Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 784 | 0,2 % |
| ≥50 % | 3.559 | 0,9 % |
| ≥10 % | 13.139 | 3,2 % |
| <10 % | 394.873 | 95,8 % |
SonicWall Warns of Potential In-the-Wild Exploitation of SSLVPN Flaw That Bypasses MFA
SonicWall has warned customers to patch a SonicOS SSLVPN vulnerability that could let attackers bypass SAML authentication and its multi-factor authentication checks. Tracked as CVE-2026-19868, the flaw carries a CVSS score of 7.1. The comp
iPhone Duo: Das neue Apple-Handy hat eine große Schwachstelle
(Bildquelle: Apple und Bildbearbeitung GIGA)Apples erstes Falt-Handy ist da. Ein YouTube-Experte spricht jedoch eine deutliche Warnung aus.Tech-Experte Zack Nelson nimmt sich das iPhone Duo vor. Auf seinem YouTube-Kanal JerryRigEverything u
Gravierende Sicherheitslücke: Millionen Webseiten bedroht - Panorama - SZ.de
MeinungCybersicherheit. :Die Vorfälle in den Supermärkten zeigen: Jetzt wird's wirklich ernst. Kommentar von Helmut Martin-Jung. Künstliche ... Weiterlesen
CVE-2023-3972 | Red Hat insights-client temp file (EUVD-2023-44597 / Nessus ID 239778)
A vulnerability categorized as critical has been discovered in Red Hat insights-client. The impacted element is an unknown function. The manipulation results in insecure temporary file. This vulnerability is reported as CVE-2023-3972. The a
CVE-2023-3758 | sssd GPO Policy race condition (RHSA-2024:1919 / Nessus ID 211196)
A vulnerability classified as critical has been found in sssd. This affects an unknown part of the component GPO Policy. This manipulation causes race condition. This vulnerability is registered as CVE-2023-3758. The attack requires access
CVE-2023-3745 | ImageMagick prior 6.9.11-0/7.0.10-0 quantum-private.h PushCharPixel heap-based overflow
A vulnerability classified as critical has been found in ImageMagick. Affected is the function PushCharPixel of the file quantum-private.h. This manipulation causes heap-based buffer overflow. This vulnerability appears as CVE-2023-3745. Th
CVE-2026-55458 | Caddy WebSocket Upgrade reverseproxy.go handleUpgradeResponse request smuggling (Nessus ID 377111)
A vulnerability has been found in Caddy and classified as problematic. Affected is the function handleUpgradeResponse of the file modules/caddyhttp/reverseproxy/reverseproxy.go of the component WebSocket Upgrade. The manipulation leads to h
CVE-2026-49272 | OAuthLib Device Code Grant device_code.py DeviceCodeGrant.validate_token_request device_code input validation (Nessus ID 377110)
A vulnerability was found in OAuthLib. It has been declared as critical. This issue affects the function DeviceCodeGrant.validate_token_request of the file oauthlib/oauth2/rfc6749/grant_types/device_code.py of the component Device Code Gran
CVE-2025-61456 | Bhabishya-123 E-commerce 1.0 Endpoint /index cross site scripting
A vulnerability, which was classified as problematic, has been found in Bhabishya-123 E-commerce 1.0. This impacts an unknown function of the file /index of the component Endpoint. Performing a manipulation results in cross site scripting.
