Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 786 | 0,2 % |
| ≥50 % | 3.561 | 0,9 % |
| ≥10 % | 13.156 | 3,2 % |
| <10 % | 396.052 | 95,8 % |
🗂️ …
CVE-2023-39341 | FFRI yarai denial of service
A vulnerability categorized as problematic has been discovered in FFRI yarai, yarai Home Edition, yarai Business Edition, Zerona PLUS and Dual Safe Powered. This impacts an unknown function. Executing a manipulation can lead to denial of se
CVE-2023-37863 | Phoenix Contact WP 6xxx prior 4.0.10 on WordPress SNMP Request os command injection (VDE-2023-018)
A vulnerability classified as critical has been found in Phoenix Contact WP 6xxx on WordPress. The affected element is an unknown function of the component SNMP Request Handler. The manipulation leads to os command injection. This vulnerabi
CVE-2023-37862 | Phoenix Contact WP 6xxx up to 4.0.9 on WordPress HTTP API authorization (VDE-2023-018)
A vulnerability described as critical has been identified in Phoenix Contact WP 6xxx up to 4.0.9 on WordPress. Impacted is an unknown function of the component HTTP API. Executing a manipulation can lead to missing authorization. This vulne
CVE-2023-37861 | Phoenix Contact WP 6xxx up to 4.0.9 on WordPress HTTP os command injection (VDE-2023-018)
A vulnerability labeled as critical has been found in Phoenix Contact WP 6xxx up to 4.0.9 on WordPress. This vulnerability affects unknown code of the component HTTP Handler. Such manipulation leads to os command injection. This vulnerabili
CVE-2023-37860 | Phoenix WP 6xxx prior 4.0.10 on WordPress Community String authorization (VDE-2023-018)
A vulnerability has been found in Phoenix WP 6xxx on WordPress and classified as problematic. Affected is an unknown function of the component Community String Handler. Performing a manipulation results in missing authorization. This vulner
CVE-2023-37859 | Phoenix Contact WP 6xxx prior 4.0.10 on WordPress SNMPv2 privileges management (VDE-2023-018)
A vulnerability identified as critical has been detected in Phoenix Contact WP 6xxx on WordPress. This affects an unknown part of the component SNMPv2. This manipulation causes improper privilege management. This vulnerability appears as CV
CVE-2023-37858 | Phoenix Contact WP 6xxx prior 4.0.10 on WordPress hard-coded key (VDE-2023-018)
A vulnerability marked as critical has been reported in Phoenix Contact WP 6xxx on WordPress. This issue affects some unknown processing. Performing a manipulation results in use of hard-coded cryptographic key . This vulnerability is known
CVE-2023-37857 | Phoenix Contact WP 6xxx prior 4.0.10 on WordPress hard-coded credentials (VDE-2023-018)
A vulnerability categorized as critical has been discovered in Phoenix Contact WP 6xxx on WordPress. Affected by this issue is some unknown functionality. The manipulation results in hard-coded credentials. This vulnerability is reported as
CVE-2023-37856 | Phoenix Contact WP 6xxx prior 4.0.10 on WordPress Embedded Qt Browser external reference (VDE-2023-018)
A vulnerability was found in Phoenix Contact WP 6xxx on WordPress. It has been rated as problematic. Affected by this vulnerability is an unknown functionality of the component Embedded Qt Browser. The manipulation leads to externally contr
CVE-2023-37855 | Phoenix Contact WP 6xxx prior 4.0.10 on WordPress Embedded Qt Browser external reference (VDE-2023-018)
A vulnerability was found in Phoenix Contact WP 6xxx on WordPress. It has been declared as problematic. Affected is an unknown function of the component Embedded Qt Browser. Executing a manipulation can lead to externally controlled referen
CVE-2023-38186 | Microsoft Windows up to Server 2022 Mobile Device Management missing authentication
A vulnerability was found in Microsoft Windows 10 21H2/10 22H2/11 21H2/11 22H2/Server 2022. It has been rated as critical. Affected is an unknown function of the component Mobile Device Management. Performing a manipulation results in missi
