Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 786 | 0,2 % |
| ≥50 % | 3.570 | 0,9 % |
| ≥10 % | 23.060 | 5,7 % |
| <10 % | 380.695 | 93,3 % |
CISA Warns of Actively Exploited WordPress RCE Flaw
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned that attackers are actively exploiting a recently patched, high-severity vulnerability in WordPress Core. The flaw, tracked as CVE-2026-119977, can allow unauthen
Ein Websitebesuch reichte: So nutzten Hacker eine Schwachstelle in iOS und Android aus
Laut Sicherheitsforscher:innen wurden ganz unterschiedliche Internetseiten manipuliert, um in die Smartphones der Opfer einzudringen. Hinter den Angriffen könnte der russische Auslandsgeheimdienst stecken. weiterlesen auf t3n.de Weiterlesen
CVE-2025-61121 | Glority Mobile Scanner App 2.12.38 on Android com.glority.everlens information disclosure
A vulnerability was found in Glority Mobile Scanner App 2.12.38 on Android. It has been rated as problematic. The affected element is an unknown function of the component com.glority.everlens. This manipulation causes information disclosure
CVE-2025-61120 | IO FIT AG Life Logger App up to 1.0.2.72 on Android com.donki.healthy information disclosure
A vulnerability marked as problematic has been reported in IO FIT AG Life Logger App up to 1.0.2.72 on Android. Affected is an unknown function of the component com.donki.healthy. The manipulation leads to information disclosure. This vulne
CVE-2025-61119 | Kanova App 1.0.27 on Android access control
A vulnerability was found in Kanova App 1.0.27 on Android. It has been classified as critical. The impacted element is an unknown function. This manipulation causes improper access controls. This vulnerability is handled as CVE-2025-61119.
CVE-2025-61118 | mCarFix Motorists App 2.3 on Android com.skytop.mcarfix access control
A vulnerability has been found in mCarFix Motorists App 2.3 on Android and classified as critical. Impacted is an unknown function of the component com.skytop.mcarfix. The manipulation leads to improper access controls. This vulnerability i
CVE-2025-61116 | AdForest App 4.0.12 on Android scriptsbundle.adforest access control
A vulnerability, which was classified as critical, has been found in AdForest App 4.0.12 on Android. This vulnerability affects unknown code of the component scriptsbundle.adforest. Performing a manipulation results in improper access contr
CVE-2025-61114 | 2nd Line App up to 1.2.92 on Android com.mysecondline.app access control
A vulnerability was found in 2nd Line App up to 1.2.92 on Android and classified as critical. The affected element is an unknown function of the component com.mysecondline.app. The manipulation results in improper access controls. This vuln
CVE-2025-61113 | TalkTalk App 3.3.6 on Android API Endpoint access control
A vulnerability classified as critical was found in TalkTalk App 3.3.6 on Android. This affects an unknown part of the component API Endpoint. Such manipulation leads to improper access controls. This vulnerability is documented as CVE-2025
CVE-2025-60950 | AIxBlock Data Preparation unrestricted upload
A vulnerability described as critical has been identified in AIxBlock. This vulnerability affects unknown code of the component Data Preparation. Such manipulation leads to unrestricted upload. This vulnerability is listed as CVE-2025-60950
CVE-2024-4693 | QEMU Virtio PCI Binding hw/virtio/virtio-pci.c vhost_net_stop operation after expiration (EUVD-2024-44292 / Nessus ID 209545)
A vulnerability classified as critical has been found in QEMU. This affects the function vhost_net_stop of the file hw/virtio/virtio-pci.c of the component Virtio PCI Binding. The manipulation leads to operation on a resource after expirati
CVE-2024-2496 | libvirt virtinterfaced memory corruption (DLA 3778-1 / EUVD-2024-27445)
A vulnerability has been found in libvirt and classified as critical. Affected by this issue is some unknown functionality of the component virtinterfaced. Performing a manipulation results in memory corruption. This vulnerability is report
CVE-2024-1481 | FreeIPA HTTP Request denial of service (EUVD-2024-17231 / Nessus ID 210488)
A vulnerability was found in FreeIPA. It has been classified as problematic. This issue affects some unknown processing of the component HTTP Request Handler. Performing a manipulation results in denial of service. This vulnerability is ide
CVE-2024-11029 | Red Hat Enterprise Linux 9 FreeIPA API Audit information expsure (EUVD-2024-34378 / Nessus ID 214230)
A vulnerability identified as problematic has been detected in Red Hat Enterprise Linux 7, Enterprise Linux 8 and Enterprise Linux 9. This affects an unknown function of the component FreeIPA API Audit. This manipulation causes exposure of
CVE-2024-0690 | Red Hat Ansible 2.14/2.15/2.16 Log information disclosure (RHSA-2024:0733 / EUVD-2024-0003)
A vulnerability was found in Red Hat Ansible 2.14/2.15/2.16 and classified as problematic. This affects an unknown part of the component Log Handler. Such manipulation leads to information disclosure. This vulnerability is listed as CVE-202
CVE-2023-7192 | Linux Kernel Netfilter nf_conntrack_netlink.c ctnetlink_create_conntrack memory leak (EUVD-2023-59373 / Nessus ID 239742)
A vulnerability marked as problematic has been reported in Linux Kernel. Affected by this issue is the function ctnetlink_create_conntrack of the file net/netfilter/nf_conntrack_netlink.c of the component Netfilter. Performing a manipulatio
