Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 720 | 0,2 % |
| ≥50 % | 3.222 | 0,9 % |
| ≥10 % | 22.115 | 6,0 % |
| <10 % | 343.282 | 92,9 % |
CVE-2026-96869 | Mozilla Firefox up to 140.16/153.3/156 Networking information disclosure (Nessus ID 366012 / WID-SEC-2026-3654)
A vulnerability, which was classified as problematic, has been found in Mozilla Firefox up to 140.16/153.3/156. The impacted element is an unknown function of the component Networking. Performing a manipulation results in information disclo
CVE-2026-100786 | Mozilla Firefox up to 115.41/140.16/153.3/156 Graphics use after free (Nessus ID 366012 / WID-SEC-2026-3654)
A vulnerability was found in Mozilla Firefox up to 115.41/140.16/153.3/156. It has been declared as critical. This impacts an unknown function of the component Graphics. The manipulation results in use after free. This vulnerability is cata
CVE-2026-100797 | Mozilla Firefox up to 115.41/140.16/153.3/156 WebRender use after free (Nessus ID 366012 / WID-SEC-2026-3654)
A vulnerability classified as critical has been found in Mozilla Firefox up to 115.41/140.16/153.3/156. Impacted is an unknown function of the component WebRender. This manipulation causes use after free. This vulnerability is handled as CV
CVE-2026-100779 | Mozilla Firefox up to 115.41/140.16/153.3/156 XSLT use after free (Nessus ID 366012 / WID-SEC-2026-3654)
A vulnerability, which was classified as critical, has been found in Mozilla Firefox up to 115.41/140.16/153.3/156. This issue affects some unknown processing of the component XSLT. This manipulation causes use after free. The identificatio
Drupal Field UI: Security-Team schließt kritischen RCE-Pfad (CVE-2026-108097)
LONDON (IT BOLTWISE) – Drupal schließt eine kritische Schwachstelle im Field-UI-Modul, die einen Angreifer zur Ausführung von Code auf dem Server nutzen könnte. Die Fixes wurden am 14. Oktober in mehreren Drupal-Versionen ausgeliefert, daru
Version 1.0: Cisco Secure Email Gateway - Zero-Day-Schwachstelle wird aktiv ausgenutzt
Weiterlesen
Resumo das Atualizações de Segurança da Microsoft – Outubro 2026, em português
YouTube VideoNosso mini-briefing de outubro traz uma visão geral da release de atualizações de segurança da Microsoft e a análise de alguns destaques do mês. 00:00 - Introdução 00:35 - Visão geral da release 04:40 - CVE-2026-96951 — Window
What’s old is new: Lightwell discovers novel zero-day vulnerability in core Java framework
Enterprise IT runs on decades-old foundational code. The prevailing assumption around these mature components is that if code has been sitting untouched in production for ten years without breaking, it must be safe. Libraries like the Eclip
Mysteriöse Sicherheitslücke: AMD-GPUs erhalten seltene vBIOS-Updates
Für ältere Grafikkarten der Radeon-RX-7000-Serie von AMD stehen aktuell vBIOS-Updates bereit. Sie sollen eine bisher nicht näher spezifizierte potenzielle Sicherheitslücke schließen. AMD rät Besitzern entsprechender Hardware zum zeitnahen U
Attackers exploit Palo Alto PAN-OS flaw for root access as CISA orders three-day fix
Attackers are exploiting a newly disclosed flaw in Palo Alto Networks’ PAN-OS firewall software to run code with root privileges, and US federal agencies have been ordered to fix it and check for compromise by October 17. Palo Alto Networks
CVE-2026-100777 | Mozilla Firefox up to 115.41/140.16/153.3/156 Canvas2D use after free (Nessus ID 366012 / WID-SEC-2026-3654)
A vulnerability classified as critical has been found in Mozilla Firefox up to 115.41/140.16/153.3/156. This affects an unknown part of the component Canvas2D. The manipulation leads to use after free. This vulnerability is uniquely identif
