Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 741 | 0,2 % |
| ≥50 % | 3.216 | 0,8 % |
| ≥10 % | 22.042 | 5,8 % |
| <10 % | 354.730 | 93,2 % |
CVE-2026-111497: Native Brotli Decoder Remote Code Execution and Memory Disclosure
Bulletin ID: 2026-155-AWS Publication Date: 10/28/2026 15:00 PM PDT Description: AWS is aware of CVE-2026-111497, an issue in the native Brotli decompression library that could allow a third party to run code or read process memory in an af
CVE-2023-53677 | Linux Kernel up to 6.3.1 fake_get_pages memory leak (EUVD-2025-31958 / WID-SEC-2025-2229)
A vulnerability described as critical has been identified in Linux Kernel up to 6.3.1. This affects the function fake_get_pages. Executing a manipulation can lead to memory leak. This vulnerability is tracked as CVE-2023-53677. The attack i
CVE-2023-53676 | Linux Kernel up to 6.5.4 scsi lio_target_nacl_info_show buffer overflow (EUVD-2025-31973 / Nessus ID 279063)
A vulnerability classified as critical was found in Linux Kernel up to 6.5.4. Affected by this issue is the function lio_target_nacl_info_show of the component scsi. Executing a manipulation can lead to buffer overflow. This vulnerability i
CVE-2023-53675 | Linux Kernel up to 6.2.2 scsi ses_enclosure_data_process out-of-bounds (EUVD-2025-31966 / Nessus ID 283685)
A vulnerability classified as critical has been found in Linux Kernel up to 6.2.2. Affected by this issue is the function ses_enclosure_data_process of the component scsi. The manipulation leads to out-of-bounds read. This vulnerability is
CVE-2023-53674 | Linux Kernel up to 5.15.120/6.1.38/6.3.12/6.4.3 clk devm_clk_notifier_register memory leak (EUVD-2025-31940 / WID-SEC-2025-2229)
A vulnerability was found in Linux Kernel up to 5.15.120/6.1.38/6.3.12/6.4.3 and classified as critical. This affects the function devm_clk_notifier_register of the component clk. Executing a manipulation can lead to memory leak. This vulne
CVE-2023-53664 | Linux Kernel up to 6.5.2 OPP drivers/opp/core.c dev_pm_opp_get_required_pstate null pointer dereference (EUVD-2025-31949 / WID-SEC-2025-2229)
A vulnerability was found in Linux Kernel up to 6.5.2. It has been classified as critical. This issue affects the function dev_pm_opp_get_required_pstate of the file drivers/opp/core.c of the component OPP. Performing a manipulation results
CVE-2023-53662 | Linux Kernel up to 6.1.53/6.5.3 ext4 ext4_fname_setup_filename memory leak (EUVD-2025-31971 / Nessus ID 303082)
A vulnerability was found in Linux Kernel up to 6.1.53/6.5.3. It has been declared as critical. Impacted is the function ext4_fname_setup_filename of the component ext4. Executing a manipulation can lead to memory leak. This vulnerability a
CVE-2023-53661 | Linux Kernel up to 5.15.112/6.1.29/6.3.3 bnxt bnxt_get_nvram_directory buffer overflow (EUVD-2025-31948 / Nessus ID 278484)
A vulnerability was found in Linux Kernel up to 5.15.112/6.1.29/6.3.3. It has been declared as critical. The impacted element is the function bnxt_get_nvram_directory of the component bnxt. Executing a manipulation can lead to buffer overfl
CVE-2023-53658 | Linux Kernel up to 6.4.3 platform_get_drvdata use after free (EUVD-2025-31957 / Nessus ID 270263)
A vulnerability labeled as critical has been found in Linux Kernel up to 6.4.3. This affects the function platform_get_drvdata. The manipulation results in use after free. This vulnerability is identified as CVE-2023-53658. The attack can o
CVE-2023-34119 | Zoom Rooms up to 5.14.5 temp file
A vulnerability classified as problematic was found in Zoom Rooms up to 5.14.5. This affects an unknown part. The manipulation results in insecure temporary file. This vulnerability is known as CVE-2023-34119. Attacking locally is a require
CVE-2023-33181 | Xibo CMS up to 3.3.4 information exposure (GHSA-c9cx-ghwr-x58m)
A vulnerability marked as problematic has been reported in Xibo CMS up to 3.3.4. This issue affects some unknown processing. This manipulation causes information exposure through error message. This vulnerability is handled as CVE-2023-3318
CVE-2023-31101 | Apache InLong information disclosure
