Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 725 | 0,2 % |
| ≥50 % | 3.222 | 0,9 % |
| ≥10 % | 22.088 | 5,9 % |
| <10 % | 347.080 | 93,0 % |
CVE-2026-98913 | Linux Kernel up to 6.1.188/6.6.157/6.12.110/6.18.52 thunderx nicvf_probe memory leak (EUVD-2026-108869)
A vulnerability identified as critical has been detected in Linux Kernel up to 6.1.188/6.6.157/6.12.110/6.18.52. Impacted is the function nicvf_probe of the component thunderx. This manipulation causes memory leak. The identification of thi
CVE-2026-98912 | Linux Kernel up to 6.18.52 ALSA OSS Sequencer snd_seq_oss_read buffer overflow (EUVD-2026-108868)
A vulnerability categorized as very critical has been discovered in Linux Kernel up to 6.18.52. This issue affects the function snd_seq_oss_read of the component ALSA OSS Sequencer. The manipulation results in buffer overflow. This vulnerab
CVE-2026-98915 | Linux Kernel up to 6.1.188/6.6.157/6.12.110/6.18.52 video-i2c video_unregister_device denial of service (EUVD-2026-108871)
A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.1.188/6.6.157/6.12.110/6.18.52. This affects the function video_unregister_device of the component video-i2c. This manipulation causes denial of servi
CVE-2026-98914 | Linux Kernel up to 6.18.52 amdgpu infinite loop (EUVD-2026-108870)
A vulnerability was found in Linux Kernel up to 6.18.52. It has been rated as problematic. This vulnerability affects unknown code of the component amdgpu. The manipulation leads to infinite loop. This vulnerability is uniquely identified a
CVE-2026-98916 | Linux Kernel up to 6.6.159/6.12.113/6.18.52 nl80211 input validation (EUVD-2026-108872)
A vulnerability labeled as very critical has been found in Linux Kernel up to 6.6.159/6.12.113/6.18.52. The affected element is an unknown function of the component nl80211. Such manipulation leads to improper input validation. This vulnera
CVE-2026-55889 | flatpak xdg-desktop-portal up to 1.22.0 FileTransfer FileTransfer.RetrieveFiles random values (EUVD-2026-108751)
A vulnerability, which was classified as problematic, has been found in flatpak xdg-desktop-portal up to 1.22.0. The affected element is the function FileTransfer.RetrieveFiles of the component FileTransfer. The manipulation leads to insuff
CVE-2026-55888 | Flatpak XDG Desktop Portal up to 1.22.0 FileChooser.SaveFiles sandbox (EUVD-2026-108752)
A vulnerability classified as problematic was found in Flatpak XDG Desktop Portal up to 1.22.0. Impacted is the function FileChooser.SaveFiles. Executing a manipulation can lead to sandbox issue. This vulnerability is tracked as CVE-2026-55
Critical PHP2Shell Exploit Code Goes Public as Hackers Attempt to Deploy Botnet Malware
Public proof-of-concept code for two critical PHP vulnerabilities is now available, and attackers have tried to use the flaws to deploy botnet malware. Known together as PHP2Shell, CVE-2026-109618 and CVE-2026-109619 both carry a CVSS sever
CVE-2026-114649 | MongoDB C# Driver up to 3.12.x TLS Client Certificate Comparison certificate validation (WID-SEC-2026-4126)
A vulnerability classified as problematic was found in MongoDB C# Driver up to 3.12.x. The affected element is an unknown function of the component TLS Client Certificate Comparison. The manipulation results in improper certificate validati
CVE-2026-114648 | MongoDB C# Driver up to 3.12.x LINQ Query Processing neutralization (WID-SEC-2026-4126)
A vulnerability categorized as very critical has been discovered in MongoDB C# Driver up to 3.12.x. This vulnerability affects unknown code of the component LINQ Query Processing. Such manipulation leads to improper neutralization. This vul
CVE-2026-114647 | MongoDB C# Driver up to 3.12.x Document Replacement Validation FindOneAndReplace input validation (WID-SEC-2026-4126)
A vulnerability identified as problematic has been detected in MongoDB C# Driver up to 3.12.x. Affected by this issue is the function FindOneAndReplace of the component Document Replacement Validation. This manipulation causes improper inpu
