Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | 2026-08-30 | 2026-09-18 |
|---|---|---|
| ≥90 % | 0 | 0 |
| ≥50 % | 0 | 0 |
| ≥10 % | 0 | 0 |
| <10 % | 300 | 300 |
CVE-2026-59714 | open-webui Open WebUI Chat Completion API improper authorization
A vulnerability marked as critical has been reported in open-webui Open WebUI. The affected element is an unknown function of the component Chat Completion API. The manipulation leads to improper authorization. This vulnerability is referen
CVE-2026-45725 | oscal-compass compliance-trestle up to 3.12.1/4.0.2 Remote Fetching Cache Mechanism path traversal
A vulnerability classified as problematic was found in oscal-compass compliance-trestle up to 3.12.1/4.0.2. This impacts an unknown function of the component Remote Fetching Cache Mechanism. Such manipulation leads to path traversal. This v
CVE-2026-73655 | Trigger.dev up to 4.5.1 Google Authentication googleAuth.server.ts addGoogleStrategy improper authentication
A vulnerability marked as critical has been reported in Trigger.dev up to 4.5.1. Affected by this issue is the function addGoogleStrategy of the file apps/webapp/app/services/googleAuth.server.ts of the component Google Authentication. Perf
CVE-2026-73649 | shepherdwind Velocity.js up to 2.1.6 Property-Read Expressions references.ts getReferences os command injection
A vulnerability, which was classified as critical, was found in shepherdwind Velocity.js up to 2.1.6. This issue affects the function getReferences of the file src/compile/references.ts of the component Property-Read Expressions. Executing
CVE-2026-73644 | OpenIdentityPlatform OpenDJ up to 5.1.1 SASL PlainSASLMechanismHandler.java improper authorization
A vulnerability was found in OpenIdentityPlatform OpenDJ up to 5.1.1. It has been classified as very critical. The impacted element is an unknown function of the file opendj-server-legacy/src/main/java/org/opends/server/extensions/PlainSASL
CVE-2026-45774 | oscal-compass compliance-trestle up to 3.12.1/4.0.2 Profile Import Mechanism resolve imports[].href path traversal
A vulnerability labeled as problematic has been found in oscal-compass compliance-trestle up to 3.12.1/4.0.2. Impacted is the function resolve of the component Profile Import Mechanism. Executing a manipulation of the argument imports[].hre
CVE-2026-73654 | triggerdotdev trigger.dev up to 4.5.5 Run Metadata operations.ts JSONHeroPath.set operation.key denial of service
A vulnerability has been found in triggerdotdev trigger.dev up to 4.5.5 and classified as problematic. This impacts the function JSONHeroPath.set of the file packages/core/src/v3/runMetadata/operations.ts of the component Run Metadata. Perf
CVE-2026-73650 | svg SVGO up to 2.8.2/3.3.3/4.0.1 removeScripts cross site scripting
A vulnerability was found in svg SVGO up to 2.8.2/3.3.3/4.0.1. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component removeScripts. Executing a manipulation can lead to cross site s
CVE-2026-73651 | TypeORM up to 0.3.30/1.0.x Migration Generate Command MigrationGenerateCommand.ts generate COMMENT/DEFAULT code injection
A vulnerability, which was classified as problematic, has been found in TypeORM up to 0.3.30/1.0.x. The affected element is the function Generate of the file src/commands/MigrationGenerateCommand.ts of the component Migration Generate Comma
CVE-2026-73652 | vantage6 up to 5.0.2 algorithm-store permission
A vulnerability, which was classified as critical, was found in vantage6 up to 5.0.2. The impacted element is an unknown function of the component algorithm-store. The manipulation results in permission issues. This vulnerability was named
CVE-2026-73643 | nodeca js-yaml up to 5.2.1 Parser src/parser/parser.ts readFlowCollection infinite loop (Nessus ID 335459)
