Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 785 | 0,2 % |
| ≥50 % | 3.561 | 0,9 % |
| ≥10 % | 13.151 | 3,2 % |
| <10 % | 396.058 | 95,8 % |
Barracuda Email Security Gateway Flaws Allow Unauthenticated Attackers to Execute Commands as Root
Two critical security vulnerabilities in Barracuda Email Security Gateway (ESG) could let unauthenticated attackers bypass authentication and run operating system commands as root. The vulnerabilities, tracked as CVE-2026-116606 and CVE-202
Chrome Update Patches Exploited XML Zero-Day, Eighth This Year
The high-severity use-after-free in Chrome’s XML component was reported anonymously on November 6 and is already exploited in attacks. This article has been indexed from SecurityWeek Read the original article: Chrome Update Patches Exploite
CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added four security flaws impacting GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex to its Known Exploited Vulnerabilities (KEV) catalog, cit
CVE-2026-43277 | Linux Kernel up to 6.19.5 ghes_new buffer overflow
A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.19.5. Affected by this vulnerability is the function ghes_new. This manipulation causes buffer overflow. This vulnerability is tracked as CVE-2026-432
CVE-2026-43267 | Linux Kernel up to 6.18.15/6.19.5 wifi divide by zero
A vulnerability classified as critical has been found in Linux Kernel up to 6.18.15/6.19.5. This affects an unknown function of the component wifi. Performing a manipulation results in divide by zero. This vulnerability is cataloged as CVE-
CVE-2026-26083 | Fortinet FortiSandbox Cloud/FortiSandbox/FortiSandbox PaaS up to 4.4.8/5.0.1 HTTP Request authorization (FG-IR-26-136)
A vulnerability identified as critical has been detected in Fortinet FortiSandbox Cloud, FortiSandbox and FortiSandbox PaaS up to 4.4.8/5.0.1. Affected by this vulnerability is an unknown functionality of the component HTTP Request Handler.
CVE-2026-14543 | Axis Communications AB AXIS OS up to 12.11.83/13.0.41 VAPIX Edge Storage API privileges management (EUVD-2026-120772)
A vulnerability was found in Axis Communications AB AXIS OS up to 12.11.83/13.0.41 and classified as problematic. Impacted is an unknown function of the component VAPIX Edge Storage API. Executing a manipulation can lead to improper privile
CVE-2026-14542 | Axis Communications AB Axis OS up to 10.12.351/11.11.227/12.11.122/13.0.82 VAPIX SIP configuration API input validation (EUVD-2026-120771)
A vulnerability was found in Axis Communications AB Axis OS up to 10.12.351/11.11.227/12.11.122/13.0.82. It has been rated as critical. This affects an unknown function of the component VAPIX SIP configuration API. This manipulation causes
CVE-2026-63288 | Axis Communications AB AXIS A1810 improper authorization (EUVD-2026-120775)
A vulnerability classified as very critical has been found in Axis Communications AB AXIS A1210, AXIS A1601, AXIS A1610, AXIS A1710 and AXIS A1810. This vulnerability affects unknown code. This manipulation causes improper authorization. Th
CVE-2026-63282 | Axis Communications Axis OS up to 13.0.83 command injection (EUVD-2026-120773)
A vulnerability was found in Axis Communications Axis OS up to 13.0.83. It has been classified as problematic. The affected element is an unknown function. The manipulation leads to command injection. This vulnerability is documented as CVE
CVE-2026-14918 | Axis Communications Signed Video Framework out-of-bounds (EUVD-2026-120774)
A vulnerability was found in Axis Communications Signed Video Framework, Signed Media Verifier and Axis File Player. It has been declared as problematic. The impacted element is an unknown function. The manipulation results in out-of-bounds