CVE-2026-114646 | MongoDB C# Driver up to 3.12.x BSON input validation (WID-SEC-2026-4126)
A vulnerability was found in MongoDB C# Driver up to 3.12.x. It has been classified as critical. The affected element is an unknown function of the component BSON Handler. Performing a manipulation results in improper input validation. This
CVE-2026-114644 | MongoDB C# Driver up to 3.12.x Deserialization resource consumption (WID-SEC-2026-4126)
A vulnerability was found in MongoDB C# Driver up to 3.12.x. It has been declared as critical. This impacts an unknown function of the component Deserialization. Executing a manipulation can lead to resource consumption. This vulnerability
CVE-2026-114643 | MongoDB C# Driver up to 3.12.x input validation (WID-SEC-2026-4126)
A vulnerability was found in MongoDB C# Driver up to 3.12.x. It has been declared as problematic. Affected by this issue is some unknown functionality. The manipulation results in improper input validation. This vulnerability is reported as
CVE-2026-106017 | OpenVPN up to 3.11.7 Core certificate validation (WID-SEC-2026-4127)
A vulnerability was found in OpenVPN up to 3.11.7. It has been rated as problematic. Impacted is an unknown function of the component Core. The manipulation leads to improper certificate validation. This vulnerability is listed as CVE-2026-
CVE-2026-98878 | Linux Kernel up to 6.18.52 irqchip-gic-v5 irq_eoi denial of service (EUVD-2026-108672)
A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.18.52. Affected by this issue is the function irq_eoi of the component irqchip-gic-v5. The manipulation leads to denial of service. This vulnerability
CVE-2026-98877 | Linux Kernel up to 6.18.52 irqchip-gic-v4 __irq_domain_instantiate null pointer dereference (EUVD-2026-108723)
A vulnerability classified as problematic was found in Linux Kernel up to 6.18.52. Affected by this vulnerability is the function __irq_domain_instantiate of the component irqchip-gic-v4. Executing a manipulation can lead to null pointer de
CVE-2026-98880 | Linux Kernel up to 6.6.157/6.12.110/6.18.52 ntfs3 set_blocksize buffer overflow (EUVD-2026-108674)
A vulnerability marked as problematic has been reported in Linux Kernel up to 6.6.157/6.12.110/6.18.52. This affects the function set_blocksize of the component ntfs3. This manipulation causes buffer overflow. This vulnerability appears as
CVE-2026-98879 | Linux Kernel up to 6.18.52 isofs set_blocksize buffer overflow (EUVD-2026-108673)
A vulnerability labeled as problematic has been found in Linux Kernel up to 6.18.52. The impacted element is the function set_blocksize of the component isofs. The manipulation results in buffer overflow. This vulnerability is reported as C
CVE-2026-98882 | Linux Kernel up to 6.12.110/6.18.52 wave5 wave5-vpuapi.c wave5_vpu_dec_get_output_info frame_buf buffer overflow (EUVD-2026-108676)
A vulnerability described as very critical has been identified in Linux Kernel up to 6.12.110/6.18.52. This impacts the function wave5_vpu_dec_get_output_info of the file drivers/media/platform/chips-media/wave5/wave5-vpuapi.c of the compon
CVE-2026-98881 | Linux Kernel up to 6.18.52 Bridge Multicast br_multicast.c br_multicast_dev_del infinite loop (EUVD-2026-108675)
A vulnerability classified as critical has been found in Linux Kernel up to 6.18.52. Affected is the function br_multicast_dev_del of the file net/bridge/br_multicast.c of the component Bridge Multicast. Performing a manipulation results in
CVE-2026-114486 | Devolutions Server up to 2026.3.10 Token Generation improper authorization (WID-SEC-2026-4128)
A vulnerability, which was classified as problematic, was found in Devolutions Server up to 2026.3.10. The impacted element is an unknown function of the component Token Generation. The manipulation results in improper authorization. This v
