Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 744 | 0,2 % |
| ≥50 % | 3.220 | 0,8 % |
| ≥10 % | 22.083 | 5,8 % |
| <10 % | 354.682 | 93,2 % |
CVE-2026-117877 | Mozilla Firefox up to 153.5/158 Layout Text/Fonts use after free (Nessus ID 373648)
A vulnerability was found in Mozilla Firefox up to 153.5/158 and classified as critical. This affects an unknown part of the component Layout Text/Fonts. The manipulation results in use after free. This vulnerability is reported as CVE-2026
CVE-2026-117876 | Mozilla Firefox up to 115.43/153.5/158 Layout use after free (Nessus ID 373648)
A vulnerability, which was classified as critical, has been found in Mozilla Firefox up to 115.43/153.5/158. Affected is an unknown function of the component Layout. Performing a manipulation results in use after free. This vulnerability is
CVE-2026-117874 | Mozilla Firefox up to 115.43/153.5/158 Internationalization use after free (Nessus ID 373648)
A vulnerability has been found in Mozilla Firefox up to 115.43/153.5/158 and classified as critical. Affected by this issue is some unknown functionality of the component Internationalization. The manipulation leads to use after free. This
CVE-2026-117873 | Mozilla Firefox up to 115.43/153.5/158 Audio Video Playback array index (Nessus ID 373648)
A vulnerability classified as critical was found in Mozilla Firefox up to 115.43/153.5/158. This impacts an unknown function of the component Audio Video Playback. Such manipulation leads to improper validation of array index. This vulnerab
CVE-2026-117872 | Mozilla Firefox up to 115.43/153.5/158 JavaScript use after free (Nessus ID 373648)
A vulnerability classified as critical has been found in Mozilla Firefox up to 115.43/153.5/158. This affects an unknown function of the component JavaScript. This manipulation causes use after free. This vulnerability is tracked as CVE-202
CVE-2026-117871 | Mozilla Firefox up to 153.5/158 Graphics memory corruption (Nessus ID 373648)
A vulnerability labeled as critical has been found in Mozilla Firefox up to 153.5/158. Impacted is an unknown function of the component Graphics Component. Executing a manipulation can lead to memory corruption. The identification of this v
CVE-2022-48126 | TOTOLINK A7100RU 7.4cu.2313_B20191024 Setting setOpenVpnCertGenerationCfg username command injection (EUVD-2022-50838)
A vulnerability, which was classified as critical, has been found in TOTOLINK A7100RU 7.4cu.2313_B20191024. This affects the function setOpenVpnCertGenerationCfg of the component Setting Handler. Performing a manipulation of the argument Us
CVE-2022-48125 | TOTOLINK A7100RU 7.4cu.2313_B20191024 Setting setOpenVpnCertGenerationCfg password command injection (EUVD-2022-50837)
A vulnerability classified as critical was found in TOTOLINK A7100RU 7.4cu.2313_B20191024. Affected by this issue is the function setOpenVpnCertGenerationCfg of the component Setting Handler. Such manipulation of the argument Password leads
CVE-2022-48124 | TOTOLINK A7100RU 7.4cu.2313_B20191024 Setting setOpenVpnCertGenerationCfg FileName command injection (EUVD-2022-50836)
A vulnerability classified as critical has been found in TOTOLINK A7100RU 7.4cu.2313_B20191024. Affected by this vulnerability is the function setOpenVpnCertGenerationCfg of the component Setting Handler. This manipulation of the argument F
CVE-2026-92092 | Red Hat OpenShift Container Platform openshift-ansible channel accessible (EUVD-2026-113354)
A vulnerability was found in Red Hat OpenShift Container Platform. It has been rated as critical. Affected is an unknown function of the component openshift-ansible. Performing a manipulation results in channel accessible by non-endpoint. T
CVE-2026-51832 | IDrive Backup up to 7.0.1.1 id_service.exe os command injection (EUVD-2026-113367)
A vulnerability was found in IDrive Backup up to 7.0.1.1. It has been classified as problematic. This affects an unknown function of the file id_service.exe. This manipulation causes os command injection. This vulnerability is registered as
CVE-2026-51831 | IDrive Backup for Windows up to 7.0.1.1 id_service.exe os command injection (EUVD-2026-113368)
A vulnerability was found in IDrive Backup for Windows up to 7.0.1.1 and classified as problematic. The impacted element is an unknown function of the file id_service.exe. The manipulation results in os command injection. This vulnerability
