Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 785 | 0,2 % |
| ≥50 % | 3.557 | 0,9 % |
| ≥10 % | 13.139 | 3,2 % |
| <10 % | 391.261 | 95,7 % |
CVE-2025-61505 | e107 CMS up to 2.3.3 POST Parameter install.php base64_decode previous_steps deserialization
A vulnerability described as critical has been identified in e107 CMS up to 2.3.3. Impacted is the function base64_decode of the file install.php of the component POST Parameter Handler. The manipulation of the argument previous_steps resul
CVE-2025-60838 | MCMS 6.0.1 unrestricted upload
A vulnerability marked as critical has been reported in MCMS 6.0.1. Impacted is an unknown function. This manipulation causes unrestricted upload. This vulnerability appears as CVE-2025-60838. The attack may be initiated remotely. There is
CVE-2025-60535 | Wallos 4.1.1 GET Request currency cross-site request forgery
A vulnerability, which was classified as problematic, was found in Wallos 4.1.1. This affects an unknown function of the file /endpoints/currency/currency of the component GET Request Handler. The manipulation results in cross-site request
CVE-2025-60308 | code-projects Simple Online Hotel Reservation System 1.0 Add Room Description cross site scripting
A vulnerability, which was classified as problematic, was found in code-projects Simple Online Hotel Reservation System 1.0. The impacted element is an unknown function of the component Add Room Handler. Executing a manipulation of the argu
CVE-2025-60306 | code-projects Simple Car Rental System 1.0 permission
A vulnerability marked as critical has been reported in code-projects Simple Car Rental System 1.0. This affects an unknown part. The manipulation leads to permission issues. This vulnerability is traded as CVE-2025-60306. It is possible to
CVE-2025-60269 | JeeWMS 20250820 CgExportExcelController.java exportXls sql injection
A vulnerability was found in JeeWMS 20250820. It has been declared as critical. Impacted is the function exportXls of the file src/main/java/org/jeecgframework/web/cgreport/controller/excel/CgExportExcelController.java. Executing a manipula
CVE-2025-56747 | Creativeitem Academy LMS up to 5.13 Api_instructor Controller privileges management
A vulnerability, which was classified as critical, was found in Creativeitem Academy LMS up to 5.13. Affected by this issue is some unknown functionality of the component Api_instructor Controller. Such manipulation leads to improper privil
CVE-2025-55903 | CodeCanyon Perfex CRM 3.3.1 Estimate Bill To cross site scripting
A vulnerability labeled as problematic has been found in CodeCanyon Perfex CRM 3.3.1. This impacts an unknown function of the component Estimate Module. Such manipulation of the argument Bill To leads to basic cross site scripting. This vul
CVE-2025-54603 | Claroty Secure Access up to 4.0.2 improper authentication
A vulnerability, which was classified as critical, has been found in Claroty Secure Access up to 4.0.2. The impacted element is an unknown function. The manipulation leads to improper authentication. This vulnerability is documented as CVE-
Hackers Exploit SonicWall SSL VPN Flaw to Bypass SAML Authentication and MFA
SonicWall has warned that an authentication enforcement flaw in SonicOS SSLVPN could let attackers bypass SAML authentication and associated multifactor authentication protections. Tracked as CVE-2026-19868, the issue affects deployments th
CVE-2026-63687 | Apache CXF up to 3.6.11/4.1.7/4.2.2 JwtRequestCodeFilter nonce improper authentication (WID-SEC-2026-2682)
A vulnerability classified as critical has been found in Apache CXF up to 3.6.11/4.1.7/4.2.2. This affects the function JwtRequestCodeFilter. Performing a manipulation of the argument nonce results in improper authentication. This vulnerabi
CVE-2026-61466 | Apache CXF up to 3.6.11/4.1.7/4.2.2 Dynamic Client Registration privileges management (WID-SEC-2026-2682)
A vulnerability described as critical has been identified in Apache CXF up to 3.6.11/4.1.7/4.2.2. Affected by this issue is some unknown functionality of the component Dynamic Client Registration. Such manipulation leads to improper privile
CVE-2026-57818 | Apache CXF up to 3.6.11/4.1.7/4.2.2 JCacheCodeDataProvider toctou (WID-SEC-2026-2682)
A vulnerability marked as critical has been reported in Apache CXF up to 3.6.11/4.1.7/4.2.2. Affected by this vulnerability is an unknown functionality of the component JCacheCodeDataProvider. This manipulation causes time-of-check time-of-
CVE-2026-57817 | Apache CXF up to 3.6.11/4.1.7/4.2.2 c_hash input validation (WID-SEC-2026-2682)
A vulnerability was found in Apache CXF up to 3.6.11/4.1.7/4.2.2 and classified as critical. This issue affects some unknown processing. The manipulation of the argument c_hash results in improper input validation. This vulnerability is cat
CVE-2026-94218 | Red Hat Keycloak/Single Sign-On Session Management improper authentication (EUVD-2026-83846 / WID-SEC-2026-3484)
A vulnerability, which was classified as critical, was found in Red Hat Keycloak and Single Sign-On. The impacted element is an unknown function of the component Session Management. Such manipulation leads to improper authentication. This v