CVE-2026-114485 | Devolutions Server up to 2026.3.10 User List Endpoint information disclosure (WID-SEC-2026-4128)
A vulnerability has been found in Devolutions Server up to 2026.3.10 and classified as problematic. This affects an unknown function of the component User List Endpoint. This manipulation causes information disclosure. This vulnerability ap
CVE-2026-93981 | honojs hono up to 4.13.6 JSX Rendering hono/jsx/dom/server renderToString/renderToReadableStream cross site scripting (WID-SEC-2026-4131)
A vulnerability categorized as problematic has been discovered in honojs hono up to 4.13.6. Impacted is the function renderToString/renderToReadableStream of the file hono/jsx/dom/server of the component JSX Rendering. The manipulation resu
CVE-2026-84365 | honojs Hono up to 4.13.4 Static Site Generation toSSG ssgParams path traversal (WID-SEC-2026-4131)
A vulnerability categorized as problematic has been discovered in honojs Hono up to 4.13.4. This affects the function toSSG of the component Static Site Generation. Such manipulation of the argument ssgParams leads to path traversal. This v
CVE-2026-84364 | honojs Hono up to 4.13.4 Dot-notation Parsing parseBody resource consumption (WID-SEC-2026-4131)
A vulnerability was found in honojs Hono up to 4.13.4. It has been classified as problematic. Affected is the function parseBody of the component Dot-notation Parsing. The manipulation leads to resource consumption. This vulnerability is li
CVE-2026-84363 | honojs Hono up to 4.13.4 Cache Middleware cross site scripting (WID-SEC-2026-4131)
A vulnerability was found in honojs Hono up to 4.13.4. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Cache Middleware. This manipulation causes cross site scripting. This vulnerabili
Critical HPE Aruba AOS-8 Flaw Allows Hackers to Bypass SSH Authentication and Take Over Systems
Hewlett Packard Enterprise (HPE) has addressed a critical authentication-bypass vulnerability in the SSH daemon of its AOS-8 wireless operating system. This vulnerability, tracked as CVE-2026-79855, could let a remote, unauthenticated attac
CVE-2026-114645 | MongoDB C Driver up to 1.30.13/2.5.6 Kerberos Authentication out-of-bounds write (WID-SEC-2026-4134)
A vulnerability identified as critical has been detected in MongoDB C Driver up to 1.30.13/2.5.6. This issue affects some unknown processing of the component Kerberos Authentication. Performing a manipulation results in out-of-bounds write.
URGENT – PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches
PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, assigned CVE-2026-115560, affects only web applications configured in an un
CVE-2026-113869 | Mozilla Thunderbird up to 158.0.0 use after free (WID-SEC-2026-4064)
A vulnerability categorized as problematic has been discovered in Mozilla Thunderbird up to 158.0.0. This issue affects some unknown processing. The manipulation results in use after free. This vulnerability is identified as CVE-2026-113869
CVE-2026-113868 | Mozilla Thunderbird up to 158.0.0 NTLM Authentication out-of-bounds (WID-SEC-2026-4064)
A vulnerability was found in Mozilla Thunderbird up to 158.0.0. It has been rated as problematic. This vulnerability affects unknown code of the component NTLM Authentication. The manipulation leads to out-of-bounds read. This vulnerability
CVE-2026-113867 | Mozilla Thunderbird up to 158.0.0 Chat injection (WID-SEC-2026-4064)
A vulnerability was found in Mozilla Thunderbird up to 158.0.0. It has been declared as problematic. This affects an unknown part of the component Chat. Executing a manipulation can lead to injection. The identification of this vulnerabilit
CVE-2026-113866 | Mozilla Thunderbird up to 158.0.0 AutoDiscover service cleartext transmission (WID-SEC-2026-4064)
A vulnerability was found in Mozilla Thunderbird up to 158.0.0. It has been classified as problematic. Affected by this issue is some unknown functionality of the component AutoDiscover service. Performing a manipulation results in cleartex