CVE-2025-60856 | Reolink Video Doorbell WiFi DB_566128M5MP_W UART Interface missing authentication
A vulnerability classified as critical was found in Reolink Video Doorbell WiFi DB_566128M5MP_W. This affects an unknown function of the component UART Interface. Such manipulation leads to missing authentication. This vulnerability is trad
CVE-2025-56450 | Log2Space Subscriber Management Software 1.1 POST selfcareLeadHistory lead_id sql injection
A vulnerability classified as critical was found in Log2Space Subscriber Management Software 1.1. Affected is an unknown function of the file /l2s/api/selfcareLeadHistory of the component POST Handler. The manipulation of the argument lead_
CVE-2025-26782 | Samsung Modem Exynos/Modem up to 9825 L2 denial of service (WID-SEC-2025-2726)
A vulnerability has been found in Samsung Modem Exynos and Modem up to 9825 and classified as problematic. This affects an unknown function of the component L2. Performing a manipulation results in denial of service. This vulnerability was
CVE-2025-61417 | TastyIgniter 3.7.7 SVG File Parser /admin/media_manager cross site scripting
A vulnerability, which was classified as problematic, was found in TastyIgniter 3.7.7. Affected is an unknown function of the file /admin/media_manager of the component SVG File Parser. Executing a manipulation can lead to cross site script
CVE-2025-56221 | SigningHub 8.6.8 excessive authentication
A vulnerability classified as problematic has been found in SigningHub 8.6.8. This affects an unknown function. The manipulation leads to improper restriction of excessive authentication attempts. This vulnerability is referenced as CVE-202
CVE-2025-54957 | Microsoft Windows up to Server 2025 Dolby Digital Plus Audio Decoder integer overflow (WID-SEC-2025-2307)
A vulnerability was found in Microsoft Windows. It has been classified as problematic. Impacted is an unknown function of the component Dolby Digital Plus Audio Decoder. This manipulation causes integer overflow. This vulnerability appears
WordPress Schwachstellen CVE-2026-119977 u. CVE-2026-100109
Es gibt derzeit wohl zwei Schwachstellen im Umfeld von WordPress, die man als Administrator kennen sollte. Einmal kann WordPress beim Core-Update in bestimmten Konstellationen angreifbar sein (CVE-2026-119977). Zudem gibt es die kritische S
CVE-2026-120548 | icopydoc YML for Yandex Market Plugin up to 5.10.0 on WordPress yml-for-yandex-market.log y4ym_check_action information disclosure (EUVD-2026-119032)
A vulnerability identified as problematic has been detected in icopydoc YML for Yandex Market Plugin up to 5.10.0 on WordPress. This affects an unknown part of the file wp-content/uploads/y4ym/yml-for-yandex-market.log. This manipulation of
CVE-2026-110004 | tomdever wpForo Forum Plugin up to 3.2.2 on WordPress Theme Deletion theme_delete wpforo_secondary_groupids path traversal (EUVD-2026-119031)
A vulnerability has been found in tomdever wpForo Forum Plugin up to 3.2.2 on WordPress and classified as problematic. The impacted element is the function theme_delete of the component Theme Deletion. This manipulation of the argument wpfo
CVE-2026-119155 | tomdever wpForo Forum Plugin up to 3.2.2 on WordPress href[locale] sql injection (EUVD-2026-119033)
A vulnerability categorized as critical has been discovered in tomdever wpForo Forum Plugin up to 3.2.2 on WordPress. Affected by this issue is some unknown functionality. The manipulation of the argument href[locale] results in sql injecti
CVE-2026-104992 | melograno Booking for Appointments and Events Calendar Plugin authorization (EUVD-2026-119034)
A vulnerability was found in melograno Booking for Appointments and Events Calendar Plugin up to 9.9.1 on WordPress and classified as problematic. This affects an unknown function. Such manipulation leads to authorization bypass. This vulne
CVE-2026-118784 | john-dagelmore WPSpeed Plugin up to 2.6.10 on WordPress LightImages HTML optimizer optimize nickname/display_name HTML injection (EUVD-2026-119035)
A vulnerability labeled as problematic has been found in john-dagelmore WPSpeed Plugin up to 2.6.10 on WordPress. This vulnerability affects the function Dispatcher::runOptimize/LightImages::optimize of the component LightImages HTML optimi
CVE-2026-119164 | tomdever wpForo Forum Plugin up to 3.2.2 on WordPress Secondary Groupids Authorization Guard classes/Members.php Members::update secondary_groupids privileges management (EUVD-2026-119037)
A vulnerability classified as critical was found in tomdever wpForo Forum Plugin up to 3.2.2 on WordPress. This issue affects the function Members::update of the file classes/Members.php of the component Secondary Groupids Authorization Gua