A vulnerability has been found in Apache InLong and classified as problematic. This impacts an unknown function. This manipulation causes information disclosure. This vulnerability is registered as CVE-2023-31101. The attack requires access
CVE-2023-30742 | SAP CRM up to 801 WebClient UI cross site scripting
A vulnerability marked as problematic has been reported in SAP CRM up to 801. Affected by this issue is some unknown functionality of the component WebClient UI. This manipulation causes cross site scripting. This vulnerability is registere
CVE-2023-30741 | SAP BusinessObjects Business Intelligence Platform 420/430 redirect
A vulnerability classified as problematic was found in SAP BusinessObjects Business Intelligence Platform 420/430. This impacts an unknown function. The manipulation results in open redirect. This vulnerability is known as CVE-2023-30741. I
CVE-2023-3055 | AZEXO Page Builder Plugin up to 1.27.133 on WordPress azh_save cross-site request forgery
A vulnerability has been found in AZEXO Page Builder Plugin up to 1.27.133 on WordPress and classified as problematic. This impacts the function azh_save. This manipulation causes cross-site request forgery. The identification of this vulne
CVE-2023-2468 | Google Chrome up to 112.0.5615.137 PictureInPicture Remote Code Execution (FEDORA-2023-12b28d0d37)
A vulnerability labeled as critical has been found in Google Chrome. This issue affects some unknown processing of the component PictureInPicture. Executing a manipulation can lead to Remote Code Execution. This vulnerability is tracked as
CVE-2023-2462 | Google Chrome up to 112.0.5615.137 Prompts Remote Code Execution (FEDORA-2023-12b28d0d37)
A vulnerability was found in Google Chrome and classified as critical. This impacts an unknown function of the component Prompts. Executing a manipulation can lead to Remote Code Execution. This vulnerability is handled as CVE-2023-2462. Th
CVE-2023-22789 | Aruba InstantOS/ArubaOS 10 Command Line command injection (PSA-2023-006)
A vulnerability identified as critical has been detected in Aruba InstantOS and ArubaOS 10. This impacts an unknown function of the component Command Line Handler. Performing a manipulation results in command injection. This vulnerability i
Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN
Cisco Talos has identified UAT-11473, a highly sophisticated advanced persistent threat (APT) actor, who exploited CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances to bypass authentication
CVE-2026-98174 | Linux Kernel up to 7.3-rc3 smb cifs_signal_cifsd_for_reconnect null pointer dereference (Nessus ID 372925 / WID-SEC-2026-3743)
A vulnerability identified as very critical has been detected in Linux Kernel up to 6.6.157/6.12.111/6.18.53/7.2.7/7.3-rc3. The affected element is the function cifs_signal_cifsd_for_reconnect of the component smb. The manipulation leads to
CVE-2026-98222 | Linux Kernel up to 6.12.111/6.18.53/7.2.7/7.3-rc3 KEYS encrypted_key_alloc integer overflow (Nessus ID 372925)
A vulnerability identified as very critical has been detected in Linux Kernel up to 6.12.111/6.18.53/7.2.7/7.3-rc3. This affects the function encrypted_key_alloc of the component KEYS. The manipulation leads to integer overflow. This vulner
CVE-2026-63928 | Linux Kernel up to 7.0.11 Serial Omninet memory corruption (Nessus ID 372926)
A vulnerability classified as very critical has been found in Linux Kernel up to 7.0.11. This vulnerability affects unknown code of the component Serial Omninet. This manipulation causes memory corruption. The identification of this vulnera
CVE-2026-88806 | x.org libX11 up to 1.8.13 XkbGetMap buffer overflow (Nessus ID 372929 / WID-SEC-2026-3503)
A vulnerability marked as critical has been reported in x.org libX11 up to 1.8.13. Affected by this vulnerability is an unknown functionality of the component XkbGetMap Handler. Performing a manipulation results in buffer overflow. This vul
OffSec startet kostenloses PHP2Shell-Lab in PG Play nach kritischen CVEs
NEW YORK / LONDON (IT BOLTWISE) – OffSec stellt in Proving Grounds Play ein kostenloses, interaktives Lab bereit, um PHP2Shell-Angriffe anhand der kritischen CVE-2026-109618 und CVE-2026-109619 praktisch zu untersuchen. Die Lücken hängen mi
