Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 753 | 0,2 % |
| ≥50 % | 3.325 | 0,9 % |
| ≥10 % | 22.133 | 5,7 % |
| <10 % | 361.522 | 93,2 % |
CVE-2026-118057 | paultgoodchild Shield Security Plugin up to 22.3.2 on WordPress DataTables ForTraffic.php REQUEST_URI cross site scripting (EUVD-2026-114648)
A vulnerability was found in paultgoodchild Shield Security Plugin up to 22.3.2 on WordPress. It has been rated as problematic. The impacted element is an unknown function of the file ForTraffic.php of the component DataTables. Performing a
CVE-2026-116535 | rainbowgeek SEOPress Plugin up to 10.3 on WordPress display_name cross site scripting (EUVD-2026-114650)
A vulnerability was found in rainbowgeek SEOPress Plugin up to 10.3 on WordPress. It has been declared as problematic. This impacts an unknown function. Executing a manipulation of the argument display_name can lead to cross site scripting.
CVE-2026-103962 | wedevs User Frontend Plugin up to 4.3.13 on WordPress Shortcode field_attr cross site scripting (EUVD-2026-114651)
A vulnerability was found in wedevs User Frontend Plugin up to 4.3.13 on WordPress and classified as problematic. The impacted element is an unknown function of the component Shortcode Handler. Such manipulation of the argument field_attr l
CVE-2026-107759 | WPO365 Microsoft 365 Graph Mailer Plugin up to 6.2 on WordPress Subject cross site scripting (EUVD-2026-114654)
A vulnerability was found in WPO365 Microsoft 365 Graph Mailer Plugin up to 6.2 on WordPress. It has been declared as problematic. The affected element is an unknown function. Such manipulation of the argument Subject leads to cross site sc
CVE-2026-107750 | wpovernight PDF Invoices & Packing Slips for WooCommerce Plugin wp_kses cross site scripting (EUVD-2026-114607)
A vulnerability was found in wpovernight PDF Invoices &amp; Packing Slips for WooCommerce Plugin up to 5.16.4 on WordPress. It has been classified as problematic. This affects the function wp_kses. The manipulation of the argument billi
CVE-2026-115840 | e4jvikwp VikRentCar Car Rental Management System Plugin up to 1.4.9 on WordPress poplink cross site scripting (EUVD-2026-114608)
A vulnerability was found in e4jvikwp VikRentCar Car Rental Management System Plugin up to 1.4.9 on WordPress. It has been rated as problematic. This issue affects some unknown processing. This manipulation of the argument poplink causes cr
CVE-2026-82115 | Apache Wicket up to 8.19.0/9.24.0/10.11.0 WebSocket WebSocketResource.onPayload improper authorization (EUVD-2026-114886)
A vulnerability was found in Apache Wicket up to 8.19.0/9.24.0/10.11.0 and classified as critical. The impacted element is the function WebSocketResource.onPayload of the component WebSocket Handler. The manipulation results in improper aut
CVE-2026-13575 | HTTP::Session up to 0.53 CHI Store CHI.pm session id command injection (EUVD-2026-114833)
A vulnerability, which was classified as critical, has been found in HTTP::Session up to 0.53. This impacts an unknown function of the file lib/HTTP/Session/Store/CHI.pm of the component CHI Store. The manipulation of the argument session i
CVE-2026-120274 | beecue FastBee up to 2.1.0 Groovy Script Executor /iot/script code injection (IKIU7D / EUVD-2026-114885)
A vulnerability classified as problematic has been found in beecue FastBee up to 2.1.0. Affected by this issue is some unknown functionality of the file /iot/script of the component Groovy Script Executor. The manipulation leads to code inj
CVE-2026-82558 | Apache Wicket up to 8.19.0/9.24.0/10.11.0 WebSocket Behavior WebSocketBehavior.java onMessage improper authorization (EUVD-2026-114888)
A vulnerability classified as critical was found in Apache Wicket up to 8.19.0/9.24.0/10.11.0. The affected element is the function onMessage of the file org/apache/wicket/protocol/ws/api/WebSocketBehavior.java of the component WebSocket Be
CVE-2026-82557 | Apache Wicket up to 10.11.0 Form Submission Form.java Form.onRequest improper authorization (EUVD-2026-114887)
A vulnerability was found in Apache Wicket. It has been classified as critical. This affects the function Form.onRequest of the file Form.java of the component Form Submission. This manipulation causes improper authorization. The identifica
CVE-2026-9535 | VTK 9.6.1 vtkChacoReader InputGraph2 out-of-bounds (Nessus ID 374813)
A vulnerability has been found in VTK 9.6.1 and classified as critical. Affected by this vulnerability is the function InputGraph2 of the component vtkChacoReader. This manipulation causes out-of-bounds read. This vulnerability is registere
CVE-2026-119563 | phpMyAdmin up to 5.2.3 Designer query mode history.js DesignerHistory.display cross site scripting (Nessus ID 374815)
A vulnerability was found in phpMyAdmin up to 5.2.3 and classified as problematic. This vulnerability affects the function DesignerHistory.display of the file js/src/designer/history.js of the component Designer query mode. Executing a mani
