Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 730 | 0,2 % |
| ≥50 % | 3.213 | 0,9 % |
| ≥10 % | 22.093 | 5,9 % |
| <10 % | 347.758 | 93,0 % |
CVE-2026-106931 When Someone Else Runs Your SiteGuard
CVE-2026-106931 When Someone Else Runs Your SiteGuard SiteGuard Server Edition is often installed by a hosting provider, a web agency or an internal platform team rather than by the security group that ends up answering for it. CVE-2026-106
[UPDATE] [mittel] docker: Schwachstelle ermöglicht Manipulation von Daten und Umgehen von Sicherheitsvorkehrungen
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in docker ausnutzen, um Daten zu manipulieren, und um Sicherheitsvorkehrungen zu umgehen. Weiterlesen
Microsoft Authenticator Flaw Lets Malicious Android Apps Steal Login Tokens Without Permissions
A high-severity vulnerability in Microsoft Authenticator for Android let a malicious app with no Android permissions steal authentication tokens for a victim’s signed-in work account, potentially exposing Microsoft 365 email, files, calenda
PHP-Schwachstelle: Sieben Experten warnen vor massiven Sicherheitslücken
Viele“, schrieb Shumer. „Wir stecken mitten im größten Moment für die Cybersicherheit seit Jahren.“ Laut Shumers Beitrag könnte Folgendes passieren:. Weiterlesen
HTTP2Shell Vulnerability Extends Beyond HTTP, Affecting .NET, FFmpeg, ClickHouse, and Apache Arrow
The HTTP2Shell vulnerability reaches beyond web traffic, with new research showing how the same Brotli decoder flaw (CVE-2026-111497) can disrupt .NET applications, FFmpeg media processing, ClickHouse servers, and Apache Arrow workloads. Th
CVE-2026-116229 | ffxiv-teamcraft FFXIV Teamcraft up to 11.4.31 Renderer-Process IPC Bridge preload.ts clipboard.readText cross site scripting
A vulnerability was found in ffxiv-teamcraft FFXIV Teamcraft up to 11.4.31. It has been classified as problematic. Impacted is the function clipboard.readText of the file apps/electron/src/preload.ts of the component Renderer-Process IPC Br
CVE-2026-116228 | 777genius agent-teams-ai up to 2.17.10 Local HTTP Service HttpServer.ts doStart missing authentication
A vulnerability was found in 777genius agent-teams-ai up to 2.17.10 and classified as problematic. This issue affects the function doStart of the file src/main/services/infrastructure/HttpServer.ts of the component Local HTTP Service. The m
CVE-2026-116282 | Kameleo up to 5.3.1 Cookie Controller w.cs CookieController.ListCookies guid information disclosure
A vulnerability was found in Kameleo up to 5.3.1. It has been declared as problematic. Affected by this issue is the function CookieController.ListCookies of the file client-engine-application/w.cs of the component Cookie Controller. The ma
CVE-2026-116281 | Kameleo up to 5.0.1.26 Profile Controller t.cs ListProfiles information disclosure
A vulnerability was found in Kameleo up to 5.0.1.26. It has been classified as problematic. Affected by this vulnerability is the function ListProfiles of the file client-engine-application/t.cs of the component Profile Controller. The mani
Citrix NetScaler Zero-Day: 3 Wellen in 11 Tagen [2026] - shattered.io
Weitere Hintergründe zu Schwachstellen und Gegenmaßnahmen sammelt die Rubrik Cybersicherheit. Fünf Prognosen für die nächsten Wochen. Die folgenden ... Weiterlesen
CVE-2026-116280 | Kameleo up to 5.0.1.26 Proxy Validation f.cs InternalController.TestProxy host/port server-side request forgery
A vulnerability was found in Kameleo up to 5.0.1.26 and classified as problematic. Affected is the function InternalController.TestProxy of the file client-engine-application/f.cs of the component Proxy Validation. Executing a manipulation
CVE-2026-116284 | Kameleo up to 5.3.1 Local API /general/user-info information disclosure
A vulnerability categorized as problematic has been discovered in Kameleo up to 5.3.1. This vulnerability affects unknown code of the file /general/user-info of the component Local API. Such manipulation leads to information disclosure. Thi
CVE-2026-116105 | HeyCyan App 1.0.103 on Android Network Security Configuration AndroidManifest.xml cleartext transmission
A vulnerability described as problematic has been identified in HeyCyan App 1.0.103 on Android. Affected is an unknown function of the file AndroidManifest.xml of the component Network Security Configuration. Executing a manipulation can le
CVE-2026-116106 | HeyCyan App 1.0.103 on Android FileProvider access control
A vulnerability classified as critical has been found in HeyCyan App 1.0.103 on Android. Affected by this vulnerability is an unknown functionality of the component FileProvider. The manipulation leads to improper access controls. This vuln
Böswillige Admins können in Fortinet-Produkten beliebige Dateien löschen
Angreifer nutzen eine Path-Traversal-Sicherheitslücke in mehreren Fortinet-Produkten aus. Über kompromittierte Admin-Konten können sie damit beliebige Dateien manipulieren oder löschen. (Bild: ChubbyCat - stock.adobe.com / KI-generiert) Wei
BeyondTrust Sicherheitslücke: CVSS 9,3 aktiv [2026] - Tech Insider
BeyondTrust-Zero-Day: CVSS 9,3, seit August aktiv [2026]. Elias Virtanen; Oktober 26, 2026; Cybersicherheit · Elias ... Weiterlesen
CVE-2026-116119 | A vulnerability was found in NocoDB up to 2026.08.0. This affects an unknown part of the file packages/nocodb/src/services/users/users.service.ts of the component Password-Reset Flow. The manipulation results in race condition. The attack can be executed remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.
