Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 720 | 0,2 % |
| ≥50 % | 3.224 | 0,9 % |
| ≥10 % | 22.120 | 6,0 % |
| <10 % | 345.014 | 93,0 % |
CVE-2026-83531 | Apache Camel Camel-Dynamic-Router Control Endpoint code injection (WID-SEC-2026-4006)
A vulnerability classified as critical was found in Apache Camel. The affected element is an unknown function of the component Camel-Dynamic-Router Control Endpoint. The manipulation results in code injection. This vulnerability was named C
CVE-2026-80344 | Apache Camel AS2 server-side request forgery (WID-SEC-2026-4006)
A vulnerability, which was classified as critical, has been found in Apache Camel. The impacted element is an unknown function of the component AS2. This manipulation causes server-side request forgery. The identification of this vulnerabil
CVE-2026-80343 | Apache Camel Camel-Netty-HTTP improper authorization (WID-SEC-2026-4006)
A vulnerability marked as critical has been reported in Apache Camel. This vulnerability affects unknown code of the component Camel-Netty-HTTP. Performing a manipulation results in improper authorization. This vulnerability is known as CVE
CVE-2026-80312 | Apache Camel Fail-Open Processors improper authentication (WID-SEC-2026-4006)
A vulnerability classified as critical has been found in Apache Camel. Impacted is an unknown function of the component Fail-Open Processors. The manipulation leads to improper authentication. This vulnerability is uniquely identified as CV
CVE-2026-79986 | Apache Camel camel-azure-files path traversal (WID-SEC-2026-4006)
A vulnerability identified as critical has been detected in Apache Camel. Affected by this issue is some unknown functionality of the component camel-azure-files. This manipulation causes path traversal. This vulnerability appears as CVE-20
CVE-2026-79985 | Apache Camel SMB path traversal (WID-SEC-2026-4006)
A vulnerability categorized as critical has been discovered in Apache Camel. Affected by this vulnerability is an unknown functionality of the component SMB. The manipulation results in path traversal. This vulnerability is reported as CVE-
CVE-2022-46697 | Apple macOS up to 13.0 IOMobileFrameBuffer out-of-bounds (HT213532 / EUVD-2022-49486)
A vulnerability was found in Apple macOS and classified as critical. This issue affects some unknown processing of the component IOMobileFrameBuffer. Executing a manipulation can lead to out-of-bounds read. This vulnerability appears as CVE
Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation
Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation. The vulnerability, tracked as CVE-2026-0322 (CVSS score: 8.6), is a case of remote code execution i
CVE-2018-7489 | Oracle Retail Invoice Matching 15.0/16.0 jackson-databind incomplete blacklist (Nessus ID 109906 / ID 236791)
A vulnerability has been found in Oracle Retail Invoice Matching 15.0/16.0 and classified as very critical. Affected is an unknown function of the component jackson-databind. The manipulation leads to incomplete blacklist. This vulnerabilit
CVE-2018-1304 | Apache Tomcat up to 7.0.84/8.0.49/8.5.27/9.0.4 URL Pattern Empty String 7pk security (RHSA-2018:0465 / Nessus ID 106975)
A vulnerability described as critical has been identified in Apache Tomcat up to 7.0.84/8.0.49/8.5.27/9.0.4. The affected element is an unknown function of the component URL Pattern Handler. Executing a manipulation as part of Empty String
CVE-2026-79984 | Apache Camel camel-mina-sftp path traversal (WID-SEC-2026-4006)
A vulnerability was found in Apache Camel. It has been rated as critical. Affected is an unknown function of the component camel-mina-sftp. The manipulation leads to path traversal. This vulnerability is documented as CVE-2026-79984. The at
CVE-2026-79983 | Apache Camel FTP path traversal (WID-SEC-2026-4006)
A vulnerability was found in Apache Camel. It has been declared as critical. This impacts an unknown function of the component FTP. Executing a manipulation can lead to path traversal. This vulnerability is registered as CVE-2026-79983. It