Nach Sicherheitslücke: Internetseite des Saalekreises bleibt vorsorglich offline
Cybersicherheit im Saalekreis Nach Sicherheitslücke: Internetseite des Saalekreises bleibt vorsorglich offline. Nach den Warnungen vor einer ... Weiterlesen
Webseiten-Abschaltung "richtig": Bund stellt bisher keine Angriffe nach PHP-Sicherheitslücke fest
... IT-Sicherheitsbehörde. "Dennoch können erfolgreiche Angriffe derzeit ... Auch der US-Geheimdienst National Security Agency (NSA) mahnte wegen ... Weiterlesen
CVE-2026-113401 | Mozilla Firefox up to 158.0.0 PDF Viewer denial of service (WID-SEC-2026-4064)
A vulnerability classified as problematic was found in Mozilla Firefox up to 158.0.0. Affected by this issue is some unknown functionality of the component PDF Viewer. Such manipulation leads to denial of service. This vulnerability is docu
CVE-2026-113400 | Mozilla Firefox up to 158.0.0 cubeb uninitialized pointer (WID-SEC-2026-4064)
A vulnerability classified as critical has been found in Mozilla Firefox up to 158.0.0. Affected by this vulnerability is an unknown functionality of the component cubeb. This manipulation causes uninitialized pointer. This vulnerability is
CVE-2026-113399 | Mozilla Firefox up to 158.0.0 SVG out-of-bounds (WID-SEC-2026-4064)
A vulnerability described as critical has been identified in Mozilla Firefox up to 158.0.0. Affected is an unknown function of the component SVG. The manipulation results in out-of-bounds read. This vulnerability is cataloged as CVE-2026-11
CVE-2026-92745 | Red Hat Cockpit cockpit-machines getAccessToken invocation of process using visible sensitive information (Nessus ID 348655 / WID-SEC-2026-4118)
A vulnerability was found in Red Hat Cockpit. It has been declared as critical. This impacts the function getAccessToken of the component cockpit-machines. The manipulation results in invocation of process using visible sensitive informatio
CVE-2026-114406 | Red Hat Satellite 6 ca-certificates certificate validation (EUVD-2026-107565)
A vulnerability was found in Red Hat Advanced Cluster Management for Kubernetes, Advanced Cluster Security, Assisted Installer for OpenShift Container Platform, cert-manager Operator for OpenShift, Confidential Compute Attestation, Connecti
CVE-2026-91403 | Oracle Java SE/GraalVM for JDK/GraalVM Enterprise Edition JSSE privileges management (EUVD-2026-107578)
A vulnerability classified as critical has been found in Oracle Java SE, GraalVM for JDK and GraalVM Enterprise Edition up to 27.0.1. This issue affects some unknown processing of the component JSSE. This manipulation causes improper privil
PHP-Sicherheitslücke: IT-Experten fordern Maßnahmen über Updates hinaus - Tagesschau
Thomas Boele, Sicherheitsexperte beim Softwareunternehmen Check Point, warnte Systembetreiber davor, sich in falscher Sicherheit zu wiegen. Er ... Weiterlesen
Attackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Months
The critical-severity SQL injection flaw allows attackers to access privileged internal functionality and gain operator privileges. This article has been indexed from SecurityWeek Read the original article: Attackers Exploit Third VeloCloud
Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image
Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to open. The flaw, CVE-2026-112900, is in the way Pillow handles EPS images, which i
[NEU] [hoch] TianoCore EDK2 PXE Treiber: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode und DoS
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in TianoCore EDK2 ausnutzen, um beliebigen Programmcode mit Ring-0-Rechten auszuführen oder einen Denial-of-Service-Zustand zu verursachen. Weiterlesen
[NEU] [mittel] MongoDB C Treiber: Schwachstelle ermöglicht Denial of Service und manipulation von Daten
Ein lokaler Angreifer kann eine Schwachstelle in MongoDB C Treiber ausnutzen, um einen Denial of Service Angriff durchzuführen, und um Daten zu manipulieren. Weiterlesen