CVE-2023-38184 | Microsoft Windows up to Server 2022 Lightweight Directory Access Protocol use after free
A vulnerability categorized as critical has been discovered in Microsoft Windows. Impacted is an unknown function of the component Lightweight Directory Access Protocol. The manipulation results in use after free. This vulnerability was nam
CVE-2023-38178 | Microsoft .NET/Visual Studio denial of service
A vulnerability marked as problematic has been reported in Microsoft .NET and Visual Studio. This vulnerability affects unknown code. This manipulation causes denial of service. The identification of this vulnerability is CVE-2023-38178. It
CVE-2023-38176 | Microsoft Azure Arc-Enabled Servers path traversal
A vulnerability described as critical has been identified in Microsoft Azure Arc-Enabled Servers. This issue affects some unknown processing. Such manipulation leads to path traversal. This vulnerability is referenced as CVE-2023-38176. The
CVE-2023-38175 | Microsoft Windows Defender link following
A vulnerability was found in Microsoft Windows Defender and classified as critical. The affected element is an unknown function. Executing a manipulation can lead to link following. This vulnerability is handled as CVE-2023-38175. It is pos
CVE-2023-38170 | Microsoft HEVC Video Extensions heap-based overflow
A vulnerability identified as critical has been detected in Microsoft HEVC Video Extensions. The affected element is an unknown function. This manipulation causes heap-based buffer overflow. The identification of this vulnerability is CVE-2
CVE-2023-36914 | Microsoft Windows up to Server 2022 Smart Card Resource Management Server information disclosure
A vulnerability, which was classified as problematic, was found in Microsoft Windows 10 21H2/10 22H2/11 21H2/11 22H2/Server 2022. This affects an unknown part of the component Smart Card Resource Management Server. Such manipulation leads t
CVE-2023-36913 | Microsoft Windows up to Server 2022 Message Queuing information disclosure
A vulnerability, which was classified as problematic, was found in Microsoft Windows. The impacted element is an unknown function of the component Message Queuing. Executing a manipulation can lead to information disclosure. This vulnerabil
CVE-2023-36911 | Microsoft Windows up to Server 2022 Message Queuing integer overflow
A vulnerability labeled as very critical has been found in Microsoft Windows. Affected by this issue is some unknown functionality of the component Message Queuing. Executing a manipulation can lead to integer overflow. This vulnerability i
CVE-2026-20320 | Cisco BroadWorks XML Parser information disclosure
A vulnerability was found in Cisco BroadWorks and classified as problematic. This affects an unknown function of the component XML Parser. Such manipulation leads to information disclosure. This vulnerability is documented as CVE-2026-20320
CVE-2026-125350 | Google Chrome up to 157.0.8103.38 XML use after free
A vulnerability, which was classified as critical, was found in Google Chrome. This impacts an unknown function of the component XML. Such manipulation leads to use after free. This vulnerability is traded as CVE-2026-125350. The attack may
CVE-2026-111793 | Openwave Messaging Limited Webtop Media Transcoder prior 1.1.22.0 File Type Restriction access control
A vulnerability was found in Openwave Messaging Limited Webtop Media Transcoder. It has been declared as problematic. This vulnerability affects unknown code of the component File Type Restriction. Such manipulation leads to improper access
USN-9037-1: HPLIP vulnerabilities
It was discovered that HPLIP did not properly handle certain data, which could result in an out-of-bounds write. An attacker could possibly use this issue to cause a denial of service, expose sensitive information or execute arbitrary code.
