Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 784 | 0,2 % |
| ≥50 % | 3.558 | 0,9 % |
| ≥10 % | 13.141 | 3,2 % |
| <10 % | 395.489 | 95,8 % |
Building an Evidence Trail for CVE-2026-76466 Remediation
Building an Evidence Trail for CVE-2026-76466 Remediation The CVE-2026-76466 advisory names a clear outcome: unauthenticated remote command execution as root. It also names conditions that are easy to lose in a large patch program: Cisco Ex
Vulnerability Scans for Older Cisco IOS Vulnerability / Opt-Out Headers, (Thu, Nov 5th)
This morning, I was browsing our honeypot data for any new and existing PHP exploit attempts. Instead, I first ran into some GeoServer exploits, but found them to be too boring to write up. This Cisco IOS exploit attempt was a bit more inte
Hackers Exploit OpenSSH SSHole Flaw Within Hours
A newly disclosed OpenSSH vulnerability, nicknamed SSHole, is already being exploited in the wild. The flaw, tracked as CVE-2026-123158 and carrying a CVSS score of 8.1, lets unauthenticated attackers log in to certain Linux accounts that
CVE-2025-61464 | Gnuboard up to 4.36.04 bbs/search.php search_table sql injection
A vulnerability, which was classified as critical, was found in Gnuboard up to 4.36.04. The impacted element is the function search_table of the file bbs/search.php. The manipulation results in sql injection. This vulnerability was named CV
CVE-2025-61136 | axewater sharewarez 2.4.3 Password Reset url_for injection
A vulnerability marked as problematic has been reported in axewater sharewarez 2.4.3. Affected is the function url_for of the component Password Reset Handler. The manipulation leads to injection. This vulnerability is traded as CVE-2025-61
CVE-2025-61132 | levlaz braindump 0.4.14 Password Reset url_for injection
A vulnerability labeled as problematic has been found in levlaz braindump 0.4.14. This impacts the function url_for of the component Password Reset Handler. Executing a manipulation can lead to injection. This vulnerability appears as CVE-2
CVE-2025-60859 | Gnuboard 5.6.15 bbs/view_comment.php c_id cross site scripting
A vulnerability was found in Gnuboard 5.6.15. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file bbs/view_comment.php. Executing a manipulation of the argument c_id can lead to cross
CVE-2025-60852 | Instant Developer Foundation prior 25.0.9600 CSV Export csv injection
A vulnerability was found in Instant Developer Foundation. It has been declared as problematic. Impacted is an unknown function of the component CSV Export Handler. The manipulation results in csv injection. This vulnerability is cataloged
CVE-2025-60837 | MCMS 6.0.1 cross site scripting
A vulnerability identified as problematic has been detected in MCMS 6.0.1. This impacts an unknown function. The manipulation leads to cross site scripting. This vulnerability is listed as CVE-2025-60837. The attack may be initiated remotel
CVE-2025-57240 | 17gz International Student service system 1.0 Registration cross site scripting
A vulnerability categorized as problematic has been discovered in 17gz International Student service system 1.0. This affects an unknown function of the component Registration. Executing a manipulation can lead to cross site scripting. This
CVE-2025-62401 | Moodle Timed Assignment access control (EUVD-2025-35665 / Nessus ID 276867)
A vulnerability was found in Moodle. It has been rated as critical. Impacted is an unknown function of the component Timed Assignment Handler. Performing a manipulation results in improper access controls. This vulnerability is cataloged as
CVE-2025-62400 | Moodle Hidden Group Name information disclosure (EUVD-2025-35667 / Nessus ID 276838)
A vulnerability was found in Moodle. It has been declared as problematic. This issue affects some unknown processing of the component Hidden Group Name Handler. Such manipulation leads to information disclosure. This vulnerability is listed
CVE-2025-62399 | Moodle Mobile/Web excessive authentication (EUVD-2025-35668 / Nessus ID 276851)
