Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 784 | 0,2 % |
| ≥50 % | 3.557 | 0,9 % |
| ≥10 % | 13.141 | 3,2 % |
| <10 % | 392.888 | 95,7 % |
CVE-2026-123037 | Red Hat Ansible Automation Platform/Ansible Core User User.ssh_key_gen symlink (Nessus ID 377113)
A vulnerability classified as problematic has been found in Red Hat Ansible Automation Platform and Ansible Core. Affected by this vulnerability is the function User.ssh_key_gen of the component User Module. The manipulation leads to symlin
CVE-2026-48761 | Symfony URL Attribute cross site scripting (Nessus ID 377115)
A vulnerability marked as problematic has been reported in Symfony. Affected is an unknown function of the component URL Attribute Handler. The manipulation leads to cross site scripting. This vulnerability is traded as CVE-2026-48761. It i
CVE-2026-123962 | Debian FreedomBox up to 26.14 authorized_keys privileges management (Nessus ID 377114)
A vulnerability identified as problematic has been detected in Debian FreedomBox up to 26.14. This affects an unknown part of the file authorized_keys. This manipulation causes improper privilege management. The identification of this vulne
CVE-2026-45753 | Symfony HtmlSanitizer cross site scripting (Nessus ID 377115)
A vulnerability was found in Symfony HtmlSanitizer. It has been rated as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. This vulnerability is referenced as CVE-2026-4
CVE-2026-123273 | ImageMagick up to 7.1.2-34/6.9.13-59 SVG Decoder MagickCore/cache.c QueueAuthenticPixelCacheNexus infinite loop (Nessus ID 377117)
A vulnerability was found in ImageMagick up to 7.1.2-34/6.9.13-59 and classified as problematic. The affected element is the function QueueAuthenticPixelCacheNexus of the file MagickCore/cache.c of the component SVG Decoder. Such manipulati
CVE-2026-121949 | SensioLabs Symfony up to 6.4.49/7.4.22/8.1.10 HtmlSanitizer access control (Nessus ID 377115)
A vulnerability classified as problematic was found in SensioLabs Symfony up to 6.4.49/7.4.22/8.1.10. Affected by this issue is some unknown functionality of the component HtmlSanitizer. Such manipulation leads to improper access controls.
CVE-2026-123876 | Red Hat Enterprise Linux Seccomp Profile numeric truncation error (Nessus ID 377118)
A vulnerability, which was classified as problematic, has been found in Red Hat Enterprise Linux, Hardened Images and OpenShift Container Platform. This affects an unknown function of the component Seccomp Profile. This manipulation causes
CVE-2026-121006 | HTTP::Body 1.23_01/1.24_01 Trailer Parsing add resource consumption (Nessus ID 377119)
A vulnerability was found in HTTP::Body 1.23_01/1.24_01. It has been declared as problematic. Impacted is the function Add of the component Trailer Parsing. The manipulation results in resource consumption. This vulnerability is identified
CVE-2026-123202 | bakulf libnxml up to 0.18.5 src/nxml_parser.c buffer overflow (Nessus ID 377120)
A vulnerability described as problematic has been identified in bakulf libnxml up to 0.18.5. Impacted is an unknown function of the file src/nxml_parser.c. Executing a manipulation can lead to buffer overflow. This vulnerability is register
CVE-2026-112938 | tox-dev filelock up to 4.2.0 File Lock src/filelock/_strict.py StrictSoftFileLock._acquire race condition (Nessus ID 377121)
A vulnerability marked as problematic has been reported in tox-dev filelock up to 4.2.0. This affects the function StrictSoftFileLock._acquire of the file src/filelock/_strict.py of the component File Lock. The manipulation leads to race co
CVE-2026-123269 | libyal libvmdk Descriptor File Parser libvmdk_descriptor_file.c libvmdk_descriptor_file_read_header out-of-bounds (Issue 41 / Nessus ID 377122)
A vulnerability labeled as problematic has been found in libyal libvmdk. Affected by this vulnerability is the function libvmdk_descriptor_file_read_header of the file libvmdk/libvmdk_descriptor_file.c of the component Descriptor File Parse
CVE-2026-68481 | Apache CXF up to 3.6.11/4.1.7/4.2.2 DefaultEncryptingOAuthDataProvider access control (WID-SEC-2026-2682)
A vulnerability, which was classified as critical, has been found in Apache CXF up to 3.6.11/4.1.7/4.2.2. This issue affects the function DefaultEncryptingOAuthDataProvider. The manipulation leads to improper access controls. This vulnerabi
CVE-2026-68079 | Apache CXF up to 3.6.11/4.1.7/4.2.2 authentication replay (WID-SEC-2026-2682)
A vulnerability labeled as critical has been found in Apache CXF up to 3.6.11/4.1.7/4.2.2. Affected is an unknown function. The manipulation results in authentication bypass by capture-replay. This vulnerability is known as CVE-2026-68079.