CVE-2026-103900 | denishua WPJAM Basic Plugin up to 7.1 on WordPress Signup signup args privileges management (EUVD-2026-119036)
A vulnerability classified as critical has been found in denishua WPJAM Basic Plugin up to 7.1 on WordPress. This vulnerability affects the function WPJAM_User_Signup::signup of the component Signup. Performing a manipulation of the argumen
CVE-2026-95870 | tomdever wpForo Forum Plugin up to 3.2.1 on WordPress data sql injection (EUVD-2026-119038)
A vulnerability was found in tomdever wpForo Forum Plugin up to 3.2.1 on WordPress. It has been declared as critical. Affected is an unknown function. Executing a manipulation of the argument data can lead to sql injection. This vulnerabili
CVE-2026-120532 | tomdever wpForo Forum Plugin up to 3.2.2 on WordPress post[body] cross site scripting (EUVD-2026-119039)
A vulnerability, which was classified as problematic, has been found in tomdever wpForo Forum Plugin up to 3.2.2 on WordPress. This affects an unknown function. This manipulation of the argument post[body] causes cross site scripting. This
CVE-2026-107616 | melograno Booking for Appointments and Events Calendar Plugin Command handle improper authorization (EUVD-2026-119040)
A vulnerability, which was classified as problematic, was found in melograno Booking for Appointments and Events Calendar Plugin up to 9.9.1 on WordPress. The affected element is the function GetEventAttendeesCommandHandler::handle of the c
CVE-2026-121762 | Blubrry Podcasting PowerPress Podcasting Plugin up to 11.18.0 on WordPress cross-site request forgery (EUVD-2026-119041)
A vulnerability was found in Blubrry Podcasting PowerPress Podcasting Plugin up to 11.18.0 on WordPress. It has been classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross-site reque
CVE-2026-119465 | WPVibes Elementor Addon Elements Plugin up to 1.15 on WordPress information disclosure (EUVD-2026-119042)
A vulnerability labeled as problematic has been found in WPVibes Elementor Addon Elements Plugin up to 1.15 on WordPress. The affected element is an unknown function. Executing a manipulation can lead to information disclosure. This vulnera
CVE-2026-119473 | properfraction ProfilePress Plugin up to 4.17.7 on WordPress cross site scripting (EUVD-2026-119043)
A vulnerability described as problematic has been identified in properfraction ProfilePress Plugin up to 4.17.7 on WordPress. This affects an unknown function. The manipulation results in cross site scripting. This vulnerability was named C
CVE-2026-119507 | WPDeveloper NotificationX Plugin up to 3.3.6 on WordPress cross site scripting (EUVD-2026-119044)
A vulnerability marked as problematic has been reported in WPDeveloper NotificationX Plugin up to 3.3.6 on WordPress. The impacted element is an unknown function. The manipulation leads to cross site scripting. This vulnerability is uniquel
Sicherheitslücke GhostMap blockiert Android mit einer nie geöffneten App
Google liefert keinen Patch. Meistgelesen · Cybersicherheit ... Cybersicherheit Google Cybersecurity IT-Sicherheit ... Weiterlesen
CVE-2025-60514 | Tillywork up to 0.1.3 query.builder.helper.ts sql injection
A vulnerability, which was classified as critical, was found in Tillywork up to 0.1.3. Affected by this vulnerability is an unknown functionality of the file app/common/helpers/query.builder.helper.ts. Such manipulation leads to sql injecti
CVE-2025-60361 | Radare2 up to 5.9.8 bochs_open memory leak (EUVD-2025-34881 / Nessus ID 271635)
A vulnerability was found in Radare2 up to 5.9.8. It has been declared as problematic. This vulnerability affects the function bochs_open. Executing a manipulation can lead to memory leak. This vulnerability is handled as CVE-2025-60361. Th
CVE-2025-60358 | Radare2 up to 5.9.8 _load_relocations memory leak (EUVD-2025-34833 / Nessus ID 271674)
A vulnerability was found in Radare2 up to 5.9.8. It has been classified as problematic. The impacted element is the function _load_relocations. The manipulation leads to memory leak. This vulnerability is uniquely identified as CVE-2025-60
CVE-2025-57567 | PluXml CMS minify.php code injection (EUVD-2025-34891 / Nessus ID 271640)
A vulnerability marked as critical has been reported in PluXml CMS. Impacted is an unknown function of the file /themes/defaut/css/minify.php. This manipulation causes code injection. This vulnerability is tracked as CVE-2025-57567. The att
CVE-2025-57164 | FlowiseAI Flowise up to 3.0.4 Supabase RPC Filter command injection (GHSA-7944-7c6r-55vv)
