Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 786 | 0,2 % |
| ≥50 % | 3.560 | 0,9 % |
| ≥10 % | 13.157 | 3,2 % |
| <10 % | 396.052 | 95,8 % |
[NEU] [mittel] Shibboleth Identity Provider: Schwachstelle ermöglicht Cross-Site Scripting
Ein entfernter Angreifer kann eine Schwachstelle in Shibboleth Identity Provider ausnutzen, um Dateien zu manipulieren oder einen Cross-Site Scripting Angriff durchzuführen. Weiterlesen
[NEU] [hoch] Pega Platform: Schwachstelle ermöglicht Cross-Site Scripting
Ein entfernter Angreifer kann eine Schwachstelle in Pega Platform ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen. Weiterlesen
[NEU] [mittel] Contao: Schwachstelle ermöglicht Offenlegung von Informationen
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Contao ausnutzen, um Informationen offenzulegen. Weiterlesen
[NEU] [UNGEPATCHT] [hoch] Siemens SIMATIC WinCC: Schwachstelle ermöglicht Codeausführung
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Siemens SIMATIC WinCC ausnutzen, um beliebigen Programmcode auszuführen. Weiterlesen
[NEU] [UNGEPATCHT] [hoch] Siemens SIMATIC: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Benutzerrechten
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Siemens SIMATIC ausnutzen, um Sicherheitsvorkehrungen zu umgehen und beliebigen Programmcode mit Benutzerrechten auszuführen. Weiterlesen
[NEU] [mittel] Python: Schwachstelle ermöglicht Manipulation von Dateien
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Python ausnutzen, um Dateien zu manipulieren. Weiterlesen
CVE-2022-47605 | Custom 404 Pro Plugin up to 3.7.0 on WordPress sql injection
A vulnerability has been found in Custom 404 Pro Plugin up to 3.7.0 on WordPress and classified as critical. This impacts an unknown function. This manipulation causes sql injection. The identification of this vulnerability is CVE-2022-4760
CVE-2022-47436 | Yatra Plugin up to 2.1.13 on WordPress cross site scripting
A vulnerability classified as problematic was found in Yatra Plugin up to 2.1.13 on WordPress. This impacts an unknown function. Executing a manipulation can lead to cross site scripting. This vulnerability appears as CVE-2022-47436. The at
CVE-2022-47180 | Kopa Framework Plugin up to 1.3.5 on WordPress cross-site request forgery
A vulnerability was found in Kopa Framework Plugin up to 1.3.5 on WordPress. It has been declared as problematic. Affected is an unknown function. Such manipulation leads to cross-site request forgery. This vulnerability is traded as CVE-20
CVE-2022-45839 | WHA WHA Puzzle Plugin up to 1.0.9 on WordPress cross site scripting
A vulnerability was found in WHA WHA Puzzle Plugin up to 1.0.9 on WordPress and classified as problematic. Impacted is an unknown function. Such manipulation leads to cross site scripting. This vulnerability is documented as CVE-2022-45839.