CVE-2026-100766 | Mozilla Firefox up to 115.41/140.16/153.3/156 JAR information disclosure (Nessus ID 366012 / WID-SEC-2026-3654)
A vulnerability was found in Mozilla Firefox up to 115.41/140.16/153.3/156 and classified as problematic. Affected by this issue is some unknown functionality of the component JAR. The manipulation results in information disclosure. This vu
CVE-2026-100820 | Mozilla Firefox up to 140.16/153.3/156 Address Bar privileges management (Nessus ID 366012 / WID-SEC-2026-3654)
A vulnerability classified as critical was found in Mozilla Firefox up to 140.16/153.3/156. Affected by this issue is some unknown functionality of the component Address Bar. The manipulation results in improper privilege management. This v
CVE-2026-100794 | Mozilla Firefox up to 140.16/153.3/156 Internationalization privileges management (Nessus ID 366012 / WID-SEC-2026-3654)
A vulnerability described as critical has been identified in Mozilla Firefox up to 140.16/153.3/156. This issue affects some unknown processing of the component Internationalization. The manipulation results in improper privilege management
CVE-2026-100801 | Mozilla Firefox up to 140.16/153.3/156 DLL Services privileges management (Nessus ID 366012 / WID-SEC-2026-3654)
A vulnerability marked as critical has been reported in Mozilla Firefox up to 140.16/153.3/156. The affected element is an unknown function of the component DLL Services. This manipulation causes improper privilege management. This vulnerab
CVE-2017-9050 | libxml2 20904-GITv2.9.4-16-g0741801 dict.c xmlDictAddString memory corruption (Nessus ID 100708 / ID 170014)
A vulnerability was found in libxml2 20904-GITv2.9.4-16-g0741801. It has been classified as critical. Affected is the function xmlDictAddString of the file dict.c. Performing a manipulation results in memory corruption. This vulnerability w
CVE-2017-9049 | libxml2 20904-GITv2.9.4-16-g0741801 dict.c xmlDictComputeFastKey memory corruption (Nessus ID 100708 / ID 170014)
A vulnerability was found in libxml2 20904-GITv2.9.4-16-g0741801 and classified as critical. This impacts the function xmlDictComputeFastKey of the file dict.c. Such manipulation leads to memory corruption. This vulnerability is uniquely id
CVE-2017-9048 | libxml2 20904-GITv2.9.4-16-g0741801 valid.c memory corruption (EUVD-2017-17988 / Nessus ID 100708)
A vulnerability has been found in libxml2 20904-GITv2.9.4-16-g0741801 and classified as critical. This affects an unknown function of the file valid.c. This manipulation causes memory corruption. This vulnerability is handled as CVE-2017-90
CVE-2017-7376 | libxml2 Redirect memory corruption (Nessus ID 101288 / ID 170150)
A vulnerability described as critical has been identified in libxml2. Impacted is an unknown function of the component Redirect Handler. The manipulation results in memory corruption. This vulnerability is known as CVE-2017-7376. It is poss
CVE-2017-7375 | libxml2 xml external entity reference (EUVD-2017-16402 / Nessus ID 104492)
A vulnerability marked as critical has been reported in libxml2. This issue affects some unknown processing. The manipulation leads to xml external entity reference. This vulnerability is traded as CVE-2017-7375. It is possible to initiate
CVE-2017-18258 | libxml2 up to 2.9.5 LZMA File xzlib.c xz_head resource management (USN-3739-1 / Nessus ID 117811)
A vulnerability classified as problematic has been found in libxml2 up to 2.9.5. Affected by this issue is the function xz_head in the library xzlib.c of the component LZMA File Handler. The manipulation leads to improper resource managemen
