Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 761 | 0,2 % |
| ≥50 % | 3.395 | 0,9 % |
| ≥10 % | 22.580 | 5,7 % |
| <10 % | 366.557 | 93,2 % |
Barracuda Email Security Gateway Flaws Expose Devices to Potential Root-Level Compromise
Barracuda has released security patches for two vulnerabilities that could be exploited to bypass authorization controls and gain root access to affected Email Security Gateway (ESG) appliances. These vulnerabilities, identified as CVE-2026
Critical SolarWinds Dameware Vulnerability Enables Attackers to Take Control of Remote Systems
SolarWinds has announced a critical command injection vulnerability in its Dameware software that could let authenticated attackers remotely compromise controlled hosts. This vulnerability, identified as CVE-2026-28336, has a CVSS score of
Chrome 9.6 CVE — What “No Login Needed” Actually Means (And What It Doesn’t)
Your scanner dashboard is going to show CVE-2026-121114 at the top this week. CVSS 9.6. Chrome. TabStrip use-after-free. Remote code execution outside the sandbox. Here’s what the score doesn’t tell you. The vector: AV:N/AC:L/PR:N/UI:R/S:C/
CVE-2022-48506 | Dominion Voting Systems ImageCast Precinct/ImageCast Evolution Public Ballot-level Data DVSorder entropy (EUVD-2022-51202)
A vulnerability marked as critical has been reported in Dominion Voting Systems ImageCast Precinct and ImageCast Evolution. This vulnerability affects unknown code of the component Public Ballot-level Data Handler. This manipulation causes
CVE-2022-48501 | Huawei EMUI/Magic UI Configuration denial of service (EUVD-2022-51197)
A vulnerability labeled as problematic has been found in Huawei EMUI and Magic UI. This affects an unknown function of the component Configuration Handler. Executing a manipulation can lead to denial of service. This vulnerability is handle
CVE-2022-48500 | Huawei EMUI/Magic UI Configuration denial of service (EUVD-2022-51196)
A vulnerability identified as problematic has been detected in Huawei EMUI and Magic UI. The impacted element is an unknown function of the component Configuration Handler. Performing a manipulation results in denial of service. This vulner
CVE-2022-48499 | Huawei EMUI/Magic UI Configuration denial of service (EUVD-2022-51195)
A vulnerability categorized as problematic has been discovered in Huawei EMUI and Magic UI. The affected element is an unknown function of the component Configuration Handler. Such manipulation leads to denial of service. This vulnerability
CVE-2022-48498 | Huawei EMUI/Magic UI Configuration denial of service (EUVD-2022-51194)
A vulnerability was found in Huawei EMUI and Magic UI. It has been rated as problematic. Impacted is an unknown function of the component Configuration Handler. This manipulation causes denial of service. This vulnerability appears as CVE-2
CVE-2025-62402 | Apache Airflow up to 3.1.0 API /api/v2/dagReports code injection (EUVD-2025-36994)
A vulnerability, which was classified as critical, has been found in Apache Airflow up to 3.1.0. This affects an unknown part of the file /api/v2/dagReports of the component API. This manipulation causes code injection. This vulnerability i
CVE-2025-54941 | Apache Airflow up to 3.0.4 example_dag_decorator command injection (EUVD-2025-36993)
A vulnerability described as critical has been identified in Apache Airflow up to 3.0.4. This impacts the function example_dag_decorator. Such manipulation leads to command injection. This vulnerability is uniquely identified as CVE-2025-54
CVE-2025-48734 | Apache Commons BeanUtils up to 1.10.x/2.0.0-/1 org.apache.commons getProperty access control (EUVD-2025-16219 / Nessus ID 237781)
A vulnerability has been found in Apache Commons BeanUtils up to 1.10.x/2.0.0-/1 and classified as critical. This affects the function getProperty of the component org.apache.commons. The manipulation leads to improper access controls. This
CVE-2025-22442 | Google Android 13/14/15 DevicePolicyManagerService.java race condition (EUVD-2025-26596)
A vulnerability marked as problematic has been reported in Google Android 13/14/15. The impacted element is an unknown function of the file DevicePolicyManagerService.java. Performing a manipulation results in race condition. This vulnerabi