A vulnerability categorized as problematic has been discovered in nodeca js-yaml up to 5.2.1. Affected is the function readFlowCollection of the file src/parser/parser.ts of the component Parser. Executing a manipulation can lead to infinit
CVE-2026-73648 | rails rails-html-sanitizer up to 1.7.0 PermitScrubber cross-domain policy
A vulnerability labeled as problematic has been found in rails rails-html-sanitizer up to 1.7.0. Affected by this issue is some unknown functionality of the component PermitScrubber. The manipulation results in permissive cross-domain polic
CVE-2026-73645 | OpenZeppelin Confidential Contracts up to 0.3.0 ERC7984ERC20Wrapper ERC7984ERC20Wrapper.sol wrap/onTransferReceived integer overflow
A vulnerability was found in OpenZeppelin Confidential Contracts up to 0.3.0. It has been declared as problematic. This affects the function wrap/onTransferReceived of the file contracts/token/ERC7984/extensions/ERC7984ERC20Wrapper.sol of t
CVE-2026-73564 | fatedier frp up to 0.70.0 SSH Tunnel Gateway pkg/ssh/server.go TunnelServer.handleNewChannel integer overflow
A vulnerability labeled as problematic has been found in fatedier frp up to 0.70.0. This impacts the function TunnelServer.handleNewChannel of the file pkg/ssh/server.go of the component SSH Tunnel Gateway. Executing a manipulation can lead
CVE-2026-48702 | Sigstore Rekor up to 1.5.1 APK File pkg/types/alpine/apk.go Package.Unmarshal allocation of resources
A vulnerability labeled as problematic has been found in Sigstore Rekor up to 1.5.1. This affects the function Package.Unmarshal of the file pkg/types/alpine/apk.go of the component APK File Handler. The manipulation results in allocation o
CVE-2026-73569 | NaturalIntelligence fast-xml-parser up to 5.10.0 XML Parser OrderedObjParser.js addInputEntities resource consumption
A vulnerability was found in NaturalIntelligence fast-xml-parser up to 5.10.0 and classified as problematic. The affected element is the function addInputEntities of the file src/xmlparser/OrderedObjParser.js of the component XML Parser. Th
CVE-2026-73567 | JuneAndGreen sm-crypto up to 0.4.x SM2 src/sm2/utils.js sm2.generateKeyPairHex random values
A vulnerability classified as problematic was found in JuneAndGreen sm-crypto up to 0.4.x. This affects the function sm2.generateKeyPairHex of the file src/sm2/utils.js of the component SM2. Such manipulation leads to insufficiently random
CVE-2026-73562 | Automattic Mongoose up to 6.13.9/7.8.9/8.24.0/9.7.1 Update Casting body prototype pollution
A vulnerability classified as critical has been found in Automattic Mongoose up to 6.13.9/7.8.9/8.24.0/9.7.1. Affected by this issue is the function Schema.prototype.path/Schema.prototype._getPathType of the component Update Casting. This m
CVE-2026-73563 | Backstage up to 0.29.1 Dynamic Client Registration redirect
A vulnerability identified as problematic has been detected in Backstage up to 0.29.1. This affects an unknown function of the component Dynamic Client Registration. Performing a manipulation of the argument... Weiterlesen
CVE-2026-73568 | libp2p py-libp2p up to 0.7.0 yamux yamux.py handle_incoming infinite loop
A vulnerability was found in libp2p py-libp2p up to 0.7.0. It has been rated as problematic. The affected element is the function handle_incoming of the file libp2p/stream_muxer/yamux/yamux.py of the component yamux. This manipulation cause
CVE-2026-73509 | OpenListTeam OpenList up to 4.2.3 Path Normalization fsbatch.go api/fs/batch_rename src_name path traversal
A vulnerability was found in OpenListTeam OpenList up to 4.2.3. It has been rated as critical. Affected is the function api/fs/batch_rename of the file server/handles/fsbatch.go of the component Path Normalization. This manipulation of the