A vulnerability was found in NocoDB up to 2026.08.0. This affects an unknown part of the file packages/nocodb/src/services/users/users.service.ts of the component Password-Reset Flow. The manipulation results in race condition. The attack c
CVE-2026-113345 | Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an improper file access permission vulnerability. Files in the installation folder of the application may be tampered with, resulting in arbitrary code execution.
Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an improper file access permission vulnerability. Files in the installation folder of the application ma
CVE-2026-90209 | Linux Kernel up to 7.2.5 s390dbf debug_unregister deadlock (WID-SEC-2026-3444)
A vulnerability identified as problematic has been detected in Linux Kernel up to 7.2.5. Affected by this issue is the function debug_unregister of the component s390dbf. Performing a manipulation results in deadlock. This vulnerability is
CVE-2026-90208 | Linux Kernel up to 7.2.5 Samsung PWM Timer samsung_pwm locking (WID-SEC-2026-3444)
A vulnerability described as very critical has been identified in Linux Kernel up to 7.2.5. Affected by this issue is some unknown functionality of the file samsung_pwm of the component Samsung PWM Timer. Executing a manipulation can lead t
CVE-2026-90207 | Linux Kernel up to 7.2.5 ALSA MIDI snd_midi_input_event rmidi null pointer dereference (WID-SEC-2026-3444)
A vulnerability was found in Linux Kernel up to 6.1.187/6.6.156/6.12.109/6.18.51/7.2.5. It has been declared as problematic. The affected element is the function snd_midi_input_event of the component ALSA MIDI. Executing a manipulation of t
CVE-2026-90206 | Linux Kernel up to 7.2.5 nvmet nvmet_alloc_ctrl out-of-bounds (WID-SEC-2026-3444)
A vulnerability labeled as very critical has been found in Linux Kernel up to 7.2.5. Affected is the function nvmet_alloc_ctrl of the component nvmet. Such manipulation leads to out-of-bounds read. This vulnerability is traded as CVE-2026-9
CVE-2026-90205 | Linux Kernel up to 6.18.51/7.2.5 ocfs2 fs/ocfs2/sysfile.c ocfs2_validate_inode_block max_slots use after free (WID-SEC-2026-3444)
A vulnerability marked as very critical has been reported in Linux Kernel up to 6.18.51/7.2.5. The affected element is the function ocfs2_validate_inode_block of the file fs/ocfs2/sysfile.c of the component ocfs2. This manipulation of the a
CVE-2026-90204 | Linux Kernel up to 6.18.51/7.2.5 ocfs2 fs/ocfs2/sysfile.c ocfs2_del_inode_from_orphan use after free (WID-SEC-2026-3444)
A vulnerability labeled as critical has been found in Linux Kernel up to 6.18.51/7.2.5. Impacted is the function ocfs2_del_inode_from_orphan of the file fs/ocfs2/sysfile.c of the component ocfs2. The manipulation results in use after free.