CVE-2017-17512 | sensible-utils up to 0.0.10 sensible-browser --proxy-pac-file injection (USN-3584-1 / Nessus ID 105431)
A vulnerability was found in sensible-utils up to 0.0.10. It has been declared as critical. This issue affects some unknown processing of the component sensible-browser. The manipulation of the argument --proxy-pac-file as part of Environme
CVE-2017-16931 | Oracle Fujitsu M10-1 libxml2 memory corruption
A vulnerability was found in Oracle Fujitsu M10-1, Fujitsu M10-4, Fujitsu M10-4S, Fujitsu M12-1, Fujitsu M12-2 and Fujitsu M12-2S. It has been classified as very critical. This affects an unknown part of the component libxml2. Performing a
CVE-2017-0663 | Google Android up to 7.1.2 libxml2 access control (Nessus ID 101056 / ID 196911)
A vulnerability categorized as critical has been discovered in Google Android up to 7.1.2. Affected is an unknown function of the component libxml2. Such manipulation leads to improper access controls. This vulnerability is referenced as CV
CVE-2026-98134 | Linux Kernel up to 7.2.6/7.3-rc1 BPF Verifier check_cond_jmp_op null pointer dereference (EUVD-2026-86965)
A vulnerability marked as very critical has been reported in Linux Kernel up to 7.2.6/7.3-rc1. Affected by this vulnerability is the function check_cond_jmp_op of the component BPF Verifier. Performing a manipulation results in null pointer
CVE-2026-98144 | Linux Kernel up to 7.2.6/7.3-rc1 amdxdna amdxdna_cmd_set_error information disclosure (EUVD-2026-86975)
A vulnerability was found in Linux Kernel up to 7.2.6/7.3-rc1. It has been classified as problematic. Affected by this vulnerability is the function amdxdna_cmd_set_error of the component amdxdna. This manipulation causes information disclo
CVE-2026-98162 | Linux Kernel ksmbd smb2_tree_connect tree_conns resource consumption (EUVD-2026-87062 / WID-SEC-2026-3588)
A vulnerability was found in Linux Kernel. It has been classified as critical. Affected by this issue is the function smb2_tree_connect of the component ksmbd. This manipulation of the argument tree_conns causes resource consumption. This v
CVE-2026-98147 | Linux Kernel up to 7.2.6/7.3-rc2 printk kthread_run unusual condition (EUVD-2026-86978)
A vulnerability classified as critical has been found in Linux Kernel up to 7.2.6/7.3-rc2. This affects the function kthread_run of the component printk. Performing a manipulation results in improper check for unusual conditions. This vulne
CVE-2026-98166 | Linux Kernel up to 7.2.7/7.3-rc3 TTM Swapout Logic drm/ttm ttm_tt_swapout use after free (EUVD-2026-93094 / WID-SEC-2026-3743)
A vulnerability classified as problematic has been found in Linux Kernel up to 7.2.7/7.3-rc3. This vulnerability affects the function ttm_tt_swapout of the file drm/ttm of the component TTM Swapout Logic. Performing a manipulation results i
CVE-2026-79830 | HPE NonStop Kernel T1132L01 Thread Model Lib stack-based overflow (EUVD-2026-102001)
A vulnerability classified as very critical was found in HPE NonStop Kernel T1132L01. The affected element is an unknown function of the component Thread Model Lib. Such manipulation leads to stack-based buffer overflow. This vulnerability
CVE-2017-9047 | libxml2 20904-GITv2.9.4-16-g0741801 valid.c memory corruption (Nessus ID 100708 / ID 170014)
A vulnerability, which was classified as critical, was found in libxml2 20904-GITv2.9.4-16-g0741801. The impacted element is an unknown function of the file valid.c. The manipulation results in memory corruption. This vulnerability is known
CVE-2016-9318 | libxml2 up to 2.9.4 xml external entity reference (Nessus ID 99916 / ID 172163)