CVE-2026-66909 | Apache CXF up to 3.6.11/4.1.7/4.2.2 JMS Transport deserialization (WID-SEC-2026-2682)
A vulnerability was found in Apache CXF up to 3.6.11/4.1.7/4.2.2. It has been classified as critical. Impacted is an unknown function of the component JMS Transport. This manipulation causes deserialization. This vulnerability is registered
CVE-2026-65583 | Apache CXF up to 3.6.11/4.1.7/4.2.2 improper authentication (WID-SEC-2026-2682)
A vulnerability classified as critical was found in Apache CXF up to 3.6.11/4.1.7/4.2.2. This vulnerability affects unknown code. Executing a manipulation can lead to improper authentication. The identification of this vulnerability is CVE-
CVE-2026-65432 | Apache CXF up to 3.6.11/4.1.7/4.2.2 StaxUtils/WSDL4J xml external entity reference (WID-SEC-2026-2682)
A vulnerability identified as critical has been detected in Apache CXF up to 3.6.11/4.1.7/4.2.2. This impacts an unknown function of the component StaxUtils/WSDL4J. The manipulation leads to xml external entity reference. This vulnerability
CVE-2026-105137 | Laradock up to 20.4 Build Process workspace/Dockerfile code download (EUVD-2026-92085)
A vulnerability, which was classified as problematic, was found in Laradock up to 20.4. Impacted is an unknown function of the file workspace/Dockerfile of the component Build Process. The manipulation results in download of code without in
Hackers Launch Over 240,000 Attacks Targeting WordPress Core Remote Code Execution Flaw
Hackers have launched more than 240,000 exploit attempts against a WordPress core race-condition flaw that exposes websites to unauthenticated remote code execution during upgrades. Wordfence researcher István Márton reported that probing b
CVE-2026-121379 | Tournamatch Plugin up to 4.7.0 on WordPress file inclusion (EUVD-2026-118941)
A vulnerability has been found in Tournamatch Plugin up to 4.7.0 on WordPress and classified as critical. This vulnerability affects unknown code. Performing a manipulation results in file inclusion. This vulnerability is known as CVE-2026-
CVE-2026-121491 | Fiber Admin Plugin up to 4.0.0 on WordPress code injection (EUVD-2026-118943)
A vulnerability categorized as critical has been discovered in Fiber Admin Plugin up to 4.0.0 on WordPress. This affects an unknown function. Such manipulation leads to code injection. This vulnerability is referenced as CVE-2026-121491. It
CVE-2026-121380 | Tournamatch Plugin up to 4.7.0 on WordPress information disclosure (EUVD-2026-118942)
A vulnerability labeled as problematic has been found in Tournamatch Plugin up to 4.7.0 on WordPress. This affects an unknown part. The manipulation results in information disclosure. This vulnerability is identified as CVE-2026-121380. The
CVE-2026-121796 | Add From Server Lite Plugin up to 5.x on WordPress SVG file cross site scripting (EUVD-2026-118945)
A vulnerability was found in Add From Server Lite Plugin up to 5.x on WordPress. It has been classified as problematic. Affected by this vulnerability is an unknown functionality of the component SVG file Handler. Performing a manipulation
CVE-2026-121492 | Fiber Admin Plugin up to 4.0.0 on WordPress authorization (EUVD-2026-118944)
A vulnerability identified as problematic has been detected in Fiber Admin Plugin up to 4.0.0 on WordPress. Affected by this issue is some unknown functionality. The manipulation leads to missing authorization. This vulnerability is referen
CVE-2026-121858 | Event Tickets with Ticket Scanner Plugin up to 3.2.8 on WordPress search sql injection (EUVD-2026-118948)
A vulnerability, which was classified as problematic, has been found in Event Tickets with Ticket Scanner Plugin up to 3.2.8 on WordPress. The impacted element is an unknown function. The manipulation of the argument Search leads to sql inj
CVE-2026-121857 | Event Tickets with Ticket Scanner Plugin up to 3.1.13 on WordPress authorization (EUVD-2026-118947)