CVE-2022-45836 | W3 Eden Download Manager Plugin up to 3.2.59 on WordPress cross site scripting
A vulnerability classified as problematic has been found in W3 Eden Download Manager Plugin up to 3.2.59 on WordPress. This vulnerability affects unknown code. The manipulation leads to cross site scripting. This vulnerability is referenced
CVE-2022-45084 | Softaculous Loginizer Plugin up to 1.7.5 on WordPress cross site scripting
A vulnerability was found in Softaculous Loginizer Plugin up to 1.7.5 on WordPress. It has been declared as problematic. This vulnerability affects unknown code. Executing a manipulation can lead to cross site scripting. This vulnerability
CVE-2022-45079 | Softaculous Loginizer Plugin up to 1.7.5 on WordPress cross-site request forgery
A vulnerability labeled as problematic has been found in Softaculous Loginizer Plugin up to 1.7.5 on WordPress. This affects an unknown part. The manipulation results in cross-site request forgery. This vulnerability was named CVE-2022-4507
CVE-2022-43480 | Magneticlab Homepage Pop-up Plugin up to 1.2.5 on WordPress cross site scripting
A vulnerability was found in Magneticlab Homepage Pop-up Plugin up to 1.2.5 on WordPress. It has been rated as problematic. This vulnerability affects unknown code. The manipulation leads to cross site scripting. This vulnerability is liste
Security Awareness: Wenn Mitarbeiter zur Schwachstelle werden
Warum Security Awareness Trainings in KMU oft wichtiger sind als technische Schutzmaßnahmen erklärt Torsten Bechler, Manager Product Marketing bei Sharp Business Systems Deutschland im Interview. Herr Bechler, der Mensch gilt als größte Sic
Apple Patches Everyting: November 2026 Edition, (Tue, Nov 10th)
On Monday, Apple released updates for iOS/iPadOS, macOS, watchOS, and visionOS. These updates fix nine different vulnerabilities. One of the vulnerabilities, CVE-2026-113971, applies only to iOS/iPadOS version 26. Several of the vulnerabi
CVE-2026-64629 | Siemens Parasolid prior 38.0.235/38.1.230 out-of-bounds (EUVD-2026-56124)
A vulnerability, which was classified as problematic, has been found in Siemens Parasolid. Affected is an unknown function. This manipulation causes out-of-bounds read. This vulnerability appears as CVE-2026-64629. The attack requires local
CVE-2026-59082 | Siemens SIMATIC WinCC up to 7.5/8.0/8.1 cross site scripting (EUVD-2026-120887)
A vulnerability, which was classified as problematic, was found in Siemens SIMATIC WinCC up to 7.5/8.0/8.1. The impacted element is an unknown function. The manipulation results in cross site scripting. This vulnerability was named CVE-2026
CVE-2026-112136 | Siemens Mendix Studio Pro up to 11.12.6 MCP Server access control (EUVD-2026-120890)
A vulnerability described as critical has been identified in Siemens Mendix Studio Pro up to 11.12.6. This vulnerability affects unknown code of the component MCP Server. Such manipulation leads to improper access controls. This vulnerabili
CVE-2026-109830 | Siemens meta-iot2050 up to 01.03.01 code injection (EUVD-2026-120889)
A vulnerability classified as very critical has been found in Siemens meta-iot2050 up to 01.03.01. This issue affects some unknown processing. Performing a manipulation results in code injection. This vulnerability is known as CVE-2026-1098
CVE-2026-109097 | Siemens ROS# up to 2.3.0 injection (EUVD-2026-120888)
A vulnerability classified as problematic was found in Siemens ROS# up to 2.3.0. Impacted is an unknown function. Executing a manipulation can lead to injection. This vulnerability is handled as CVE-2026-109097. It is possible to launch the
CVE-2026-112137 | Siemens Mendix Studio Pro up to 11.12.6 MCP Server cross-site request forgery (EUVD-2026-120891)
A vulnerability was found in Siemens Mendix Studio Pro up to 11.12.6 and classified as problematic. This impacts an unknown function of the component MCP Server. Such manipulation leads to cross-site request forgery. This vulnerability is r
CVE-2026-12264 | ManageEngine DDI Central prior 6201 HA Failover Config Sync Upload unrestricted upload (EUVD-2026-88226)
A vulnerability, which was classified as problematic, was found in ManageEngine DDI Central. Impacted is an unknown function of the component HA Failover Config Sync Upload. The manipulation results in unrestricted upload. This vulnerabilit
CVE-2022-46815 | Lauri Karisola WP Trio Conditional Shipping for WooCommerce Plugin cross-site request forgery