CVE-2026-94217 | Red Hat Keycloak/Single Sign-On UMA Implementation permission (EUVD-2026-83845 / WID-SEC-2026-3484)
A vulnerability has been found in Red Hat Keycloak and Single Sign-On and classified as problematic. This affects an unknown function of the component UMA Implementation. Performing a manipulation results in permission issues. This vulnerab
CVE-2026-94215 | Red Hat Keycloak Admin REST API privileges management (EUVD-2026-83841 / WID-SEC-2026-3484)
A vulnerability, which was classified as problematic, has been found in Red Hat Keycloak. The affected element is an unknown function of the component Admin REST API. This manipulation causes improper privilege management. This vulnerabilit
CVE-2025-61319 | ReNgine up to 2.2.0 Vulnerabilities cross site scripting
A vulnerability classified as problematic has been found in ReNgine up to 2.2.0. This vulnerability affects unknown code of the component Vulnerabilities Module. The manipulation leads to cross site scripting. This vulnerability is referenc
CVE-2025-60869 | Publii CMS 0.46.5 Build 17089 Site Description/Footer Follow Buttons cross site scripting
A vulnerability was found in Publii CMS 0.46.5 Build 17089. It has been rated as problematic. Affected by this vulnerability is an unknown functionality. This manipulation of the argument Site Description/Footer Follow Buttons causes cross
CVE-2025-60375 | Perfex CRM up to 3.3.0 password improper authentication
A vulnerability, which was classified as critical, was found in Perfex CRM up to 3.3.0. Affected by this issue is some unknown functionality. Such manipulation of the argument Password leads to improper authentication. This vulnerability is
CVE-2025-60307 | code-projects Computer Laboratory System 1.0 Password Field sql injection
A vulnerability, which was classified as critical, has been found in code-projects Computer Laboratory System 1.0. The affected element is an unknown function of the component Password Field Handler. Performing a manipulation results in sql
CVE-2025-60305 | SourceCodester Online Student Clearance System 1.0 access control
A vulnerability identified as critical has been detected in SourceCodester Online Student Clearance System 1.0. Impacted is an unknown function. The manipulation leads to improper access controls. This vulnerability is traded as CVE-2025-60
CVE-2026-89092 | GNU C Library up to 2.44 nscd stack-based overflow (Nessus ID 377033 / WID-SEC-2026-3317)
A vulnerability was found in GNU C Library up to 2.44. It has been declared as critical. The impacted element is an unknown function of the component nscd. Executing a manipulation can lead to stack-based buffer overflow. This vulnerability
CVE-2026-113733 | djangoproject Django up to 6.0.9/6.1.2 Admin Utils utils.py django.contrib.admin.utils.display_for_field information disclosure (Nessus ID 377035)
A vulnerability was found in djangoproject Django up to 6.0.9/6.1.2 and classified as problematic. This issue affects the function django.contrib.admin.utils.display_for_field of the file django/contrib/admin/utils.py of the component Admin
CVE-2026-111211 | Django Software Foundation up to 5.2.18/6.0.9/6.1.2 Geometry Widget widgets.py neutralization for logs (Nessus ID 377036)
A vulnerability classified as problematic was found in Django Software Foundation Django up to 5.2.18/6.0.9/6.1.2. Affected by this vulnerability is the function django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize of the file dj
CVE-2026-114582 | Django Software Foundation up to 5.2.18/6.0.9/6.1.2 SpatialReference __init__.py transform srs/srid server-side request forgery (Nessus ID 377036)
A vulnerability was found in Django Software Foundation Django up to 5.2.18/6.0.9/6.1.2. It has been declared as critical. The affected element is the function transform of the file django/contrib/gis/gdal/__init__.py of the component Spati
CVE-2026-17312 | IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to force a user to authenticate into an attacker-controlled account due to cross-site request forgery. The sign-in flow does not sufficiently verify that a login response belongs to the user's own request, which could link the victim's session to an account controlled by the attacker.
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to force a user to authenticate into an attacker-controlled account due to cross-site request forgery. The sign-in flow does not sufficiently verify that a login respon
CVE-2026-17311 | IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to modify application API subscriptions due to broken object-level authorization.
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to modify application API subscriptions due to broken object-level authorization.
CVE-2026-17310 | IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to the use of a hard-coded cryptographic key.
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to the use of a hard-coded cryptographic key.