CVE-2024-54465 | Apple macOS up to 15.1 state issue (WID-SEC-2024-3692)
A vulnerability classified as problematic was found in Apple macOS up to 15.1. This affects an unknown function. The manipulation results in state issue. This vulnerability is known as CVE-2024-54465. Attacking locally is a requirement. No
CVE-2024-50379 | Apache Tomcat up to 9.0.97/10.1.33/11.0.1 JSP Compilation toctou (Nessus ID 213078 / WID-SEC-2024-3722)
A vulnerability labeled as problematic has been found in Apache Tomcat up to 9.0.97/10.1.33/11.0.1. This issue affects some unknown processing of the component JSP Compilation. The manipulation results in time-of-check time-of-use. This vul
CVE-2024-12108 | Progress WhatsUp Gold up to 2024.0.1 Public API authentication spoofing (Nessus ID 214320)
A vulnerability classified as critical has been found in Progress WhatsUp Gold up to 2024.0.1. This affects an unknown function of the component Public API. Performing a manipulation results in authentication bypass by spoofing. This vulner
CVE-2024-55580 | Qlik Sense Enterprise on Windows code injection (EUVD-2024-52817)
A vulnerability classified as critical was found in Qlik Sense Enterprise on Windows. This issue affects some unknown processing. The manipulation results in code injection. This vulnerability is known as CVE-2024-55580. It is possible to l
CVE-2024-55579 | Qlik Sense Enterprise on Windows authorization (EUVD-2024-52816)
A vulnerability, which was classified as very critical, has been found in Qlik Sense Enterprise on Windows. Impacted is an unknown function. This manipulation causes incorrect authorization. This vulnerability is handled as CVE-2024-55579.
CVE-2024-53677 | Apache Struts up to 2.3.37/2.5.33/6.3.0.2 File Upload path traversal (Nessus ID 213040 / WID-SEC-2024-3660)
A vulnerability was found in Apache Struts up to 2.3.37/2.5.33/6.3.0.2. It has been rated as critical. Impacted is an unknown function of the component File Upload. This manipulation causes path traversal. This vulnerability is registered a
CVE-2024-52940 | AnyDesk up to 8.1.0 on Windows Allow Direct Connection information disclosure
A vulnerability was found in AnyDesk up to 8.1.0 on Windows and classified as problematic. The impacted element is an unknown function of the component Allow Direct Connection Handler. Such manipulation leads to information disclosure. This
CVE-2024-49112 | Microsoft Windows up to Server 2025 Lightweight Directory Access Protocol integer overflow (Nessus ID 212240)
A vulnerability classified as very critical was found in Microsoft Windows. Affected is an unknown function of the component Lightweight Directory Access Protocol. The manipulation results in integer overflow. This vulnerability is identifi
CVE-2024-45717 | SolarWinds Platform up to 2024.4 Search/Node Information Section cross site scripting (Nessus ID 212063)
A vulnerability labeled as problematic has been found in SolarWinds Platform up to 2024.4. This impacts an unknown function of the component Search/Node Information Section. Such manipulation leads to cross site scripting. This vulnerabilit
CVE-2024-20482 | Cisco Secure Firewall Management Center authorization (cisco-sa-fmc-priv-esc-CMQ4S6m7)
A vulnerability was found in Cisco Secure Firewall Management Center. It has been declared as problematic. This affects an unknown function. Such manipulation leads to incorrect authorization. This vulnerability is referenced as CVE-2024-20
CVE-2026-119146 | ProFTPD Project up to 1.3.9d/1.3.10rc4 mod_rewrite buffer overflow (EUVD-2026-113779)
A vulnerability has been found in ProFTPD Project ProFTPD up to 1.3.9d/1.3.10rc4 and classified as very critical. Impacted is an unknown function of the component mod_rewrite. The manipulation leads to buffer overflow. This vulnerability is
CVE-2026-119376 | SQLite up to 3.53.x Expression Walker sqlite3WalkExprNN stack-based overflow (EUVD-2026-113787)
A vulnerability, which was classified as problematic, has been found in SQLite up to 3.53.x. This vulnerability affects the function sqlite3WalkExprNN of the component Expression Walker. Performing a manipulation results in stack-based buff
CVE-2026-119372 | SQLite up to 3.53.x FTS3 fts3BestSnippet use after free (EUVD-2026-113783)