A vulnerability has been found in Lauri Karisola WP Trio Conditional Shipping for WooCommerce Plugin up to 2.3.1 on WordPress and classified as problematic. This vulnerability affects unknown code. This manipulation causes cross-site reques
CVE-2022-45807 | WPVibes WP Mail Log Plugin up to 1.0.1 on WordPress cross-site request forgery
A vulnerability was found in WPVibes WP Mail Log Plugin up to 1.0.1 on WordPress. It has been rated as problematic. The impacted element is an unknown function. The manipulation leads to cross-site request forgery. This vulnerability is lis
CVE-2022-45068 | Mercado Pago Payments for WooCommerce Plugin up to 6.3.1 on WooCommerce cross-site request forgery
A vulnerability, which was classified as problematic, has been found in Mercado Pago Payments for WooCommerce Plugin up to 6.3.1 on WooCommerce. This issue affects some unknown processing. The manipulation leads to cross-site request forger
CVE-2022-40692 | WP Sunshine Photo Cart Plugin up to 2.9.13 on WordPress cross-site request forgery
A vulnerability was found in WP Sunshine Photo Cart Plugin up to 2.9.13 on WordPress and classified as problematic. This issue affects some unknown processing. Such manipulation leads to cross-site request forgery. This vulnerability is ref
Plex2Shell: Synology und QNAP raten zum Update des Plex Media Servers
Sowohl QNAP als auch Synology warnen vor vier Schwachstellen in der Drittanbieteranwendung Plex Media Server, die unter der Bezeichnung Plex2Shell zusammengefasst werden. Die unter CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 und CVE-2026
Critical Apache Airflow Flaw CVE-2026-68982 Enables Unauthenticated Remote Code Execution
A critical missing-authentication flaw in Apache Airflow lets attackers run code on Celery workers without any Airflow credentials. Tracked as CVE-2026-68982, the bug is classified as CWE-306 and affects Airflow versions before 3.4.0 that u
CVE-2026-60037 | MB connect line/Helmholz mbCONNECT24 up to 2.20.x Device Importer code injection (EUVD-2026-120857)
A vulnerability has been found in MB connect line/Helmholz mbCONNECT24, mymbCONNECT24, myREX24V2 and myREX24V2.virtual up to 2.20.x and classified as very critical. Affected is an unknown function of the component Device Importer. This mani
CVE-2026-60036 | MB connect line/Helmholz mbCONNECT24 up to 2.20.x Backends backends patch activate function code injection (EUVD-2026-120856)
A vulnerability was found in MB connect line/Helmholz mbCONNECT24, mymbCONNECT24, myREX24V2 and myREX24V2.virtual up to 2.20.x and classified as very critical. Affected by this vulnerability is the function backends patch activate function
CVE-2026-60039 | MB connect line/Helmholz mbCONNECT24 up to 2.20.x Backup Restore code injection (EUVD-2026-120859)
A vulnerability was found in MB connect line/Helmholz mbCONNECT24, mymbCONNECT24, myREX24V2 and myREX24V2.virtual up to 2.20.x. It has been declared as very critical. This affects an unknown part of the component Backup Restore. Executing a
CVE-2026-60038 | MB connect line/Helmholz mbCONNECT24 up to 2.20.x OpenSSL ImportPKCS12 code injection (EUVD-2026-120858)
A vulnerability categorized as very critical has been discovered in MB connect line/Helmholz mbCONNECT24, mymbCONNECT24, myREX24V2 and myREX24V2.virtual up to 2.20.x. This issue affects the function ImportPKCS12 of the component OpenSSL. Th
CVE-2026-124503 | sooperset mcp-atlassian up to 0.24.0 io.py validate_safe_path path traversal (GHSA-qh7q-jmc7-rc7j / EUVD-2026-120865)
A vulnerability was found in sooperset mcp-atlassian up to 0.24.0. It has been classified as problematic. This issue affects the function validate_safe_path of the file src/mcp_atlassian/utils/io.py. The manipulation of the argument path le
CVE-2026-104619 | PackageKit up to 1.4.0 Zypp Backend privileges management (EUVD-2026-120864)
A vulnerability was found in PackageKit up to 1.4.0. It has been declared as very critical. Impacted is an unknown function of the component Zypp Backend. The manipulation results in improper privilege management. This vulnerability is cata
CVE-2026-1527 | undici 1.js HTTP Service client-h1.js crlf injection (EUVD-2026-11701 / Nessus ID 305802)
A vulnerability was found in undici 1.js and classified as problematic. The affected element is an unknown function in the library lib/dispatcher/client-h1.js of the component HTTP Service. Such manipulation leads to crlf injection. This vu