CVE-2026-124578 | Pantum BP5100DW 3.A.4.7 Web Interface /shtml/omDB.shtml missing authentication
A vulnerability, which was classified as problematic, has been found in Pantum BP5100DW 3.A.4.7. The impacted element is an unknown function of the file /shtml/omDB.shtml of the component Web Interface. The manipulation leads to missing aut
CVE-2026-124577 | Intelbras SG 2404 PoE L2+ 1.00.70/1.00.72 Web Management Interface /EXCU_SHELL improper authentication
A vulnerability classified as critical was found in Intelbras SG 2404 PoE L2+ 1.00.70/1.00.72. The affected element is an unknown function of the file /EXCU_SHELL of the component Web Management Interface. Executing a manipulation can lead
Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones
A flaw in Git can let a malicious repository run an attacker's code on a computer that clones it recursively, together with its submodules. The Git project fixed it this week in Git 2.56.1, with matching fixes for the 2.50 through 2.55
CVE-2026-123664 | nasa-gcn gcn.nasa.gov up to b299b562af665878964b981a459f0a9c04b11adf Email Notification /user/email Recipient improper authorization (Issue 3805)
A vulnerability classified as critical has been found in nasa-gcn gcn.nasa.gov up to b299b562af665878964b981a459f0a9c04b11adf. This issue affects some unknown processing of the file /user/email of the component Email Notification Handler. P
Microsoft Patch Tuesday November 2027 , (Tue, Nov 10th)
Microsoft continues its AI-induced patch surge, addressing 1,260 different vulnerabilities this month. 68 of these vulnerabilities are considered critical. 167 of the vulnerabilities are Chromium issues affecting Microsoft Edge. One of the
Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day
Today is Microsoft's November 2026 Patch Tuesday, with security updates addressing a record-breaking 1,235 flaws, including one actively exploited Microsoft Outlook zero-day vulnerability. [...] Weiterlesen
Microsoft November 2026 Patch Tuesday Fixes 1,093 Vulnerabilities, Including Outlook Zero-Day
Microsoft has released its November 2026 Patch Tuesday updates, fixing 1,093 newly released vulnerabilities across Windows, Office, SQL Server, SharePoint, Exchange Server, Azure services, and developer tools. The release includes one activ
Sicherheitslücke ermöglichte Fern-Entsperrung von Autos - Web - derStandard.de
IT-Security. Sicherheitslücke ermöglichte Fern-Entsperrung von Autos. Eine Schwachstelle der serverseitigen Authentifizierung erlaubte Zugriff auf ... Weiterlesen
USN-9038-1: GStreamer Good Plugins, GStreamer Base Plugins vulnerabilities
It was discovered that GStreamer Good Plugins did not properly handle certain network streams. A remote attacker could possibly use this issue to cause an application crash or execute arbitrary code. This issue only affected Ubuntu 16.04 LT
CVE-2026-122146 | 101arrowz fflate up to 0.8.3 esm/index.mjs unzipSync memory allocation
A vulnerability was found in 101arrowz fflate up to 0.8.3. It has been classified as problematic. This issue affects the function unzipSync of the file esm/index.mjs. This manipulation causes uncontrolled memory allocation. The identificati
CVE-2023-36910 | Microsoft Windows up to Server 2022 Message Queuing integer overflow
A vulnerability identified as very critical has been detected in Microsoft Windows. Affected by this vulnerability is an unknown functionality of the component Message Queuing. Performing a manipulation results in integer overflow. This vul
CVE-2023-36908 | Microsoft Windows up to Server 2022 Hyper-V information disclosure
A vulnerability, which was classified as problematic, has been found in Microsoft Windows. Affected by this issue is some unknown functionality of the component Hyper-V. This manipulation causes information disclosure. This vulnerability is
CVE-2023-36907 | Microsoft Windows up to Server 2022 Cryptographic Services information disclosure
A vulnerability classified as problematic was found in Microsoft Windows. Affected by this vulnerability is an unknown functionality of the component Cryptographic Services. The manipulation results in information disclosure. This vulnerabi
CVE-2023-36906 | Microsoft Windows up to Server 2022 Cryptographic Services information disclosure
A vulnerability classified as problematic has been found in Microsoft Windows. Affected is an unknown function of the component Cryptographic Services. The manipulation leads to information disclosure. This vulnerability is listed as CVE-20
CVE-2022-4955 | Google Chrome DevTools privilege escalation
A vulnerability identified as problematic has been detected in Google Chrome. This affects an unknown function of the component DevTools. This manipulation causes privilege escalation. This vulnerability is registered as CVE-2022-4955. The
CVE-2022-4925 | Google Chrome up to 96.0.4664.110 QUIC input validation (FEDORA-2023-ea7128b5ce)
A vulnerability marked as problematic has been reported in Google Chrome. Affected is an unknown function of the component QUIC. This manipulation causes improper input validation. The identification of this vulnerability is CVE-2022-4925.
