Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 784 | 0,2 % |
| ≥50 % | 3.559 | 0,9 % |
| ≥10 % | 13.140 | 3,2 % |
| <10 % | 395.489 | 95,8 % |
SonicWall CVE-2026-19868: SSL-VPN SAML MFA Bypass Exploited in the Wild
TL;DR what: SonicWall disclosed CVE-2026-19868, an SSL-VPN authentication bypass in SonicOS that lets attackers with valid credentials for an alternate authentication method skip SAML controls, and CISA has confirmed it is exploited in the
CVE-2025-61255 | PHPGurukul Bank Locker Management System /search cross site scripting
A vulnerability classified as problematic has been found in PHPGurukul Bank Locker Management System. This impacts an unknown function of the file /search. The manipulation of the argument Search leads to cross site scripting. This vulnerab
CVE-2025-60334 | Totolink N600R 4.3.0cu.7866_B20220506 setWiFiBasicConfig ssid denial of service
A vulnerability has been found in Totolink N600R 4.3.0cu.7866_B20220506 and classified as problematic. This affects the function setWiFiBasicConfig. The manipulation of the argument ssid leads to denial of service. This vulnerability is doc
CVE-2025-60333 | Totolink N600R 4.3.0cu.7866_B20220506 setWiFiMultipleConfig wepkey2 denial of service
A vulnerability, which was classified as problematic, has been found in Totolink N600R 4.3.0cu.7866_B20220506. The affected element is the function setWiFiMultipleConfig. Performing a manipulation of the argument wepkey2 results in denial o
CVE-2025-60332 | D-Link DIR-823G A1 1.0.2B05 SetWLanRadioSettings null pointer dereference
A vulnerability has been found in D-Link DIR-823G A1 1.0.2B05 and classified as problematic. The affected element is the function SetWLanRadioSettings. The manipulation leads to null pointer dereference. This vulnerability is listed as CVE-
CVE-2025-60331 | D-Link DIR-823G A1 1.0.2B05 /EXCU_SHELL FillMacCloneMac denial of service
A vulnerability classified as problematic was found in D-Link DIR-823G A1 1.0.2B05. This affects an unknown function of the file /EXCU_SHELL. Executing a manipulation of the argument FillMacCloneMac can lead to denial of service. This vulne
CVE-2025-56447 | TM2 Monitoring 3.04 improper authentication
A vulnerability described as critical has been identified in TM2 Monitoring 3.04. Affected by this issue is some unknown functionality. The manipulation results in improper authentication. This vulnerability was named CVE-2025-56447. The at
CVE-2025-61220 | AutoBizLine com.mysecondline.app 1.2.91 improper authorization
A vulnerability categorized as critical has been discovered in AutoBizLine com.mysecondline.app 1.2.91. The impacted element is an unknown function. Such manipulation leads to improper authorization. This vulnerability is traded as CVE-2025
CVE-2025-61194 | daicuocms 1.3.13 Builder.php sql injection
A vulnerability labeled as critical has been found in daicuocms 1.3.13. Affected by this issue is some unknown functionality of the file library\think\db\Builder.php. The manipulation results in sql injection. This vulnerability is known as
CVE-2025-61181 | daicuocms 1.3.13 Image unrestricted upload
A vulnerability marked as critical has been reported in daicuocms 1.3.13. Impacted is an unknown function of the component Image Handler. Performing a manipulation results in unrestricted upload. This vulnerability is known as CVE-2025-6118
CVE-2025-60933 | HR Performance Solutions Performance Pro 3.19.17 cross site scripting
A vulnerability described as problematic has been identified in HR Performance Solutions Performance Pro 3.19.17. The impacted element is an unknown function. Such manipulation of the argument Goal Name/Goal Notes/Action Step Name/Action St
CVE-2025-60932 | HR Performance Solutions Performance Pro 3.19.17 cross site scripting
A vulnerability classified as problematic has been found in HR Performance Solutions Performance Pro 3.19.17. This affects an unknown function. Performing a manipulation of the argument Goal Name/Goal Notes/Action Step Name/Action Step Desc
CVE-2025-60772 | Netlink HG322G 1.0.00-231017 HTTP Request improper authentication
A vulnerability was found in Netlink HG322G 1.0.00-231017 and classified as critical. This vulnerability affects unknown code of the component HTTP Request Handler. Executing a manipulation can lead to improper authentication. This vulnerab
CVE-2025-60511 | OpenAI Chat Block Plugin 3.0.1 on Moodle completion.php blockId authorization
A vulnerability categorized as critical has been discovered in OpenAI Chat Block Plugin 3.0.1 on Moodle. This issue affects some unknown processing of the file /blocks/openai_chat/api/completion.php. The manipulation of the argument blockId