CVE-2023-5871 | libnbd up to 1.19.1 NDB Server nbd/server.c nbd_block_status denial of service (EUVD-2023-58145)
A vulnerability identified as problematic has been detected in libnbd up to 1.19.1. Affected is the function nbd_block_status of the file nbd/server.c of the component NDB Server Handler. Performing a manipulation results in denial of servi
CVE-2023-5675 | Red Hat Quarkus RestEasy JAX-RS Endpoint improper authorization
A vulnerability classified as critical has been found in Red Hat Quarkus. This affects an unknown part of the component RestEasy JAX-RS Endpoint. The manipulation leads to improper authorization. This vulnerability is uniquely identified as
CVE-2026-122236 | OpenHands up to 1.24.0 Landing Page missing authentication (Issue 17878)
A vulnerability described as critical has been identified in OpenHands up to 1.24.0. This impacts an unknown function of the component Landing Page. Such manipulation leads to missing authentication. This vulnerability is listed as CVE-2026
CVE-2026-122191 | itsourcecode Airline Reservation System 1.0 /admin/manage_booked.php id sql injection
A vulnerability was found in itsourcecode Airline Reservation System 1.0. It has been declared as critical. This affects an unknown function of the file /admin/manage_booked.php. Executing a manipulation of the argument ID can lead to sql i
GitHub Release: aquasecurity/trivy v0.76.2 (05.11.2026)
🛡️ Security Fix aquasecurity/trivyv0.76.205.11.2026@github-actions[bot]🔐 Security update 🛡️ Trivy v0.76.2 bundles several security fixes: Official container images are rebuilt on Alpine 3.24.3, which fixes musl/musl-utils (CVE-2026-107891)
Apple-Sicherheitslücke: CISA warnt vor aktiver Ausnutzung
Schwachstelle in den KEV-Katalog aufgenommen. Die US-Behörde für Cybersicherheit und Infrastruktursicherheit (CISA) hat am Mittwoch eine Apple- ... Weiterlesen
Sicherheitskatastrophen 5.11.2026: Digicert, Fake RVTools, Barracuda 0-Day und mehr
IT-Themen, Sicherheit &amp; Co. ... Digitcert hat den Vorfall, der sich zum 18. Juni 2026 ereignete, in diesem Post bestätigt – bei Cyber Security News ... Weiterlesen
[NEU] [kritisch] SignalWire FreeSWITCH: Schwachstelle ermöglicht Codeausführung
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in SignalWire FreeSWITCH ausnutzen, um beliebigen Programmcode auszuführen. Weiterlesen
Debian, Ubuntu patch APT flaw that could hand attackers root
Linux administrators’ trust in package managers is being tested by a newly disclosed vulnerability in APT, the package management system used by Debian, Ubuntu, and their derivatives, that could allow attackers to install unverified softwar
[UPDATE] [mittel] Apple Safari: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen
Ein lokaler Angreifer kann eine Schwachstelle in Apple Safari ausnutzen, um Sicherheitsvorkehrungen zu umgehen. Weiterlesen
CVE-2022-4092 | GitLab Enterprise Edition up to 15.6.0 README Page cross site scripting (Issue 383208 / EUVD-2022-51463)
A vulnerability categorized as problematic has been discovered in GitLab Enterprise Edition up to 15.6.0. Affected by this issue is some unknown functionality of the component README Page. Such manipulation leads to cross site scripting. Th
CVE-2022-4091 | SourceCodester Canteen Management System food.php query product_name cross site scripting (EUVD-2022-51462)
A vulnerability was found in SourceCodester Canteen Management System and classified as problematic. Affected by this issue is the function Query of the file food.php. Such manipulation of the argument product_name leads to cross site scrip
CVE-2022-4090 | rickxy Stock Management System us_transac.php?action=add cross-site request forgery (EUVD-2022-51461)
A vulnerability was found in rickxy Stock Management System and classified as problematic. The affected element is an unknown function of the file us_transac.php?action=add. Executing a manipulation can lead to cross-site request forgery. T
CVE-2025-66373 | Akamai Ghost 2025-03-26/2025-07-21 HTTP Request request smuggling
A vulnerability, which was classified as critical, was found in Akamai Ghost 2025-03-26/2025-07-21. This affects an unknown function of the component HTTP Request Handler. Such manipulation leads to http request smuggling. This vulnerabilit
CVE-2025-63361 | Waveshare RS232-485 to WIFI ETH 3.1.1.0 Administrator Password missing encryption
A vulnerability, which was classified as problematic, has been found in Waveshare RS232-485 to WIFI ETH 3.1.1.0. Affected is an unknown function of the component Administrator Password Handler. Performing a manipulation results in missing e
CVE-2025-61148 | EduplusCampus 3.0.1 Student Payment API /student/get-receipt rec_no resource injection
A vulnerability marked as critical has been reported in EduplusCampus 3.0.1. Impacted is an unknown function of the file /student/get-receipt of the component Student Payment API. Performing a manipulation of the argument rec_no results in
CVE-2025-55948 | yzcheng90 SpringBoot 6.0 Role-Based Access Control access control
A vulnerability was found in yzcheng90 SpringBoot 6.0. It has been declared as critical. Affected by this issue is some unknown functionality of the component Role-Based Access Control. The manipulation results in improper access controls.