A vulnerability was found in Moodle and classified as problematic. This affects an unknown part of the component Mobile/Web. The manipulation results in improper restriction of excessive authentication attempts. This vulnerability is identi
CVE-2025-62398 | Moodle MFA improper authentication (EUVD-2025-35669 / Nessus ID 276869)
A vulnerability has been found in Moodle and classified as critical. Affected by this issue is some unknown functionality of the component MFA. The manipulation leads to improper authentication. This vulnerability is referenced as CVE-2025-
CVE-2025-62397 | Moodle 404 Router information disclosure (Nessus ID 276830)
A vulnerability, which was classified as problematic, has been found in Moodle 404. Affected is an unknown function of the component Router. Performing a manipulation results in information disclosure. This vulnerability was named CVE-2025-
CVE-2025-62395 | Moodle External Cohort Search information disclosure (EUVD-2025-35666 / Nessus ID 276846)
A vulnerability, which was classified as problematic, was found in Moodle. Affected by this vulnerability is an unknown functionality of the component External Cohort Search. Executing a manipulation can lead to information disclosure. The
CVE-2025-62394 | Moodle Quiz Notifications information disclosure (EUVD-2025-35672 / Nessus ID 276837)
A vulnerability was found in Moodle. It has been classified as problematic. This vulnerability affects unknown code of the component Quiz Notifications. This manipulation causes information disclosure. This vulnerability is tracked as CVE-2
CVE-2025-62393 | Moodle Course Access course_output_fragment_course_overview permission (EUVD-2025-35673 / Nessus ID 276845)
A vulnerability classified as critical has been found in Moodle. This affects the function course_output_fragment_course_overview of the component Course Access. This manipulation causes permission issues. This vulnerability is handled as C
CVE-2025-60343 | Tenda AC6 15.03.06.50 AdvSetMacMtuWan buffer overflow
A vulnerability classified as critical has been found in Tenda AC6 15.03.06.50. This issue affects the function AdvSetMacMtuWan. The manipulation of the argument wanMTU/wanSpeed/cloneType/mac/serviceName/serverName/wanMTU2/wanSpeed2/cloneTy
CVE-2025-60340 | Tenda AC6 15.03.06.50 SetClientState limitSpeed/deviceId/limitSpeedUp buffer overflow
A vulnerability marked as critical has been reported in Tenda AC6 15.03.06.50. This issue affects the function SetClientState. Performing a manipulation of the argument limitSpeed/deviceId/limitSpeedUp results in buffer overflow. This vulne
CVE-2025-60339 | Tenda AC6 15.03.06.50 openSchedWifi schedStartTime/schedEndTime buffer overflow
A vulnerability was found in Tenda AC6 15.03.06.50. It has been classified as critical. Affected by this issue is the function openSchedWifi. The manipulation of the argument schedStartTime/schedEndTime leads to buffer overflow. This vulner
CVE-2025-60336 | TOTOLINK N600R 4.3.0cu.7866_B20220506 HTTP sub_41773C null pointer dereference
A vulnerability, which was classified as critical, has been found in TOTOLINK N600R 4.3.0cu.7866_B20220506. This issue affects the function sub_41773C of the component HTTP Handler. This manipulation causes null pointer dereference. This vu
CVE-2023-3397 | Linux Kernel JFS lmLogClose use after free
A vulnerability has been found in Linux Kernel and classified as problematic. This affects the function lmLogClose of the component JFS. The manipulation leads to use after free. This vulnerability is documented as CVE-2023-3397. The attack
CVE-2020-27792 | GhostScript PDF gdevlp8k.c lp8000_print_page heap-based overflow (DLA 3096-1 / Nessus ID 235015)
A vulnerability was found in GhostScript. It has been classified as critical. Affected by this vulnerability is the function lp8000_print_page of the file gdevlp8k.c of the component PDF Handler. The manipulation leads to heap-based buffer