CVE-2026-49856 | vmoranv jshookmcp 0.3.1 server-side request forgery
A vulnerability has been found in vmoranv jshookmcp 0.3.1 and classified as problematic. Impacted is an unknown function. This manipulation causes server-side request forgery. This vulnerability is handled as CVE-2026-49856. The attack can
CVE-2026-49857 | ymw0407 auth-fetch-mcp up to 3.0.1 src/security.ts isPrivateV6 server-side request forgery
A vulnerability marked as critical has been reported in ymw0407 auth-fetch-mcp up to 3.0.1. Affected is the function isPrivateV6 of the file src/security.ts. This manipulation causes server-side request forgery. This vulnerability is regist
CVE-2026-49820 | GetProbo up to 0.193.0 saferedirect path.Clean continue
A vulnerability categorized as problematic has been discovered in GetProbo Probo up to 0.193.0. The impacted element is the function path.Clean of the component saferedirect. Executing a manipulation of the argument continue can lead to ope
CVE-2026-49481 | seriousm4x UpSnap up to 5.3.x Device Management ip/mac os command injection
A vulnerability, which was classified as critical, has been found in seriousm4x UpSnap up to 5.3.x. Affected by this issue is some unknown functionality of the component Device Management. Performing a manipulation of the argument ip/mac re
CVE-2026-49827 | SMEWebify WebErpMesv2 up to 1.19 File Upload scan_file input validation
A vulnerability was found in SMEWebify WebErpMesv2 up to 1.19. It has been rated as critical. This impacts an unknown function of the component File Upload. This manipulation of the argument scan_file causes improper input validation. This
CVE-2026-73291 | seerr-team Seerr up to 3.3.x ImageProxy server/lib/imageproxy.ts path.join path traversal
A vulnerability has been found in seerr-team Seerr up to 3.3.x and classified as critical. Affected by this issue is the function path.join of the file server/lib/imageproxy.ts of the component ImageProxy. Performing a manipulation results
CVE-2026-73296 | Microsoft UFO up to 3.0.7 Mobile MCP Server mobile_mcp_server.py information disclosure (EUVD-2026-57323)
A vulnerability was found in Microsoft UFO up to 3.0.7. It has been declared as problematic. This affects the function create_mobile_data_collection_server/create_mobile_action_server of the file ufo/client/mcp/http_servers/mobile_mcp_serve
CVE-2026-73500 | etcd-io etcd up to 3.5.32/3.6.13/3.7.0 TLS Listener listener_tls.go tls.Conn.Handshake infinite loop
A vulnerability was found in etcd-io etcd up to 3.5.32/3.6.13/3.7.0. It has been classified as problematic. This affects the function tls.Conn.Handshake of the file client/pkg/transport/listener_tls.go of the component TLS Listener. The man
CVE-2026-73501 | getkin kin-openapi up to 0.143.x ValidationHandler validation_handler.go ValidationHandler.Load improper authentication
A vulnerability was found in getkin kin-openapi up to 0.143.x and classified as critical. Affected by this issue is the function ValidationHandler.Load of the file openapi3filter/validation_handler.go of the component ValidationHandler. Exe
CVE-2026-73499 | etcd-io etcd up to 3.5.32/3.6.13/3.7.0 Range Permission Cache range_perm_cache.go isRangeOpPermitted permission
A vulnerability has been found in etcd-io etcd up to 3.5.32/3.6.13/3.7.0 and classified as problematic. Affected by this vulnerability is the function isRangeOpPermitted of the file server/auth/range_perm_cache.go of the component Range Per
CVE-2026-73298 | Microsoft Container Migration Solution Accelerator up to 2.1.2 resource injection
A vulnerability labeled as critical has been found in Microsoft Container Migration Solution Accelerator up to 2.1.2. Affected by this issue is some unknown functionality. Such manipulation leads to improper control of resource identifiers.