CVE-2025-29268 | Allnet ALL-RUT22GW 3.3.8 libicos.so hard-coded credentials
A vulnerability identified as critical has been detected in Allnet ALL-RUT22GW 3.3.8. This affects an unknown part in the library libicos.so. Performing a manipulation results in hard-coded credentials. This vulnerability was named CVE-2025
Windows-Sicherheitslücke: Ausgerechnet Microsoft Paint wird zum Einfallstor für Hacker
Schon Mitte Oktober 2026 hatte Microsoft eine Lücke in seinem Zeichenprogramm Paint gemeldet, über die Hacker:innen Schadcode einschleusen könnten. Ein bereitgestellter Patch scheint aber noch nicht bei allen Nutzer:innen angekommen zu sein
Windows-Sicherheitslücke: Ausgerechnet Microsoft Paint wird zum Einfallstor für Hacker
Schon Mitte Oktober 2026 hatte Microsoft eine Lücke in seinem Zeichenprogramm Paint gemeldet, über die Hacker:innen Schadcode einschleusen könnten. Ein bereitgestellter Patch scheint aber noch nicht bei allen Nutzer:innen angekommen zu sein
[NEU] [UNGEPATCHT] [hoch] Gogs: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen und DoS
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Gogs ausnutzen, um Sicherheitsvorkehrungen zu umgehen und einen Denial of Service zu verursachen. Weiterlesen
[NEU] [mittel] drawio: Schwachstelle ermöglicht Offenlegung von Informationen
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in drawio ausnutzen, um Informationen offenzulegen. Weiterlesen
CVE-2025-65345 | alexusmai laravel-file-manager up to 3.3.1 ZIP path traversal
A vulnerability classified as critical was found in alexusmai laravel-file-manager up to 3.3.1. This impacts an unknown function of the component ZIP Handler. Executing a manipulation can lead to path traversal. This vulnerability is tracke
CVE-2025-54307 | Thermo Fisher Torrent Suite Django Application up to 5.18.1 ZIP File Parser zip plupload_file_upload name/filename path traversal
A vulnerability described as critical has been identified in Thermo Fisher Torrent Suite Django Application up to 5.18.1. This impacts the function plupload_file_upload of the file /configure/plugins/plugin/upload/zip/ of the component ZIP
CVE-2025-54306 | Thermo Fisher Torrent Suite Django Application up to 5.18.1 /etc/environment input validation
A vulnerability labeled as problematic has been found in Thermo Fisher Torrent Suite Django Application up to 5.18.1. Affected by this issue is some unknown functionality of the file /etc/environment. The manipulation results in improper in
CVE-2025-54305 | Thermo Fisher Torrent Suite Django Application 5.18.1 LocalhostAuthMiddleware REMOTE_ADDR improper authentication
A vulnerability described as critical has been identified in Thermo Fisher Torrent Suite Django Application 5.18.1. The affected element is an unknown function of the component LocalhostAuthMiddleware. Executing a manipulation of the argume
CVE-2025-54304 | Thermo Fisher Ion Torrent OneTouch 2 INS1005527 Access Control List access control
A vulnerability marked as critical has been reported in Thermo Fisher Ion Torrent OneTouch 2 INS1005527. This affects an unknown part of the component Access Control List Handler. This manipulation causes improper access controls. This vuln
CVE-2025-54303 | Thermo Fisher Torrent Suite Django Application 5.18.1 Django ORM API default credentials
A vulnerability categorized as problematic has been discovered in Thermo Fisher Torrent Suite Django Application 5.18.1. This affects an unknown part of the component Django ORM API. The manipulation results in use of default credentials. T
CVE-2025-53963 | Thermo Fisher Ion Torrent OneTouch 2 INS1005527 default password
A vulnerability identified as very critical has been detected in Thermo Fisher Ion Torrent OneTouch 2 INS1005527. Affected by this vulnerability is an unknown functionality. The manipulation leads to use of default password. This vulnerabil
CVE-2025-50361 | SmallBASIC main.cpp main buffer overflow
A vulnerability labeled as critical has been found in SmallBASIC. This affects the function main of the file main.cpp. Executing a manipulation can lead to buffer overflow. The identification of this vulnerability is CVE-2025-50361. The att
[NEU] [hoch] FRRouting Project FRRouting: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen und Denial of Service
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in FRRouting Project FRRouting ausnutzen, um Sicherheitsvorkehrungen zu umgehen, und um einen Denial of Service Angriff durchzuführen. Weiterlesen
[NEU] [mittel] Webmin: Schwachstelle ermöglicht Offenlegung von Informationen
