Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 720 | 0,2 % |
| ≥50 % | 3.222 | 0,9 % |
| ≥10 % | 22.115 | 6,0 % |
| <10 % | 343.282 | 92,9 % |
CVE-2026-101934 | Juniper Networks Junos OS/Junos OS Evolved Eventd Relay Service out-of-bounds write (WID-SEC-2026-3976)
A vulnerability classified as problematic has been found in Juniper Networks Junos OS and Junos OS Evolved. This issue affects some unknown processing of the component Eventd Relay Service. Performing a manipulation results in out-of-bounds
CVE-2026-101927 | Juniper Networks Junos OS/Junos OS Evolved eventd heap-based overflow (WID-SEC-2026-3976)
A vulnerability described as very critical has been identified in Juniper Networks Junos OS and Junos OS Evolved. This vulnerability affects unknown code of the component eventd. Such manipulation leads to heap-based buffer overflow. This v
CVE-2026-93637 | Zimbra Collaboration Suite up to 10.1.21 GraphQL excessive authentication (WID-SEC-2026-3977)
A vulnerability classified as problematic was found in Zimbra Collaboration Suite up to 10.1.21. This vulnerability affects unknown code of the component GraphQL. The manipulation results in improper restriction of excessive authentication
CVE-2026-93635 | Zimbra Collaboration Suite up to 10.1.21 LDAP Filter injection (WID-SEC-2026-3977)
A vulnerability was found in Zimbra Collaboration Suite up to 10.1.21. It has been classified as critical. Affected is an unknown function of the component LDAP Filter. The manipulation leads to injection. This vulnerability is traded as CV
CVE-2026-105841 | Uwe Ohse lrzsz up to 0.12.9 lrz receive utility pipe mode src/lrz.c procheader os command injection (WID-SEC-2026-3978)
A vulnerability was found in Uwe Ohse lrzsz up to 0.12.9. It has been classified as critical. This affects the function procheader of the file src/lrz.c of the component lrz receive utility pipe mode. Performing a manipulation results in os
CVE-2026-105840 | Uwe Ohse lrzsz up to 0.12.x lrz receive utility src/lrz.c checkpath path traversal (WID-SEC-2026-3978)
A vulnerability categorized as critical has been discovered in Uwe Ohse lrzsz up to 0.12.x. Affected by this vulnerability is the function checkpath of the file src/lrz.c of the component lrz receive utility. The manipulation results in pat
CVE-2026-98432 | Linux Kernel up to 7.3-rc6 ipv4 tcp_v4_syn_recv_sock ireq_opt/inet_opt/optlen use after free (EUVD-2026-102025)
A vulnerability, which was classified as very critical, has been found in Linux Kernel up to 7.3-rc6. Affected is the function tcp_v4_syn_recv_sock of the component ipv4. The manipulation of the argument ireq_opt/inet_opt/optlen leads to us
CVE-2026-109693 | WP ManageNinja Fluent CRM Plugin up to 3.2.5 on WordPress privileges management (EUVD-2026-102026)
A vulnerability categorized as critical has been discovered in WP ManageNinja Fluent CRM Plugin up to 3.2.5 on WordPress. The affected element is an unknown function. The manipulation results in improper privilege management. This vulnerabi
CVE-2026-109698 | Kitae Park Mang Board Plugin up to 2.4.4 on WordPress sql injection (EUVD-2026-102028)
A vulnerability was found in Kitae Park Mang Board Plugin up to 2.4.4 on WordPress. It has been declared as critical. This issue affects some unknown processing. Executing a manipulation can lead to sql injection. This vulnerability is trac
CVE-2026-109692 | meGrill User Registration Plugin up to 5.2.8 on WordPress authorization (EUVD-2026-102027)
A vulnerability was found in meGrill User Registration Plugin up to 5.2.8 on WordPress. It has been classified as critical. This vulnerability affects unknown code. Performing a manipulation results in missing authorization. This vulnerabil
CVE-2026-110724 | Eclipse Connected Services Platform up to 1.7.3 api-gateway ClientIpKeyResolver inclusion of web functionality from an untrusted source (EUVD-2026-102029)