CVE-2026-119325 | Bricks Theme Plugin up to 2.4.0 Popup Content load_popup_content popupId access control (EUVD-2026-113376)
A vulnerability was found in Bricks Theme Plugin up to 2.4.0. It has been rated as problematic. This affects an unknown part of the file /wp-json/bricks/v1/load_popup_content of the component Popup Content. The manipulation of the argument
CVE-2026-13303 | HashiCorp Boundary prior 1.0.2/0.21.6 Vault Credential Store Integration server-side request forgery (EUVD-2026-113390)
A vulnerability, which was classified as problematic, has been found in HashiCorp Boundary. Affected is an unknown function of the component Vault Credential Store Integration. This manipulation causes server-side request forgery. The ident
CVE-2026-119284 | authlib joserfc up to 1.7.5 Compact JWS Deserialization deserialize_compact allocation of resources (EUVD-2026-113401)
A vulnerability classified as problematic was found in authlib joserfc up to 1.7.5. Affected by this issue is the function deserialize_compact of the component Compact JWS Deserialization. Such manipulation leads to allocation of resources.
CVE-2026-119285 | Gofiber Fiber up to 2.52.2 CORS Middleware middleware/cors/utils.go cross-domain policy (EUVD-2026-113402)
A vulnerability, which was classified as problematic, has been found in Gofiber Fiber up to 2.52.2. This affects an unknown part of the file middleware/cors/utils.go of the component CORS Middleware. Performing a manipulation results in per
CVE-2026-115943 | Spreadsheet::XLSX up to 0.18 ExcelFmt os command injection (EUVD-2026-113403)
A vulnerability classified as critical has been found in Spreadsheet::XLSX up to 0.18. Affected by this vulnerability is an unknown functionality of the component ExcelFmt. This manipulation causes os command injection. This vulnerability i
CVE-2026-119286 | graphql-python graphql-core up to 3.3.0 Validation Error validate resource consumption (EUVD-2026-113404)
A vulnerability described as problematic has been identified in graphql-python graphql-core up to 3.3.0. Affected is the function validate of the component Validation Error Handler. The manipulation results in resource consumption. This vul
CVE-2026-9268 | GitLab up to 19.2.7/19.3.4/19.4.1 CI/CD Deployment Rollback Settings privileges management (WID-SEC-2026-3858)
A vulnerability was found in GitLab up to 19.2.7/19.3.4/19.4.1. It has been classified as problematic. The impacted element is an unknown function of the component CI/CD Deployment Rollback Settings. This manipulation causes improper privil
CVE-2026-82632 | GitLab up to 19.2.7/19.3.4/19.4.1 Import improper authorization (WID-SEC-2026-3858)
A vulnerability, which was classified as problematic, was found in GitLab up to 19.2.7/19.3.4/19.4.1. This issue affects some unknown processing of the component Import. Executing a manipulation can lead to improper authorization. The ident
CVE-2025-34253 | D-Link Nuclias Connect up to 1.3.1.4 Network cross site scripting (EUVD-2025-34830)
A vulnerability identified as problematic has been detected in D-Link Nuclias Connect up to 1.3.1.4. Impacted is an unknown function. The manipulation of the argument Network leads to cross site scripting. This vulnerability is listed as CV
CVE-2025-34108 | Falconstor Disk Pulse Enterprise 9.0.34 HTTP POST Request /login username stack-based overflow (EDB-40452)
A vulnerability classified as critical has been found in Falconstor Disk Pulse Enterprise 9.0.34. The affected element is an unknown function in the library libspp.dll of the file /login of the component HTTP POST Request Handler. This mani
CVE-2024-58300 | Siklu MultiHaul TG 1.x Network Request missing authentication (Exploit 51932 / EDB-51932)
A vulnerability was found in Siklu MultiHaul TG 1.x. It has been declared as critical. This affects an unknown function of the component Network Request Handler. Executing a manipulation can lead to missing authentication. This vulnerabilit
CVE-2024-58296 | PhoenixCart CE Phoenix 1.0.8.20 Administration Panel title cross site scripting (Exploit 52015 / EDB-52015)
A vulnerability was found in PhoenixCart CE Phoenix 1.0.8.20. It has been declared as problematic. Affected by this issue is some unknown functionality of the component Administration Panel. Such manipulation of the argument Title leads to
CVE-2024-22047 | Audited up to 5.3.3 Audit Log race condition (ID 601 / EUVD-2023-1560)