CVE-2026-119299 | gopacket up to 1.7.1 SCTP Sub-decoder layers/sctp.go out-of-bounds (Nessus ID 374816)
A vulnerability was found in gopacket up to 1.7.1 and classified as problematic. Affected is the function decodeSCTPInit/decodeSCTPShutdown/decodeSCTPError/decodeSCTPSack/decodeSCTPParameter of the file layers/sctp.go of the component SCTP
CVE-2026-119371 | SQLite up to 3.53.x Common Table Expressions selectExpander recursion (Nessus ID 374817)
A vulnerability was found in SQLite up to 3.53.x and classified as problematic. The affected element is the function selectExpander of the component Common Table Expressions. The manipulation results in uncontrolled recursion. This vulnerab
CVE-2026-118374 | OpenBSD LibreSSL up to 4.4.0 ocspcheck http_head_read/http_body_read memory allocation (Nessus ID 374823)
A vulnerability labeled as problematic has been found in OpenBSD LibreSSL up to 4.4.0. Affected is the function http_head_read/http_body_read of the component ocspcheck. The manipulation results in uncontrolled memory allocation. This vulne
CVE-2026-118373 | OpenBSD LibreSSL up to 4.4.0 ocspcheck url2host cleartext transmission (Nessus ID 374823)
A vulnerability categorized as problematic has been discovered in OpenBSD LibreSSL up to 4.4.0. This affects the function url2host of the component ocspcheck. Executing a manipulation can lead to cleartext transmission of sensitive informat
CVE-2026-118372 | OpenBSD LibreSSL up to 4.4.0 ocspcheck url2host crlf injection (Nessus ID 374823)
A vulnerability was found in OpenBSD LibreSSL up to 4.4.0. It has been declared as problematic. This impacts the function url2host of the component ocspcheck. Executing a manipulation can lead to crlf injection. This vulnerability appears a
CVE-2026-118371 | OpenBSD LibreSSL up to 4.4.0 OCSP_sendreq_new/OCSP_parse_url crlf injection (Nessus ID 374823)
A vulnerability was found in OpenBSD LibreSSL up to 4.4.0. It has been classified as problematic. This affects the function OCSP_sendreq_new/OCSP_parse_url. Performing a manipulation results in crlf injection. This vulnerability is reported
CVE-2026-106234 | Google Chrome up to 154.0.8037.97 Network use after free (WID-SEC-2026-3761)
A vulnerability identified as problematic has been detected in Google Chrome. Affected by this issue is some unknown functionality of the component Network. Performing a manipulation results in use after free. This vulnerability is identifi
CVE-2026-106233 | Google Chrome up to 154.0.8037.97 Metrics use after free (WID-SEC-2026-3761)
A vulnerability labeled as critical has been found in Google Chrome. This affects an unknown part of the component Metrics. Executing a manipulation can lead to use after free. This vulnerability is tracked as CVE-2026-106233. The attack ca
CVE-2026-106232 | Google Chrome up to 154.0.8037.97 cross site scripting (WID-SEC-2026-3761)
A vulnerability categorized as problematic has been discovered in Google Chrome. Affected by this vulnerability is an unknown functionality. Such manipulation leads to cross site scripting. This vulnerability is referenced as CVE-2026-10623
CVE-2026-106231 | Google Chrome up to 154.0.8037.97 Dawn uninitialized resource (WID-SEC-2026-3761)
A vulnerability was found in Google Chrome. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Dawn. This manipulation causes uninitialized resource. This vulnerability is tracked as CVE-
CVE-2026-106230 | Google Chrome up to 154.0.8037.97 Offline information disclosure (WID-SEC-2026-3761)
A vulnerability was found in Google Chrome. It has been classified as problematic. Affected is an unknown function of the component Offline. The manipulation leads to information disclosure. This vulnerability is referenced as CVE-2026-1062
CVE-2026-106229 | Google Chrome up to 154.0.8037.97 FileSystem access control (WID-SEC-2026-3761)
A vulnerability, which was classified as critical, was found in Google Chrome. Affected is an unknown function of the component FileSystem. Executing a manipulation can lead to improper access controls. This vulnerability is handled as CVE-
CVE-2026-106228 | Google Chrome up to 154.0.8037.97 Google Lens privileges management (WID-SEC-2026-3761)
A vulnerability classified as critical was found in Google Chrome. This affects an unknown function of the component Google Lens. Such manipulation leads to improper privilege management. This vulnerability is traded as CVE-2026-106228. The
CVE-2026-106227 | Google Chrome up to 154.0.8037.97 Core use after free (WID-SEC-2026-3761)
A vulnerability, which was classified as critical, has been found in Google Chrome. This impacts an unknown function of the component Core. Performing a manipulation results in use after free. This vulnerability is known as CVE-2026-106227.
