Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 720 | 0,2 % |
| ≥50 % | 3.224 | 0,9 % |
| ≥10 % | 22.120 | 6,0 % |
| <10 % | 345.001 | 93,0 % |
CVE-2026-19076 | Mattermost up to 11.7.9/11.8.5/11.9.1/11.10.0 Account Type Switch Endpoint switch improper authentication (EUVD-2026-102747)
A vulnerability marked as problematic has been reported in Mattermost up to 11.7.9/11.8.5/11.9.1/11.10.0. Affected by this vulnerability is an unknown functionality of the file /api/v4/users/login/switch of the component Account Type Switch
CVE-2026-18560 | Mattermost up to 11.7.9/11.8.5/11.9.1/11.10.0 Permissions permission (EUVD-2026-102746)
A vulnerability labeled as problematic has been found in Mattermost up to 11.7.9/11.8.5/11.9.1/11.10.0. Affected is an unknown function of the component Permissions. The manipulation results in permission issues. This vulnerability is known
CVE-2026-18256 | Mattermost up to 11.7.9/11.8.5/11.9.1/11.10.0 Team Search privileges management (EUVD-2026-102749)
A vulnerability was found in Mattermost up to 11.7.9/11.8.5/11.9.1/11.10.0. It has been declared as problematic. The affected element is an unknown function of the component Team Search. Such manipulation leads to improper privilege managem
CVE-2026-18223 | Mattermost up to 11.7.9/11.8.5/11.9.1/11.10.0 input validation (EUVD-2026-102748)
A vulnerability identified as problematic has been detected in Mattermost up to 11.7.9/11.8.5/11.9.1/11.10.0. This impacts an unknown function. The manipulation leads to improper input validation. This vulnerability is traded as CVE-2026-18
CVE-2026-18799 | Mattermost up to 11.7.9/11.8.5/11.9.1/11.10.0 Slack Import privileges management (EUVD-2026-102751)
A vulnerability was found in Mattermost up to 11.7.9/11.8.5/11.9.1/11.10.0. It has been rated as problematic. The impacted element is an unknown function of the component Slack Import. Performing a manipulation results in improper privilege
CVE-2026-16251 | Mattermost up to 11.7.9/11.8.5/11.9.1/11.10.0 Image Proxy memory allocation (EUVD-2026-102750)
A vulnerability classified as problematic was found in Mattermost up to 11.7.9/11.8.5/11.9.1/11.10.0. This vulnerability affects unknown code of the component Image Proxy. Executing a manipulation can lead to uncontrolled memory allocation.
CVE-2018-7489 | FasterXML jackson-databind up to 2.8.11.0/2.9.4 JSON readValue incomplete blacklist (RHSA-2018:1449 / Nessus ID 109906)
A vulnerability labeled as critical has been found in FasterXML jackson-databind up to 2.8.11.0/2.9.4. Impacted is the function readValue of the component JSON Handler. The manipulation results in incomplete blacklist. This vulnerability is
CVE-2018-1305 | Oracle Retail Order Broker 5.1/5.2/15.0 Upgrade Install access control (Nessus ID 110264 / ID 87328)
A vulnerability classified as critical was found in Oracle Retail Order Broker 5.1/5.2/15.0. This affects an unknown part of the component Upgrade Install. The manipulation results in improper access controls. This vulnerability is reported
CVE-2026-69519 | Microsoft Azure Stack HCI information disclosure (WID-SEC-2026-2951)
A vulnerability described as problematic has been identified in Microsoft Azure Stack HCI. This affects an unknown part. Executing a manipulation can lead to information disclosure. This vulnerability is registered as CVE-2026-69519. It is
CVE-2026-69400 | Microsoft Azure Logic Apps path traversal (EUVD-2026-63626 / WID-SEC-2026-2951)
A vulnerability marked as critical has been reported in Microsoft Azure Logic Apps. Affected by this issue is some unknown functionality. Performing a manipulation results in path traversal. This vulnerability is cataloged as CVE-2026-69400
CVE-2026-68789 | Microsoft Azure SQL Database sql injection (WID-SEC-2026-2951)