CVE-2022-34453 | Dell XtremIO X2 XMS prior 1.116-4-1.11 access control (dsa-2022-290)
A vulnerability was found in Dell XtremIO X2 XMS and classified as critical. The affected element is an unknown function. Executing a manipulation can lead to improper access controls. The identification of this vulnerability is CVE-2022-34
CVE-2022-26838 | Cybozu Remote Service 3.1.2 Mobile Device Data Import path traversal
A vulnerability classified as critical has been found in Cybozu Remote Service 3.1.2. Affected is an unknown function of the component Mobile Device Data Import. The manipulation leads to path traversal. This vulnerability is documented as
CVE-2022-2416 | Octopus Deploy Request information disclosure
A vulnerability, which was classified as problematic, has been found in Octopus Deploy. This impacts an unknown function of the component Request Handler. This manipulation causes information disclosure. This vulnerability is registered as
CVE-2022-2346 | Octopus Deploay Extension Endpoint access control
A vulnerability classified as critical was found in Octopus Deploay. This affects an unknown function of the component Extension Endpoint Handler. The manipulation results in improper access controls. This vulnerability is cataloged as CVE-
CVE-2026-58114 | Siemens SIMATIC Batch up to 7.5/8.0/8.1/9.1 improper authentication (WID-SEC-2026-4441)
A vulnerability, which was classified as very critical, has been found in Siemens SIMATIC Batch, SIMATIC Information Server, SIMATIC PCS 7, SIMATIC Process Historian, SIMATIC WinCC and SIMATIC WinCC Runtime Professional up to 7.5/8.0/8.1/9.
CVE-2026-125652 | Red Hat Keycloak/Single Sign-On keycloak-services improper authorization (WID-SEC-2026-4446)
A vulnerability marked as critical has been reported in Red Hat Keycloak and Single Sign-On. This issue affects some unknown processing of the component keycloak-services. This manipulation causes improper authorization. This vulnerability
CVE-2024-28235 | Contao up to 4.13.39/5.3.3 Broken Link information disclosure (WID-SEC-2026-4445)
A vulnerability has been found in Contao up to 4.13.39/5.3.3 and classified as problematic. Affected is an unknown function of the component Broken Link Handler. This manipulation causes information disclosure. This vulnerability is registe
CVE-2026-18836 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinations and return the response to the attacker.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended des
CVE-2026-18689 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accepted where it should not be, which could reveal the names of other organizations.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accep
CVE-2026-17428 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization decisions without sufficient verification, which could allow access to information belonging to others.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization
CVE-2026-17411 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized before it is used in database queries.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized befo
CVE-2026-17410 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.
CVE-2026-17409 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of a request, which could allow restricted operations to be reached.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access c
CVE-2026-17408 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.
CVE-2026-17407 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before being used in a database query, which could allow SQL commands to run.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before
CVE-2026-17406 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Address checks can be bypassed, which could allow the server to reach destinations that should be blocked.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Address checks can be bypassed, which could allow the s
CVE-2026-17405 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm that the requesting user is permitted to read them, which could expose keystore information.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm
CVE-2026-17404 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17403 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.
CVE-2026-17402 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is passed to the operating system, which could allow commands to run on the underlying host.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is pas
CVE-2026-17401 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.