A vulnerability was found in Eclipse Connected Services Platform up to 1.7.3 and classified as critical. This affects the function ClientIpKeyResolver of the component api-gateway. Such manipulation leads to inclusion of web functionality f
CVE-2026-110723 | Eclipse Connected Services Platform up to 1.7.3 api-gateway ClientIpKeyResolver X-Forwarded-For config (EUVD-2026-102030)
A vulnerability has been found in Eclipse Connected Services Platform up to 1.7.3 and classified as problematic. Affected by this issue is the function ClientIpKeyResolver of the component api-gateway. This manipulation of the argument X-Fo
[UPDATE] [hoch] Rancher: Schwachstelle ermöglicht Privilegieneskalation
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Rancher ausnutzen, um seine Privilegien zu erhöhen. Weiterlesen
[NEU] [hoch] Netgate pfSense: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Administratorrechten
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Netgate pfSense ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen. Weiterlesen
[NEU] [hoch] ESRI ArcGIS: Mehrere Schwachstelle
Ein Angreifer kann mehrere Schwachstellen in ESRI ArcGIS ausnutzen, um einen SQL-Injection oder Cross Site Scripting Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen und einen Denial of Service zu verursachen. Weiterlesen
[NEU] [kritisch] Cisco Secure Email Gateway: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Administratorrechten
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Cisco Secure Email Gateway ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen. Weiterlesen
[NEU] [mittel] ONLYOFFICE Docs: Schwachstelle ermöglicht Offenlegung von Informationen
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in ONLYOFFICE Docs ausnutzen, um Sicherheitsmaßnahmen zu umgehen und Informationen offenzulegen. Weiterlesen
[NEU] [mittel] 7-Zip: Schwachstelle ermöglicht Offenlegung von Informationen
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in 7-Zip ausnutzen, um Informationen offenzulegen. Weiterlesen
[NEU] [hoch] Gitea: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Administratorrechten
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Gitea ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen. Weiterlesen
[NEU] [hoch] QT: Schwachstelle ermöglicht Denial of Service
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in QT ausnutzen, um einen Denial of Service Angriff durchzuführen. Weiterlesen
[NEU] [hoch] ILIAS: Schwachstelle ermöglicht Codeausführung
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in ILIAS ausnutzen, um beliebigen Programmcode auszuführen. Weiterlesen
[NEU] [mittel] Gogs: Schwachstelle ermöglicht Darstellen falscher Informationen und Umgehen von Sicherheitsvorkehrungen
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Gogs ausnutzen, um Sicherheitsvorkehrungen zu umgehen und um falsche Informationen darzustellen. Weiterlesen
[NEU] [mittel] Znuny: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Znuny ausnutzen, um Sicherheitsvorkehrungen zu umgehen, wodurch er Daten manipulieren und offenlegen kann. Weiterlesen
CVE-2022-46594 | TRENDnet TEW755AP 1.13B01 auto_up_fw update_file_name stack-based overflow (EUVD-2022-49398)
A vulnerability has been found in TRENDnet TEW755AP 1.13B01 and classified as critical. This affects the function auto_up_fw. The manipulation of the argument update_file_name leads to stack-based buffer overflow. This vulnerability is refe
CVE-2022-46593 | TRENDnet TEW755AP 1.13B01 do_sta_enrollee_wifi wps_sta_enrollee_pin stack-based overflow (EUVD-2022-49397)
A vulnerability, which was classified as critical, was found in TRENDnet TEW755AP 1.13B01. The impacted element is the function do_sta_enrollee_wifi. Executing a manipulation of the argument wps_sta_enrollee_pin can lead to stack-based buff