CVE-2026-106226 | Google Chrome up to 154.0.8037.97 Compositing input validation (WID-SEC-2026-3761)
A vulnerability classified as critical has been found in Google Chrome. The impacted element is an unknown function of the component Compositing. This manipulation causes improper input validation. This vulnerability appears as CVE-2026-106
CVE-2026-106225 | Google Chrome up to 154.0.8037.97 Autofill improper authorization (WID-SEC-2026-3761)
A vulnerability marked as problematic has been reported in Google Chrome. Impacted is an unknown function of the component Autofill. The manipulation leads to improper authorization. This vulnerability is documented as CVE-2026-106225. The
CVE-2026-106224 | Google Chrome up to 154.0.8037.97 Google Lens cross-domain policy (WID-SEC-2026-3761)
A vulnerability described as problematic has been identified in Google Chrome. The affected element is an unknown function of the component Google Lens. The manipulation results in permissive cross-domain policy with untrusted domains. This
Zimbra CVE-2026-73570: Patched in July? Check Whether Someone Got In First
Zimbra fixed CVE-2026-73570 in version 10.1.20 on 20 July 2026. The flaw lets anyone who can send mail to a Zimbra server run shell commands on it, with no login and no user action, as long as the optional zimbra-snmp package is installed a
CVE-2026-99099 | Linux Kernel up to 6.18.56/7.2.10 AMD CPU /CPU/AMD improper synchronization
A vulnerability classified as very critical was found in Linux Kernel up to 6.18.56/7.2.10. This issue affects some unknown processing of the file /CPU/AMD of the component AMD CPU. Executing a manipulation can lead to improper synchronizat
CVE-2026-116471 | BKWLD Decoy up to 5.11.1 Authorization Policy Policy.php role privileges management
A vulnerability categorized as problematic has been discovered in BKWLD Decoy up to 5.11.1. The impacted element is an unknown function of the file Policy.php of the component Authorization Policy. The manipulation of the argument role resu
CVE-2026-116461 | Omega Solution Restro POS up to 20261026 /sale-invoice/ productUnitSalePrice logic error (Issue 29)
A vulnerability, which was classified as problematic, was found in Omega Solution Restro POS up to 20261026. This impacts an unknown function of the file /sale-invoice/. Executing a manipulation of the argument productUnitSalePrice can lead
CVE-2026-116369 | Sunwood-ai-labs github-kanban-mcp-server up to 0.4.0 issue-handlers.ts handleListIssues state/labels os command injection (Issue 26)
A vulnerability was found in Sunwood-ai-labs github-kanban-mcp-server up to 0.4.0 and classified as critical. Impacted is the function handleListIssues of the file src/handlers/issue-handlers.ts. Such manipulation of the argument state/labe
CVE-2026-115917 | vllm-project vLLM up to 0.31.x CORSMiddleware cross-site request forgery
A vulnerability identified as problematic has been detected in vllm-project vLLM up to 0.31.x. The affected element is an unknown function of the component CORSMiddleware. The manipulation leads to cross-site request forgery. This vulnerabi
CVE-2013-10077 | OctoPrint 1.0.0 API Key settings.py getSettings information disclosure
A vulnerability identified as problematic has been detected in OctoPrint 1.0.0. This impacts the function getSettings of the file src/octoprint/server/ajax/settings.py of the component API Key Handler. This manipulation causes information d
CVE-2026-118070 | Welcart E-Commerce Plugin up to 2.12.5 on WordPress gid cross site scripting (EUVD-2026-114609)
A vulnerability categorized as problematic has been discovered in Welcart E-Commerce Plugin up to 2.12.5 on WordPress. Impacted is an unknown function. Such manipulation of the argument gid leads to cross site scripting. This vulnerability
CVE-2026-116548 | e4jvikwp VikRentCar Car Rental Management System Plugin up to 1.4.10 on WordPress optionals cross site scripting (EUVD-2026-114612)