A vulnerability was found in SQLite up to 3.53.x. It has been rated as problematic. This impacts the function fts3BestSnippet of the component FTS3. Performing a manipulation results in use after free. This vulnerability is cataloged as CVE
CVE-2026-121615 | Linksys E5600 1.1.0.26 Login /cgi-bin/mesh_login.cgi improper authentication (EUVD-2026-116686)
A vulnerability was found in Linksys E5600 1.1.0.26 and classified as very critical. Affected is an unknown function of the file /cgi-bin/mesh_login.cgi of the component Login Handler. Executing a manipulation can lead to improper authentic
CVE-2026-119407 | Element Web/Element Desktop up to 1.12.31 Guest Session loadSession guest_user_id/guest_access_token improper authentication (EUVD-2026-113791)
A vulnerability, which was classified as problematic, has been found in Element Web and Element Desktop up to 1.12.31. This impacts the function loadSession of the component Guest Session Handler. This manipulation of the argument guest_use
CVE-2026-119415 | CakePHP up to 5.4.3 FormDataPart Message::setAttachments Content-Type/Content-ID injection (EUVD-2026-113795)
A vulnerability was found in CakePHP up to 5.4.3. It has been rated as problematic. The affected element is the function Message::setAttachments of the component FormDataPart. This manipulation of the argument Content-Type/Content-ID causes
CVE-2026-76527 | Splunk SOAR up to 8.6.x improper check or handling of exceptional conditions (EUVD-2026-107638)
A vulnerability, which was classified as critical, was found in Splunk SOAR up to 8.6.x. This affects an unknown part. Such manipulation leads to improper check or handling of exceptional conditions. This vulnerability is uniquely identifie
CVE-2026-119127 | Zitadel up to 4.19.4 Login V2 UI injection (EUVD-2026-113194)
A vulnerability classified as critical has been found in Zitadel up to 4.19.4. Affected by this vulnerability is an unknown functionality of the component Login V2 UI. Performing a manipulation of the argument x-zitadel-public-host/x-zitade
CVE-2026-119123 | ImageMagick up to 7.1.2-33 TIFF Decoder stack-based overflow (EUVD-2026-113190)
A vulnerability categorized as problematic has been discovered in ImageMagick. The affected element is an unknown function of the component TIFF Decoder. Executing a manipulation can lead to stack-based buffer overflow. This vulnerability i
CVE-2026-119139 | Bytecode Alliance Wasmtime up to 48.0.5/49.0.2 Func component::Func::call denial of service (EUVD-2026-113206)
A vulnerability categorized as problematic has been discovered in Bytecode Alliance Wasmtime up to 48.0.5/49.0.2. This impacts the function component::Func::call of the component Func. The manipulation results in denial of service. This vul
CVE-2026-119135 | Bytecode Alliance Wasmtime up to 48.0.5/49.0.2 Component Model Read Path assertion (EUVD-2026-113202)
A vulnerability was found in Bytecode Alliance Wasmtime up to 48.0.5/49.0.2 and classified as problematic. Impacted is an unknown function of the component Component Model Read Path. Such manipulation leads to reachable assertion. This vuln
CVE-2026-119131 | Bytecode Alliance Wasmtime up to 48.0.5/49.0.2 wasmtime-wasi-http set-path-with-query denial of service (EUVD-2026-113198)
A vulnerability, which was classified as problematic, has been found in Bytecode Alliance Wasmtime up to 48.0.5/49.0.2. Impacted is the function set-path-with-query of the component wasmtime-wasi-http. This manipulation causes denial of ser
CVE-2026-119143 | Bytecode Alliance Wasmtime up to 48.0.5/49.0.2 Component Model Direct::remaining out-of-bounds (EUVD-2026-113210)
A vulnerability was found in Bytecode Alliance Wasmtime up to 48.0.5/49.0.2. It has been rated as problematic. This affects the function Direct::remaining of the component Component Model. This manipulation causes out-of-bounds read. This v
CVE-2026-121608 | Qihoo 360 D603-2/D600-2/D606-6 up to 6.3.2 Timezone Push /fs2/bin/iscm on_push_message tz os command injection (EUVD-2026-116672)
A vulnerability classified as critical was found in Qihoo 360 D603-2, D600-2 and D606-6 up to 6.3.2. This vulnerability affects the function on_push_message of the file /fs2/bin/iscm of the component Timezone Push Handler. Executing a manip