A vulnerability has been found in Microsoft Azure SQL Database and classified as critical. The impacted element is an unknown function. Performing a manipulation results in sql injection. This vulnerability is known as CVE-2026-68789. Remot
Researchers Use AI to Discover Critical Linux Kernel Flaw That Enables Virtual Machine Escape
Researchers at pwn.ai used an AI-assisted research harness to find a critical Linux kernel networking flaw, tracked as CVE-2026-99999 and nicknamed “PwnEscape”. It lets an untrusted guest virtual machine leak host kernel memory and, in lab
Hackers Exploit Critical Nextcloud Collabora Flaw to Execute Remote Commands
Hackers are exploiting a critical vulnerability in Nextcloud’s built-in Collabora Online CODE Server app to run operating system commands without authentication. Tracked as CVE-2026-110447, the flaw affects richdocumentscode versions before
CVE-2026-102556 | Red Hat Enterprise Linux libsoup heap-based overflow (Nessus ID 366321)
A vulnerability classified as very critical was found in Red Hat Enterprise Linux. Impacted is an unknown function of the component libsoup. Executing a manipulation can lead to heap-based buffer overflow. This vulnerability is registered a
CVE-2026-102557 | Red Hat Enterprise Linux up to 10 libsoup heap-based overflow (Nessus ID 366321)
A vulnerability classified as very critical has been found in Red Hat Enterprise Linux 6/7/8/9/10. This issue affects some unknown processing of the component libsoup. Performing a manipulation results in heap-based buffer overflow. This vu
CVE-2026-101258 | Red Hat Enterprise Linux Ghostscript sandbox (EUVD-2026-93982 / Nessus ID 366323)
A vulnerability marked as critical has been reported in Red Hat Enterprise Linux. This impacts an unknown function of the component Ghostscript. Performing a manipulation results in sandbox issue. This vulnerability is identified as CVE-202
CVE-2026-76927 | Wireshark up to 4.4.18/4.6.7 H.245 Protocol Dissector input validation (Nessus ID 366330)
A vulnerability was found in Wireshark up to 4.4.18/4.6.7. It has been declared as problematic. This affects an unknown function of the component H.245 Protocol Dissector. The manipulation results in improper input validation. This vulnerab
BeyondTrust 0-Day Vulnerability Exploited Since August to Gain Full Admin Access in Minutes
A critical zero-day vulnerability in BeyondTrust Remote Support was exploited in late August, weeks before the company disclosed the flaw and released a patch. The suspected China-linked espionage group ARMORY CASTLE used the weakness to ac
CVE-2026-76919 | Wireshark up to 4.4.17/4.6.7 ESS Protocol Dissector denial of service (EUVD-2026-63173 / Nessus ID 366330)
A vulnerability identified as problematic has been detected in Wireshark up to 4.4.17/4.6.7. This affects an unknown function of the component ESS Protocol Dissector. This manipulation causes denial of service. This vulnerability is tracked
CVE-2026-76880 | Wireshark up to 4.4.17/4.6.7 RRC protocol dissector denial of service (Nessus ID 366330)
A vulnerability has been found in Wireshark up to 4.4.17/4.6.7 and classified as problematic. This affects an unknown part of the component RRC protocol dissector. This manipulation causes denial of service. This vulnerability is handled as
CVE-2026-76886 | Wireshark up to 4.4.17/4.6.7 Dissector input validation (Nessus ID 366330)
A vulnerability has been found in Wireshark up to 4.4.17/4.6.7 and classified as critical. Impacted is an unknown function of the component Dissector. Performing a manipulation results in improper input validation. This vulnerability is kno
CVE-2026-107570 | Mutt up to 2.4.2 convert_file_from_to out-of-bounds write (EUVD-2026-94853 / Nessus ID 366332)
A vulnerability classified as problematic was found in Mutt up to 2.4.2. This affects the function convert_file_from_to. Executing a manipulation can lead to out-of-bounds write. The identification of this vulnerability is CVE-2026-107570.