A vulnerability identified as critical has been detected in FlowiseAI Flowise up to 3.0.4. This issue affects some unknown processing. This manipulation of the argument Supabase RPC Filter causes command injection. This vulnerability is han
CVE-2026-123037 | Red Hat Ansible Automation Platform/Ansible Core User User.ssh_key_gen symlink (Nessus ID 377113)
A vulnerability classified as problematic has been found in Red Hat Ansible Automation Platform and Ansible Core. Affected by this vulnerability is the function User.ssh_key_gen of the component User Module. The manipulation leads to symlin
CVE-2026-48761 | Symfony URL Attribute cross site scripting (Nessus ID 377115)
A vulnerability marked as problematic has been reported in Symfony. Affected is an unknown function of the component URL Attribute Handler. The manipulation leads to cross site scripting. This vulnerability is traded as CVE-2026-48761. It i
CVE-2026-123962 | Debian FreedomBox up to 26.14 authorized_keys privileges management (Nessus ID 377114)
A vulnerability identified as problematic has been detected in Debian FreedomBox up to 26.14. This affects an unknown part of the file authorized_keys. This manipulation causes improper privilege management. The identification of this vulne
CVE-2026-45753 | Symfony HtmlSanitizer cross site scripting (Nessus ID 377115)
A vulnerability was found in Symfony HtmlSanitizer. It has been rated as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. This vulnerability is referenced as CVE-2026-4
CVE-2026-123273 | ImageMagick up to 7.1.2-34/6.9.13-59 SVG Decoder MagickCore/cache.c QueueAuthenticPixelCacheNexus infinite loop (Nessus ID 377117)
A vulnerability was found in ImageMagick up to 7.1.2-34/6.9.13-59 and classified as problematic. The affected element is the function QueueAuthenticPixelCacheNexus of the file MagickCore/cache.c of the component SVG Decoder. Such manipulati
CVE-2026-121949 | SensioLabs Symfony up to 6.4.49/7.4.22/8.1.10 HtmlSanitizer access control (Nessus ID 377115)
A vulnerability classified as problematic was found in SensioLabs Symfony up to 6.4.49/7.4.22/8.1.10. Affected by this issue is some unknown functionality of the component HtmlSanitizer. Such manipulation leads to improper access controls.
CVE-2026-123876 | Red Hat Enterprise Linux Seccomp Profile numeric truncation error (Nessus ID 377118)
A vulnerability, which was classified as problematic, has been found in Red Hat Enterprise Linux, Hardened Images and OpenShift Container Platform. This affects an unknown function of the component Seccomp Profile. This manipulation causes
CVE-2026-121006 | HTTP::Body 1.23_01/1.24_01 Trailer Parsing add resource consumption (Nessus ID 377119)
A vulnerability was found in HTTP::Body 1.23_01/1.24_01. It has been declared as problematic. Impacted is the function Add of the component Trailer Parsing. The manipulation results in resource consumption. This vulnerability is identified
CVE-2026-123202 | bakulf libnxml up to 0.18.5 src/nxml_parser.c buffer overflow (Nessus ID 377120)
A vulnerability described as problematic has been identified in bakulf libnxml up to 0.18.5. Impacted is an unknown function of the file src/nxml_parser.c. Executing a manipulation can lead to buffer overflow. This vulnerability is register
CVE-2026-112938 | tox-dev filelock up to 4.2.0 File Lock src/filelock/_strict.py StrictSoftFileLock._acquire race condition (Nessus ID 377121)
A vulnerability marked as problematic has been reported in tox-dev filelock up to 4.2.0. This affects the function StrictSoftFileLock._acquire of the file src/filelock/_strict.py of the component File Lock. The manipulation leads to race co
CVE-2026-123269 | libyal libvmdk Descriptor File Parser libvmdk_descriptor_file.c libvmdk_descriptor_file_read_header out-of-bounds (Issue 41 / Nessus ID 377122)
A vulnerability labeled as problematic has been found in libyal libvmdk. Affected by this vulnerability is the function libvmdk_descriptor_file_read_header of the file libvmdk/libvmdk_descriptor_file.c of the component Descriptor File Parse
CVE-2026-68481 | Apache CXF up to 3.6.11/4.1.7/4.2.2 DefaultEncryptingOAuthDataProvider access control (WID-SEC-2026-2682)
A vulnerability, which was classified as critical, has been found in Apache CXF up to 3.6.11/4.1.7/4.2.2. This issue affects the function DefaultEncryptingOAuthDataProvider. The manipulation leads to improper access controls. This vulnerabi
CVE-2026-68079 | Apache CXF up to 3.6.11/4.1.7/4.2.2 authentication replay (WID-SEC-2026-2682)
A vulnerability labeled as critical has been found in Apache CXF up to 3.6.11/4.1.7/4.2.2. Affected is an unknown function. The manipulation results in authentication bypass by capture-replay. This vulnerability is known as CVE-2026-68079.