A vulnerability, which was classified as problematic, has been found in e4jvikwp VikRentCar Car Rental Management System Plugin up to 1.4.10 on WordPress. Affected by this issue is some unknown functionality. Performing a manipulation of th
CVE-2026-119065 | arosoft Shipping Zones by Drawing for WooCommerce Plugin up to 3.3.0 on WordPress Checkout Field szbd_checkout_field_update_order_meta szbd-picked cross site scripting (EUVD-2026-114614)
A vulnerability classified as problematic has been found in arosoft Shipping Zones by Drawing for WooCommerce Plugin up to 3.3.0 on WordPress. The impacted element is the function szbd_checkout_field_update_order_meta of the component Check
CVE-2026-111592 | PublishPress Authors Plugin up to 4.17.0 on WordPress name cross site scripting (EUVD-2026-114646)
A vulnerability, which was classified as problematic, has been found in PublishPress Authors Plugin up to 4.17.0 on WordPress. This issue affects some unknown processing. The manipulation of the argument Name leads to cross site scripting.
CVE-2026-120019 | BoldGrid W3 Total Cache Plugin up to 2.10.7 on WordPress Input Sanitization comment cross site scripting (EUVD-2026-114597)
A vulnerability has been found in BoldGrid W3 Total Cache Plugin up to 2.10.7 on WordPress and classified as problematic. This vulnerability affects unknown code of the component Input Sanitization. The manipulation of the argument Comment
CVE-2026-119089 | ThirstyAffiliates Plugin up to 3.12.1 on WordPress Comment Content comment cross site scripting (EUVD-2026-114598)
A vulnerability, which was classified as problematic, was found in ThirstyAffiliates Plugin up to 3.12.1 on WordPress. This affects an unknown part of the component Comment Content. Executing a manipulation of the argument Comment can lead
CVE-2026-116522 | comesio Relevanssi Plugin up to 4.28.5 on WordPress comment cross site scripting (EUVD-2026-114599)
A vulnerability classified as problematic was found in comesio Relevanssi Plugin up to 4.28.5 on WordPress. Affected by this vulnerability is an unknown functionality. Such manipulation of the argument Comment leads to cross site scripting.
CVE-2026-116546 | WP Job Portal Job Portal Plugin up to 2.7.0 on WordPress degreetitle cross site scripting (EUVD-2026-114600)
A vulnerability was found in WP Job Portal Job Portal Plugin up to 2.7.0 on WordPress. It has been classified as problematic. Impacted is an unknown function. This manipulation of the argument degreetitle causes cross site scripting. This v
CVE-2026-119162 | specialk User Submitted Posts Plugin up to 20260916 on WordPress user-submitted-content cross site scripting (EUVD-2026-114603)
A vulnerability labeled as problematic has been found in specialk User Submitted Posts Plugin up to 20260916 on WordPress. The impacted element is an unknown function. Executing a manipulation of the argument user-submitted-content can lead
CVE-2026-107765 | marketingfire Discussion Board Plugin up to 2.6.0 on WordPress Output Escaping ctdb_filter_comment_author_name user_url cross site scripting (EUVD-2026-114602)
A vulnerability was found in marketingfire Discussion Board Plugin up to 2.6.0 on WordPress. It has been declared as problematic. This vulnerability affects the function ctdb_filter_comment_author_name of the component Output Escaping. The
CVE-2026-88942 | Woobewoo Product Filter for WooCommerce by WBW Plugin up to 3.4.6 on WordPress Setting getVar wpf_fid cross site scripting (EUVD-2026-114606)
A vulnerability described as problematic has been identified in Woobewoo Product Filter for WooCommerce by WBW Plugin up to 3.4.6 on WordPress. This impacts the function getVar of the component Setting Handler. The manipulation of the argum
CVE-2026-120242 | Ruijie RG-ES205GC ESW_1.0(1)B1P48 Cloud Management set_cloud_serverUrl.cgi url cross site scripting (EUVD-2026-114884)
A vulnerability labeled as problematic has been found in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P ESW_1.0(1)B1P48. The affected element is an unknown function of the file set_cloud_serverUrl.cgi of the com