A vulnerability classified as critical has been found in Event Tickets with Ticket Scanner Plugin up to 3.1.13 on WordPress. This affects an unknown part. This manipulation causes incorrect authorization. This vulnerability is registered as
CVE-2026-121848 | Magic Link Plugin up to 2.2.5 on WordPress privileges management (EUVD-2026-118946)
A vulnerability marked as critical has been reported in Magic Link Plugin up to 2.2.5 on WordPress. This vulnerability affects unknown code. This manipulation causes improper privilege management. This vulnerability is tracked as CVE-2026-1
CVE-2026-122001 | Komfortkasse for WooCommerce Plugin up to 1.4.8 on WordPress cross-site request forgery (EUVD-2026-118950)
A vulnerability classified as problematic was found in Komfortkasse for WooCommerce Plugin up to 1.4.8 on WordPress. This vulnerability affects unknown code. Such manipulation leads to cross-site request forgery. This vulnerability is docum
CVE-2026-121866 | Exsile iLeads SMS Gateway Plugin up to 1.x on WordPress privileges management (EUVD-2026-118949)
A vulnerability classified as critical has been found in Exsile iLeads SMS Gateway Plugin up to 1.x on WordPress. Impacted is an unknown function. Performing a manipulation results in improper privilege management. This vulnerability is cat
CVE-2026-83495 | Red Hat OpenShift AI Trainer privileges management (EUVD-2026-118951)
A vulnerability was found in Red Hat OpenShift AI and classified as critical. Affected is an unknown function of the component Trainer. Such manipulation leads to improper privilege management. This vulnerability is traded as CVE-2026-83495
CVE-2023-5156 | GNU C Library getaddrinfo.c free_and_return memory leak (EUVD-2023-57494 / Nessus ID 215876)
A vulnerability was found in GNU C Library and classified as problematic. The impacted element is the function free_and_return of the file sysdeps/posix/getaddrinfo.c. The manipulation results in memory leak. This vulnerability was named CV
CVE-2023-34966 | Samba up to 4.16.10/4.17.9/4.18.4 mdssvc RPC Service sl_unpack_loop infinite loop (FEDORA-2023-bcd91bfcd3 / EUVD-2023-39005)
A vulnerability has been found in Samba up to 4.16.10/4.17.9/4.18.4 and classified as problematic. Affected is the function sl_unpack_loop of the component mdssvc RPC Service. The manipulation leads to infinite loop. This vulnerability is d
CVE-2026-119158 | Genetechproducts Pie Register Plugin up to 3.8.4.16 on WordPress first_name cross site scripting (EUVD-2026-118602)
A vulnerability classified as problematic was found in Genetechproducts Pie Register Plugin up to 3.8.4.16 on WordPress. Affected is an unknown function. The manipulation of the argument first_name results in cross site scripting. This vuln
Android-Schwachstelle GhostMap zwingt Smartphones in Absturzschleife
Bitdefender-Forscher haben mit GhostMap eine Schwachstelle entdeckt, durch die eine speziell präparierte Android-App einen dauerhaften Systemabsturz auslösen kann. Betroffene Geräte lassen sich unter Umständen nur noch durch ein Zurücksetze
CVE-2025-61543 | CraftMyCMS 4.0.2.2 HTTP Header Host password recovery
A vulnerability marked as problematic has been reported in CraftMyCMS 4.0.2.2. This vulnerability affects unknown code of the component HTTP Header Handler. Performing a manipulation of the argument Host results in weak password recovery. T
CVE-2025-61541 | Webmin 2.510 Header forgot_send.cgi get_webmin_email_url Host password recovery
A vulnerability identified as problematic has been detected in Webmin 2.510. Affected by this issue is the function get_webmin_email_url of the file forgot_send.cgi of the component Header Handler. This manipulation of the argument Host cau
CVE-2025-61540 | Ultimate PHP Board 2.2.7 lostpassword.php username sql injection
A vulnerability was found in Ultimate PHP Board 2.2.7. It has been declared as critical. This impacts an unknown function of the file lostpassword.php. Executing a manipulation of the argument Username can lead to sql injection. This vulner