CVE-2026-73498 | sooperset mcp-atlassian up to 0.21.x Attachments attachments.py _upload_attachment_direct file_path path traversal
A vulnerability identified as problematic has been detected in sooperset mcp-atlassian up to 0.21.x. This vulnerability affects the function _upload_attachment_direct of the file src/mcp_atlassian/confluence/attachments.py of the component
CVE-2026-73297 | Microsoft UFO up to 3.0.7 url_security.py _is_blocked_ip server-side request forgery (EUVD-2026-57325)
A vulnerability was found in Microsoft UFO up to 3.0.7. It has been rated as critical. This vulnerability affects the function _is_blocked_ip of the file ufo/utils/url_security.py. This manipulation causes server-side request forgery. This
CVE-2026-72925 | swc-project swc/html/swc_html_minifier prior 1.15.47-nightly-20260729.1/59.0.0 MinifyJson Processing lib.rs cross site scripting
A vulnerability classified as problematic has been found in swc-project swc, html and swc_html_minifier. The affected element is an unknown function of the file crates/swc_html_minifier/src/lib.rs of the component MinifyJson Processing. The
CVE-2026-73232 | ffuf up to 2.1.x Response Size Guard pkg/runner/simple.go io.ReadAll resource consumption (EUVD-2026-56926)
A vulnerability categorized as problematic has been discovered in ffuf up to 2.1.x. Affected by this issue is the function io.ReadAll of the file pkg/runner/simple.go of the component Response Size Guard. The manipulation results in resourc
CVE-2026-39452 | Intel Transfer Learning Tool up to 0.6 privileges management
A vulnerability classified as critical has been found in Intel Transfer Learning Tool up to 0.6. Affected by this vulnerability is an unknown functionality. This manipulation causes improper privilege management. This vulnerability is track
CVE-2026-73230 | Ente up to 2026.07.27 2of3 card format missing encryption
A vulnerability categorized as problematic has been discovered in Ente up to 2026.07.27. The impacted element is an unknown function of the component 2of3 card format. The manipulation results in missing encryption of sensitive data. This v
CVE-2026-48802 | miguelgrinberg python-engineio up to 4.13.1 denial of service (Nessus ID 335307)
A vulnerability identified as problematic has been detected in miguelgrinberg python-engineio up to 4.13.1. This issue affects some unknown processing. Performing a manipulation results in denial of service. This vulnerability is known as C
CVE-2026-48809 | miguelgrinberg python-engineio up to 4.13.1 allocation of resources
A vulnerability was found in miguelgrinberg python-engineio up to 4.13.1. It has been rated as problematic. This affects an unknown part. This manipulation causes allocation of resources. This vulnerability appears as CVE-2026-48809. The at
The quiet DoS bug in Cisco's email gateway hardening release
The quiet DoS bug in Cisco's email gateway hardening release Cisco's September 2026 hardening release for its email security appliances covers five CVEs. Four of them are the kind of flaw that draws attention: directory escape, au
When the Payment-Failure Email Is the Exploit: Inside the Magento Template Rendering Chain of CVE-2026-75650
When the Payment-Failure Email Is the Exploit: Inside the Magento Template Rendering Chain of CVE-2026-75650 Opening CVE-2026-75650 is an unauthenticated remote code execution vulnerability in Adobe Commerce and Magento Open Source that rea
CVE-2026-48170 | thomaspoignant scim-patch up to 0.9.0 scimPatch Value prototype pollution
A vulnerability was found in thomaspoignant scim-patch up to 0.9.0. It has been declared as critical. This affects the function scimPatch. The manipulation of the argument Value results in improperly controlled modification of object protot
CVE-2026-48169 | MervinPraison PraisonAI Platform up to 0.1.3 Service Layer workspace_id improper authorization
A vulnerability was found in MervinPraison PraisonAI Platform up to 0.1.3. It has been rated as critical. This impacts an unknown function of the component Service Layer. This manipulation of the argument workspace_id causes improper author
CVE-2026-48161 | dai-shi react18-use Postinstall Script src/install.js permission
A vulnerability, which was classified as critical, was found in dai-shi react18-use. Impacted is an unknown function of the file src/install.js of the component Postinstall Script. The manipulation results in permission issues. This vulnera
CVE-2026-72917 | Mintplex-Labs AnythingLLM up to 1.15.0 Account Recovery index.js recoverAccount recoveryCodes improper authentication
A vulnerability labeled as critical has been found in Mintplex-Labs AnythingLLM up to 1.15.0. Affected is the function recoverAccount of the file server/utils/PasswordRecovery/index.js of the component Account Recovery. The manipulation of
CVE-2026-72904 | Firecrawl up to 2.11.31 Schema Dereferencing dereference-schema.ts path traversal
A vulnerability categorized as problematic has been discovered in Firecrawl up to 2.11.31. This affects an unknown function of the file apps/api/src/lib/extract/helpers/dereference-schema.ts of the component Schema Dereferencing. Executing
CVE-2026-48048 | XWiki prior 16.10.17/17.4.9/17.10.13/18.0.0RC1 LiveTableResults weak password hash
A vulnerability has been found in XWiki and classified as problematic. This impacts an unknown function of the component LiveTableResults. The manipulation leads to password hash with insufficient computational effort. This vulnerability is
CVE-2026-48122 | Shopify ruby-lsp up to 0.10.3 VS Code Extension .vscode/settings.json os command injection (EUVD-2026-54723)
A vulnerability was found in Shopify ruby-lsp up to 0.10.3 and classified as critical. This impacts an unknown function of the file .vscode/settings.json of the component VS Code Extension. The manipulation results in os command injection.