A vulnerability categorized as problematic has been discovered in Audited up to 5.3.3. Affected by this issue is some unknown functionality of the component Audit Log Handler. Executing a manipulation can lead to race condition. This vulner
CVE-2023-53937 | Hubstaff 1.6.13/1.6.14 wow64log.dll uncontrolled search path (Exploit 51461 / EDB-51461)
A vulnerability labeled as problematic has been found in Hubstaff 1.6.13/1.6.14. Impacted is an unknown function in the library wow64log.dll. The manipulation results in uncontrolled search path. This vulnerability is reported as CVE-2023-5
CVE-2023-53907 | Bludit up to 3.13.0 path traversal (Exploit 51541 / EDB-51541)
A vulnerability marked as critical has been reported in Bludit up to 3.13.0. This vulnerability affects unknown code. Performing a manipulation results in path traversal. This vulnerability is identified as CVE-2023-53907. The attack can be
CVE-2026-25439 | fs-code Booknetic Plugin up to 4.8.5 on WordPress authentication bypass
A vulnerability has been found in fs-code Booknetic Plugin up to 4.8.5 on WordPress and classified as critical. Affected by this vulnerability is an unknown functionality. This manipulation causes authentication bypass using alternate chann
CVE-2023-31317 | AMD Instinct MI210 memory corruption
A vulnerability classified as critical was found in AMD Radeon RX 6000 Graphics Products, Radeon RX 7000 Graphics Products, Radeon PRO W7000 Graphics Products, Radeon PRO W6000 Graphics Products, Instinct MI250 and Instinct MI210. Affected
CVE-2023-31316 | AMD Radeon PRO V620 Configuration hardware configuration state
A vulnerability, which was classified as problematic, has been found in AMD Ryzen 5000 Mobile Processors with Radeon Graphics, Ryzen 7000 Desktop Processors, Ryzen 4000 Desktop Processors, Ryzen 5000 Desktop Processors with Radeon Graphics,
CVE-2023-31309 | AMD Radeon PRO V620 Power Management Firmware array index
A vulnerability was found in AMD Radeon RX 6000 Graphics Products, Radeon PRO W6000 Graphics Products, Radeon PRO V520 and Radeon PRO V620 and classified as problematic. Impacted is an unknown function of the component Power Management Firm
CVE-2023-30059 | MK-Auth up to 23.01K4.9 GET chamado resource injection
A vulnerability, which was classified as critical, was found in MK-Auth up to 23.01K4.9. Affected by this issue is some unknown functionality of the component GET Handler. The manipulation of the argument chamado results in improper control
CVE-2026-115415 – Secret masking bypass in the environment tool in Strands Agents Tools
Bulletin ID: 2026-154-AWS Publication Date: 10/28/2026 12:30 PM PDT Description: We identified CVE-2026-115415, an issue where the environment tool accepted a masking parameter from the large language model (LLM) through its tool schema. A
CVE-2026-81839 | GitLab up to 19.2.7/19.3.4/19.4.1 Pipeline Execution Policy privileges management (WID-SEC-2026-3858)
A vulnerability classified as critical was found in GitLab up to 19.2.7/19.3.4/19.4.1. This affects an unknown part of the component Pipeline Execution Policy. Such manipulation leads to improper privilege management. This vulnerability is
CVE-2026-78335 | GitLab up to 19.2.7/19.3.4/19.4.1 Integrations improper authorization (WID-SEC-2026-3858)
A vulnerability classified as critical has been found in GitLab up to 19.2.7/19.3.4/19.4.1. Affected by this issue is some unknown functionality of the component Integrations. This manipulation causes improper authorization. This vulnerabil
CVE-2026-7767 | GitLab up to 19.2.7/19.3.4/19.4.1 Kubernetes Proxy redirect (WID-SEC-2026-3858)
A vulnerability described as problematic has been identified in GitLab up to 19.2.7/19.3.4/19.4.1. Affected by this vulnerability is an unknown functionality of the component Kubernetes Proxy. The manipulation results in open redirect. This
CVE-2026-6567 | GitLab up to 19.2.7/19.3.4/19.4.1 improper authorization (WID-SEC-2026-3858)
A vulnerability marked as problematic has been reported in GitLab up to 19.2.7/19.3.4/19.4.1. Affected is an unknown function. The manipulation leads to improper authorization. This vulnerability is traded as CVE-2026-6567. It is possible t
CVE-2026-5954 | GitLab 15.1/19.2.7/19.3.4/19.4.1 improper authorization (WID-SEC-2026-3858)
A vulnerability identified as problematic has been detected in GitLab 15.1/19.2.7/19.3.4/19.4.1. This affects an unknown function. Performing a manipulation results in improper authorization. This vulnerability is reported as CVE-2026-5954.