CVE-2026-62374 | Openwallet Foundation sd-jwt-js up to 0.19.0 Decode SDJwtInstance.verify improper authorization (EUVD-2026-113215)
A vulnerability has been found in Openwallet Foundation sd-jwt-js up to 0.19.0 and classified as critical. Affected is the function SDJwtInstance.verify of the component Decode. The manipulation leads to improper authorization. This vulnera
CVE-2026-99247 | Linux Kernel up to 7.2.12 Tracing tracer_init_tracefs_work_func null pointer dereference (Nessus ID 375608)
A vulnerability identified as problematic has been detected in Linux Kernel up to 6.1.190/6.6.160/6.12.114/6.18.58/7.2.12. Affected by this vulnerability is the function tracer_init_tracefs_work_func of the component Tracing. This manipulat
CVE-2026-99258 | Linux Kernel up to 6.12.114/6.18.58/7.2.12 hyperv hv_apicid_to_vp_index allocation of resources (Nessus ID 375610)
A vulnerability, which was classified as very critical, has been found in Linux Kernel up to 6.12.114/6.18.58/7.2.12. This vulnerability affects the function hv_apicid_to_vp_index of the component hyperv. The manipulation leads to allocatio
CVE-2026-99256 | Linux Kernel up to 7.2.12 dm cache cache_resume locking (Nessus ID 375609)
A vulnerability classified as critical has been found in Linux Kernel up to 7.2.12. Affected by this issue is the function cache_resume of the component dm cache. Performing a manipulation results in improper locking. This vulnerability was
CVE-2026-121439 | Bytecode Alliance Wasmtime up to 48.0.6/49.0.3 wasi-http response splitting (Nessus ID 375611)
A vulnerability classified as problematic was found in Bytecode Alliance Wasmtime up to 48.0.6/49.0.3. The impacted element is an unknown function of the component wasi-http. Executing a manipulation can lead to http response splitting. Thi
CVE-2026-121426 | Nodemailer up to 10.1.3 addressparser input validation (Nessus ID 375612)
A vulnerability marked as critical has been reported in Nodemailer up to 10.1.3. Affected by this issue is the function addressparser. The manipulation leads to improper input validation. This vulnerability is listed as CVE-2026-121426. The
CVE-2026-99269 | Linux Kernel up to 7.2.13 sched_ext race condition (Nessus ID 375613)
A vulnerability was found in Linux Kernel up to 7.2.13. It has been declared as very critical. Affected by this vulnerability is the function scx_move_local_task_to_local_dsq/unlink_dsq_and_switch_rq_lock/move_task_between_dsqs of the compo
CVE-2024-6800 | GitHub Enterprise Server up to 3.10.15/3.11.13/3.12.7/3.13.2 SAML Authentication signature verification (Nessus ID 208084)
A vulnerability, which was classified as problematic, has been found in GitHub Enterprise Server up to 3.10.15/3.11.13/3.12.7/3.13.2. Affected by this vulnerability is an unknown functionality of the component SAML Authentication Handler. T
CVE-2024-46852 | Linux Kernel up to 6.1.110/6.6.51/6.10.10 dma-buf off-by-one (Nessus ID 208099 / WID-SEC-2025-0477)
A vulnerability marked as problematic has been reported in Linux Kernel up to 6.1.110/6.6.51/6.10.10. Affected by this vulnerability is an unknown functionality of the component dma-buf. Performing a manipulation results in off-by-one. This
CVE-2024-38200 | Microsoft Office/365 Apps for Enterprise information disclosure (EDB-52113)
A vulnerability was found in Microsoft Office and 365 Apps for Enterprise. It has been classified as problematic. The affected element is an unknown function. This manipulation causes information disclosure. This vulnerability is tracked as
CVE-2024-29847 | Ivanti EPM up to 2022 SU5/2024 Agent Portal deserialization
A vulnerability has been found in Ivanti EPM up to 2022 SU5/2024 and classified as critical. This affects an unknown part of the component Agent Portal. This manipulation causes deserialization. This vulnerability is tracked as CVE-2024-298
CVE-2024-29014 | SonicWALL NetExtender up to 10.2.339 on Windows EPC Client Update code injection (SNWLID-2024-0011)
A vulnerability, which was classified as critical, was found in SonicWALL NetExtender up to 10.2.339 on Windows. This affects an unknown part of the component EPC Client Update Handler. The manipulation results in code injection. This vulne