CVE-2026-46409 | OpenYak up to 1.1.2 Desktop Backend cross-domain policy
A vulnerability classified as problematic has been found in OpenYak up to 1.1.2. This issue affects some unknown processing of the component Desktop Backend. This manipulation causes permissive cross-domain policy with untrusted domains. Th
CVE-2026-48047 | XWiki Platform up to 16.10.16/17.4.8/17.10.2 WebJars API path traversal
A vulnerability described as problematic has been identified in XWiki Platform up to 16.10.16/17.4.8/17.10.2. This vulnerability affects unknown code of the component WebJars API. The manipulation results in path traversal. This vulnerabili
CVE-2026-62857 | fedify-dev fedify up to 2.3.1 URL Validation getNodeInfo links[] server-side request forgery
A vulnerability categorized as critical has been discovered in fedify-dev fedify up to 2.3.1. This vulnerability affects the function getNodeInfo of the component URL Validation. Executing a manipulation of the argument links[] can lead to
CVE-2026-71554 | python-hyper h2 up to 4.4.0 request smuggling
A vulnerability was found in python-hyper h2 up to 4.4.0 and classified as problematic. The impacted element is an unknown function. Executing a manipulation can lead to http request smuggling. This vulnerability is handled as CVE-2026-7155
CVE-2026-71476 | Nrwl Nx up to 22.7.6/23.0.1 path traversal
A vulnerability classified as critical was found in Nrwl Nx up to 22.7.6/23.0.1. Affected by this issue is some unknown functionality. Such manipulation leads to path traversal. This vulnerability is referenced as CVE-2026-71476. It is poss
CVE-2026-70646 | vovchic17 aiosend up to 3.0.6 JSON Parsing WebhookHandler.feed_update memory allocation
A vulnerability classified as problematic has been found in vovchic17 aiosend up to 3.0.6. This issue affects the function WebhookHandler.feed_update of the component JSON Parsing. This manipulation causes uncontrolled memory allocation. Th
CVE-2026-65490 | Mediavine Create by Mediavine Plugin up to 2.5.3 on WordPress information disclosure
A vulnerability was found in Mediavine Create by Mediavine Plugin up to 2.5.3 on WordPress. It has been rated as problematic. Affected by this issue is some unknown functionality. This manipulation causes information disclosure. The identif
CVE-2026-22223 | TP-Link Archer BE230 1.2.4 os command injection (EUVD-2026-5086)
A vulnerability categorized as critical has been discovered in TP-Link Archer BE230 1.2.4. This vulnerability affects unknown code. The manipulation results in os command injection. This vulnerability is cataloged as CVE-2026-22223. The att
CVE-2026-22221 | TP-Link Archer BE230 1.2.4 os command injection (EUVD-2026-5100)
A vulnerability was found in TP-Link Archer BE230 1.2.4. It has been declared as critical. Affected by this issue is some unknown functionality. Executing a manipulation can lead to os command injection. This vulnerability is tracked as CVE
CVE-2026-0631 | TP-Link Archer BE230 1.2.4 os command injection (EUVD-2026-5098)
A vulnerability was found in TP-Link Archer BE230 1.2.4. It has been classified as critical. Affected by this vulnerability is an unknown functionality. Performing a manipulation results in os command injection. This vulnerability is identi
Click2Shell-Sicherheitslücke; zeitnah auf WordPress 7.1.1 aktualisieren
Kurze Information: Am 17. September 2026 haben die Entwickler das nächste Wartungsupdate auf 7.1.1. für diese Hauptversion veröffentlicht. Betreiber von WordPress-Sites sollten unverzüglich patchen, da eine Click2Shell-Sicherheitslücke, ges