CVE-2022-46592 | TRENDnet TEW755AP 1.13B01 set_sta_enrollee_pin_5g wps_sta_enrollee_pin stack-based overflow (EUVD-2022-49396)
A vulnerability, which was classified as critical, has been found in TRENDnet TEW755AP 1.13B01. The affected element is the function set_sta_enrollee_pin_5g. Performing a manipulation of the argument wps_sta_enrollee_pin results in stack-ba
CVE-2022-46591 | TRENDnet TEW755AP 1.13B01 reject reject_url stack-based overflow (EUVD-2022-49395)
A vulnerability classified as critical was found in TRENDnet TEW755AP 1.13B01. Impacted is the function Reject. Such manipulation of the argument reject_url leads to stack-based buffer overflow. This vulnerability is uniquely identified as
Seven stable kernels for Thursday with fix for critical vulnerability
Greg Kroah-Hartman has announced the release of the 7.2.11, 6.18.57, 6.12.113, 6.6.159, 6.1.190, 5.15.223, and 5.10.272 stable kernels. This series includes, among other things, a fix for a critical vulnerability (CVE-2026-99999). The flaw
How Uber Got Hacked (No 0-Day Required) 💀
YouTube VideoAttackers didn't use an elite zero-day exploit to breach Uber. They just found valid access keys left behind in a GitHub repository and gained access to internal customer data. Sometimes the easiest way in is just finding
CVE-2019-7309 | GNU C Library up to 2.29 RDX memcmp memory corruption (BID-106835)
A vulnerability labeled as critical has been found in GNU C Library up to 2.29. Affected by this issue is the function memcmp of the component RDX Handler. Such manipulation leads to memory corruption. This vulnerability is documented as CV
CVE-2019-6488 | GNU C Library up to 2.28 on x32 String memmove-vec-unaligned-erms.S __memmove_avx_unaligned_erms denial of service (BID-106671)
A vulnerability identified as problematic has been detected in GNU C Library up to 2.28 on x32. The affected element is the function __memmove_avx_unaligned_erms of the file sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S of the compo
CVE-2019-6111 | OpenSSH 7.9 scp path traversal (RHSA-2019:3702 / EDB-46193)
A vulnerability, which was classified as critical, was found in OpenSSH 7.9. This impacts an unknown function of the component scp. Such manipulation leads to path traversal. This vulnerability is referenced as CVE-2019-6111. It is possible
CVE-2019-6110 | OpenSSH 7.9 access control (ssa-412672 / EDB-46193)
A vulnerability, which was classified as critical, has been found in OpenSSH 7.9. This affects an unknown function. This manipulation causes improper access controls. The identification of this vulnerability is CVE-2019-6110. It is possible
CVE-2018-20482 | GNU tar up to 1.30 sparse.c sparse_dump_region Archive out-of-bounds (DLA 1623-1 / Nessus ID 119957)
A vulnerability was found in GNU tar up to 1.30. It has been rated as problematic. This issue affects the function sparse_dump_region of the file sparse.c. The manipulation as part of Archive leads to out-of-bounds read. This vulnerability
CVE-2018-19591 | GNU C Library up to 2.28 getaddrinfo Hostname input validation (FEDORA-2018-f6b7df660d / Nessus ID 120918)
A vulnerability categorized as problematic has been discovered in GNU C Library up to 2.28. The impacted element is the function getaddrinfo. The manipulation as part of Hostname results in improper input validation. This vulnerability is c
CVE-2018-18928 | International Components for Unicode 63.1 number_decimalquantity.cpp toScientificString integer overflow (FEDORA-2018-db05d9982f / Nessus ID 120841)
A vulnerability marked as critical has been reported in International Components for Unicode 63.1. Affected by this vulnerability is the function number::impl::DecimalQuantity::toScientificString of the file i18n/number_decimalquantity.cpp.