A vulnerability classified as critical was found in libxml2 up to 2.9.4. This affects an unknown function. The manipulation results in xml external entity reference. This vulnerability was named CVE-2016-9318. The attack needs to be approac
CVE-2016-4658 | libxml2 memory corruption (Nessus ID 94319 / ID 196731)
A vulnerability labeled as critical has been found in libxml2. Affected by this issue is some unknown functionality. Executing a manipulation can lead to memory corruption. This vulnerability appears as CVE-2016-4658. The attack may be perf
CVE-2016-10228 | GNU C Library up to 2.25 iconv -c input validation (Nessus ID 266254 / BID-96525)
A vulnerability labeled as problematic has been found in GNU C Library up to 2.25. Affected by this vulnerability is an unknown functionality of the component iconv. Such manipulation of the argument -c leads to improper input validation. T
CVE-2015-8126 | Apple Mac OS X up to 10.11.3 Python memory corruption (HT206167 / Nessus ID 89527)
A vulnerability was found in Apple Mac OS X up to 10.11.3. It has been classified as critical. Impacted is an unknown function of the component Python. Performing a manipulation results in memory corruption. This vulnerability is identified
CVE-2015-6117 | Microsoft SharePoint Foundation 2013 SP1 Access Control Policy cross site scripting (MS16-004 / Nessus ID 87882)
A vulnerability classified as problematic has been found in Microsoft SharePoint Foundation 2013 SP1. This issue affects some unknown processing of the component Access Control Policy. Performing a manipulation results in cross site scripti
CVE-2015-5351 | Apache Tomcat 7.0/8.0/9.0 Index Page cross-site request forgery (RHSA-2016:1087 / Nessus ID 88936)
A vulnerability categorized as problematic has been discovered in Apache Tomcat 7.0/8.0/9.0. Affected by this issue is some unknown functionality of the component Index Page. Executing a manipulation can lead to cross-site request forgery.
CVE-2015-5346 | Apache Tomcat 7.0/8.0/9.0 requestedSessionSSL session fixiation (RHSA-2016:1087 / Nessus ID 88937)
A vulnerability has been found in Apache Tomcat 7.0/8.0/9.0 and classified as critical. The impacted element is an unknown function. The manipulation of the argument requestedSessionSSL leads to session fixiation. This vulnerability is uniq
CVE-2015-5345 | Apache Tomcat 6.0/7.0/8.0/9.0 Error path traversal (RHSA-2016:1087 / Nessus ID 88935)
A vulnerability was found in Apache Tomcat 6.0/7.0/8.0/9.0. It has been declared as problematic. Affected is an unknown function of the component Error Handler. Such manipulation leads to path traversal. This vulnerability is referenced as
CVE-2015-5174 | Apache Tomcat 6.0/7.0/8.0/9.0 ServletContext getResource/getResourceAsStream/getResourcePaths path traversal (RHSA-2016:1432 / Nessus ID 88935)
A vulnerability identified as critical has been detected in Apache Tomcat 6.0/7.0/8.0/9.0. This affects the function getResource/getResourceAsStream/getResourcePaths of the component ServletContext. The manipulation leads to path traversal.
CVE-2026-39781 | Dan Rossiter Document Gallery Plugin up to 5.1.1 on WordPress cross site scripting (EUVD-2026-93029)
A vulnerability was found in Dan Rossiter Document Gallery Plugin up to 5.1.1 on WordPress. It has been rated as problematic. This vulnerability affects unknown code. This manipulation causes cross site scripting. This vulnerability appears
CISA Warns of Hackers Exploiting Ivanti Connect Secure Zero-Day to Steal Credentials
CISA urged administrators to patch Ivanti Connect Secure appliances after attackers exploited CVE-2026-104935, a zero-day flaw that allows remote authentication bypass and command execution, enabling credential theft and data exfiltration.