CVE-2026-90203 | Linux Kernel up to 7.2.5 Squashfs squashfs_copy_data out-of-bounds (WID-SEC-2026-3444)
A vulnerability categorized as critical has been discovered in Linux Kernel up to 7.2.5. Affected by this vulnerability is the function squashfs_copy_data of the component Squashfs. Such manipulation leads to out-of-bounds read. This vulner
CVE-2026-90202 | Linux Kernel up to 7.2.5 mpt3sas _base_release_memory_pools null pointer dereference (WID-SEC-2026-3444)
A vulnerability was found in Linux Kernel up to 7.2.5. It has been rated as critical. Affected is the function _base_release_memory_pools of the component mpt3sas. This manipulation causes null pointer dereference. This vulnerability is reg
CVE-2026-90200 | Linux Kernel up to 6.6.156/6.12.109/6.18.51/7.2.5 ntfs3 fs/ntfs3/run.c ntfs_init_from_boot mlcn/mlcn2 integer overflow (WID-SEC-2026-3444)
A vulnerability was found in Linux Kernel up to 6.6.156/6.12.109/6.18.51/7.2.5. It has been declared as critical. This impacts the function ntfs_init_from_boot of the file fs/ntfs3/run.c of the component ntfs3. The manipulation of the argum
CVE-2026-90199 | Linux Kernel up to 6.6.156/6.12.109/6.18.51/7.2.5 ntfs3 fs/ntfs3 mi_enum_attr integer overflow (WID-SEC-2026-3444)
A vulnerability was found in Linux Kernel up to 6.6.156/6.12.109/6.18.51/7.2.5. It has been classified as critical. This affects the function mi_enum_attr of the file fs/ntfs3 of the component ntfs3. The manipulation leads to integer overfl
CVE-2026-90198 | Linux Kernel up to 7.2.5 ALSA Core sound/core/init.c snd_card_do_free use after free (WID-SEC-2026-3444)
A vulnerability has been found in Linux Kernel up to 7.2.5 and classified as critical. This vulnerability affects the function snd_card_do_free of the file sound/core/init.c of the component ALSA Core. This manipulation causes use after fre
CVE-2026-116118 | A vulnerability has been found in Z.ai Zcode up to 3.14.3/3.15.1. Affected by this issue is some unknown functionality of the component Sed Command Filter. The manipulation leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
A vulnerability has been found in Z.ai Zcode up to 3.14.3/3.15.1. Affected by this issue is some unknown functionality of the component Sed Command Filter. The manipulation leads to os command injection. Remote exploitation of the attack is
CVE-2026-116117 | A flaw has been found in halo-dev halo up to 2.27.0-beta.1. Affected by this vulnerability is the function run.halo.app.theme.DefaultViewNameResolver.resolveViewNameOrDefault of the file application/src/main/java/run/halo/app/theme/DefaultViewNameResolver.java of the component View Name Resolver. Executing a manipulation of the argument template can lead to path traversal. The attack may be launched remotely. The exploit has been published and may be used. T
A flaw has been found in halo-dev halo up to 2.27.0-beta.1. Affected by this vulnerability is the function run.halo.app.theme.DefaultViewNameResolver.resolveViewNameOrDefault of the file application/src/main/java/run/halo/app/theme/DefaultV
CVE-2026-116116 | A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36. Affected is an unknown function of the component Secure Boot. Performing a manipulation results in improper verification of cryptographic signature. The attack needs to be approached locally. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36. Affected is an unknown function of the component Secure Boot. Performing a manipulation results in improper verification of cryptographic signature. The attack needs to be a
CVE-2026-5650 | code-projects Online Application System for Admission 1.0 oas.sql sensitive information
A vulnerability was found in code-projects Online Application System for Admission 1.0. It has been classified as critical. Impacted is an unknown function of the file /enrollment/database/oas.sql. Performing a manipulation results in insec
CVE-2026-34951 | forceworkbench up to 64.x Error Page footerScripts cross site scripting (GHSA-j94x-h584-rjf9)
A vulnerability classified as problematic was found in forceworkbench up to 64.x. This affects an unknown part of the component Error Page. Such manipulation of the argument footerScripts leads to cross site scripting. This vulnerability is
CVE-2026-34885 | David Lingren Media LIbrary Assistant Plugin up to 3.34 on WordPress sql injection
A vulnerability described as critical has been identified in David Lingren Media LIbrary Assistant Plugin up to 3.34 on WordPress. The affected element is an unknown function. Executing a manipulation can lead to sql injection. This vulnera
CVE-2026-34729 | thorsten phpMyFAQ up to 4.1.0 Filter::removeAttributes cross site scripting (GHSA-cv2g-8cj8-vgc7)
A vulnerability, which was classified as problematic, was found in thorsten phpMyFAQ up to 4.1.0. The affected element is the function Filter::removeAttributes. The manipulation results in cross site scripting. This vulnerability was named
