Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 733 | 0,2 % |
| ≥50 % | 3.220 | 0,8 % |
| ≥10 % | 22.112 | 5,8 % |
| <10 % | 353.806 | 93,1 % |
Brotli bug reaches far beyond Node.js (CVE-2026-111497)
A vulnerability in Brotli, Google’s widely used open-source compression library, is putting a broad range of software at risk. About CVE-2026-111497 Alternatively known as “Node2Shell”, “Broccoli2Shell” and “Brotli2Shell”, CVE-2026-111497 i
IT Security News Hourly Summary 2026-10-27 19h : 23 posts
23 posts published in the last hour 17:46CVE-2026-89065 and CVE-2026-89066: Issue with projen – Path traversal and OS command injection 17:46CVE-2026-89049 – Server-side request forgery in the Session Manager port forwarding functionality i
Nintendo Switch 2: Hacker finden schwerwiegende Sicherheitslücke - ingame.de
Mithilfe eines manipulierten Spielstandes und anderen Methoden sind Hacker nun unter der neuesten Firmware 23.0.1 in der Lage, Inhalte der Konsole zu ... Weiterlesen
CVE-2026-35273: SSRF to RCE in Oracle PeopleSoft
On September 25, 2026, Mandiant released a report regarding continued mass exploitation of CVE-2026-35273 by the ShinyHunters group. TrendAI’s Zero Day Initiative first reported this CVE to Oracle on June 10, 2026, following an investigatio
CVE-2025-62396 | Moodle Router r.php exposure of information through directory listing (EUVD-2025-35671 / Nessus ID 276840)
A vulnerability classified as problematic was found in Moodle. This impacts an unknown function of the file r.php of the component Router. Such manipulation leads to exposure of information through directory listing. This vulnerability is u
CVE-2025-61035 | seffaflik up to 0.0.9 permission
A vulnerability marked as critical has been reported in seffaflik up to 0.0.9. Affected by this vulnerability is an unknown functionality. The manipulation leads to permission issues. This vulnerability is uniquely identified as CVE-2025-61
CVE-2025-60424 | Nagios Fusion 2024R1.2/2024R2 OTP Verification excessive authentication
A vulnerability described as problematic has been identified in Nagios Fusion 2024R1.2/2024R2. This vulnerability affects unknown code of the component OTP Verification. Such manipulation leads to improper restriction of excessive authentic
CVE-2025-60335 | TOTOLINK N600R 4.3.0cu.7866_B20220506 null pointer dereference
A vulnerability was found in TOTOLINK N600R 4.3.0cu.7866_B20220506. It has been rated as critical. Affected is an unknown function. Performing a manipulation results in null pointer dereference. This vulnerability is reported as CVE-2025-60
CVE-2025-52079 | D-Link DIR-820L 1.06B02 POST /get_set.ccp unverified password change
A vulnerability was found in D-Link DIR-820L 1.06B02. It has been rated as critical. This impacts an unknown function of the file /get_set.ccp of the component POST Handler. Performing a manipulation results in unverified password change. T
CVE-2025-50950 | Audiofile 0.3.7 ModuleState::setup null pointer dereference (Nessus ID 271717 / WID-SEC-2025-2882)
A vulnerability has been found in Audiofile 0.3.7 and classified as problematic. Impacted is the function ModuleState::setup. The manipulation leads to null pointer dereference. This vulnerability is referenced as CVE-2025-50950. The attack
CVE-2026-6653 reaches further than the libxml2 package name
CVE-2026-6653 reaches further than the libxml2 package name The advisory for CVE-2026-6653 names one upstream project, but the affected list is a map of downstream products. Anyone responsible for patching should read that list before assum
CVE-2026-108359 | PHPOffice PhpSpreadsheet up to 5.9.x Ods Reader Ods.php Ods::processTableRow resource consumption (EUVD-2026-108267)
A vulnerability described as problematic has been identified in PHPOffice PhpSpreadsheet up to 1.30.6/2.1.18/2.4.7/3.10.7/5.9.x. This impacts the function Ods::processTableRow of the file src/PhpSpreadsheet/Reader/Ods.php of the component O
CVE-2026-114619 | Authlib up to 1.8.x Implicit Grant implicit.py improper authorization (EUVD-2026-108521)