CVE-2025-60507 | GeniAI Plugin 2.3.6 on Moodle local_geniai cross site scripting
A vulnerability, which was classified as problematic, has been found in GeniAI Plugin 2.3.6 on Moodle. The affected element is an unknown function of the component local_geniai. The manipulation leads to cross site scripting. This vulnerabi
CVE-2025-60506 | PDF Annotator Plugin 1.5 on Moodle Public Comments Feature cross site scripting
A vulnerability, which was classified as problematic, was found in PDF Annotator Plugin 1.5 on Moodle. The impacted element is an unknown function of the component Public Comments Feature. The manipulation results in cross site scripting. T
CVE-2025-60500 | QDocs Smart School Management System 7.1 PHP File Parser access control
A vulnerability labeled as critical has been found in QDocs Smart School Management System 7.1. The affected element is an unknown function of the component PHP File Parser. Such manipulation leads to improper access controls. This vulnerab
CVE-2025-60427 | LibreTime up to 3.0.0-alpha.10 Web UI/API information disclosure
A vulnerability was found in LibreTime up to 3.0.0-alpha.10. It has been rated as problematic. The affected element is an unknown function of the component Web UI/API. This manipulation causes information disclosure. This vulnerability appe
CVE-2025-60280 | Bang Resto 1.0 cross site scripting
A vulnerability was found in Bang Resto 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to cross site scripting. This vulnerability is registered as CVE
CVE-2025-59438 | Mbed TLS up to 3.6.4 timing discrepancy (EUVD-2025-35171 / Nessus ID 271649)
A vulnerability marked as problematic has been reported in Mbed TLS up to 3.6.4. The affected element is an unknown function. This manipulation causes observable timing discrepancy. This vulnerability is tracked as CVE-2025-59438. The attac
CVE-2026-123963 | OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a Agent Registry im_server/app.py register desc/name missing authentication (Issue 21 / EUVD-2026-119217)
A vulnerability was found in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. It has been declared as critical. The impacted element is the function register of the file im_server/app.py of the component Agent Regi
CVE-2026-123477 | Crocoblock JetEngine Plugin up to 3.9.0.2 on WordPress cross site scripting (EUVD-2026-119218)
A vulnerability was found in Crocoblock JetEngine Plugin up to 3.9.0.2 on WordPress and classified as problematic. The impacted element is an unknown function. Executing a manipulation can lead to cross site scripting. The identification of
CVE-2026-119498 | RelyWP Simple Cloudflare Turnstile Plugin up to 1.44.4 on WordPress improper authentication (EUVD-2026-119212)
A vulnerability was found in RelyWP Simple Cloudflare Turnstile Plugin up to 1.44.4 on WordPress. It has been classified as critical. Impacted is an unknown function. Performing a manipulation results in improper authentication. This vulner
CVE-2026-122663 | Villame CURCY Plugin up to 2.2.20 on WordPress missing authentication (EUVD-2026-119220)
A vulnerability labeled as problematic has been found in Villame CURCY Plugin up to 2.2.20 on WordPress. Affected is an unknown function. Such manipulation leads to missing authentication. This vulnerability is documented as CVE-2026-122663
CVE-2026-121784 | Magepeople Bookingly Plugin up to 1.4.3 on WordPress cross site scripting (EUVD-2026-119219)
A vulnerability, which was classified as problematic, has been found in Magepeople Bookingly Plugin up to 1.4.3 on WordPress. This issue affects some unknown processing. This manipulation causes cross site scripting. This vulnerability is h
CVE-2026-123474 | LeapWorx Premium Blocks Plugin up to 2.3.18 on WordPress authorization (EUVD-2026-119224)
A vulnerability was found in LeapWorx Premium Blocks Plugin up to 2.3.18 on WordPress. It has been rated as problematic. The impacted element is an unknown function. The manipulation leads to missing authorization. This vulnerability is lis
CVE-2026-123462 | myCred Plugin up to 4.0.2 on WordPress missing authentication (EUVD-2026-119222)
A vulnerability, which was classified as problematic, was found in myCred Plugin up to 4.0.2 on WordPress. Impacted is an unknown function. Such manipulation leads to missing authentication. This vulnerability is uniquely identified as CVE-
CVE-2026-122669 | Everest Forms Plugin up to 3.6.3 on WordPress cross site scripting (EUVD-2026-119221)
A vulnerability classified as problematic was found in Everest Forms Plugin up to 3.6.3 on WordPress. This vulnerability affects unknown code. The manipulation results in cross site scripting. This vulnerability is known as CVE-2026-122669.