CVE-2026-33616 | MB connect line mbCONNECT24/mymbCONNECT24 up to 2.19.4 mb24api Endpoint sql injection (VDE-2026-030)
A vulnerability was found in MB connect line mbCONNECT24 and mymbCONNECT24 up to 2.19.4. It has been rated as critical. This affects an unknown part of the component mb24api Endpoint. The manipulation leads to sql injection. This vulnerabil
CVE-2026-28805 | devcode-it openstamanager up to 2.10.1 GET Parameter superselect['stato'] sql injection (GHSA-3gw8-3mg3-jmpc)
A vulnerability identified as critical has been detected in devcode-it openstamanager up to 2.10.1. The impacted element is an unknown function of the component GET Parameter Handler. Performing a manipulation of the argument superselect[&#
CVE-2026-21382 | Qualcomm Snapdragon Compute/Snapdragon Industrial IOT up to XG101039 buffer overflow
A vulnerability identified as critical has been detected in Qualcomm Snapdragon Compute and Snapdragon Industrial IOT. This impacts an unknown function. The manipulation leads to buffer overflow. This vulnerability is referenced as CVE-2026
CVE-2026-21380 | Qualcomm Snapdragon Compute/Snapdragon Industrial IOT up to XG101039 IOCTL Call use after free
A vulnerability was found in Qualcomm Snapdragon Compute and Snapdragon Industrial IOT. It has been rated as critical. The impacted element is an unknown function of the component IOCTL Call Handler. Performing a manipulation results in use
CVE-2026-21372 | Qualcomm Snapdragon Compute up to XG101039 IOCTL Request heap-based overflow
A vulnerability was found in Qualcomm Snapdragon Compute, Snapdragon Industrial IOT and Snapdragon Mobile. It has been rated as critical. This issue affects some unknown processing of the component IOCTL Request Handler. This manipulation c
CVE-2026-116115 | A security vulnerability has been detected in Yoosee GM8135S Camera 21.00.01.36. This impacts an unknown function of the file wpa_supplicantX.conf of the component WiFi Configuration. Such manipulation leads to improper initialization. The attack can only be initiated within the local network. This attack is characterized by high complexity. The exploitability is said to be difficult. The exploit has been disclosed publicly and may be used. The vendor was co
A security vulnerability has been detected in Yoosee GM8135S Camera 21.00.01.36. This impacts an unknown function of the file wpa_supplicantX.conf of the component WiFi Configuration. Such manipulation leads to improper initialization. The
CVE-2026-34750 | payloadcms payload up to 3.77.x URL Endpoint path traversal (GHSA-frq9-7j6g-v74x)
A vulnerability has been found in payloadcms payload up to 3.77.x and classified as critical. This affects an unknown part of the component URL Endpoint. This manipulation causes path traversal. This vulnerability appears as CVE-2026-34750.
CVE-2026-34568 | ci4-cms-erp ci4ms 0.28.5.0 cross site scripting (GHSA-x7wh-g25g-53vg)
A vulnerability described as problematic has been identified in ci4-cms-erp ci4ms 0.28.5.0. This impacts an unknown function. Executing a manipulation can lead to cross site scripting. The identification of this vulnerability is CVE-2026-34
CVE-2026-32925 | Fuji Electric V-SFT up to 6.2.10.0 WriteV7DataToRom stack-based overflow
A vulnerability was found in Fuji Electric V-SFT up to 6.2.10.0. It has been classified as critical. The impacted element is the function CV7BaseMap::WriteV7DataToRom. The manipulation leads to stack-based buffer overflow. This vulnerabilit
CVE-2026-2475 | IBM Verify Identity Access Container up to 11.0.2 Request redirect
A vulnerability classified as problematic was found in IBM Verify Identity Access Container, Security Verify Access Container, Verify Identity Access and Security Verify Access up to 11.0.2. Impacted is an unknown function of the component
CVE-2026-116114 | A weakness has been identified in Yoosee GM8135S Camera 21.00.01.36. This affects an unknown function of the file /npc/npc of the component Live UDP H.264 Video Stream Handler. This manipulation causes cleartext transmission of sensitive information. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The exploit has been made available to the public and could be used for attacks. The v
A weakness has been identified in Yoosee GM8135S Camera 21.00.01.36. This affects an unknown function of the file /npc/npc of the component Live UDP H.264 Video Stream Handler. This manipulation causes cleartext transmission of sensitive in
CVE-2026-116113 | A security flaw has been discovered in GouGuOA up to 6.1.2. The impacted element is the function chunkUpload of the file app/disk/controller/Api.php. The manipulation of the argument file_extension results in unrestricted upload. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