A vulnerability was found in Authlib up to 1.8.x and classified as problematic. This issue affects the function OpenIDImplicitGrant.validate_authorization_request of the file authlib/oidc/core/grants/implicit.py of the component Implicit Gr
CVE-2026-114615 | Authlib up to 1.8.x OctKey oct_key.py OctKey.import_key improper authentication (EUVD-2026-108514)
A vulnerability was found in Authlib up to 1.8.x. It has been rated as critical. This issue affects the function OctKey.import_key of the file authlib/jose/rfc7518/oct_key.py of the component OctKey. The manipulation leads to improper authe
CVE-2026-108360 | PHPOffice PhpSpreadsheet up to 5.9.x Image URL Validation setPath server-side request forgery (EUVD-2026-108264)
A vulnerability was found in PHPOffice PhpSpreadsheet up to 1.30.6/2.1.18/2.4.7/3.10.7/5.9.x. It has been classified as problematic. This affects the function Worksheet\Drawing::setPath of the component Image URL Validation. The manipulatio
CVE-2026-114618 | Authlib up to 1.8.x JWT Bearer Grant JWTBearerGrant.get_audiences improper authorization (EUVD-2026-108520)
A vulnerability was found in Authlib up to 1.8.x. It has been declared as critical. The affected element is the function JWTBearerGrant.get_audiences of the component JWT Bearer Grant. The manipulation results in improper authorization. Thi
CVE-2026-114617 | Authlib up to 1.8.x OpenID Connect sync_openid.py OpenIDMixin.parse_id_token authentication replay (EUVD-2026-108519)
A vulnerability was found in Authlib up to 1.8.x. It has been classified as critical. Impacted is the function OpenIDMixin.parse_id_token of the file authlib/integrations/base_client/sync_openid.py of the component OpenID Connect. The manip
CVE-2026-117510 | Dexmal Dexbotic up to 0.2.0 gr00tsonic Checkpoint Loader gr00tsonic_arch.py load_pretrained_gr00t weight_map path traversal (Issue 103 / EUVD-2026-111084)
A vulnerability was found in Dexmal Dexbotic up to 0.2.0. It has been classified as critical. Affected by this vulnerability is the function load_pretrained_gr00t of the file dexbotic/model/gr00tsonic/gr00tsonic_arch.py of the component gr0
CVE-2026-109823 | Tidewave AI up to 0.9.1 Host Header Validation cross-domain policy (EUVD-2026-111085)
A vulnerability has been found in Tidewave AI Tidewave up to 0.9.1 and classified as problematic. This issue affects some unknown processing of the component Host Header Validation. The manipulation leads to permissive cross-domain policy w
CVE-2026-110839 | FreeRDP up to 3.31.x JPEG Conversion winpr_convert_from_jpeg heap-based overflow (Nessus ID 372227)
A vulnerability categorized as problematic has been discovered in FreeRDP up to 3.31.x. Impacted is the function winpr_convert_from_jpeg of the component JPEG Conversion. The manipulation results in heap-based buffer overflow. This vulnerab
CVE-2026-111379 | FreeRDP up to 3.31.x Persistent Cache persistent_cache_read_entry_v3 width/height heap-based overflow (Nessus ID 372227)
A vulnerability, which was classified as problematic, was found in FreeRDP up to 3.31.x. This affects the function persistent_cache_read_entry_v3 of the component Persistent Cache. The manipulation of the argument width/height results in he
CVE-2026-76957 | Libexpat up to 2.8.3 use after free (Nessus ID 372240 / WID-SEC-2026-2930)
A vulnerability, which was classified as critical, has been found in Libexpat up to 2.8.3. The affected element is an unknown function. Performing a manipulation results in use after free. This vulnerability is reported as CVE-2026-76957. T
CVE-2026-118008 | Mozilla Firefox up to 158 Navigation privileges management (EUVD-2026-110906)
A vulnerability identified as critical has been detected in Mozilla Firefox up to 158. Affected by this issue is some unknown functionality of the component Navigation Component. The manipulation leads to improper privilege management. This
CVE-2026-117976 | Mozilla Firefox up to 153.5/158 Navigation isolation (EUVD-2026-111007)
A vulnerability marked as critical has been reported in Mozilla Firefox up to 153.5/158. This affects an unknown function of the component Navigation. Performing a manipulation results in improper isolation or compartmentalization. This vul