CVE-2026-123183 | PluginUs.Net Active Products Tables Plugin up to 2.1.6 on WordPress cross site scripting (EUVD-2026-119225)
A vulnerability has been found in PluginUs.Net Active Products Tables Plugin up to 2.1.6 on WordPress and classified as problematic. The affected element is an unknown function. Performing a manipulation results in cross site scripting. Thi
CVE-2026-121775 | Villame CURCY Plugin up to 2.2.20 on WordPress authorization (EUVD-2026-119223)
A vulnerability categorized as problematic has been discovered in Villame CURCY Plugin up to 2.2.20 on WordPress. This affects an unknown function. The manipulation results in missing authorization. This vulnerability is cataloged as CVE-20
iPhone Duo: Das neue Apple-Handy hat eine große Schwachstelle
(Bildquelle: Apple und Bildbearbeitung GIGA)Apples erstes Falt-Handy ist da. Ein YouTube-Experte spricht jedoch eine deutliche Warnung aus.Tech-Experte Zack Nelson nimmt sich das iPhone Duo vor. Auf seinem YouTube-Kanal JerryRigEverything u
Gravierende Sicherheitslücke: Millionen Webseiten bedroht - Panorama - SZ.de
MeinungCybersicherheit. :Die Vorfälle in den Supermärkten zeigen: Jetzt wird's wirklich ernst. Kommentar von Helmut Martin-Jung. Künstliche ... Weiterlesen
CVE-2023-3972 | Red Hat insights-client temp file (EUVD-2023-44597 / Nessus ID 239778)
A vulnerability categorized as critical has been discovered in Red Hat insights-client. The impacted element is an unknown function. The manipulation results in insecure temporary file. This vulnerability is reported as CVE-2023-3972. The a
CVE-2023-3758 | sssd GPO Policy race condition (RHSA-2024:1919 / Nessus ID 211196)
A vulnerability classified as critical has been found in sssd. This affects an unknown part of the component GPO Policy. This manipulation causes race condition. This vulnerability is registered as CVE-2023-3758. The attack requires access
CVE-2023-3745 | ImageMagick prior 6.9.11-0/7.0.10-0 quantum-private.h PushCharPixel heap-based overflow
A vulnerability classified as critical has been found in ImageMagick. Affected is the function PushCharPixel of the file quantum-private.h. This manipulation causes heap-based buffer overflow. This vulnerability appears as CVE-2023-3745. Th
CVE-2026-55458 | Caddy WebSocket Upgrade reverseproxy.go handleUpgradeResponse request smuggling (Nessus ID 377111)
A vulnerability has been found in Caddy and classified as problematic. Affected is the function handleUpgradeResponse of the file modules/caddyhttp/reverseproxy/reverseproxy.go of the component WebSocket Upgrade. The manipulation leads to h
CVE-2026-49272 | OAuthLib Device Code Grant device_code.py DeviceCodeGrant.validate_token_request device_code input validation (Nessus ID 377110)
A vulnerability was found in OAuthLib. It has been declared as critical. This issue affects the function DeviceCodeGrant.validate_token_request of the file oauthlib/oauth2/rfc6749/grant_types/device_code.py of the component Device Code Gran
CVE-2025-61456 | Bhabishya-123 E-commerce 1.0 Endpoint /index cross site scripting
A vulnerability, which was classified as problematic, has been found in Bhabishya-123 E-commerce 1.0. This impacts an unknown function of the file /index of the component Endpoint. Performing a manipulation results in cross site scripting.