SonicWall CVE-2026-19868: SSL-VPN SAML MFA Bypass Exploited in the Wild
TL;DR what: SonicWall disclosed CVE-2026-19868, an SSL-VPN authentication bypass in SonicOS that lets attackers with valid credentials for an alternate authentication method skip SAML controls, and CISA has confirmed it is exploited in the
CVE-2025-61255 | PHPGurukul Bank Locker Management System /search cross site scripting
A vulnerability classified as problematic has been found in PHPGurukul Bank Locker Management System. This impacts an unknown function of the file /search. The manipulation of the argument Search leads to cross site scripting. This vulnerab
CVE-2025-60334 | Totolink N600R 4.3.0cu.7866_B20220506 setWiFiBasicConfig ssid denial of service
A vulnerability has been found in Totolink N600R 4.3.0cu.7866_B20220506 and classified as problematic. This affects the function setWiFiBasicConfig. The manipulation of the argument ssid leads to denial of service. This vulnerability is doc
CVE-2025-60333 | Totolink N600R 4.3.0cu.7866_B20220506 setWiFiMultipleConfig wepkey2 denial of service
A vulnerability, which was classified as problematic, has been found in Totolink N600R 4.3.0cu.7866_B20220506. The affected element is the function setWiFiMultipleConfig. Performing a manipulation of the argument wepkey2 results in denial o
CVE-2025-60332 | D-Link DIR-823G A1 1.0.2B05 SetWLanRadioSettings null pointer dereference
A vulnerability has been found in D-Link DIR-823G A1 1.0.2B05 and classified as problematic. The affected element is the function SetWLanRadioSettings. The manipulation leads to null pointer dereference. This vulnerability is listed as CVE-
CVE-2025-60331 | D-Link DIR-823G A1 1.0.2B05 /EXCU_SHELL FillMacCloneMac denial of service
A vulnerability classified as problematic was found in D-Link DIR-823G A1 1.0.2B05. This affects an unknown function of the file /EXCU_SHELL. Executing a manipulation of the argument FillMacCloneMac can lead to denial of service. This vulne
CVE-2025-56447 | TM2 Monitoring 3.04 improper authentication
A vulnerability described as critical has been identified in TM2 Monitoring 3.04. Affected by this issue is some unknown functionality. The manipulation results in improper authentication. This vulnerability was named CVE-2025-56447. The at
CVE-2025-61220 | AutoBizLine com.mysecondline.app 1.2.91 improper authorization
A vulnerability categorized as critical has been discovered in AutoBizLine com.mysecondline.app 1.2.91. The impacted element is an unknown function. Such manipulation leads to improper authorization. This vulnerability is traded as CVE-2025
CVE-2025-61194 | daicuocms 1.3.13 Builder.php sql injection
A vulnerability labeled as critical has been found in daicuocms 1.3.13. Affected by this issue is some unknown functionality of the file library\think\db\Builder.php. The manipulation results in sql injection. This vulnerability is known as
CVE-2025-61181 | daicuocms 1.3.13 Image unrestricted upload
A vulnerability marked as critical has been reported in daicuocms 1.3.13. Impacted is an unknown function of the component Image Handler. Performing a manipulation results in unrestricted upload. This vulnerability is known as CVE-2025-6118
CVE-2025-60933 | HR Performance Solutions Performance Pro 3.19.17 cross site scripting
A vulnerability described as problematic has been identified in HR Performance Solutions Performance Pro 3.19.17. The impacted element is an unknown function. Such manipulation of the argument Goal Name/Goal Notes/Action Step Name/Action St
CVE-2025-60932 | HR Performance Solutions Performance Pro 3.19.17 cross site scripting
A vulnerability classified as problematic has been found in HR Performance Solutions Performance Pro 3.19.17. This affects an unknown function. Performing a manipulation of the argument Goal Name/Goal Notes/Action Step Name/Action Step Desc
CVE-2025-60772 | Netlink HG322G 1.0.00-231017 HTTP Request improper authentication