CVE-2026-117505 | a2aproject a2a-java up to 1.2.0.Final ChildQueue queue.offer resource consumption (ID 1040 / EUVD-2026-110927)
A vulnerability, which was classified as problematic, has been found in a2aproject a2a-java up to 1.2.0.Final. The impacted element is the function queue.offer of the component ChildQueue. Performing a manipulation results in resource consu
CVE-2026-117999 | Mozilla Firefox up to 153.5/158 IPC race condition (EUVD-2026-110898)
A vulnerability was found in Mozilla Firefox up to 153.5/158. It has been classified as critical. This affects an unknown function of the component IPC. This manipulation causes race condition. The identification of this vulnerability is CV
CVE-2026-117604 | Getgrav Grav up to 1.7.53.5 Debugger isDebuggerRequestAuthorized authorization (EUVD-2026-110928)
A vulnerability categorized as problematic has been discovered in Getgrav Grav. This affects the function Debugger::isDebuggerRequestAuthorized of the component Debugger. Such manipulation leads to authorization bypass. This vulnerability i
CVE-2026-114609 | py-pdf fpdf2 up to 2.8.7 Shared Image Loader FPDF.image/FPDF.write_html server-side request forgery (EUVD-2026-108261)
A vulnerability was found in py-pdf fpdf2 up to 2.8.7. It has been rated as problematic. This issue affects the function FPDF.image/FPDF.write_html of the component Shared Image Loader. This manipulation causes server-side request forgery.
CVE-2026-117506 | a2aproject a2a-java up to 1.2.0.Final Push Notification Config Store JpaDatabasePushNotificationConfigStore.java InMemoryPushNotificationConfigStore.setInfo resource consumption (ID 1044 / EUVD-2026-110929)
A vulnerability, which was classified as problematic, was found in a2aproject a2a-java up to 1.2.0.Final. This affects the function InMemoryPushNotificationConfigStore.setInfo of the file... Weiterlesen
CVE-2026-28167 | Super Forms Plugin up to 6.3.315 on WordPress information disclosure (EUVD-2026-64796 / CNNVD-2026-96785795)
A vulnerability identified as problematic has been detected in Super Forms Plugin up to 6.3.315 on WordPress. Impacted is an unknown function. Performing a manipulation results in information disclosure. This vulnerability is identified as
CVE-2026-109242 | FreeRDP up to 2.x/3.31.x Tile Rendering out-of-bounds (Nessus ID 372241)
A vulnerability identified as critical has been detected in FreeRDP up to 2.x/3.31.x. Affected by this vulnerability is an unknown functionality of the component Tile Rendering. The manipulation leads to out-of-bounds read. This vulnerabili
CVE-2026-111377 | FreeRDP up to 3.31.x Static Virtual Channel WTSProcessChannelData resource consumption (Nessus ID 372241)
A vulnerability, which was classified as problematic, has been found in FreeRDP up to 3.31.x. This impacts the function WTSProcessChannelData of the component Static Virtual Channel. Performing a manipulation results in resource consumption
CVE-2026-110838 | FreeRDP up to 3.31.x Shadow Server injection (Nessus ID 372241)
A vulnerability was found in FreeRDP up to 3.31.x. It has been rated as problematic. This issue affects some unknown processing of the component Shadow Server. The manipulation leads to injection. This vulnerability is listed as CVE-2026-11
CVE-2026-111378 | FreeRDP up to 3.31.x NLA Parsing parse_nla_mode_pdu resource consumption (Nessus ID 372241)
A vulnerability was found in FreeRDP up to 3.31.x. It has been classified as problematic. This affects the function parse_nla_mode_pdu of the component NLA Parsing. This manipulation causes resource consumption. This vulnerability is tracke
CVE-2026-83366 | Oracle Shipping Execution up to 12.2.15 Workflow Events access control (EUVD-2026-106286)
A vulnerability, which was classified as critical, has been found in Oracle Shipping Execution up to 12.2.15. The affected element is an unknown function of the component Workflow Events. Performing a manipulation results in improper access
CVE-2026-90727 | Dell PowerProtect Data Domain up to 8.8 path traversal (EUVD-2026-110858)