CVE-2025-60856 | Reolink Video Doorbell WiFi DB_566128M5MP_W UART Interface missing authentication
A vulnerability classified as critical was found in Reolink Video Doorbell WiFi DB_566128M5MP_W. This affects an unknown function of the component UART Interface. Such manipulation leads to missing authentication. This vulnerability is trad
CVE-2025-56450 | Log2Space Subscriber Management Software 1.1 POST selfcareLeadHistory lead_id sql injection
A vulnerability classified as critical was found in Log2Space Subscriber Management Software 1.1. Affected is an unknown function of the file /l2s/api/selfcareLeadHistory of the component POST Handler. The manipulation of the argument lead_
CVE-2025-26782 | Samsung Modem Exynos/Modem up to 9825 L2 denial of service (WID-SEC-2025-2726)
A vulnerability has been found in Samsung Modem Exynos and Modem up to 9825 and classified as problematic. This affects an unknown function of the component L2. Performing a manipulation results in denial of service. This vulnerability was
CVE-2025-61417 | TastyIgniter 3.7.7 SVG File Parser /admin/media_manager cross site scripting
A vulnerability, which was classified as problematic, was found in TastyIgniter 3.7.7. Affected is an unknown function of the file /admin/media_manager of the component SVG File Parser. Executing a manipulation can lead to cross site script
CVE-2025-56221 | SigningHub 8.6.8 excessive authentication
A vulnerability classified as problematic has been found in SigningHub 8.6.8. This affects an unknown function. The manipulation leads to improper restriction of excessive authentication attempts. This vulnerability is referenced as CVE-202
CVE-2025-54957 | Microsoft Windows up to Server 2025 Dolby Digital Plus Audio Decoder integer overflow (WID-SEC-2025-2307)
A vulnerability was found in Microsoft Windows. It has been classified as problematic. Impacted is an unknown function of the component Dolby Digital Plus Audio Decoder. This manipulation causes integer overflow. This vulnerability appears
WordPress Schwachstellen CVE-2026-119977 u. CVE-2026-100109
Es gibt derzeit wohl zwei Schwachstellen im Umfeld von WordPress, die man als Administrator kennen sollte. Einmal kann WordPress beim Core-Update in bestimmten Konstellationen angreifbar sein (CVE-2026-119977). Zudem gibt es die kritische S
CVE-2026-120548 | icopydoc YML for Yandex Market Plugin up to 5.10.0 on WordPress yml-for-yandex-market.log y4ym_check_action information disclosure (EUVD-2026-119032)
A vulnerability identified as problematic has been detected in icopydoc YML for Yandex Market Plugin up to 5.10.0 on WordPress. This affects an unknown part of the file wp-content/uploads/y4ym/yml-for-yandex-market.log. This manipulation of
CVE-2026-110004 | tomdever wpForo Forum Plugin up to 3.2.2 on WordPress Theme Deletion theme_delete wpforo_secondary_groupids path traversal (EUVD-2026-119031)
A vulnerability has been found in tomdever wpForo Forum Plugin up to 3.2.2 on WordPress and classified as problematic. The impacted element is the function theme_delete of the component Theme Deletion. This manipulation of the argument wpfo
CVE-2026-119155 | tomdever wpForo Forum Plugin up to 3.2.2 on WordPress href[locale] sql injection (EUVD-2026-119033)
A vulnerability categorized as critical has been discovered in tomdever wpForo Forum Plugin up to 3.2.2 on WordPress. Affected by this issue is some unknown functionality. The manipulation of the argument href[locale] results in sql injecti
CVE-2026-104992 | melograno Booking for Appointments and Events Calendar Plugin authorization (EUVD-2026-119034)
A vulnerability was found in melograno Booking for Appointments and Events Calendar Plugin up to 9.9.1 on WordPress and classified as problematic. This affects an unknown function. Such manipulation leads to authorization bypass. This vulne