CVE-2024-20419 | Cisco Smart Software Manager On-Prem 8-202206 HTTP Request unverified password change (cisco-sa-cssm-auth-sLw3uhUy / EDB-52155)
A vulnerability labeled as critical has been found in Cisco Smart Software Manager On-Prem 8-202206. Impacted is an unknown function of the component HTTP Request Handler. The manipulation results in unverified password change. This vulnera
CVE-2022-48497 | Huawei EMUI/Magic UI Configuration denial of service (EUVD-2022-51193)
A vulnerability was found in Huawei EMUI and Magic UI. It has been declared as problematic. This issue affects some unknown processing of the component Configuration Handler. The manipulation results in denial of service. This vulnerability
CVE-2022-48496 | Huawei EMUI/Magic UI Lax App improper authorization (EUVD-2022-51192)
A vulnerability, which was classified as critical, was found in Huawei EMUI and Magic UI. This vulnerability affects unknown code of the component Lax App. Executing a manipulation can lead to improper authorization. This vulnerability is t
CVE-2022-48495 | Huawei EMUI/Magic UI information disclosure (EUVD-2022-51191)
A vulnerability, which was classified as problematic, has been found in Huawei EMUI and Magic UI. This affects an unknown part. Performing a manipulation results in information disclosure. This vulnerability is identified as CVE-2022-48495.
CVE-2022-48494 | Huawei EMUI/Magic UI Lax App improper authorization (EUVD-2022-51190)
A vulnerability classified as critical was found in Huawei EMUI and Magic UI. Affected by this issue is some unknown functionality of the component Lax App. Such manipulation leads to improper authorization. This vulnerability is referenced
CVE-2022-48493 | Huawei EMUI/Magic UI Configuration denial of service (EUVD-2022-51189)
A vulnerability was found in Huawei EMUI and Magic UI. It has been classified as problematic. This vulnerability affects unknown code of the component Configuration Handler. The manipulation leads to denial of service. This vulnerability is
CVE-2022-48492 | Huawei EMUI/Magic UI Configuration denial of service (EUVD-2022-51188)
A vulnerability was found in Huawei EMUI and Magic UI and classified as problematic. This affects an unknown part of the component Configuration Handler. Executing a manipulation can lead to denial of service. This vulnerability is register
CVE-2022-48491 | Huawei EMUI/Magic UI Ad Handler improper authentication (EUVD-2022-51187)
A vulnerability classified as critical was found in Huawei EMUI and Magic UI. This impacts an unknown function of the component Ad Handler. The manipulation results in improper authentication. This vulnerability is identified as CVE-2022-48
CVE-2026-120064 | PostgreSQL psqlODBC 18.00.0005 Entry Points SQLBindCol/SQLColAttribute/SQLSetPos column_number/row_index out-of-bounds (Nessus ID 375465)
A vulnerability, which was classified as critical, has been found in PostgreSQL psqlODBC 18.00.0005. Affected by this issue is the function SQLBindCol/SQLColAttribute/SQLSetPos of the component Entry Points. Performing a manipulation of the
CVE-2026-119025 | sindresorhus open up to 10.x index.js authorization_endpoint os command injection (Nessus ID 375466)
A vulnerability described as critical has been identified in sindresorhus open up to 10.x. This affects an unknown function of the file index.js. The manipulation of the argument authorization_endpoint results in os command injection. This
CVE-2026-120060 | PostgreSQL psqlODBC up to 18.00.5 Server Data SQLBulkOperations/SQLStatistics out-of-bounds (Nessus ID 375467)
A vulnerability was found in PostgreSQL psqlODBC up to 18.00.5. It has been declared as critical. This vulnerability affects the function SQLBulkOperations/SQLStatistics of the component Server Data Handler. The manipulation results in out-
CVE-2026-74684 | Linux Kernel up to 6.18.44/7.1.8 tap tap_get_user_xdp null pointer dereference (Nessus ID 375470)
A vulnerability described as critical has been identified in Linux Kernel up to 6.18.44/7.1.8. This affects the function tap_get_user_xdp of the component tap. Executing a manipulation can lead to null pointer dereference. This vulnerabilit