CVE-2026-8372 | Axis Communications AB AXIS Camera Station Pro up to 6.17 improper authorization (EUVD-2026-120777)
A vulnerability, which was classified as critical, has been found in Axis Communications AB AXIS Camera Station Pro up to 6.17. Impacted is an unknown function. Performing a manipulation results in improper authorization. This vulnerability
CVE-2026-4762 | Axis Communications AB AXIS Camera Station Pro up to 6.17 privileges management (EUVD-2026-120776)
A vulnerability classified as very critical was found in Axis Communications AB AXIS Camera Station Pro up to 6.17. This issue affects some unknown processing. Such manipulation leads to improper privilege management. This vulnerability is
Chrome Update Patches Exploited XML Zero-Day, Eighth This Year
The high-severity use-after-free in Chrome’s XML component was reported anonymously on November 6 and is already exploited in attacks. The post Chrome Update Patches Exploited XML Zero-Day, Eighth This Year appeared first on SecurityWeek. W
Apple-Schwachstelle von 2024 in Angriffskampagne eingesetzt
Eine aktuell Spionagekampagne kombiniert eine 2024 behobene Apple-Schwachstelle mit einem weiteren WebKit-Fehler, um Cookies auf ungepatchten iPhones zu stehlen. Ein Zusammenhang mit den jüngsten Warnungen zur „Mercenary Spyware“ ist nicht
Google Fixes Actively Exploited Chrome Zero-Day Vulnerability in Emergency Security Update
Google released a Chrome security update that addresses nine security flaws, including an actively exploited zero-day in its XML component. Published November 9, 2026, the Stable channel release patches CVE-2026-125350, a high-severity memo
CVE-2026-8810 | Insyde H2O up to 05.63.20/05.72.20 HDD Password information disclosure (EUVD-2026-62294 / WID-SEC-2026-3254)
A vulnerability, which was classified as problematic, was found in Insyde H2O up to 05.63.20/05.72.20. The impacted element is an unknown function of the component HDD Password. The manipulation results in information disclosure. This vulne
CVE-2026-76235 | Red Hat Enterprise Linux/OpenShift Dev Spaces 7/8/9/10 cockpit-ws CockpitLang memory leak
A vulnerability was found in Red Hat Enterprise Linux and OpenShift Dev Spaces 7/8/9/10. It has been classified as critical. This affects an unknown function of the component cockpit-ws. Performing a manipulation of the argument CockpitLang
CVE-2026-76166 | Red Hat Enterprise Application Platform Advertise Listener AdvertiseListenerImpl.java verifyDigest comparison (EUVD-2026-62367)
A vulnerability was found in Red Hat Enterprise Application Platform, Enterprise Application Platform Expansion Pack, Web Server and Single Sign-On. It has been rated as problematic. This issue affects the function verifyDigest of the file
CVE-2026-75981 | Cozmos Labs TranslatePress Plugin up to 3.2.5 on WordPress class-translation-render.php translate_page cross site scripting
A vulnerability has been found in Cozmos Labs TranslatePress Plugin up to 3.2.5 on WordPress and classified as problematic. This affects the function translate_page of the file includes/class-translation-render.php. This manipulation causes
CVE-2026-75900 | Red Hat Enterprise Linux NVRAM SWTPM_NVRAM_CheckHeader out-of-bounds (EUVD-2026-62363)
A vulnerability has been found in Red Hat Enterprise Linux and classified as problematic. Affected by this vulnerability is the function SWTPM_NVRAM_CheckHeader of the component NVRAM. Performing a manipulation results in out-of-bounds read
CVE-2026-72868 | Dokploy up to 0.29.12 Destination Router destination.ts child_process.exec privileges management (EUVD-2026-55726)