CVE-2023-27270 | SAP NetWeaver Application Server for ABAP and ABAP Platform resource consumption
A vulnerability marked as problematic has been reported in SAP NetWeaver Application Server for ABAP and ABAP Platform up to 791. This issue affects some unknown processing. This manipulation of the argument certain causes resource consumpt
CVE-2023-23815 | Alan Jackson Multi-column Tag Map Plugin up to 17.0.24 on WordPress cross site scripting
A vulnerability was found in Alan Jackson Multi-column Tag Map Plugin up to 17.0.24 on WordPress. It has been rated as problematic. Affected by this issue is some unknown functionality. This manipulation causes cross site scripting. This vu
CVE-2023-20627 | MediaTek MT6879/MT6895/MT6983/MT8167/MT8168 pqframework out-of-bounds write (ALPS07629585 / EUVD-2023-24806)
A vulnerability, which was classified as critical, has been found in MediaTek MT6879, MT6895, MT6983, MT8167 and MT8168. The impacted element is an unknown function of the component pqframework. This manipulation causes out-of-bounds write.
CVE-2023-0902 | SourceCodester Simple Food Ordering System 1.0 process_order.php order cross site scripting (EDB-51287)
A vulnerability described as problematic has been identified in SourceCodester Simple Food Ordering System 1.0. This impacts an unknown function of the file process_order.php. Such manipulation of the argument order leads to cross site scri
CVE-2022-48107 | D-Link DIR-878 1.30B08 IPAddress command injection (EUVD-2022-50821)
A vulnerability categorized as critical has been discovered in D-Link DIR-878 1.30B08. This impacts an unknown function of the file /setnetworksettings/IPAddress. Such manipulation leads to command injection. This vulnerability is listed as
CVE-2022-48094 | lmxcms 1.41 TemplateAction.class.php path traversal (EUVD-2022-50808)
A vulnerability categorized as critical has been discovered in lmxcms 1.41. This impacts an unknown function of the file TemplateAction.class.php. Executing a manipulation can lead to path traversal. This vulnerability is handled as CVE-202
CVE-2022-48093 | SeaCMS 12.7 admin_ip.php ip code injection (EUVD-2022-50807)
A vulnerability was found in SeaCMS 12.7. It has been declared as critical. This issue affects some unknown processing of the file admin_ip.php. The manipulation of the argument ip results in code injection. This vulnerability is known as C
CVE-2022-48091 | Tramyardg hotel-mgmt-system 2022.4 process_update_profile.php cross site scripting (Issue 22 / EUVD-2022-50805)
A vulnerability, which was classified as problematic, has been found in Tramyardg hotel-mgmt-system 2022.4. Affected by this vulnerability is an unknown functionality of the file process_update_profile.php. This manipulation causes cross si
CVE-2023-22839 | F5 BIG-IP up to 14.1.5.2/15.1.8.0/16.1.3.2/17.0.0.1 Traffic Management Microkernel null pointer dereference (K37708118)
A vulnerability classified as problematic has been found in F5 BIG-IP up to 14.1.5.2/15.1.8.0/16.1.3.2/17.0.0.1. Affected by this vulnerability is an unknown functionality of the component Traffic Management Microkernel. This manipulation c
CVE-2023-21435 | Samsung Smart Phone Fingerprint TA information disclosure (EUVD-2023-25603)
A vulnerability was found in Samsung Smart Phone. It has been classified as problematic. This affects an unknown part of the component Fingerprint TA. This manipulation causes information disclosure. The identification of this vulnerability
CVE-2023-0704 | Google Chrome up to 109.0.5414.119 DevTools Remote Code Execution (EUVD-2023-12732)
A vulnerability was found in Google Chrome and classified as critical. This issue affects some unknown processing of the component DevTools. Executing a manipulation can lead to Remote Code Execution. This vulnerability appears as CVE-2023-
CVE-2023-0698 | Google Chrome up to 109.0.5414.119 WebRTC out-of-bounds (EUVD-2023-12726)
A vulnerability described as problematic has been identified in Google Chrome. This impacts an unknown function of the component WebRTC. Executing a manipulation can lead to out-of-bounds read. This vulnerability is tracked as CVE-2023-0698