CVE-2026-66909 | Apache CXF up to 3.6.11/4.1.7/4.2.2 JMS Transport deserialization (WID-SEC-2026-2682)
A vulnerability was found in Apache CXF up to 3.6.11/4.1.7/4.2.2. It has been classified as critical. Impacted is an unknown function of the component JMS Transport. This manipulation causes deserialization. This vulnerability is registered
CVE-2026-65583 | Apache CXF up to 3.6.11/4.1.7/4.2.2 improper authentication (WID-SEC-2026-2682)
A vulnerability classified as critical was found in Apache CXF up to 3.6.11/4.1.7/4.2.2. This vulnerability affects unknown code. Executing a manipulation can lead to improper authentication. The identification of this vulnerability is CVE-
CVE-2026-65432 | Apache CXF up to 3.6.11/4.1.7/4.2.2 StaxUtils/WSDL4J xml external entity reference (WID-SEC-2026-2682)
A vulnerability identified as critical has been detected in Apache CXF up to 3.6.11/4.1.7/4.2.2. This impacts an unknown function of the component StaxUtils/WSDL4J. The manipulation leads to xml external entity reference. This vulnerability
CVE-2026-105137 | Laradock up to 20.4 Build Process workspace/Dockerfile code download (EUVD-2026-92085)
A vulnerability, which was classified as problematic, was found in Laradock up to 20.4. Impacted is an unknown function of the file workspace/Dockerfile of the component Build Process. The manipulation results in download of code without in
CVE-2026-121379 | Tournamatch Plugin up to 4.7.0 on WordPress file inclusion (EUVD-2026-118941)
A vulnerability has been found in Tournamatch Plugin up to 4.7.0 on WordPress and classified as critical. This vulnerability affects unknown code. Performing a manipulation results in file inclusion. This vulnerability is known as CVE-2026-
CVE-2026-121491 | Fiber Admin Plugin up to 4.0.0 on WordPress code injection (EUVD-2026-118943)
A vulnerability categorized as critical has been discovered in Fiber Admin Plugin up to 4.0.0 on WordPress. This affects an unknown function. Such manipulation leads to code injection. This vulnerability is referenced as CVE-2026-121491. It
CVE-2026-121380 | Tournamatch Plugin up to 4.7.0 on WordPress information disclosure (EUVD-2026-118942)
A vulnerability labeled as problematic has been found in Tournamatch Plugin up to 4.7.0 on WordPress. This affects an unknown part. The manipulation results in information disclosure. This vulnerability is identified as CVE-2026-121380. The
CVE-2026-121796 | Add From Server Lite Plugin up to 5.x on WordPress SVG file cross site scripting (EUVD-2026-118945)
A vulnerability was found in Add From Server Lite Plugin up to 5.x on WordPress. It has been classified as problematic. Affected by this vulnerability is an unknown functionality of the component SVG file Handler. Performing a manipulation
CVE-2026-121492 | Fiber Admin Plugin up to 4.0.0 on WordPress authorization (EUVD-2026-118944)
A vulnerability identified as problematic has been detected in Fiber Admin Plugin up to 4.0.0 on WordPress. Affected by this issue is some unknown functionality. The manipulation leads to missing authorization. This vulnerability is referen
CVE-2026-121858 | Event Tickets with Ticket Scanner Plugin up to 3.2.8 on WordPress search sql injection (EUVD-2026-118948)
A vulnerability, which was classified as problematic, has been found in Event Tickets with Ticket Scanner Plugin up to 3.2.8 on WordPress. The impacted element is an unknown function. The manipulation of the argument Search leads to sql inj
CVE-2026-121857 | Event Tickets with Ticket Scanner Plugin up to 3.1.13 on WordPress authorization (EUVD-2026-118947)
A vulnerability classified as critical has been found in Event Tickets with Ticket Scanner Plugin up to 3.1.13 on WordPress. This affects an unknown part. This manipulation causes incorrect authorization. This vulnerability is registered as