A vulnerability marked as very critical has been reported in Dokploy up to 0.29.12. This issue affects the function child_process.exec of the file apps/dokploy/server/api/routers/destination.ts of the component Destination Router. This mani
CVE-2026-49431 | FreeBSD ZFS up to p0.x/p6/p10/p15 ZFS_IOC_SET_PROP hasrecvd improper authorization
A vulnerability was found in FreeBSD ZFS up to p0.x/p6/p10/p15. It has been classified as problematic. Affected by this vulnerability is the function ZFS_IOC_SET_PROP. This manipulation of the argument hasrecvd causes improper authorization
CVE-2026-49430 | FreeBSD ZFS up to p0.x/p6/p10/p15 Heal Receive Path ZFS_IOC_RECV_NEW memory corruption
A vulnerability was found in FreeBSD ZFS up to p0.x/p6/p10/p15 and classified as critical. Affected is the function ZFS_IOC_RECV_NEW of the component Heal Receive Path. The manipulation results in memory corruption. This vulnerability is id
CVE-2026-49429 | FreeBSD ZFS up to p0.x/p6/p10/p15 ZFS_IOC_USERSPACE_MANY heap-based overflow
A vulnerability has been found in FreeBSD ZFS up to p0.x/p6/p10/p15 and classified as critical. This impacts the function ZFS_IOC_USERSPACE_MANY. The manipulation leads to heap-based buffer overflow. This vulnerability is referenced as CVE-
CVE-2026-49428 | FreeBSD Kernel up to p0.x/p6/p10/p15 Largepage Objects open/fspacectl O_TRUNC privileges management
A vulnerability has been found in FreeBSD Kernel up to p0.x/p6/p10/p15 and classified as very critical. Affected is the function open/fspacectl of the component Largepage Objects. This manipulation of the argument O_TRUNC causes improper pr
CVE-2026-49423 | FreeBSD Kernel up to p0.x/p6/p10/p15 Ktls Ocf ktls_ocf_tls_cbc_decrypt uninitialized resource
A vulnerability was found in FreeBSD Kernel up to p0.x/p6/p10/p15. It has been declared as critical. Affected by this vulnerability is the function ktls_ocf_tls_cbc_decrypt of the component Ktls Ocf. Executing a manipulation can lead to uni
CVE-2026-19489 | Citrix ADC/Gateway up to 14.1/73.32/13.1/63.21 buffer overflow (Nessus ID 338328)
A vulnerability classified as very critical has been found in Citrix ADC and Gateway up to 14.1/73.32/13.1/63.21. Affected is an unknown function. This manipulation causes buffer overflow. This vulnerability is tracked as CVE-2026-19489. Th
CVE-2026-15780 | Veronalabs WP Statistics Plugin up to 14.16.8 on WordPress REST Endpoint /wp-statistics/v2/hit utm_campaign cross site scripting
A vulnerability was found in Veronalabs WP Statistics Plugin up to 14.16.8 on WordPress and classified as problematic. This impacts an unknown function of the file /wp-statistics/v2/hit of the component REST Endpoint. Such manipulation of t
CVE-2026-15446 | nosilver4u EWWW Image Optimizer Plugin up to 8.7.3 on WordPress Unveilhooks Addon data-script cross site scripting
A vulnerability was found in nosilver4u EWWW Image Optimizer Plugin up to 8.7.3 on WordPress. It has been classified as problematic. Affected is an unknown function of the component Unveilhooks Addon. Performing a manipulation of the argume
CVE-2026-5745 | libarchive ACL Parser archive_acl_from_text_nl null pointer dereference
A vulnerability was found in libarchive and classified as problematic. Impacted is the function archive_acl_from_text_nl of the component ACL Parser. The manipulation results in null pointer dereference. This vulnerability is known as CVE-2
CVE-2026-43262 | Linux Kernel up to 6.19.5 gfs2_fiemap memory corruption
A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.19.5. Impacted is the function gfs2_fiemap. Performing a manipulation results in memory corruption. This vulnerability is cataloged as CVE-2026-43262.