CVE-2022-35948 | undici up to 5.8.0 on Node.js Content-Type Header crlf injection (GHSA-f772-66g8-q5h3 / WID-SEC-2026-3596)
A vulnerability identified as critical has been detected in undici up to 5.8.0 on Node.js. Affected is an unknown function of the component Content-Type Header Handler. This manipulation causes crlf injection. This vulnerability is register
Chrome: Update schließt aktiv ausgenutzte Sicherheitslücke
Google hat ein Sicherheitsupdate für Chrome im Stable Channel veröffentlicht, das eine aktiv ausgenutzte Zero-Day-Lücke schließt. Für die als „High“ eingestufte Schwachstelle CVE-2026-125350 gibt es laut Google bereits einen Exploit, der in
[UPDATE] [hoch] RPM: Schwachstelle ermöglicht Codeausführung
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in RPM ausnutzen, um beliebigen Programmcode auszuführen. Weiterlesen
Anthropic Launches Claude Mythos 5.2, Scoring 76.3% on Cybersecurity Benchmark to Identify 0-Day Flaws
Anthropic has launched Claude Mythos 5.2, its latest AI model for cybersecurity engineering, reporting a 76.3% score on CyScenarioBench. Released on November 9 alongside Claude Fable 5.2, the model is designed to help security teams find, r
[NEU] [hoch] Atlassian Confluence: Schwachstelle ermöglicht Codeausführung
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Atlassian Confluence ausnutzen, um beliebigen Programmcode auszuführen. Weiterlesen
[NEU] [mittel] Google Cloud Service Mesh: Schwachstelle ermöglicht Denial of Service
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Google Cloud Service Mesh ausnutzen, um einen Denial of Service Angriff durchzuführen. Weiterlesen
[NEU] [mittel] Infoblox NIOS: Schwachstelle ermöglicht Cross-Site Scripting
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Infoblox NIOS ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen. Weiterlesen
[NEU] [mittel] Ghostscript: Schwachstelle ermöglicht Codeausführung
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Ghostscript ausnutzen, um beliebigen Programmcode auszuführen. Weiterlesen
[NEU] [UNGEPATCHT] [mittel] Tinyproxy: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Tinyproxy ausnutzen, um Sicherheitsvorkehrungen zu umgehen. Weiterlesen
[NEU] [niedrig] ImageMagick: Schwachstelle ermöglicht Offenlegung von Informationen
Ein lokaler Angreifer kann eine Schwachstelle in ImageMagick ausnutzen, um Informationen offenzulegen. Weiterlesen
CVE-2026-28578 | Google Android 14/15/16/16-qpr2 DevicePolicyManagerService.java denial of service
A vulnerability, which was classified as critical, was found in Google Android 14/15/16/16-qpr2. The impacted element is an unknown function of the file DevicePolicyManagerService.java. Such manipulation leads to denial of service. This vul
CVE-2026-0100 | Google Android 14/15/16/16-qpr2 LoadedArsc.cpp Load heap-based overflow
A vulnerability classified as critical was found in Google Android 14/15/16/16-qpr2. Impacted is the function Load of the file LoadedArsc.cpp. The manipulation results in heap-based buffer overflow. This vulnerability was named CVE-2026-010
CVE-2026-60041 | MB connect line/Helmholz mbCONNECT24 up to 2.20.x cross-site request forgery (EUVD-2026-120861)
A vulnerability classified as problematic was found in MB connect line/Helmholz mbCONNECT24, mymbCONNECT24, myREX24V2 and myREX24V2.virtual up to 2.20.x. Affected is an unknown function. The manipulation results in cross-site request forger
CVE-2026-60040 | MB connect line/Helmholz mbCONNECT24 up to 2.20.x Backends Backup Creation denial of service (EUVD-2026-120860)
A vulnerability marked as critical has been reported in MB connect line/Helmholz mbCONNECT24, mymbCONNECT24, myREX24V2 and myREX24V2.virtual up to 2.20.x. The impacted element is an unknown function of the component Backends Backup Creation
CVE-2026-60042 | MB connect line/Helmholz mbCONNECT24 up to 2.20.x com_check improper authentication (EUVD-2026-120862)
A vulnerability was found in MB connect line/Helmholz mbCONNECT24, mymbCONNECT24, myREX24V2 and myREX24V2.virtual up to 2.20.x. It has been rated as critical. This vulnerability affects the function com_check. The manipulation leads to impr
CVE-2026-60045 | MB connect line/Helmholz mbCONNECT24 up to 2.20.x unrestricted upload (EUVD-2026-120834)
A vulnerability classified as problematic has been found in MB connect line/Helmholz mbCONNECT24, mymbCONNECT24, myREX24V2 and myREX24V2.virtual up to 2.20.x. This impacts an unknown function. The manipulation leads to unrestricted upload.