CVE-2026-16301 | GitLab up to 19.2.7/19.3.4/19.4.1 Downstream Pipeline Creation Service improper authorization (WID-SEC-2026-3858)
A vulnerability labeled as critical has been found in GitLab up to 19.2.7/19.3.4/19.4.1. This impacts an unknown function of the component Downstream Pipeline Creation Service. Executing a manipulation can lead to improper authorization. Th
CVE-2026-97229 | GitLab up to 19.2.7/19.3.4/19.4.1 Regular Expression Validation incorrect regex
A vulnerability categorized as critical has been discovered in GitLab up to 19.2.7/19.3.4/19.4.1. Affected is an unknown function of the component Regular Expression Validation. Executing a manipulation can lead to incorrect regular express
CVE-2026-76418 | Cisco Secure Firewall Adaptive Security Appliance Remote Access SSL VPN service denial of service
A vulnerability described as critical has been identified in Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense. Impacted is an unknown function of the component Remote Access SSL VPN service. The manipulat
CVE-2026-16275 | GitLab up to 19.2.7/19.3.4/19.4.1 improper authorization (WID-SEC-2026-3858)
A vulnerability categorized as problematic has been discovered in GitLab up to 19.2.7/19.3.4/19.4.1. The impacted element is an unknown function. Such manipulation leads to improper authorization. This vulnerability is documented as CVE-202
CVE-2026-14814 | GitLab up to 19.2.7/19.3.4/19.4.1 CI/CD Pipeline input validation (WID-SEC-2026-3858)
A vulnerability was found in GitLab up to 19.2.7/19.3.4/19.4.1. It has been declared as problematic. Impacted is an unknown function of the component CI/CD Pipeline. The manipulation results in improper input validation. This vulnerability
CVE-2026-14552 | GitLab up to 19.2.7/19.3.4/19.4.1 Epic improper authorization (WID-SEC-2026-3858)
A vulnerability was found in GitLab up to 19.2.7/19.3.4/19.4.1. It has been rated as problematic. The affected element is an unknown function of the component Epic. This manipulation causes improper authorization. This vulnerability is regi
CVE-2026-105458 | GitLab up to 19.2.7/19.3.4/19.4.1 Duo Agent Platform permission (WID-SEC-2026-3858)
A vulnerability was found in GitLab up to 19.2.7/19.3.4/19.4.1 and classified as problematic. This vulnerability affects unknown code of the component Duo Agent Platform. Executing a manipulation can lead to permission issues. This vulnerab
CVE-2026-104661 | GitLab up to 19.2.7/19.3.4/19.4.1 Compliance Pipeline permission (WID-SEC-2026-3858)
A vulnerability, which was classified as problematic, was found in GitLab up to 19.2.7/19.3.4/19.4.1. Affected by this issue is some unknown functionality of the component Compliance Pipeline. Such manipulation leads to permission issues. T
CVE-2026-100104 | GitLab up to 19.2.7/19.3.4/19.4.1 URL Validation race condition (WID-SEC-2026-3858)
A vulnerability has been found in GitLab up to 19.2.7/19.3.4/19.4.1 and classified as critical. This affects an unknown part of the component URL Validation. Performing a manipulation results in race condition. This vulnerability is identif
HTTP2Shell - Brotli-Sicherheitslücke geht über Node.js hinaus - Netzpalaver
Cybersecurity-Gefahr - anfälliger Brotli-Code könnte auch in anderen Laufzeiten, Paketen, HTTP2Shell tauchte kurz nach PHP2Shell auf, doch die ... Weiterlesen
CVE-2024-53326 | LINQPad up to 5.52.0 PopulateFromCache deserialization
A vulnerability labeled as problematic has been found in LINQPad up to 5.52.0. This issue affects the function LINQPad.AutoRefManager::PopulateFromCache. Such manipulation leads to deserialization. This vulnerability is documented as CVE-20