A vulnerability was found in Netlink HG322G 1.0.00-231017 and classified as critical. This vulnerability affects unknown code of the component HTTP Request Handler. Executing a manipulation can lead to improper authentication. This vulnerab
CVE-2025-60511 | OpenAI Chat Block Plugin 3.0.1 on Moodle completion.php blockId authorization
A vulnerability categorized as critical has been discovered in OpenAI Chat Block Plugin 3.0.1 on Moodle. This issue affects some unknown processing of the file /blocks/openai_chat/api/completion.php. The manipulation of the argument blockId
CVE-2025-60507 | GeniAI Plugin 2.3.6 on Moodle local_geniai cross site scripting
A vulnerability, which was classified as problematic, has been found in GeniAI Plugin 2.3.6 on Moodle. The affected element is an unknown function of the component local_geniai. The manipulation leads to cross site scripting. This vulnerabi
CVE-2025-60506 | PDF Annotator Plugin 1.5 on Moodle Public Comments Feature cross site scripting
A vulnerability, which was classified as problematic, was found in PDF Annotator Plugin 1.5 on Moodle. The impacted element is an unknown function of the component Public Comments Feature. The manipulation results in cross site scripting. T
CVE-2025-60500 | QDocs Smart School Management System 7.1 PHP File Parser access control
A vulnerability labeled as critical has been found in QDocs Smart School Management System 7.1. The affected element is an unknown function of the component PHP File Parser. Such manipulation leads to improper access controls. This vulnerab
CVE-2025-60427 | LibreTime up to 3.0.0-alpha.10 Web UI/API information disclosure
A vulnerability was found in LibreTime up to 3.0.0-alpha.10. It has been rated as problematic. The affected element is an unknown function of the component Web UI/API. This manipulation causes information disclosure. This vulnerability appe
CVE-2025-60280 | Bang Resto 1.0 cross site scripting
A vulnerability was found in Bang Resto 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to cross site scripting. This vulnerability is registered as CVE
CVE-2025-59438 | Mbed TLS up to 3.6.4 timing discrepancy (EUVD-2025-35171 / Nessus ID 271649)
A vulnerability marked as problematic has been reported in Mbed TLS up to 3.6.4. The affected element is an unknown function. This manipulation causes observable timing discrepancy. This vulnerability is tracked as CVE-2025-59438. The attac
CVE-2026-123963 | OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a Agent Registry im_server/app.py register desc/name missing authentication (Issue 21 / EUVD-2026-119217)
A vulnerability was found in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. It has been declared as critical. The impacted element is the function register of the file im_server/app.py of the component Agent Regi
CVE-2026-123477 | Crocoblock JetEngine Plugin up to 3.9.0.2 on WordPress cross site scripting (EUVD-2026-119218)
A vulnerability was found in Crocoblock JetEngine Plugin up to 3.9.0.2 on WordPress and classified as problematic. The impacted element is an unknown function. Executing a manipulation can lead to cross site scripting. The identification of
CVE-2026-119498 | RelyWP Simple Cloudflare Turnstile Plugin up to 1.44.4 on WordPress improper authentication (EUVD-2026-119212)
A vulnerability was found in RelyWP Simple Cloudflare Turnstile Plugin up to 1.44.4 on WordPress. It has been classified as critical. Impacted is an unknown function. Performing a manipulation results in improper authentication. This vulner
CVE-2026-122663 | Villame CURCY Plugin up to 2.2.20 on WordPress missing authentication (EUVD-2026-119220)
A vulnerability labeled as problematic has been found in Villame CURCY Plugin up to 2.2.20 on WordPress. Affected is an unknown function. Such manipulation leads to missing authentication. This vulnerability is documented as CVE-2026-122663
CVE-2026-121784 | Magepeople Bookingly Plugin up to 1.4.3 on WordPress cross site scripting (EUVD-2026-119219)