CVE-2026-43259 | Linux Kernel up to 6.18.15/6.19.5 phy platform_set_drvdata privilege escalation
A vulnerability classified as critical was found in Linux Kernel up to 6.18.15/6.19.5. This issue affects the function platform_set_drvdata of the component phy. Such manipulation leads to privilege escalation. This vulnerability is listed
CVE-2026-43257 | Linux Kernel up to 6.19.5 media snd_cx88_hw_params release of resource
A vulnerability categorized as critical has been discovered in Linux Kernel up to 6.19.5. This affects the function snd_cx88_hw_params of the component media. Such manipulation leads to missing release of resource. This vulnerability is lis
CVE-2026-49427 | FreeBSD up to p0.x/p6/p10/p15 Shared Memory sendfile privileges management
A vulnerability was found in FreeBSD up to p0.x/p6/p10/p15 and classified as very critical. Affected by this vulnerability is the function sendfile of the component Shared Memory. Such manipulation leads to improper privilege management. Th
CVE-2026-49426 | FreeBSD Kernel up to p0.x/p6/p10/p15 Audit AUDIT_SYSCALL_EXIT return value
A vulnerability labeled as problematic has been found in FreeBSD Kernel up to p0.x/p6/p10/p15. The affected element is the function AUDIT_SYSCALL_EXIT of the component Audit. Such manipulation leads to unchecked return value. This vulnerabi
CVE-2026-49422 | FreeBSD Kernel up to p0.x/p6/p10/p15 RACK setsockopt use after free
A vulnerability was found in FreeBSD Kernel up to p0.x/p6/p10/p15. It has been declared as very critical. Affected is the function setsockopt of the component RACK. Such manipulation leads to use after free. This vulnerability is referenced
CVE-2026-49421 | FreeBSD Kernel up to p0.x/p6/p10/p15 Path Resolution unlinkat/funlinkat AT_RESOLVE_BENEATH access control
A vulnerability was found in FreeBSD Kernel up to p0.x/p6/p10/p15. It has been classified as very critical. This impacts the function unlinkat/funlinkat of the component Path Resolution. This manipulation of the argument AT_RESOLVE_BENEATH
CVE-2026-49420 | FreeBSD libalias up to p0.x/p6/p10/p15 RTSP stack-based overflow
A vulnerability was found in FreeBSD libalias up to p0.x/p6/p10/p15 and classified as very critical. This affects an unknown function of the component RTSP Handler. The manipulation results in stack-based buffer overflow. This vulnerability
CVE-2026-19842 | SAML Single Sign On Plugin up to 5.4.6 on WordPress improper authentication (EUVD-2026-62293)
A vulnerability described as critical has been identified in SAML Single Sign On Plugin up to 5.4.6 on WordPress. This vulnerability affects unknown code. Such manipulation leads to improper authentication. This vulnerability is listed as C
CVE-2026-19782 | WPS Bidouille Plugin up to 1.33.4 on WordPress information disclosure (EUVD-2026-62292)
A vulnerability marked as problematic has been reported in WPS Bidouille Plugin up to 1.33.4 on WordPress. This affects an unknown part. This manipulation causes information disclosure. This vulnerability is tracked as CVE-2026-19782. The a
CVE-2026-19417 | KiviCare Plugin up to 4.5.3 on WordPress authorization (EUVD-2026-62290)
A vulnerability labeled as problematic has been found in KiviCare Plugin up to 4.5.3 on WordPress. Affected by this issue is some unknown functionality. The manipulation results in authorization bypass. This vulnerability is identified as C
CVE-2026-19416 | KiviCare Plugin up to 4.5.3 on WordPress authorization
A vulnerability identified as critical has been detected in KiviCare Plugin up to 4.5.3 on WordPress. Affected by this vulnerability is an unknown functionality. The manipulation leads to authorization bypass. This vulnerability is referenc
CVE-2026-18937 | Broken Link Checker Plugin up to 2.4.11 on WordPress code injection
A vulnerability was found in Broken Link Checker Plugin up to 2.4.11 on WordPress. It has been declared as critical. This affects an unknown part. Executing a manipulation can lead to code injection. The identification of this vulnerability
CVE-2026-18779 | TrueBooker Plugin up to 1.2.6 on WordPress authorization
A vulnerability was found in TrueBooker Plugin up to 1.2.6 on WordPress. It has been rated as critical. This impacts an unknown function. Performing a manipulation results in missing authorization. This vulnerability was named CVE-2026-1877
CVE-2026-18778 | TrueBooker Plugin up to 1.2.6 on WordPress information disclosure
A vulnerability was found in TrueBooker Plugin up to 1.2.6 on WordPress. It has been declared as problematic. This affects an unknown function. Such manipulation leads to information disclosure. This vulnerability is uniquely identified as
CVE-2026-100225 | Microsoft Windows up to Server 2025 Storage buffer overflow (WID-SEC-2026-3892)