CVE-2026-99094 | Linux Kernel up to 6.12.112/6.18.56/7.2.10 btintel_pcie btintel_pcie_prepare_tx memory corruption
A vulnerability classified as very critical has been found in Linux Kernel up to 6.12.112/6.18.56/7.2.10. Affected by this vulnerability is the function btintel_pcie_prepare_tx of the component btintel_pcie. This manipulation causes memory
CVE-2026-116340 | iFlytek astron-agent up to 1.1.2 Console Knowledge-List Endpoint FileInfoV2Service.java FileInfoV2Service.listKnowledgeByPage space-id authorization
A vulnerability classified as problematic was found in iFlytek astron-agent up to 1.1.2. This impacts the function FileInfoV2Service.listKnowledgeByPage of the file FileInfoV2Service.java of the component Console Knowledge-List Endpoint. Su
CVE-2026-116283 | Kameleo up to 5.0.1.26 Local API /profiles information disclosure
A vulnerability was found in Kameleo up to 5.0.1.26. It has been rated as problematic. This affects an unknown part of the file /profiles of the component Local API. This manipulation causes information disclosure. This vulnerability is tra
CVE-2026-116257 | BillaBear up to 2025.01.03 Installation InstallController.php processInstall missing authentication
A vulnerability identified as critical has been detected in BillaBear up to 2025.01.03. Affected by this issue is the function processInstall of the file src/BillaBear/Controller/InstallController.php of the component Installation Handler.
CVE-2026-116254 | rathena FluxCP up to 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d PayPal IPN PaymentNotifyRequest.php verifyiprange X-Real-IP origin validation
A vulnerability, which was classified as critical, has been found in rathena FluxCP up to 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d. This issue affects the function verifyiprange of the file lib/Flux/PaymentNotifyRequest.php of the component
CVE-2026-116236 | Oray Pugongying X5 Pro 7.6.1 PPPoE WAN Setting /tmp/upload_files plugin_init pppd_options unrestricted upload
A vulnerability described as critical has been identified in Oray Pugongying X5 Pro 7.6.1. Affected by this issue is the function plugin_init of the file /tmp/upload_files of the component PPPoE WAN Setting Handler. Such manipulation of the
CVE-2026-116233 | Oray Pugongying X5 Pro 7.6.1 Dnsmasq rent_time crlf injection
A vulnerability identified as very critical has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the component Dnsmasq. The manipulation of the argument rent_time leads to crlf injection. This vulnerability
CVE-2026-116227 | Edimax BR-6208AC 1.32 Virtual Server Page cross site scripting
A vulnerability has been found in Edimax BR-6208AC 1.32 and classified as problematic. This vulnerability affects unknown code of the component Virtual Server Page. The manipulation leads to cross site scripting. This vulnerability is refer
CVE-2026-116563 | NextGEN Gallery Plugin up to 4.5.4 on WordPress Output Escaping comment cross site scripting (EUVD-2026-114573)
A vulnerability was found in NextGEN Gallery Plugin up to 4.5.4 on WordPress. It has been rated as problematic. This impacts an unknown function of the component Output Escaping. Performing a manipulation of the argument Comment results in
CVE-2026-109997 | kstover Ninja Forms Plugin up to 3.15.5 on WordPress Input Sanitization nf_ajax_submit formData.extra cross site scripting (EUVD-2026-114576)
A vulnerability has been found in kstover Ninja Forms Plugin up to 3.15.5 on WordPress and classified as problematic. Impacted is the function nf_ajax_submit of the component Input Sanitization. The manipulation of the argument formData.ext
CVE-2026-109234 | tigroumeow Meow Lightbox Plugin up to 5.6.4 on WordPress post_content cross site scripting (EUVD-2026-114574)
A vulnerability was found in tigroumeow Meow Lightbox Plugin up to 5.6.4 on WordPress and classified as problematic. The affected element is an unknown function. The manipulation of the argument post_content results in cross site scripting.