A vulnerability described as problematic has been identified in Dell PowerProtect Data Domain up to 8.8. This issue affects some unknown processing. Executing a manipulation can lead to path traversal. This vulnerability is tracked as CVE-2
CVE-2026-90726 | Dell PowerProtect Data Domain up to 8.6.1.20 path traversal (EUVD-2026-110859)
A vulnerability labeled as problematic has been found in Dell PowerProtect Data Domain up to 7.7.1.0/8.8/7.13.1.80/8.3.1.40/8.6.1.20. This affects an unknown part. Such manipulation leads to path traversal. This vulnerability is referenced
CVE-2026-83377 | Oracle HRMS up to 12.2.15 Mobile Applications privileges management (EUVD-2026-106295)
A vulnerability marked as problematic has been reported in Oracle HRMS up to 12.2.15. Impacted is an unknown function of the component Mobile Applications. This manipulation causes improper privilege management. This vulnerability is tracke
CVE-2026-113718 | pypa virtualenv up to 21.14.8 Xonsh Activation activate.xsh quote XONSH_ENCODING encoding error (EUVD-2026-105299)
A vulnerability labeled as problematic has been found in pypa virtualenv up to 21.14.8. The affected element is the function quote of the file activate.xsh of the component Xonsh Activation. Such manipulation of the argument XONSH_ENCODING
CVE-2026-113713 | pypa virtualenv up to 21.14.9 App-Data Seeder state issue (EUVD-2026-105259)
A vulnerability, which was classified as problematic, has been found in pypa virtualenv up to 21.14.9. This affects an unknown function of the component App-Data Seeder. The manipulation leads to state issue. This vulnerability is traded as
CVE-2026-111382 | FreeRDP up to 3.31.x RDPGFX general_LumaToYUV444 out-of-bounds write (Nessus ID 372241)
A vulnerability was found in FreeRDP up to 3.31.x. It has been declared as critical. This vulnerability affects the function general_LumaToYUV444 of the component RDPGFX. Such manipulation leads to out-of-bounds write. This vulnerability is
CVE-2026-111381 | FreeRDP up to 3.31.x Persistent Cache persistent_cache_read_entry_v2 height heap-based overflow (Nessus ID 372241)
A vulnerability, which was classified as problematic, has been found in FreeRDP up to 3.31.x. Affected by this issue is the function persistent_cache_read_entry_v2 of the component Persistent Cache. The manipulation of the argument height l
CVE-2026-103263 | TornadoWeb Tornado up to 6.5.8 StaticFileHandler path traversal (Nessus ID 372243)
A vulnerability was found in TornadoWeb Tornado up to 6.5.8. It has been declared as problematic. Affected by this issue is the function StaticFileHandler. Executing a manipulation can lead to path traversal. This vulnerability is registere
CVE-2026-100236 | Red Hat Enterprise Linux GSO Library integer overflow (Nessus ID 372250)
A vulnerability, which was classified as very critical, was found in Red Hat Enterprise Linux, Fast Datapath, OpenShift Container Platform and OpenStack Platform. The impacted element is an unknown function of the component GSO Library. Suc
CVE-2026-86565 | Red Hat Enterprise Linux vhost out-of-bounds write (Nessus ID 372250)
A vulnerability identified as very critical has been detected in Red Hat Enterprise Linux, Fast Datapath for RHEL, OpenShift Container Platform and OpenStack Platform. Affected by this issue is some unknown functionality of the component vh
CVE-2026-86848 | Red Hat DPDK vhost-crypto out-of-bounds (Nessus ID 372250)
A vulnerability was found in Red Hat DPDK. It has been declared as problematic. The affected element is an unknown function of the component vhost-crypto. Such manipulation leads to out-of-bounds read. This vulnerability is uniquely identif
CVE-2023-49288 | Squid Proxy up to 6.0.0 Collapsed Forwarding use after free (GHSA-rj5h-46j6-q2g5 / Nessus ID 372261)
A vulnerability, which was classified as problematic, was found in Squid Proxy up to 6.0.0. Affected is an unknown function of the component Collapsed Forwarding Handler. Executing a manipulation can lead to use after free. This vulnerabili
CVE-2026-95619 | Red Hat libstdc++ integer overflow (Nessus ID 372263)