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Webmin ausnutzen, um Informationen offenzulegen. Weiterlesen
[NEU] [mittel] Red Hat Enterprise Linux (xorg-x11-server): Schwachstelle ermöglicht Codeausführung und DoS
Ein lokaler Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um beliebigen Programmcode auszuführen oder um einen Denial-of-Service-Zustand zu verursachen. Weiterlesen
CVE-2026-114426 | SEPPmail Secure Email Gateway up to 15.1.0 resource consumption (WID-SEC-2026-4349)
A vulnerability labeled as problematic has been found in SEPPmail Secure Email Gateway up to 15.1.0. Affected by this issue is some unknown functionality. Executing a manipulation can lead to resource consumption. The identification of this
CVE-2026-114421 | SEPPmail Secure Email Gateway up to 15.1.0 password recovery (WID-SEC-2026-4349)
A vulnerability described as critical has been identified in SEPPmail Secure Email Gateway up to 15.1.0. This vulnerability affects unknown code. The manipulation results in weak password recovery. This vulnerability is identified as CVE-20
CVE-2026-114420 | SEPPmail Secure Email Gateway up to 15.1.0 GINA Web Interface neutralization (WID-SEC-2026-4349)
A vulnerability classified as problematic has been found in SEPPmail Secure Email Gateway up to 15.1.0. This issue affects some unknown processing of the component GINA Web Interface. This manipulation causes improper neutralization. This v
Zyxel GS1900 Zero-Day: Why June's Patch Failed and Which Firmware Fixes It
Zyxel's June patch failed to stop an exploited GS1900 zero-day affecting 10 switch models. Here's which firmware versions fix the flaw and what administrators should check. Weiterlesen
Sicherheitskatastrophen 5.11.2026: Digicert, Fake RVTools, Barracuda 0-Day und mehr
Alles abschalten: Die Sicherheitskatastrophen und -Vorfälle stellen langsam alles in den Schatten, was wir bisher erlebt haben. Zertifikataussteller Digicert wurde gehackt und Nutzerdaten (auch Ausweiskopien etc.) sind abgeflossen. Es gibt
CVE-2026-116639 | A vulnerability was detected in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to a8902bf64575e325f6d6bf93a55f7bd273ec58cd. Affected is an unknown function of the file chat.php. Performing a manipulation of the argument ID results in cross site scripting. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for aff
A vulnerability was detected in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to a8902bf64575e325f6d6bf93a55f7bd273ec58cd. Affected is an unknown function of the file chat.php. Performing a manipulation of the argument ID results in
CVE-2026-116839 | A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to make unauthorized changes and execute a Denial of Service (DoS) attack on the device.
A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to make unauthorized changes and execute a Denial of Service (DoS) attack on the
CVE-2026-116838 | A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to execute a Command Injection on the device.
A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to execute a Command Injection on the device.
CVE-2026-116623 | A vulnerability was detected in code-projects Simple Content Management System 1.0. Impacted is an unknown function of the file /web/admin/welcome.php of the component Admin Interface. The manipulation of the argument addnews results in missing authorization. The attack can be launched remotely. The exploit is now public and may be used.
A vulnerability was detected in code-projects Simple Content Management System 1.0. Impacted is an unknown function of the file /web/admin/welcome.php of the component Admin Interface. The manipulation of the argument addnews results in mis
CVE-2026-116837 | A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, SolarPoint, and SolarSwitch devices to execute arbitrary code on the device.
A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, SolarPoint, and SolarSwitch devices to execute arbitrary code on the device.
CVE-2026-116844 | Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerability because TransferOpen checks only the transferTLS flag set by PROT, not whether the prepared data connection uses TLS. When a client sends PROT P after PASV or PORT, file contents and directory listings cross the network unencrypted, even with mandatory encryption, letting on-path attackers read or modify them.
Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerability because TransferOpen checks only the transferTLS flag set by PROT, not whether the prepared data connection uses TLS. When a client sends PROT P after PAS