CVE-2025-61539 | Ultimate PHP Board 2.2.7 lostpassword.php u_name cross site scripting
A vulnerability described as problematic has been identified in Ultimate PHP Board 2.2.7. This issue affects some unknown processing of the file lostpassword.php. Executing a manipulation of the argument u_name can lead to cross site script
CVE-2025-61536 | FelixRiddle dev-jobs-handlebars 1.0 req.headers.host password recovery
A vulnerability categorized as problematic has been discovered in FelixRiddle dev-jobs-handlebars 1.0. Affected by this vulnerability is an unknown functionality. The manipulation of the argument req.headers.host results in weak password re
CVE-2025-61330 | H3C Magic Telnet Service /etc/shadow weak password
A vulnerability was found in H3C Magic and classified as critical. Impacted is an unknown function of the file /etc/shadow of the component Telnet Service. Such manipulation leads to weak password requirements. This vulnerability is referen
CVE-2025-60641 | Vfront 0.99.52 mexcel.php mexcel deserialization
A vulnerability categorized as problematic has been discovered in Vfront 0.99.52. The affected element is an unknown function of the file mexcel.php. Executing a manipulation of the argument mexcel can lead to deserialization. This vulnerab
CVE-2025-56700 | Base Digitale Group Centrax Open PSIM 6.1 datafine sql injection
A vulnerability marked as critical has been reported in Base Digitale Group Centrax Open PSIM 6.1. The affected element is an unknown function. The manipulation of the argument datafine leads to sql injection. This vulnerability is traded a
CVE-2025-56699 | Base Digitale Group Centrax Open PSIM 6.1 sender sql injection
A vulnerability described as critical has been identified in Base Digitale Group Centrax Open PSIM 6.1. The impacted element is an unknown function. The manipulation of the argument sender results in sql injection. This vulnerability is kno
CVE-2026-72221 | Linux Kernel up to 6.6.144/6.12.96/6.18.39/7.1.4 sunrpc svc_tcp_handshake race condition (Nessus ID 377032)
A vulnerability was found in Linux Kernel up to 6.6.144/6.12.96/6.18.39/7.1.4. It has been declared as very critical. The affected element is the function svc_tcp_handshake of the component sunrpc. Executing a manipulation can lead to race
CVE-2026-72080 | Linux Kernel up to 6.18.41/7.1.4/7.2-rc2 resctrl fs/resctrl resctrl_exit priv use after free (Nessus ID 377032)
A vulnerability labeled as critical has been found in Linux Kernel up to 6.18.41/7.1.4/7.2-rc2. This impacts the function resctrl_exit of the file fs/resctrl of the component resctrl. The manipulation of the argument priv results in use aft
CVE-2026-72222 | Linux Kernel up to 6.6.144/6.12.96/6.18.39/7.1.4 sunrpc svc_tcp_handshake use after free (Nessus ID 377032)
A vulnerability described as very critical has been identified in Linux Kernel up to 6.6.144/6.12.96/6.18.39/7.1.4. The impacted element is the function svc_tcp_handshake of the component sunrpc. Executing a manipulation can lead to use aft
CVE-2026-95818 | GNU glibc up to 2.44 Dynamic Loader ld.so ORIGIN buffer overflow (Nessus ID 377033 / WID-SEC-2026-3522)
A vulnerability classified as problematic has been found in GNU glibc up to 2.44. This issue affects some unknown processing of the file ld.so of the component Dynamic Loader. The manipulation of the argument ORIGIN leads to buffer overflow
CVE-2026-86805 | GNU glibc up to 2.44 Dynamic Loader ld.so toctou (Nessus ID 377033 / WID-SEC-2026-3522)
A vulnerability identified as problematic has been detected in GNU glibc up to 2.44. This affects an unknown function of the file ld.so of the component Dynamic Loader. The manipulation leads to time-of-check time-of-use. This vulnerability
CVE-2026-8674 | glibc up to 2.44 DNS stub resolver buffer overflow (Nessus ID 377033)
A vulnerability has been found in glibc up to 2.44 and classified as problematic. This issue affects some unknown processing of the component DNS stub resolver. The manipulation leads to buffer overflow. This vulnerability is traded as CVE-