CVE-2018-0851 | Microsoft Office up to 2016 memory corruption (Nessus ID 106817 / ID 110311)
A vulnerability, which was classified as critical, has been found in Microsoft Office 2007 SP2/2010 SP2/2013 RT SP1/2013 SP1/2016. Affected is an unknown function. This manipulation causes memory corruption. This vulnerability appears as CV
CVE-2017-7674 | Apache Tomcat up to 7.0.78/8.0.44/8.5.15/9.0.0.M21 CORS Filter Cache Poisoning data authenticity (RHSA-2017:1801 / Nessus ID 102587)
A vulnerability was found in Apache Tomcat up to 7.0.78/8.0.44/8.5.15/9.0.0.M21. It has been rated as problematic. This affects an unknown part of the component CORS Filter. This manipulation causes insufficient verification of data authent
CVE-2017-12616 | Apache Tomcat up to 7.0.80 VirtualDirContext Source information disclosure (RHSA-2018:0465 / Nessus ID 103430)
A vulnerability described as problematic has been identified in Apache Tomcat up to 7.0.80. This vulnerability affects unknown code of the component VirtualDirContext. Executing a manipulation can lead to information disclosure (Source). Th
CVE-2017-12172 | PostgreSQL up to 10.0 link following (RHSA-2017:3402 / Nessus ID 104574)
A vulnerability was found in PostgreSQL up to 10.0. It has been rated as critical. This issue affects some unknown processing. This manipulation causes link following. This vulnerability is registered as CVE-2017-12172. The attack needs to
BeyondTrust Zero-Day: Hacker übernehmen Remote-Support-Appliances
LONDON (IT BOLTWISE) – Eine von China-nexus-Aktivisten betriebene Gruppe soll eine Zero-Day-Lücke in BeyondTrust Remote Support ausgenutzt haben, um Remote-Support-Appliances zu übernehmen. Laut Meldung betraf die Schwachstelle die unzureic
China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers
The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026. The vulnerability
CVE-2026-62834 | Microsoft Azure Data Factory improper authorization (WID-SEC-2026-2951)
A vulnerability classified as critical has been found in Microsoft Azure Data Factory. This vulnerability affects unknown code. The manipulation leads to improper authorization. This vulnerability is documented as CVE-2026-62834. The attack
CVE-2026-55467 | OpenPrinting CUPS up to 2.4.19 Option String Builder scheduler/job.c cupsdCreateJob destination-uri/pre-dial-string injection (WID-SEC-2026-3860)
A vulnerability classified as problematic has been found in OpenPrinting CUPS up to 2.4.19. This affects the function cupsdCreateJob of the file scheduler/job.c of the component Option String Builder. Performing a manipulation of the argume
CVE-2026-110039 | Smush Plugin up to 4.3.3 on WordPress authorization (EUVD-2026-102695)
A vulnerability marked as problematic has been reported in Smush Plugin up to 4.3.3 on WordPress. This affects an unknown part. This manipulation causes incorrect authorization. The identification of this vulnerability is CVE-2026-110039. I
CVE-2026-110015 | Salon Booking System Plugin up to 10.31.8 on WordPress REST API Request Verification cross-site request forgery (EUVD-2026-102694)
A vulnerability, which was classified as problematic, was found in Salon Booking System Plugin up to 10.31.8 on WordPress. This issue affects some unknown processing of the component REST API Request Verification. Executing a manipulation c
CVE-2026-110014 | Salon Booking System Plugin up to 10.31.8 on WordPress authorization (EUVD-2026-102693)
A vulnerability labeled as critical has been found in Salon Booking System Plugin up to 10.31.8 on WordPress. Affected by this issue is some unknown functionality. The manipulation results in missing authorization. This vulnerability was na
CVE-2026-110179 | affiliate-toolkit Plugin up to 3.8.8 on WordPress sort sql injection (EUVD-2026-102697)
A vulnerability described as critical has been identified in affiliate-toolkit Plugin up to 3.8.8 on WordPress. This vulnerability affects unknown code. Such manipulation of the argument sort leads to sql injection. This vulnerability is re
CVE-2026-110135 | OTP Login & Register Woocommerce Plugin up to 2.7.2 on WordPress improper authentication (EUVD-2026-102696)