CVE-2026-78165 | Apache Camel Spring deserialization (WID-SEC-2026-4006)
A vulnerability was found in Apache Camel. It has been declared as critical. This issue affects some unknown processing of the component Spring. Such manipulation leads to deserialization. This vulnerability is listed as CVE-2026-78165. The
CVE-2026-78164 | Apache Camel HTTP Producer input validation (WID-SEC-2026-4006)
A vulnerability marked as critical has been reported in Apache Camel. The affected element is an unknown function of the component HTTP Producer. The manipulation leads to improper input validation. This vulnerability is traded as CVE-2026-
CVE-2026-78163 | Apache Camel Camel-Docling server-side request forgery (WID-SEC-2026-4006)
A vulnerability classified as critical was found in Apache Camel. Affected by this issue is some unknown functionality of the component Camel-Docling. Executing a manipulation can lead to server-side request forgery. This vulnerability is h
CVE-2026-99999 | Linux Kernel up to 7.3-rc6 ipv4 skb_checksum_help stack-based overflow (WID-SEC-2026-4008)
A vulnerability identified as very critical has been detected in Linux Kernel up to 7.3-rc6. The impacted element is the function skb_checksum_help of the component ipv4. This manipulation causes stack-based buffer overflow. This vulnerabil
CVE-2026-108798 | ZKTeco BioTime 9.5.6 Build 20260130.3206 hard-coded key
A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206 and classified as critical. This issue affects some unknown processing. The manipulation results in use of hard-coded cryptographic key . This vulnerability is cataloged
CVE-2026-108797 | ZKTeco BioTime 9.5.6 Build 20260130.3206 Employee REST API employees authorization
A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206 and classified as problematic. This vulnerability affects unknown code of the file /personnel/api/employees/ of the component Employee REST API. The manipulation lea
CVE-2026-108796 | ZKTeco BioTime 9.5.6 Build 20260130.3206 Biometric Data Endpoint /iclock/finger_data/ emp_code authorization
A vulnerability, which was classified as problematic, was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/finger_data/ of the component Biometric Data Endpoint. Executing a manipulation of
CVE-2026-108795 | ZKTeco BioTime 9.5.6 Build 20260130.3206 System Settings API /base/api/systemSettings access control
A vulnerability, which was classified as problematic, has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API
CVE-2026-108794 | ZKTeco BioTime 9.5.6 Build 20260130.3206 Database Migration Functionality db_migrate_setting sql injection (EUVD-2026-97164)
A vulnerability classified as critical was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this vulnerability is an unknown functionality of the file /base/api/v1.0/systemSettings/db_migrate_setting/ of the component Database
Google Chrome 155 Patches Critical Use-After-Free Flaw and Nine Additional Security Bugs
Google has released Chrome 155 to the Stable channel with 10 security fixes. One is rated Critical: a use-after-free in Prerender, tracked as CVE-2026-110922. The update was published on October 15, 2026. The Stable channel moves to version
CVE-2022-46696 | Apple iOS/iPadOS up to 16.1.2 WebKit memory corruption (HT213530 / EUVD-2022-49485)
A vulnerability was found in Apple iOS and iPadOS up to 16.1.2. It has been declared as critical. This affects an unknown part of the component WebKit. Such manipulation leads to memory corruption. This vulnerability is referenced as CVE-20
CVE-2022-46691 | Apple macOS up to 13.0 WebKit memory allocation (HT213532 / EUVD-2022-49480)
A vulnerability was found in Apple macOS. It has been declared as critical. This impacts an unknown function of the component WebKit. Such manipulation leads to uncontrolled memory allocation. This vulnerability is traded as CVE-2022-46691.