CVE-2024-51092 | LibreNMS up to 24.9.x AboutController.php index os command injection
A vulnerability, which was classified as critical, has been found in LibreNMS up to 24.9.x. The affected element is the function index of the file AboutController.php. The manipulation leads to os command injection. This vulnerability is un
CVE-2024-46508 | yeti-platform yeti up to 2.1.11 hard-coded key
A vulnerability identified as problematic has been detected in yeti-platform yeti up to 2.1.11. This vulnerability affects unknown code. This manipulation causes use of hard-coded cryptographic key . This vulnerability is registered as CVE-
CVE-2024-46507 | yeti-platform yeti up to 2.1.11 special elements in template engine
A vulnerability was found in yeti-platform yeti up to 2.1.11. It has been rated as critical. Affected by this issue is some unknown functionality. The manipulation leads to improper neutralization of special elements used in a template engi
CVE-2024-45257 | BYOB 2.0 Payload Build Page core/generators.py build command injection
A vulnerability was found in BYOB 2.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file core/generators.py of the component Payload Build Page. Executing a manipulation of the argument
CVE-2024-33724 | SOPlanning 1.52.00 process/groupe_save.php groupe_id cross site scripting
A vulnerability categorized as problematic has been discovered in SOPlanning 1.52.00. This affects an unknown part of the file process/groupe_save.php. The manipulation of the argument groupe_id results in cross site scripting. This vulnera
CVE-2024-33722 | SOPlanning 1.52.00 projets.php statut[] sql injection
A vulnerability was found in SOPlanning 1.52.00 and classified as critical. This impacts an unknown function of the file projets.php. Such manipulation of the argument statut[] leads to sql injection. This vulnerability is referenced as CVE
CVE-2024-33288 | Prison Management System 1.0 Admin Login Page username sql injection
A vulnerability, which was classified as critical, was found in Prison Management System 1.0. The impacted element is an unknown function of the component Admin Login Page. The manipulation of the argument Username results in sql injection.
CVE-2024-27686 | MikroTik RouterOS 5.0/6.44/6.49.10 SMB Request denial of service (ID 177811)
A vulnerability described as problematic has been identified in MikroTik RouterOS 5.0/6.44/6.49.10. Affected by this issue is some unknown functionality of the component SMB Request Handler. The manipulation results in denial of service. Th
CVE-2023-46453 | GL.iNet Device 4.3.7 incorrect regex (Exploit 51865)
A vulnerability, which was classified as very critical, was found in GL.iNet Device 4.3.7. Affected is an unknown function. Such manipulation leads to incorrect regular expression. This vulnerability is uniquely identified as CVE-2023-46453
CVE-2023-27753 | MK-Auth 23.01K4.9 PHP File unrestricted upload
A vulnerability classified as critical was found in MK-Auth 23.01K4.9. Affected is an unknown function of the component PHP File Handler. Executing a manipulation can lead to unrestricted upload. This vulnerability is handled as CVE-2023-27
USN-8958-1: .NET vulnerabilities
It was discovered that the .NET Blazor WebAssembly debug proxy did not properly escape certain values. An attacker could possibly use this issue to execute arbitrary code. The fix for this CVE was originally released via USN-8942-1, but it