CVE-2022-46590 | TRENDnet TEW755AP 1.13B01 tools_netstat cameo.cameo.netstat_rsname stack-based overflow (EUVD-2022-49394)
A vulnerability classified as critical has been found in TRENDnet TEW755AP 1.13B01. This issue affects the function tools_netstat. This manipulation of the argument cameo.cameo.netstat_rsname causes stack-based buffer overflow. This vulnera
CVE-2022-46589 | TRENDnet TEW755AP 1.13B01 tools_netstat cameo.cameo.netstat_option stack-based overflow (EUVD-2022-49393)
A vulnerability described as critical has been identified in TRENDnet TEW755AP 1.13B01. This vulnerability affects the function tools_netstat. The manipulation of the argument cameo.cameo.netstat_option results in stack-based buffer overflo
CVE-2022-46588 | TRENDnet TEW755AP 1.13B01 setup_wizard_mydlink sys_service stack-based overflow (EUVD-2022-49392)
A vulnerability marked as critical has been reported in TRENDnet TEW755AP 1.13B01. This affects the function setup_wizard_mydlink. The manipulation of the argument sys_service leads to stack-based buffer overflow. This vulnerability is trad
CVE-2022-46586 | TRENDnet TEW755AP 1.13B01 kick_ban_wifi_mac_allow maclist stack-based overflow (EUVD-2022-49390)
A vulnerability labeled as critical has been found in TRENDnet TEW755AP 1.13B01. Affected by this issue is the function kick_ban_wifi_mac_allow. Executing a manipulation of the argument maclist can lead to stack-based buffer overflow. This
CVE-2026-17525 | Incomplete cleanup vulnerability in ABB My Control System. This issue affects My Control System: 26.4 and 26.5.
Incomplete cleanup vulnerability in ABB My Control System. This issue affects My Control System: 26.4 and 26.5.
CVE-2026-79829 | A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption which may result in a system halt.
A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption which may result in a system halt.
CVE-2026-79828 | A heap buffer overflow in HPE NonStop Debug Utilities could corrupt resume-execution address and may potentially redirect execution flow.
A heap buffer overflow in HPE NonStop Debug Utilities could corrupt resume-execution address and may potentially redirect execution flow.
CVE-2026-79827 | A heap buffer overflow in HPE NonStop Inspect Subsystem could corrupt resume-execution address and may potentially redirect execution flow.
A heap buffer overflow in HPE NonStop Inspect Subsystem could corrupt resume-execution address and may potentially redirect execution flow.
CVE-2026-18659 | In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, and `jetty-eeN-servlet`, the Jakarta Spec constraints defined as `http-method-omission` can be bypassed by using substrings of the defined HTTP Methods.
In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, and `jetty-eeN-servlet`, the Jakarta Spec constraints defined as `http-method-omission` can be bypassed by using substrings of the defined HTTP Methods
CVE-2026-18662 | In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec. Resulting in later http-method-omission sets overriding previous constraints with the same http-method-omission set.
In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec. Re
CVE-2026-19864 | Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the authenticated session is persisted to a session data store, the password may consequently be written to persistent storage in plaintext. An attacker with sufficient privileges to read the persisted session data may obtain the plaintext passwords of authenticated users.
Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the authenticated session is persisted to a session data store, the password may cons
CVE-2026-19863 | An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path. This is caused by the authenticator using an unanchored substring match when identifying the login page. If the login path appears later within a protected request path, the request may be treated as the login page and its authentication or role requirement replaced with ALLOWED. Exploitation requires
An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path. This is caused by the authenticator using an unanchored substring match when identi
CVE-2026-79826 | A heap buffer overflow in HPE NonStop OCAX could corrupt address space and may potentially redirect execution flow.
A heap buffer overflow in HPE NonStop OCAX could corrupt address space and may potentially redirect execution flow.
CVE-2026-50619 | A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attackers to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsirch 7.0.3.0 and later
A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attackers to read the contents of unexpected files or system data. We have already fixed the vulnerability in the followi
CVE-2026-47790 | A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: QuFTP Service 1.4.6 and later QuFTP Service 1.5.5 and later QuFTP Service 1.6.5 and later
A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in t
CVE-2026-47786 | An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.23 and later HybridDesk Station 4.3.4 and later
An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following vers
CVE-2026-39997 | A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.22 and later
A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability
CVE-2026-18660 | In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case.
In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case.