CVE-2026-110140 | Google Chrome up to 155.0.8059.39 V8 type confusion (Nessus ID 366230)
A vulnerability described as critical has been identified in Google Chrome. The impacted element is an unknown function of the component V8. Such manipulation leads to type confusion. This vulnerability is traded as CVE-2026-110140. The att
CVE-2026-110139 | Google Chrome up to 155.0.8059.39 Media use after free (Nessus ID 366230)
A vulnerability labeled as critical has been found in Google Chrome. Impacted is an unknown function of the component Media. The manipulation results in use after free. This vulnerability is reported as CVE-2026-110139. The attack can be la
CVE-2026-110138 | Google Chrome up to 155.0.8059.39 ShapeDetection use after free (Nessus ID 366230)
A vulnerability marked as critical has been reported in Google Chrome. The affected element is an unknown function of the component ShapeDetection. This manipulation causes use after free. This vulnerability appears as CVE-2026-110138. The
CVE-2026-110137 | Google Chrome up to 155.0.8059.39 WebRTC use after free (Nessus ID 366230)
A vulnerability identified as critical has been detected in Google Chrome. This issue affects some unknown processing of the component WebRTC. The manipulation leads to use after free. This vulnerability is documented as CVE-2026-110137. Th
CVE-2026-110136 | Google Chrome up to 155.0.8059.39 PDF use after free (Nessus ID 366230)
A vulnerability was found in Google Chrome. It has been rated as critical. This affects an unknown part of the component PDF. Performing a manipulation results in use after free. This vulnerability is cataloged as CVE-2026-110136. It is pos
CVE-2026-108334 | Red Hat Connectivity Link 1/OpenShift AI WebAssembly Shim escape output (EUVD-2026-102322)
A vulnerability categorized as very critical has been discovered in Red Hat Connectivity Link 1 and OpenShift AI. Affected is an unknown function of the component WebAssembly Shim. Such manipulation leads to escaping of output. This vulnera
CVE-2026-101295 | Red Hat Assisted Installer for OpenShift Container Platform Operator Catalog Image Extraction path traversal (EUVD-2026-89959)
A vulnerability was found in Red Hat Assisted Installer for OpenShift Container Platform and OpenShift Container Platform. It has been rated as very critical. Affected is an unknown function of the component Operator Catalog Image Extractio
CVE-2026-103754 | Red Hat Ansible Automation Platform ansible-runner unstream_dir permission (EUVD-2026-90788)
A vulnerability, which was classified as problematic, has been found in Red Hat Ansible Automation Platform. Impacted is the function unstream_dir of the component ansible-runner. The manipulation leads to permission issues. This vulnerabil
CVE-2026-106033 | Red Hat Ansible Automation Platform/Hardened Images Redirect Route next cross site scripting (EUVD-2026-93781)
A vulnerability has been found in Red Hat Ansible Automation Platform and Hardened Images and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Redirect Route. This manipulation of the ar
CVE-2026-110777 | Red Hat Enterprise Linux up to 10 Attachment information disclosure (EUVD-2026-101521)
A vulnerability classified as problematic has been found in Red Hat Enterprise Linux 6/7/8/9/10. Impacted is an unknown function of the component Attachment. The manipulation leads to information disclosure. This vulnerability is listed as
CVE-2026-111413 | Cross-Site Request Forgery (CSRF) vulnerability in aThemeArt aThemeArt Theme Helper athemeart-theme-helper allows Cross Site Request Forgery.This issue affects aThemeArt Theme Helper: from n/a through 1.0.8.
Cross-Site Request Forgery (CSRF) vulnerability in aThemeArt aThemeArt Theme Helper athemeart-theme-helper allows Cross Site Request Forgery.This issue affects aThemeArt Theme Helper: from n/a through 1.0.8.
CVE-2026-110896 | Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Passster: from n/a through 4.3.18.
Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Passster: from n/a through 4.3.18.
CVE-2026-107564 | An unauthenticated remote attacker may use an allocation of resources without limits or throttling weakness in the affected product to cause high CPU load leading to a denial of service.
An unauthenticated remote attacker may use an allocation of resources without limits or throttling weakness in the affected product to cause high CPU load leading to a denial of service.
CVE-2026-111400 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Stored XSS.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.0.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Stored XSS.This issue affects PowerPack Addons for El
CVE-2026-111396 | Missing Authorization vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Post Manager: from n/a through 4.5.6.
Missing Authorization vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Post Manager: from n/a through 4.5
CVE-2026-111409 | Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.61.0.
Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH PayPal Exp
CVE-2026-110903 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through 6.18.1.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through
CVE-2026-110900 | Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BookIt: from n/a through 2.6.0.5.
Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BookIt: from n/a through 2.6.0.5.
CVE-2026-110901 | Authorization Bypass Through User-Controlled Key vulnerability in WPMU DEV SmartCrawl smartcrawl-seo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SmartCrawl: from n/a through 3.16.4.
Authorization Bypass Through User-Controlled Key vulnerability in WPMU DEV SmartCrawl smartcrawl-seo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SmartCrawl: from n/a through 3.16.4.
CVE-2026-110380 | Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.26.
Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.26.
CVE-2026-111405 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Stored XSS.This issue affects MapSVG: from n/a through 8.16.1.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Stored XSS.This issue affects MapSVG: from n/a through 8.16
CVE-2026-111399 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows SQL Injection.This issue affects MapSVG: from n/a through 8.16.1.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows SQL Injection.This issue affects MapSVG: from n/a through 8
CVE-2026-111397 | Missing Authorization vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Retrieve Embedded Sensitive Data.This issue affects MapSVG: from n/a through 8.16.1.
Missing Authorization vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Retrieve Embedded Sensitive Data.This issue affects MapSVG: from n/a through 8.16.1.