CVE-2018-14567 | libxml2 2.9.8 XML File --with-lzma resource consumption (USN-3739-1 / Nessus ID 117811)
A vulnerability identified as problematic has been detected in libxml2 2.9.8. Impacted is an unknown function of the component XML File Handler. Performing a manipulation of the argument --with-lzma results in resource consumption. This vul
CVE-2018-14404 | libxml2 up to 2.9.8 xpath.c xmlXPathCompOpEval null pointer dereference (FEDORA-2018-e198cf4a64 / EUVD-2019-0178)
A vulnerability classified as problematic was found in libxml2 up to 2.9.8. Affected by this vulnerability is the function xmlXPathCompOpEval of the file xpath.c. The manipulation results in null pointer dereference. This vulnerability was
CVE-2018-0495 | Libgcrypt up to 1.7.9/1.8.2 ECDSA Signature cipher/ecc-ecdsa.c _gcry_ecc_ecdsa_sign information disclosure (RHSA-2018:3221 / Nessus ID 110521)
A vulnerability, which was classified as problematic, has been found in Libgcrypt up to 1.7.9/1.8.2. This impacts the function _gcry_ecc_ecdsa_sign of the file cipher/ecc-ecdsa.c of the component ECDSA Signature Handler. This manipulation c
CVE-2017-15422 | International Components for Unicode up to 60.0 ucnv_UTF8FromUTF8 httpAcceptLanguage integer overflow (RHSA-2017:3401 / Nessus ID 110443)
A vulnerability was found in International Components for Unicode up to 60.0. It has been declared as critical. This affects the function ucnv_UTF8FromUTF8. The manipulation of the argument httpAcceptLanguage as part of HTML Page results in
CVE-2016-10739 | GNU C Library up to 2.28 IPv4 Address getaddrinfo input validation (RHSA-2019:2118 / Nessus ID 253661)
A vulnerability, which was classified as problematic, has been found in GNU C Library up to 2.28. Affected by this issue is the function getaddrinfo of the component IPv4 Address Handler. The manipulation leads to improper input validation.
CVE-2026-104643 | Easy HTTPS Redirection Plugin up to 2.0.1 on WordPress authorization (EUVD-2026-101850)
A vulnerability, which was classified as critical, has been found in Easy HTTPS Redirection Plugin up to 2.0.1 on WordPress. Impacted is an unknown function. The manipulation leads to missing authorization. This vulnerability is documented
CVE-2026-103304 | eaSYNC Booking Plugin up to 1.3.30 on WordPress AJAX Actions authorization (EUVD-2026-101849)
A vulnerability classified as critical was found in eaSYNC Booking Plugin up to 1.3.30 on WordPress. This issue affects some unknown processing of the component AJAX Actions. Executing a manipulation can lead to missing authorization. This
CVE-2026-74920 | Document Gallery Plugin up to 5.1.1 on WordPress cross site scripting (EUVD-2026-101853)
A vulnerability has been found in Document Gallery Plugin up to 5.1.1 on WordPress and classified as problematic. The impacted element is an unknown function. This manipulation causes cross site scripting. This vulnerability appears as CVE-
CVE-2026-109145 | User Rights Access Manager Plugin up to 1.1.3 on WordPress privileges management (EUVD-2026-101852)
A vulnerability, which was classified as critical, was found in User Rights Access Manager Plugin up to 1.1.3 on WordPress. The affected element is an unknown function. The manipulation results in improper privilege management. This vulnera
CVE-2026-106031 | Spin Wheel Plugin up to 2.2.0 on WordPress access control (EUVD-2026-101851)
A vulnerability described as critical has been identified in Spin Wheel Plugin up to 2.2.0 on WordPress. This affects an unknown part. Such manipulation leads to improper access controls. This vulnerability is listed as CVE-2026-106031. The
CVE-2026-96537 | Tutor LMS Plugin up to 4.1.0 on WordPress authorization (EUVD-2026-101854)
A vulnerability classified as critical has been found in Tutor LMS Plugin up to 4.1.0 on WordPress. This vulnerability affects unknown code. Performing a manipulation results in missing authorization. This vulnerability is cataloged as CVE-
CVE-2026-79833 | HPE NonStop ANSI SQLUTIL denial of service (EUVD-2026-102009)