A vulnerability described as critical has been identified in OTP Login &amp; Register Woocommerce Plugin up to 2.7.2 on WordPress. Affected by this vulnerability is an unknown functionality. The manipulation results in improper authenti
CVE-2026-110191 | Product Delivery Date Plugin up to 3.3.1 on WordPress Calendar View information disclosure (EUVD-2026-102698)
A vulnerability classified as problematic has been found in Product Delivery Date Plugin up to 3.3.1 on WordPress. Affected by this issue is some unknown functionality of the component Calendar View. This manipulation causes information dis
Chinese Hackers Exploit BeyondTrust Zero-Day to Gain Root Access and Deploy Backdoors
A suspected China-linked espionage group exploited a zero-day vulnerability in BeyondTrust Remote Support appliances to gain access, reach root privileges and install tools for continued access. Google Threat Intelligence Group (GTIG) says
CISA Warns of Palo Alto Networks PAN-OS Code Injection Vulnerability Exploited in Attacks
The U.S. Cybersecurity and Infrastructure Security Agency has added a high-severity Palo Alto Networks PAN-OS vulnerability to its Known Exploited Vulnerabilities catalog after confirming it is being used in real-world attacks. The flaw, tr
CVE-2026-110073 | Adobe Experience Manager up to 6.5.25 Form Fields cross site scripting (WID-SEC-2026-3926)
A vulnerability was found in Adobe Experience Manager up to 6.5.25. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Form Fields. Performing a manipulation results in cross site scripti
CVE-2026-110037 | Adobe Experience Manager up to 6.5 cross site scripting (WID-SEC-2026-3926)
A vulnerability categorized as problematic has been discovered in Adobe Experience Manager up to 6.5. This affects an unknown part. Executing a manipulation can lead to cross site scripting. This vulnerability is registered as CVE-2026-1100
CVE-2026-109415 | Adobe Experience Manager Form Fields cross site scripting (WID-SEC-2026-3926)
A vulnerability was found in Adobe Experience Manager. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Form Fields. Such manipulation leads to cross site scripting. This vulne
CVE-2026-107682 | Adobe Experience Manager up to 6.5.25 cross site scripting (WID-SEC-2026-3926)
A vulnerability was found in Adobe Experience Manager up to 6.5.25. It has been classified as problematic. Affected is an unknown function. This manipulation causes cross site scripting. This vulnerability is tracked as CVE-2026-107682. The
CVE-2026-107305 | Adobe Experience Manager up to 6.5.25 Form Fields cross site scripting (WID-SEC-2026-3926)
A vulnerability has been found in Adobe Experience Manager up to 6.5.25 and classified as problematic. This affects an unknown function of the component Form Fields. The manipulation leads to cross site scripting. This vulnerability is refe
CVE-2026-106634 | Adobe Experience Manager path traversal (WID-SEC-2026-3926)
A vulnerability described as problematic has been identified in Adobe Experience Manager. This vulnerability affects unknown code. The manipulation results in path traversal. This vulnerability is known as CVE-2026-106634. It is possible to
CVE-2026-106633 | Adobe Experience Manager 6.5 cross site scripting (WID-SEC-2026-3926)
A vulnerability was found in Adobe Experience Manager 6.5 and classified as problematic. This impacts an unknown function. The manipulation results in cross site scripting. This vulnerability is identified as CVE-2026-106633. The attack can
CVE-2026-106632 | Adobe Experience Manager cross site scripting (WID-SEC-2026-3926)
A vulnerability, which was classified as problematic, was found in Adobe Experience Manager. The impacted element is an unknown function. Executing a manipulation can lead to cross site scripting. The identification of this vulnerability is
CVE-2026-110916 | Google Chrome up to 155.0.8059.79 Desktop input validation (Nessus ID 366326)