CVE-2026-108976 | GNU Emacs up to 31.1 TRAMP tramp-user-regexp os command injection (Nessus ID 366236 / WID-SEC-2026-3857)
A vulnerability classified as problematic was found in GNU Emacs up to 31.1. This issue affects the function tramp-user-regexp of the component TRAMP. Executing a manipulation can lead to os command injection. The identification of this vul
CVE-2025-11395 | Red Hat Podman path traversal (EUVD-2025-210915 / Nessus ID 366239)
A vulnerability, which was classified as problematic, has been found in Red Hat Podman. This impacts an unknown function. The manipulation leads to path traversal. This vulnerability is documented as CVE-2025-11395. The attack needs to be p
CVE-2026-94640 | rpcbind allocation of resources (Nessus ID 366320)
A vulnerability was found in rpcbind. It has been classified as critical. This impacts an unknown function. The manipulation leads to allocation of resources. This vulnerability is traded as CVE-2026-94640. It is possible to initiate the at
CVE-2026-102559 | Red Hat Enterprise Linux libsoup heap-based overflow (Nessus ID 366321)
A vulnerability, which was classified as very critical, has been found in Red Hat Enterprise Linux. The impacted element is an unknown function of the component libsoup. This manipulation causes heap-based buffer overflow. This vulnerabilit
CVE-2026-111555 | A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to redirect wipe or load operations outside the intended metadata area. An attacker could exploit this vulnerability by providing a crafted header with valid checksums to overwrite or zero out encrypted payload data, resulting in persistent data loss and corrupted storage. Exploitation typically requires privileged a
A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to redirect wipe or load operations outside the intended metadata area. An attacker could exploi
CVE-2026-105958 | A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via out-of-bounds read and write operations on the message buffer.
A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read
CVE-2026-105959 | A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted max_encoders value in migration data.
A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a mass
CVE-2026-111391 | SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluate_filter() that allows remote attackers to execute Python code by escaping the eval() sandbox through re.search __globals__. Attackers can send a crafted filter expression to the unauthenticated /dumper/configure endpoint when DUMPER_SERVER_PORT is set, running code in the scheduler process on the next forward pass.
SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluate_filter() that allows remote attackers to execute Python code by escaping the eval() sandbox through re.search __globals__. Attackers can send a crafted filter
CVE-2026-111390 | Erupt through 2.3.0 contains an HQL injection vulnerability that allows authenticated users to bypass tree-scoped data filters by injecting unescaped quotes into the linkTreeVal parameter of POST /erupt-api/data/table/{erupt}. Attackers holding query permission on entities with String-keyed linkTree targets can append always-true OR clauses or boolean subqueries to read data from other mapped entities.
Erupt through 2.3.0 contains an HQL injection vulnerability that allows authenticated users to bypass tree-scoped data filters by injecting unescaped quotes into the linkTreeVal parameter of POST /erupt-api/data/table/{erupt}. Attackers hol
Hackers Exploit BeyondTrust Zero-Day and Erase Security Logs to Hide Their Tracks
A suspected China-nexus espionage group exploited a critical zero-day in BeyondTrust Remote Support, tracked as CVE-2026-102764. It then deleted logs to hide its activity. BeyondTrust patched the flaw in advisory BT26-05 and disclosed it on
CVE-2026-107648 | The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action (also function, plugin, post_type, post_status, ids, loggedout, and POST post_title)' parameter in all versions up to, and including, 1.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user acces
The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action (also function, plugin, post_type, post_status, ids, loggedout, and POST post_title)' parameter in all versions
CVE-2026-110029 | The Squeeze WordPress plugin before 1.8.1 does not perform a capability check on one of its AJAX actions, allowing authenticated users with a role as low as Subscriber to revert any attachment to its backup copy and to permanently delete that backup and the plugin's generated WebP derivatives, regardless of ownership.
The Squeeze WordPress plugin before 1.8.1 does not perform a capability check on one of its AJAX actions, allowing authenticated users with a role as low as Subscriber to revert any attachment to its backup copy and to permanently delete th
CVE-2026-109930 | The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its analytics data, treating a credential value shipped verbatim in its own public source as a valid API key, which allows unauthenticated attackers to retrieve the stored crawl-analytics log, including each recorded visitor's IP address, user agent and referer.
The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its analytics data, treating a credential value shipped verbatim in its own public source as a valid API key, which allows unauthenticated attackers to retrieve th