A vulnerability was found in Microsoft Windows. It has been declared as very critical. This impacts an unknown function of the component Storage. Executing a manipulation can lead to buffer overflow. This vulnerability is handled as CVE-202
CVE-2026-100222 | Microsoft Windows up to Server 2025 Network Policy Server buffer overflow (WID-SEC-2026-3892)
A vulnerability labeled as very critical has been found in Microsoft Windows. Affected is an unknown function of the component Network Policy Server. The manipulation results in buffer overflow. This vulnerability is identified as CVE-2026-
CVE-2026-100220 | Microsoft Windows up to Server 2025 Media Video Decoder heap-based overflow (WID-SEC-2026-3892)
A vulnerability marked as very critical has been reported in Microsoft Windows. Affected by this vulnerability is an unknown functionality of the component Media Video Decoder. This manipulation causes heap-based buffer overflow. This vulne
CVE-2026-100219 | Microsoft Windows up to Server 2025 QUIC use after free (WID-SEC-2026-3892)
A vulnerability was found in Microsoft Windows up to Server 2025. It has been classified as very critical. Impacted is an unknown function of the component QUIC. This manipulation causes use after free. This vulnerability is handled as CVE-
CVE-2026-100218 | Microsoft Windows up to Server 2025 Remote Desktop Gateway Service use after free (WID-SEC-2026-3892)
A vulnerability categorized as very critical has been discovered in Microsoft Windows. This affects an unknown function of the component Remote Desktop Gateway Service. Executing a manipulation can lead to use after free. The identification
CVE-2026-100217 | Microsoft Windows up to Server 2025 Group Policy privileges management (WID-SEC-2026-3892)
A vulnerability was found in Microsoft Windows. It has been classified as very critical. This affects an unknown function of the component Group Policy. Performing a manipulation results in improper privilege management. This vulnerability
CVE-2026-100216 | Microsoft Windows up to Server 2025 buffer overflow (WID-SEC-2026-3892)
A vulnerability was found in Microsoft Windows up to Server 2025 and classified as very critical. The impacted element is an unknown function. Such manipulation leads to buffer overflow. This vulnerability is traded as CVE-2026-100216. An a
Terminal2Shell: 55-Year-Old ‘Zero-Day’ Dating Back to 1971 Claims to Affect Billions of Devices
Terminal2Shell claims a critical flaw dating back to 1971 affects more than two billion devices, allowing anyone who opens a terminal to gain an interactive shell. However, the website is satire, not a confirmed vulnerability disclosure. It
CVE-2026-112322 | Red Hat Enterprise Linux GSSAPI Authentication svc_auth_gssapi.c clean_client resource consumption (Nessus ID 377860)
A vulnerability marked as critical has been reported in Red Hat Enterprise Linux. This vulnerability affects the function clean_client of the file lib/rpc/svc_auth_gssapi.c of the component GSSAPI Authentication. Performing a manipulation r
CVE-2026-121611 | Red Hat Enterprise Linux 7/8/9/10 gst-plugins-bad uninitialized pointer (Nessus ID 377861)
A vulnerability labeled as critical has been found in Red Hat Enterprise Linux 7/8/9/10. The affected element is an unknown function of the component gst-plugins-bad. Such manipulation leads to uninitialized pointer. This vulnerability is u
CVE-2026-116337 | Qt Framework Qt Network resource consumption (Nessus ID 377862)
A vulnerability identified as problematic has been detected in Qt Framework. Affected by this issue is some unknown functionality of the component Qt Network Module. Performing a manipulation results in resource consumption. This vulnerabil
Google Chrome: Sicherheitsupdate stopft aktiv ausgenutzte Zero-Day-Lücke
Google hat ein Update für den Desktop-Browser Chrome im Stable Channel veröffentlicht. Die neue Version 157.0.8103.50/.51 steht für Windows und macOS bereit, Linux-Nutzer erhalten die Version...Zum Beitrag: Google Chrome: Sicherheitsupdate
CVE-2026-76014 | BusyBox up to 1.30.1 FEATURE_WGET_TIMEOUT networking/wget.c -T null pointer dereference (Issue 124)
A vulnerability was found in BusyBox up to 1.30.1. It has been declared as problematic. This vulnerability affects unknown code of the file networking/wget.c of the component FEATURE_WGET_TIMEOUT Handler. Such manipulation of the argument -
CVE-2026-70408 | Extra Innovation acmailer CGI/acmailer DB improper authorization
A vulnerability was found in Extra Innovation acmailer CGI and acmailer DB. It has been declared as critical. Affected by this issue is some unknown functionality. Such manipulation leads to improper authorization. This vulnerability is lis