CVE-2023-0697 | Google Chrome up to 109.0.5414.119 Full Screen Mode Remote Code Execution (EUVD-2023-12725)
A vulnerability marked as critical has been reported in Google Chrome. This affects an unknown function of the component Full Screen Mode. Performing a manipulation results in Remote Code Execution. This vulnerability is identified as CVE-2
CVE-2023-0251 | Delta Electronics DIAScreen up to 1.2.1.23 memory corruption (icsa-23-033-01)
A vulnerability described as critical has been identified in Delta Electronics DIAScreen up to 1.2.1.23. The affected element is an unknown function. The manipulation results in memory corruption. This vulnerability is known as CVE-2023-025
CVE-2026-107098 | Royal Addons for Elementor Plugin up to 1.7.1069 on WordPress Map Widget cross site scripting (WID-SEC-2026-4184)
A vulnerability, which was classified as problematic, was found in Royal Addons for Elementor Plugin up to 1.7.1069 on WordPress. This vulnerability affects unknown code of the component Map Widget. The manipulation results in cross site sc
CVE-2026-107097 | Royal Addons Plugin up to 1.7.1069 on WordPress authorization (WID-SEC-2026-4184)
A vulnerability classified as critical has been found in Royal Addons Plugin up to 1.7.1069 on WordPress. Affected by this vulnerability is an unknown functionality. Performing a manipulation results in missing authorization. This vulnerabi
CVE-2026-106648 | Royal Elementor Addons Plugin up to 1.7.1069 on WordPress Email Notification injection (WID-SEC-2026-4184)
A vulnerability categorized as problematic has been discovered in Royal Elementor Addons Plugin up to 1.7.1069 on WordPress. Affected by this vulnerability is an unknown functionality of the component Email Notification. Executing a manipul
CVE-2026-106647 | Royal Addons for Elementor Plugin up to 1.7.1069 on WordPress authorization (WID-SEC-2026-4184)
A vulnerability has been found in Royal Addons for Elementor Plugin up to 1.7.1069 on WordPress and classified as critical. Affected by this issue is some unknown functionality. The manipulation leads to missing authorization. This vulnerab
CVE-2026-107590 | Qt up to 4.4.x/6.8.8/6.11.2 Qt 5 Compatibility APIs module out-of-bounds write (WID-SEC-2026-4178)
A vulnerability was found in Qt up to 4.4.x/6.8.8/6.11.2. It has been classified as critical. This affects an unknown part of the component Qt 5 Compatibility APIs module. The manipulation leads to out-of-bounds write. This vulnerability is
CVE-2026-107472 | Qt up to 3.3.8 QTextCodec TSCII encoding out-of-bounds (WID-SEC-2026-4178)
A vulnerability was found in Qt and classified as critical. The impacted element is an unknown function of the component QTextCodec TSCII encoding. Executing a manipulation can lead to out-of-bounds read. This vulnerability is registered as
CVE-2026-105946 | Qt Group up to 6.7.x/6.8.9/6.11.1 Network out-of-bounds (WID-SEC-2026-4178)
A vulnerability identified as critical has been detected in Qt Group Qt up to 6.7.x/6.8.9/6.11.1. This impacts an unknown function of the component Network Module. This manipulation causes out-of-bounds read. This vulnerability is handled a
Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns
The China-nexus cyber espionage group known as Volt Typhoon has been attributed to a now-disrupted covert access network dubbed Silent Train that has been put to use for zero-day exploitation and strategic access. "First identified in
CVE-2026-5330 | SourceCodester/mayuri_k Best Courier Management System 1.0 User Delete ajax.php?action=delete_user id access control
A vulnerability, which was classified as critical, has been found in SourceCodester/mayuri_k Best Courier Management System 1.0. Affected by this issue is some unknown functionality of the file /ajax.php?action=delete_user of the component
CVE-2026-5328 | shsuishang modulithshop up to 829bac71f507e84684c782b9b062b8bf3b5585d6 ProductItemDao Interface ProductIndexServiceImpl.java listItem sidx/sort sql injection
A vulnerability labeled as critical has been found in shsuishang modulithshop up to 829bac71f507e84684c782b9b062b8bf3b5585d6. The impacted element is the function listItem of the file src/main/java/com/suisung/shopsuite/pt/service/impl/Prod
