)
A vulnerability was found in Linux Kernel up to 5.19.1 and classified as problematic. This impacts the function cmd_hdl_filter of the file drivers/staging/rtl8712/rtl8712_cmd.c. The manipulation results in use after free. This vulnerability
Linux Fragnesia (CVE-2026-46300) is in CISA KEV and being chained to root after web footholds: patch the kernel and reboot
Fragnesia is a local privilege-escalation bug in the Linux kernel's shared-frag handling on the ESP path (CVE-2026-46300). CISA added it to KEV on Oct 28. It is not a remote one-shot by itself, but Singapore's CSA and Palo Alto