Hackers Exploit SonicWall SSL-VPN Vulnerability to Bypass Multi-Factor Authentication in Active Attacks
SonicWall has disclosed an SSL-VPN authentication enforcement flaw that could let attackers bypass SAML authentication and associated multi-factor authentication controls. Tracked as CVE-2026-19868, the issue carries a CVSS score of 7.1. Ad
Fragnesia: Linux-Lücke CVE-2026-46300, CVSS 7,8 [2026] - Tech Insider
Windows-Server stehen bei Patch-Dienstagen im Takt, Linux-Server hängen vom Rhythmus der jeweiligen Distribution ab. Wer viele verschiedene Linux ... Weiterlesen
CVE-2025-9640 | Red Hat Enterprise Linux/OpenShift Container Platform Samba vfs_streams_xattr information disclosure (Nessus ID 270677 / WID-SEC-2025-2322)
A vulnerability was found in Red Hat Enterprise Linux and OpenShift Container Platform. It has been declared as problematic. This impacts the function vfs_streams_xattr of the component Samba. The manipulation results in information disclos
CVE-2025-60537 | kafka-ui 0.6.0/0.7.2 CustomSerdeLoader.java input validation
A vulnerability classified as problematic was found in kafka-ui 0.6.0/0.7.2. The affected element is an unknown function of the file /kafka/ui/serdes/CustomSerdeLoader.java. Executing a manipulation can lead to improper input validation. Th
CVE-2025-60536 | kafka-ui up to 0.7.2 Configure New Cluster Interface denial of service
A vulnerability classified as problematic has been found in kafka-ui up to 0.7.2. Impacted is an unknown function of the component Configure New Cluster Interface. Performing a manipulation results in denial of service. This vulnerability i
CVE-2025-57618 | Starnet FastX3 up to 3.3.67 path traversal
A vulnerability was found in Starnet FastX3 up to 3.3.67. It has been classified as critical. Impacted is an unknown function. The manipulation leads to path traversal. This vulnerability is uniquely identified as CVE-2025-57618. The attack
CVE-2025-57563 | Starnet FastX up to 4.1.51 path traversal
A vulnerability described as critical has been identified in Starnet FastX up to 4.1.51. This issue affects some unknown processing. Such manipulation leads to path traversal. This vulnerability is listed as CVE-2025-57563. The attack may b
CVE-2025-56749 | Creativeitem Academy LMS up to 6.14 improper authentication
A vulnerability, which was classified as critical, was found in Creativeitem Academy LMS up to 6.14. This impacts an unknown function. The manipulation results in improper authentication. This vulnerability is reported as CVE-2025-56749. Th
CVE-2025-56748 | Creativeitem Academy LMS up to 5.13 Password Reset password recovery
A vulnerability was found in Creativeitem Academy LMS up to 5.13 and classified as problematic. This affects an unknown function of the component Password Reset Handler. The manipulation results in weak password recovery. This vulnerability
CVE-2025-56746 | Creativeitem Academy LMS up to 5.13 session fixiation
A vulnerability described as critical has been identified in Creativeitem Academy LMS up to 5.13. Impacted is an unknown function. Such manipulation leads to session fixiation. This vulnerability is listed as CVE-2025-56746. The attack may
CVE-2023-43788 | libXpm XPM Image File resource consumption (USN-6408-1 / Nessus ID 235522)
A vulnerability has been found in libXpm and classified as problematic. This issue affects some unknown processing of the component XPM Image File Handler. Performing a manipulation results in resource consumption. This vulnerability is rep
CVE-2023-3106 | Linux Kernel up to 4.8-rc6 Netlink Socket net/xfrm/xfrm_user.c xfrm_dump_sa null pointer dereference
A vulnerability was found in Linux Kernel up to 4.8-rc6 and classified as problematic. The impacted element is the function xfrm_dump_sa of the file net/xfrm/xfrm_user.c of the component Netlink Socket Handler. The manipulation results in n