[NEU] [mittel] OpenProject: Schwachstelle ermöglicht Offenlegung von Informationen
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in OpenProject ausnutzen, um Informationen offenzulegen. Weiterlesen
[NEU] [niedrig] IBM SPSS Modeler: Schwachstelle ermöglicht Manipulation von Dateien
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in IBM SPSS ausnutzen, um Dateien zu manipulieren. Weiterlesen
[NEU] [mittel] OpenVPN 3 Core Library: Schwachstelle ermöglicht Offenlegung von Informationen
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in OpenVPN 3 Core Library ausnutzen, um Informationen offenzulegen. Weiterlesen
[NEU] [kritisch] Arista VeloCloud Orchestrator: Schwachstelle ermöglicht SQL-Injection und potenziell Privilegieneskalation
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Arista VeloCloud Orchestrator ausnutzen, um einen SQL-Injection Angriff durchzuführen und potenziell um seine Privilegien zu erhöhen. Weiterlesen
[NEU] [UNGEPATCHT] [mittel] expat: Schwachstelle ermöglicht Denial of Service
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in expat ausnutzen, um einen Denial of Service Angriff durchzuführen. Weiterlesen
[NEU] [mittel] Qt Core QXmlStream parser: Schwachstelle ermöglicht Denial of Service
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Qt Core QXmlStream parser ausnutzen, um einen Denial of Service Angriff durchzuführen. Weiterlesen
[NEU] [mittel] Red Hat Enterprise Linux iperf3: Schwachstelle ermöglicht Denial of Service
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux iperf3 ausnutzen, um einen Denial of Service Angriff durchzuführen. Weiterlesen
[NEU] [UNGEPATCHT] [hoch] rsyslog: Schwachstelle ermöglicht Manipulation von Dateien
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in rsyslog ausnutzen, um Dateien zu manipulieren. Weiterlesen
[NEU] [mittel] Red Hat Enterprise Linux ca-certificates: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ca-certificates ausnutzen, um Sicherheitsvorkehrungen zu umgehen, vertrauliche Informationen auszulesen oder Daten zu manipulieren Weiterlesen
CVE-2026-55422 | conda-forge is a GitHub organization containing repositories of conda recipes. In commits 85748ad2368a and prior, two React components render externally-sourced strings directly as HTML using dangerouslySetInnerHTML, with no sanitization (the project has no DOMPurify or equivalent dependency). JSON files are produced automatically by the conda-forge autotick bot (regro/cf-scripts) while it processes every conda-forge feedstock and its upstream source artifact
conda-forge is a GitHub organization containing repositories of conda recipes. In commits 85748ad2368a and prior, two React components render externally-sourced strings directly as HTML using dangerouslySetInnerHTML, with no sanitization (t
CVE-2026-63120 | pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.2, an incomplete path traversal fix in pghoard allows an attacker with write access to the backup object storage (such as S3, GCS, or Azure) to execute arbitrary file writes and directory creation outside the designated PostgreSQL data directory (pgdata). When a database administrator executes a restore operation (via pghoard_restore
pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.2, an incomplete path traversal fix in pghoard allows an attacker with write access to the backup object storage
Sicherheitslücke in PHP: KI kann rund um die Uhr Gefahren verbreiten | ndr.de
Das Bundesamt für Sicherheit in der Informationstechnik gab eine offizielle Cybersicherheitswarnung heraus und riet zu Sicherheitsupdates. Auch ... Weiterlesen
CVE-2026-96293 | WatchGuard Agent 1.17.24.0000 Full Disk Encryption cleartext storage (EUVD-2026-108073)
A vulnerability was found in WatchGuard Agent 1.17.24.0000. It has been rated as problematic. This affects an unknown part of the component Full Disk Encryption. Performing a manipulation results in cleartext storage of sensitive informatio