A vulnerability, which was classified as problematic, has been found in Magepeople Bookingly Plugin up to 1.4.3 on WordPress. This issue affects some unknown processing. This manipulation causes cross site scripting. This vulnerability is h
CVE-2026-123474 | LeapWorx Premium Blocks Plugin up to 2.3.18 on WordPress authorization (EUVD-2026-119224)
A vulnerability was found in LeapWorx Premium Blocks Plugin up to 2.3.18 on WordPress. It has been rated as problematic. The impacted element is an unknown function. The manipulation leads to missing authorization. This vulnerability is lis
CVE-2026-123462 | myCred Plugin up to 4.0.2 on WordPress missing authentication (EUVD-2026-119222)
A vulnerability, which was classified as problematic, was found in myCred Plugin up to 4.0.2 on WordPress. Impacted is an unknown function. Such manipulation leads to missing authentication. This vulnerability is uniquely identified as CVE-
CVE-2026-122669 | Everest Forms Plugin up to 3.6.3 on WordPress cross site scripting (EUVD-2026-119221)
A vulnerability classified as problematic was found in Everest Forms Plugin up to 3.6.3 on WordPress. This vulnerability affects unknown code. The manipulation results in cross site scripting. This vulnerability is known as CVE-2026-122669.
CVE-2026-123183 | PluginUs.Net Active Products Tables Plugin up to 2.1.6 on WordPress cross site scripting (EUVD-2026-119225)
A vulnerability has been found in PluginUs.Net Active Products Tables Plugin up to 2.1.6 on WordPress and classified as problematic. The affected element is an unknown function. Performing a manipulation results in cross site scripting. Thi
CVE-2026-121775 | Villame CURCY Plugin up to 2.2.20 on WordPress authorization (EUVD-2026-119223)
A vulnerability categorized as problematic has been discovered in Villame CURCY Plugin up to 2.2.20 on WordPress. This affects an unknown function. The manipulation results in missing authorization. This vulnerability is cataloged as CVE-20
CVE-2023-3972 | Red Hat insights-client temp file (EUVD-2023-44597 / Nessus ID 239778)
A vulnerability categorized as critical has been discovered in Red Hat insights-client. The impacted element is an unknown function. The manipulation results in insecure temporary file. This vulnerability is reported as CVE-2023-3972. The a
CVE-2023-3758 | sssd GPO Policy race condition (RHSA-2024:1919 / Nessus ID 211196)
A vulnerability classified as critical has been found in sssd. This affects an unknown part of the component GPO Policy. This manipulation causes race condition. This vulnerability is registered as CVE-2023-3758. The attack requires access
CVE-2026-55458 | Caddy WebSocket Upgrade reverseproxy.go handleUpgradeResponse request smuggling (Nessus ID 377111)
A vulnerability has been found in Caddy and classified as problematic. Affected is the function handleUpgradeResponse of the file modules/caddyhttp/reverseproxy/reverseproxy.go of the component WebSocket Upgrade. The manipulation leads to h
CVE-2026-49272 | OAuthLib Device Code Grant device_code.py DeviceCodeGrant.validate_token_request device_code input validation (Nessus ID 377110)
A vulnerability was found in OAuthLib. It has been declared as critical. This issue affects the function DeviceCodeGrant.validate_token_request of the file oauthlib/oauth2/rfc6749/grant_types/device_code.py of the component Device Code Gran
CVE-2025-61456 | Bhabishya-123 E-commerce 1.0 Endpoint /index cross site scripting
A vulnerability, which was classified as problematic, has been found in Bhabishya-123 E-commerce 1.0. This impacts an unknown function of the file /index of the component Endpoint. Performing a manipulation results in cross site scripting.
CVE-2025-60856 | Reolink Video Doorbell WiFi DB_566128M5MP_W UART Interface missing authentication
A vulnerability classified as critical was found in Reolink Video Doorbell WiFi DB_566128M5MP_W. This affects an unknown function of the component UART Interface. Such manipulation leads to missing authentication. This vulnerability is trad