CVE-2026-4636 | Keycloak authorization before parsing and canonicalization (RHSA-2026:6477)
A vulnerability categorized as critical has been discovered in Keycloak. The affected element is an unknown function. Such manipulation leads to authorization before parsing and canonicalization. This vulnerability is documented as CVE-2026
CVE-2026-4634 | Keycloak scope excessive platform resource consumption within a loop (RHSA-2026:6477 / EUVD-2026-18212)
A vulnerability was found in Keycloak. It has been rated as critical. Impacted is an unknown function. This manipulation of the argument Scope causes excessive platform resource consumption within a loop. This vulnerability is registered as
CVE-2026-4325 | Keycloak SingleUseObjectProvider isolation (RHSA-2026:6477)
A vulnerability described as problematic has been identified in Keycloak. Affected is an unknown function of the component SingleUseObjectProvider. The manipulation results in improper isolation or compartmentalization. This vulnerability i
CVE-2026-4282 | Keycloak isolation (RHSA-2026:6477 / Nessus ID 330085)
A vulnerability marked as problematic has been reported in Keycloak. This impacts an unknown function. The manipulation leads to improper isolation or compartmentalization. This vulnerability is traded as CVE-2026-4282. It is possible to in
CVE-2026-3872 | Keycloak redirect (RHSA-2026:6477)
A vulnerability was found in Keycloak. It has been classified as problematic. This vulnerability affects unknown code. The manipulation leads to open redirect. This vulnerability is listed as CVE-2026-3872. The attack may be initiated remot
CVE-2026-29782 | devcode-it openstamanager up to 2.10.1 oauth2.php unserialize deserialization (GHSA-whv5-4q2f-q68g)
A vulnerability was found in devcode-it openstamanager up to 2.10.1 and classified as problematic. This affects the function unserialize of the file oauth2.php. Executing a manipulation can lead to deserialization. This vulnerability is tra
CVE-2026-26928 | Krajowa Izba Rozliczeniowa SzafirHost up to 1.0.x JAR File Parser /temp integrity check
A vulnerability, which was classified as critical, was found in Krajowa Izba Rozliczeniowa SzafirHost up to 1.0.x. This vulnerability affects unknown code of the file /temp of the component JAR File Parser. Executing a manipulation can lead
CVE-2026-26927 | Krajowa Izba Rozliczeniowa Szafir SDK Web prior 0.0.17.4 document_base_url less trusted source
A vulnerability, which was classified as problematic, has been found in Krajowa Izba Rozliczeniowa Szafir SDK Web. This affects an unknown part. Performing a manipulation of the argument document_base_url results in use of less trusted sour
Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns
The China-nexus cyber espionage group known as Volt Typhoon has been attributed to a now-disrupted covert access network dubbed Silent Train that has been put to use for zero-day exploitation and strategic access. "First identified in
Microsoft Authenticator Flaw Scores 8.6: Android Users Must Update
Microsoft Authenticator flaw CVE-2026-80097 scores 8.6 and puts Android work account tokens at risk. Learn which versions are affected and how to stay safe. Weiterlesen
CVE-2026-116639 | A vulnerability was detected in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to a8902bf64575e325f6d6bf93a55f7bd273ec58cd. Affected is an unknown function of the file chat.php. Performing a manipulation of the argument ID results in cross site scripting. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for aff
A vulnerability was detected in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to a8902bf64575e325f6d6bf93a55f7bd273ec58cd. Affected is an unknown function of the file chat.php. Performing a manipulation of the argument ID results in
CVE-2026-116839 | A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to make unauthorized changes and execute a Denial of Service (DoS) attack on the device.
A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to make unauthorized changes and execute a Denial of Service (DoS) attack on the