A vulnerability was found in HPE NonStop ANSI SQLUTIL. It has been declared as critical. Affected by this issue is some unknown functionality. Such manipulation leads to denial of service. This vulnerability is listed as CVE-2026-79833. The
CVE-2026-96869 | Mozilla Firefox up to 140.16/153.3/156 Networking information disclosure (Nessus ID 366012 / WID-SEC-2026-3654)
A vulnerability, which was classified as problematic, has been found in Mozilla Firefox up to 140.16/153.3/156. The impacted element is an unknown function of the component Networking. Performing a manipulation results in information disclo
CVE-2026-100786 | Mozilla Firefox up to 115.41/140.16/153.3/156 Graphics use after free (Nessus ID 366012 / WID-SEC-2026-3654)
A vulnerability was found in Mozilla Firefox up to 115.41/140.16/153.3/156. It has been declared as critical. This impacts an unknown function of the component Graphics. The manipulation results in use after free. This vulnerability is cata
CVE-2026-100797 | Mozilla Firefox up to 115.41/140.16/153.3/156 WebRender use after free (Nessus ID 366012 / WID-SEC-2026-3654)
A vulnerability classified as critical has been found in Mozilla Firefox up to 115.41/140.16/153.3/156. Impacted is an unknown function of the component WebRender. This manipulation causes use after free. This vulnerability is handled as CV
CVE-2026-100779 | Mozilla Firefox up to 115.41/140.16/153.3/156 XSLT use after free (Nessus ID 366012 / WID-SEC-2026-3654)
A vulnerability, which was classified as critical, has been found in Mozilla Firefox up to 115.41/140.16/153.3/156. This issue affects some unknown processing of the component XSLT. This manipulation causes use after free. The identificatio
Drupal Field UI: Security-Team schließt kritischen RCE-Pfad (CVE-2026-108097)
LONDON (IT BOLTWISE) – Drupal schließt eine kritische Schwachstelle im Field-UI-Modul, die einen Angreifer zur Ausführung von Code auf dem Server nutzen könnte. Die Fixes wurden am 14. Oktober in mehreren Drupal-Versionen ausgeliefert, daru
Version 1.0: Cisco Secure Email Gateway - Zero-Day-Schwachstelle wird aktiv ausgenutzt
Weiterlesen
Resumo das Atualizações de Segurança da Microsoft – Outubro 2026, em português
YouTube VideoNosso mini-briefing de outubro traz uma visão geral da release de atualizações de segurança da Microsoft e a análise de alguns destaques do mês. 00:00 - Introdução 00:35 - Visão geral da release 04:40 - CVE-2026-96951 — Window
What’s old is new: Lightwell discovers novel zero-day vulnerability in core Java framework
Enterprise IT runs on decades-old foundational code. The prevailing assumption around these mature components is that if code has been sitting untouched in production for ten years without breaking, it must be safe. Libraries like the Eclip
Mysteriöse Sicherheitslücke: AMD-GPUs erhalten seltene vBIOS-Updates
Für ältere Grafikkarten der Radeon-RX-7000-Serie von AMD stehen aktuell vBIOS-Updates bereit. Sie sollen eine bisher nicht näher spezifizierte potenzielle Sicherheitslücke schließen. AMD rät Besitzern entsprechender Hardware zum zeitnahen U
Attackers exploit Palo Alto PAN-OS flaw for root access as CISA orders three-day fix
Attackers are exploiting a newly disclosed flaw in Palo Alto Networks’ PAN-OS firewall software to run code with root privileges, and US federal agencies have been ordered to fix it and check for compromise by October 17. Palo Alto Networks
CVE-2026-100777 | Mozilla Firefox up to 115.41/140.16/153.3/156 Canvas2D use after free (Nessus ID 366012 / WID-SEC-2026-3654)
A vulnerability classified as critical has been found in Mozilla Firefox up to 115.41/140.16/153.3/156. This affects an unknown part of the component Canvas2D. The manipulation leads to use after free. This vulnerability is uniquely identif
CVE-2026-100766 | Mozilla Firefox up to 115.41/140.16/153.3/156 JAR information disclosure (Nessus ID 366012 / WID-SEC-2026-3654)
A vulnerability was found in Mozilla Firefox up to 115.41/140.16/153.3/156 and classified as problematic. Affected by this issue is some unknown functionality of the component JAR. The manipulation results in information disclosure. This vu