CVE-2026-118784 | john-dagelmore WPSpeed Plugin up to 2.6.10 on WordPress LightImages HTML optimizer optimize nickname/display_name HTML injection (EUVD-2026-119035)
A vulnerability labeled as problematic has been found in john-dagelmore WPSpeed Plugin up to 2.6.10 on WordPress. This vulnerability affects the function Dispatcher::runOptimize/LightImages::optimize of the component LightImages HTML optimi
CVE-2026-119164 | tomdever wpForo Forum Plugin up to 3.2.2 on WordPress Secondary Groupids Authorization Guard classes/Members.php Members::update secondary_groupids privileges management (EUVD-2026-119037)
A vulnerability classified as critical was found in tomdever wpForo Forum Plugin up to 3.2.2 on WordPress. This issue affects the function Members::update of the file classes/Members.php of the component Secondary Groupids Authorization Gua
CVE-2026-103900 | denishua WPJAM Basic Plugin up to 7.1 on WordPress Signup signup args privileges management (EUVD-2026-119036)
A vulnerability classified as critical has been found in denishua WPJAM Basic Plugin up to 7.1 on WordPress. This vulnerability affects the function WPJAM_User_Signup::signup of the component Signup. Performing a manipulation of the argumen
CVE-2026-95870 | tomdever wpForo Forum Plugin up to 3.2.1 on WordPress data sql injection (EUVD-2026-119038)
A vulnerability was found in tomdever wpForo Forum Plugin up to 3.2.1 on WordPress. It has been declared as critical. Affected is an unknown function. Executing a manipulation of the argument data can lead to sql injection. This vulnerabili
CVE-2026-120532 | tomdever wpForo Forum Plugin up to 3.2.2 on WordPress post[body] cross site scripting (EUVD-2026-119039)
A vulnerability, which was classified as problematic, has been found in tomdever wpForo Forum Plugin up to 3.2.2 on WordPress. This affects an unknown function. This manipulation of the argument post[body] causes cross site scripting. This
CVE-2026-107616 | melograno Booking for Appointments and Events Calendar Plugin Command handle improper authorization (EUVD-2026-119040)
A vulnerability, which was classified as problematic, was found in melograno Booking for Appointments and Events Calendar Plugin up to 9.9.1 on WordPress. The affected element is the function GetEventAttendeesCommandHandler::handle of the c
CVE-2026-121762 | Blubrry Podcasting PowerPress Podcasting Plugin up to 11.18.0 on WordPress cross-site request forgery (EUVD-2026-119041)
A vulnerability was found in Blubrry Podcasting PowerPress Podcasting Plugin up to 11.18.0 on WordPress. It has been classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross-site reque
CVE-2026-119465 | WPVibes Elementor Addon Elements Plugin up to 1.15 on WordPress information disclosure (EUVD-2026-119042)
A vulnerability labeled as problematic has been found in WPVibes Elementor Addon Elements Plugin up to 1.15 on WordPress. The affected element is an unknown function. Executing a manipulation can lead to information disclosure. This vulnera
CVE-2026-119473 | properfraction ProfilePress Plugin up to 4.17.7 on WordPress cross site scripting (EUVD-2026-119043)
A vulnerability described as problematic has been identified in properfraction ProfilePress Plugin up to 4.17.7 on WordPress. This affects an unknown function. The manipulation results in cross site scripting. This vulnerability was named C
CVE-2026-119507 | WPDeveloper NotificationX Plugin up to 3.3.6 on WordPress cross site scripting (EUVD-2026-119044)
A vulnerability marked as problematic has been reported in WPDeveloper NotificationX Plugin up to 3.3.6 on WordPress. The impacted element is an unknown function. The manipulation leads to cross site scripting. This vulnerability is uniquel
Sicherheitslücke GhostMap blockiert Android mit einer nie geöffneten App
Google liefert keinen Patch. Meistgelesen · Cybersicherheit ... Cybersicherheit Google Cybersecurity IT-Sicherheit ... Weiterlesen