CVE-2026-17309 | IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information and tamper with configuration due to improper certificate validation.
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information and tamper with configuration due to improper certificate validation.
CVE-2026-17308 | IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive credentials and manipulate tool responses due to improper certificate validation.
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive credentials and manipulate tool responses due to improper certificate validation.
CVE-2026-17307 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CVE-2026-17306 | IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information from internal network resources due to server-side request forgery.
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information from internal network resources due to server-side request forgery.
CVE-2026-17305 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17304 | IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation. Locations supplied when service definitions are imported are not sufficiently validated, which could allow the server to retrieve content it should not access.
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation. Locations supplied when service definitions are imported are not sufficiently validated,
CVE-2026-17303 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access internal network resources due to improper validation of a user-supplied URL. The address is not sufficiently restricted, which could allow the server to contact internal systems.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access internal network resources due to improper validation of a user-supplied URL. The address is not sufficiently res
CVE-2026-17302 | IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to probe internal network services due to improper validation of a user-supplied URL.
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to probe internal network services due to improper validation of a user-supplied URL.
CVE-2026-17301 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an unauthenticated attacker to bypass authentication due to improper verification of a cryptographic signature.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an unauthenticated attacker to bypass authentication due to improper verification of a cryptographic signature.
CVE-2026-17299 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform arbitrary file reads and server-side request forgery due to unrestricted resolution of external references. Externally referenced content in submitted definitions is not sufficiently restricted when processed, and the retrieved content could be returned to the attacker.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform arbitrary file reads and server-side request forgery due to unrestricted resolution of external references. Exte
CVE-2026-17298 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17297 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to perform an account takeover due to an open redirect vulnerability. The redirect address used during sign-in is not sufficiently validated, which could allow authentication results to be sent to an attacker-controlled location.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to perform an account takeover due to an open redirect vulnerability. The redirect address used during sign-in is not sufficiently valida
CVE-2026-17296 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17295 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to path traversal.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to path traversal.
CVE-2026-17294 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17293 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to modify user profile information due to broken object-level authorization. Access checks do not confirm that the user is permitted to change the targeted profile.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to modify user profile information due to broken object-level authorization. Access checks do not confirm that the user is
CVE-2026-17292 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to take over ownership of other organizations due to broken object-level authorization. Access checks on organization objects are incomplete, which could allow ownership of organizations the user does not control to be changed.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to take over ownership of other organizations due to broken object-level authorization. Access checks on organization objec
CVE-2026-17291 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform account takeover due to an open redirect vulnerability. The redirect address used during OAuth 2.0 sign-in is not sufficiently validated, which could allow authentication results to be sent to an attacker-controlled location.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform account takeover due to an open redirect vulnerability. The redirect address used during OAuth 2.0 sign-in is no
CVE-2026-17290 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to create unauthorized user accounts due to improper verification of cryptographic signatures. Identity information from a login provider is accepted without its signature being fully verified, so forged identity data could be used to create accounts.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to create unauthorized user accounts due to improper verification of cryptographic signatures. Identity information from a
CVE-2026-17289 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17288 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17287 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. User-supplied addresses are not sufficiently validated, so the server could be made to send requests to unintended destinations and return the results.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. User-supplied addresses are not sufficiently validated,
CVE-2026-17285 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of external references. When schemas are validated, references to external resources are not sufficiently restricted, which could allow the server to retrieve content it should not access.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of external references. When schemas are validated, references t
CVE-2026-17284 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform unauthorized operations in other tenants' environments due to improper validation of client-supplied information. Tenant context is not sufficiently verified, which could allow actions on resources belonging to other tenants.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform unauthorized operations in other tenants' environments due to improper validation of client-supplied information
CVE-2026-17283 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CVE-2026-17282 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CVE-2026-17281 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17280 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to perform unauthenticated brute-force attacks to obtain valid credentials due to improper restriction of excessive authentication attempts.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to perform unauthenticated brute-force attacks to obtain valid credentials due to improper restriction of excessive authentication attemp
CVE-2026-17279 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption. Certain requests can cause internal processing to stall, which could make the service unavailable.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption. Certain requests can cause internal processing to st
CVE-2026-17278 | IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain unauthorized access to sensitive API catalog and runtime configuration data due to improper authentication. Information supplied by the client is not sufficiently verified, which could allow a caller to appear as a trusted party.
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain unauthorized access to sensitive API catalog and runtime configuration data due to improper authentication. Information supplied by the client is not sufficient
CVE-2026-17244 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform unauthorized actions and obtain sensitive information due to missing authorization. Certain operations do not verify that the user is permitted to act on the targeted resource, which could allow other users' API keys to be deleted.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform unauthorized actions and obtain sensitive information due to missing authorization. Certain operations do not ve