CVE-2026-60044 | MB connect line/Helmholz mbCONNECT24 up to 2.20.x Backup weak password (EUVD-2026-120833)
A vulnerability labeled as problematic has been found in MB connect line/Helmholz mbCONNECT24, mymbCONNECT24, myREX24V2 and myREX24V2.virtual up to 2.20.x. The affected element is an unknown function of the component Backup. Such manipulati
CVE-2026-60046 | MB connect line/Helmholz mbCONNECT24 up to 2.20.x password recovery (EUVD-2026-120835)
A vulnerability identified as critical has been detected in MB connect line/Helmholz mbCONNECT24, mymbCONNECT24, myREX24V2 and myREX24V2.virtual up to 2.20.x. Impacted is an unknown function. This manipulation causes weak password recovery.
CVE-2026-60043 | MB connect line/Helmholz mbCONNECT24 up to 2.20.x cross site scripting (EUVD-2026-120863)
A vulnerability described as problematic has been identified in MB connect line/Helmholz mbCONNECT24, mymbCONNECT24, myREX24V2 and myREX24V2.virtual up to 2.20.x. This affects an unknown function. Executing a manipulation can lead to cross
[UPDATE] [mittel] RPM: Schwachstelle ermöglicht Codeausführung
Ein lokaler Angreifer kann eine Schwachstelle in RPM ausnutzen, um potenziell Code auszuführen, Daten zu manipulieren oder um einen Denial-of-Service-Zustand herbeizuführen. Weiterlesen
CVE-2026-86921 | Apple iOS/iPadOS/macOS/visionOS prior 26.7/27 permission
A vulnerability described as very critical has been identified in Apple iOS, iPadOS, macOS and visionOS. Affected is an unknown function. Such manipulation leads to permission issues. This vulnerability is referenced as CVE-2026-86921. The
CVE-2026-86919 | Apple iOS/iPadOS/macOS/visionOS prior 26.7/27/15.8 stack-based overflow
A vulnerability was found in Apple iOS, iPadOS, macOS and visionOS. It has been classified as very critical. This vulnerability affects unknown code. This manipulation causes stack-based buffer overflow. This vulnerability appears as CVE-20
CVE-2026-86918 | Apple iOS/iPadOS/macOS/tvOS/visionOS/watchOS up to 26 Image Processing out-of-bounds write
A vulnerability was found in Apple iOS, iPadOS, macOS, tvOS, visionOS and watchOS up to 26. It has been declared as very critical. This issue affects some unknown processing of the component Image Processing. Such manipulation leads to out-
CVE-2026-86872 | Apple Safari/visionOS/watchOS up to 26 state issue
A vulnerability was found in Apple Safari, visionOS and watchOS up to 26. It has been declared as critical. Affected by this issue is some unknown functionality. The manipulation results in state issue. This vulnerability is known as CVE-20