A security flaw has been discovered in GouGuOA up to 6.1.2. The impacted element is the function chunkUpload of the file app/disk/controller/Api.php. The manipulation of the argument file_extension results in unrestricted upload. It is poss
CVE-2026-4972 | code-projects Online Reviewer System up to 1.0 btn_functions.php description cross site scripting (EUVD-2026-16805)
A vulnerability categorized as problematic has been discovered in code-projects Online Reviewer System up to 1.0. Affected is an unknown function of the file /system/system/students/assessments/databank/btn_functions.php. Such manipulation
CVE-2026-4961 | Tenda AC6 15.03.05.16 POST Request /goform/QuickIndex formQuickIndex PPPOEPassword stack-based overflow
A vulnerability, which was classified as critical, has been found in Tenda AC6 15.03.05.16. Affected by this vulnerability is the function formQuickIndex of the file /goform/QuickIndex of the component POST Request Handler. The manipulation
CVE-2026-34388 | fleetdm fleet up to 4.80.x RPC Launcher Endpoint improper check or handling of exceptional conditions (GHSA-w254-4hp5-7cvv)
A vulnerability categorized as problematic has been discovered in fleetdm fleet up to 4.80.x. Affected is an unknown function of the component RPC Launcher Endpoint. The manipulation results in improper check or handling of exceptional cond
CVE-2026-33882 | Statamic CMS up to 5.73.15/6.7.1 Markdown Preview Endpoint improper authentication (GHSA-cvh3-23vq-w7h4)
A vulnerability classified as critical was found in Statamic CMS up to 5.73.15/6.7.1. Affected by this vulnerability is an unknown functionality of the component Markdown Preview Endpoint. Executing a manipulation can lead to improper authe
CVE-2026-33874 | Gematik app-Authenticator up to 4.15.x on macOS File os command injection (GHSA-mjgm-7hwc-qqcr)
A vulnerability was found in Gematik app-Authenticator up to 4.15.x on macOS. It has been rated as critical. This issue affects some unknown processing of the component File Handler. Performing a manipulation results in os command injection
CVE-2026-26060 | fleetdm fleet up to 4.80.x Password Reset Token session expiration (GHSA-3458-r943-hmx4)
A vulnerability was found in fleetdm fleet up to 4.80.x. It has been declared as critical. This affects an unknown function of the component Password Reset Token Handler. Executing a manipulation can lead to session expiration. This vulnera
CVE-2026-116112 | A vulnerability was identified in HashenUdara edoc-doctor-appointment-system up to cc258425b915d1af9e298777ccd26d160493e68d. The affected element is an unknown function of the file admin/add-new.php. The manipulation of the argument spec leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. This product is using a rolling release to provide continious delivery. Therefore, no version detai
A vulnerability was identified in HashenUdara edoc-doctor-appointment-system up to cc258425b915d1af9e298777ccd26d160493e68d. The affected element is an unknown function of the file admin/add-new.php. The manipulation of the argument spec le
CVE-2026-116111 | A vulnerability was determined in 2K Games Civilization V 1.0.3.144. Impacted is the function loadstring of the component Lua Sandbox. Executing a manipulation can lead to type confusion. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was determined in 2K Games Civilization V 1.0.3.144. Impacted is the function loadstring of the component Lua Sandbox. Executing a manipulation can lead to type confusion. The attack may be performed from remote. The exploit
CVE-2026-90197 | Linux Kernel up to 6.18.51/7.2.5 HID haptic fill_effect_buf uninitialized variable (WID-SEC-2026-3444)
A vulnerability, which was classified as very critical, has been found in Linux Kernel up to 6.18.51/7.2.5. Affected by this issue is the function fill_effect_buf of the component HID haptic. The manipulation leads to use of uninitialized v
CVE-2026-90196 | Linux Kernel up to 7.2.5 SOF integer overflow (WID-SEC-2026-3444)
A vulnerability classified as problematic was found in Linux Kernel up to 6.1.187/6.6.156/6.12.109/6.18.51/7.2.5. Affected by this vulnerability is an unknown functionality of the component SOF. Executing a manipulation can lead to integer
CVE-2026-90195 | Linux Kernel up to 6.12.109/6.18.51/7.2.5 BPF JIT input validation (WID-SEC-2026-3444)
A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.12.109/6.18.51/7.2.5. This impacts an unknown function of the component BPF JIT. Performing a manipulation results in improper input validation. This
CVE-2026-90194 | Linux Kernel up to 7.2.5 ACPI acpi_device_cleanup allocation of resources (WID-SEC-2026-3444)
A vulnerability classified as critical has been found in Linux Kernel up to 6.1.187/6.6.156/6.12.109/6.18.51/7.2.5. Affected is the function acpi_device_cleanup of the component ACPI. Performing a manipulation results in allocation of resou