A vulnerability categorized as critical has been discovered in Google Chrome. Affected by this issue is some unknown functionality of the component Desktop. The manipulation results in improper input validation. This vulnerability is known
CVE-2026-106631 | Adobe Experience Manager 6.5/6.5 LTS Form Fields cross site scripting (WID-SEC-2026-3926)
A vulnerability classified as problematic was found in Adobe Experience Manager 6.5 LTS/6.5. Impacted is an unknown function of the component Form Fields. Such manipulation leads to cross site scripting. This vulnerability is uniquely ident
CVE-2026-106630 | Adobe Experience Manager 6.5 cross site scripting (WID-SEC-2026-3926)
A vulnerability, which was classified as problematic, has been found in Adobe Experience Manager 6.5. The affected element is an unknown function. Performing a manipulation results in cross site scripting. This vulnerability was named CVE-2
CVE-2026-106629 | Adobe Experience Manager Form Fields cross site scripting (WID-SEC-2026-3926)
A vulnerability classified as problematic has been found in Adobe Experience Manager. This issue affects some unknown processing of the component Form Fields. This manipulation causes cross site scripting. This vulnerability is handled as C
CVE-2026-106628 | Adobe Experience Manager 6.5 cross site scripting (WID-SEC-2026-3926)
A vulnerability marked as problematic has been reported in Adobe Experience Manager 6.5. This affects an unknown part. The manipulation leads to cross site scripting. This vulnerability is traded as CVE-2026-106628. It is possible to initia
CVE-2026-106626 | Adobe Experience Manager as a Cloud Service input validation (WID-SEC-2026-3926)
A vulnerability labeled as problematic has been found in Adobe Experience Manager as a Cloud Service and Experience Manager. Affected by this issue is some unknown functionality. Executing a manipulation can lead to improper input validatio
CVE-2026-105895 | Adobe Experience Manager up to 6.5.25 input validation (WID-SEC-2026-3926)
A vulnerability categorized as critical has been discovered in Adobe Experience Manager up to 6.5.25. Affected is an unknown function. Such manipulation leads to improper input validation. This vulnerability is documented as CVE-2026-105895
CVE-2026-103848 | Adobe Experience Manager 6.5 os command injection (WID-SEC-2026-3926)
A vulnerability identified as critical has been detected in Adobe Experience Manager 6.5. Affected by this vulnerability is an unknown functionality. Performing a manipulation results in os command injection. This vulnerability is reported
Ivanti Connect Secure Zero-Day CVE-2026-104935 [2026] - Tech Insider
Elias Virtanen is the Cybersecurity Analyst at Tech Insider, bringing hands-on expertise from his background in penetration testing and security ... Weiterlesen
CVE-2026-95686 | The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'targetUrl' parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected pa
The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'targetUrl' parameter in all versions up to, and includi
CVE-2026-104000 | The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all versions up to, and including, 1.6.12.35 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious payload is stored unconditionally because debug logging is
The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all versions up to, and including, 1.6.12.35 due to insufficient input sanitization and output escaping. This m
CVE-2026-107748 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 4.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a us
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 4.0.3 du
CVE-2026-103999 | The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5.54 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The extension blocklist gatekeeper is bypassed by uploading text-type files (.txt, .
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5.54 due to insufficient input sanitization and output escaping. This makes it pos
CVE-2026-103480 | The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The
The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 3.0.1 due to insufficient input sanitizatio