A vulnerability identified as critical has been detected in Red Hat libstdc++. This impacts an unknown function. Performing a manipulation results in integer overflow. This vulnerability is reported as CVE-2026-95619. The attack is possible
CVE-2026-83382 | Oracle Report Manager up to 12.2.15 Internal Operations information disclosure (EUVD-2026-106300)
A vulnerability categorized as problematic has been discovered in Oracle Report Manager up to 12.2.15. This affects an unknown part of the component Internal Operations. Executing a manipulation can lead to information disclosure. The ident
CVE-2026-68866 | Dell PowerProtect Data Domain Certificate path traversal (EUVD-2026-110860)
A vulnerability identified as problematic has been detected in Dell PowerProtect Data Domain. Affected by this issue is some unknown functionality of the component Certificate. This manipulation causes path traversal. The identification of
CVE-2026-117503 | a2aproject a2a-go up to 2.4.0 REST SSE handler a2asrv/rest.go resource consumption (ID 396 / EUVD-2026-110861)
A vulnerability classified as problematic has been found in a2aproject a2a-go up to 2.4.0. Impacted is an unknown function of the file a2asrv/rest.go of the component REST SSE handler. This manipulation causes resource consumption. The iden
CVE-2026-90725 | Dell PowerProtect Data Domain up to 8.8 stack-based overflow (EUVD-2026-110862)
A vulnerability marked as problematic has been reported in Dell PowerProtect Data Domain up to 8.8. This vulnerability affects unknown code. Performing a manipulation results in stack-based buffer overflow. This vulnerability is identified
Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads
Apple on Monday backported fixes for a high-severity security flaw that was exploited in real-world cyber attacks to older devices. The vulnerability, tracked as CVE-2026-86950 (CVSS score: 8.8), is an out-of-bounds write affecting CoreGrap
EPICS Base
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition, corrupt memory, disclose sensitive information, or potentially execute arbitrary code. The following versions
Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code (CVE-2023-4863), bypass authentication (CVE-2026-16436 and CVE-2026-16437), or perform arbitrary operations (CVE-2026-16438
PHP-Sicherheitslücke als Weckruf: IT-Sicherheit als Daueraufgabe für Unternehmen - WKO
Künstliche Intelligenz verändert die Bedrohungslage – regionale IT-Spezialisten werden für die Sicherheit immer wichtiger“, betont Horst Kasper. Weiterlesen
CVE-2026-116639 | A vulnerability was detected in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to a8902bf64575e325f6d6bf93a55f7bd273ec58cd. Affected is an unknown function of the file chat.php. Performing a manipulation of the argument ID results in cross site scripting. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for aff
A vulnerability was detected in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to a8902bf64575e325f6d6bf93a55f7bd273ec58cd. Affected is an unknown function of the file chat.php. Performing a manipulation of the argument ID results in
CVE-2026-116839 | A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to make unauthorized changes and execute a Denial of Service (DoS) attack on the device.
A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to make unauthorized changes and execute a Denial of Service (DoS) attack on the
CVE-2026-116838 | A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to execute a Command Injection on the device.
A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to execute a Command Injection on the device.
CVE-2026-116623 | A vulnerability was detected in code-projects Simple Content Management System 1.0. Impacted is an unknown function of the file /web/admin/welcome.php of the component Admin Interface. The manipulation of the argument addnews results in missing authorization. The attack can be launched remotely. The exploit is now public and may be used.
A vulnerability was detected in code-projects Simple Content Management System 1.0. Impacted is an unknown function of the file /web/admin/welcome.php of the component Admin Interface. The manipulation of the argument addnews results in mis