Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 720 | 0,2 % |
| ≥50 % | 3.224 | 0,9 % |
| ≥10 % | 22.120 | 6,0 % |
| <10 % | 344.967 | 93,0 % |
PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions
A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH. The attack involves the exploitation of CVE-2025-61624
PEERSTITCH-Malware nutzt FortiOS-Schwachstelle für speicherresistente Angriffe
LONDON (IT BOLTWISE) – Eine speicherresidente ARM64-Malware namens PEERSTITCH wurde offenbar über eine FortiOS-Schwachstelle eingeschleust, ohne eine persistente Datei auf dem Gerät zu hinterlassen. Die Angreifer patchten offenbar nach Ausn
BeyondTrust patches zero-day exploited in attacks since August
BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late August. [...] Weiterlesen
CISA Warns Hackers Are Exploiting Palo Alto PAN-OS Zero-Day to Gain Root Access
The U.S. Cybersecurity and Infrastructure Security Agency has added a critical Palo Alto Networks PAN-OS vulnerability, tracked as CVE-2026-0322, to its Known Exploited Vulnerabilities catalog after confirming active exploitation. The flaw
CVE-2026-19746 | Calix GigaSpire 26.1.0 traceroute.cmd denial of service
A vulnerability has been found in Calix GigaSpire 26.1.0 and classified as problematic. The affected element is an unknown function of the file traceroute.cmd. The manipulation leads to denial of service. This vulnerability is listed as CVE
CVE-2026-19745 | Calix GigaSpire 26.1.0 Web Management Interface utilities_configurationsave.cgi sessionKey denial of service
A vulnerability, which was classified as problematic, was found in Calix GigaSpire 26.1.0. Impacted is an unknown function of the file utilities_configurationsave.cgi of the component Web Management Interface. Executing a manipulation of th
Hackers Exploit BeyondTrust Zero-Day to Establish Persistent Root Access and Target Credentials
Hackers linked to a suspected Chinese espionage group exploited a BeyondTrust Remote Support zero-day to gain persistent root access and target stored credentials. Mandiant identified attacks beginning in late August 2026, weeks before Beyo
Ivanti patches Connect Secure zero-day after researchers confirm in-the-wild attacks
Vendor promises fix for separate privilege-escalation flaw in the coming weeks This article has been indexed from www.theregister.com – Articles Read the original article: Ivanti patches Connect Secure zero-day after researchers confirm in-
Critical Linux Kernel Zero-Day Lets Attackers Escape Virtual Machines and Gain Root Access
A critical Linux kernel networking vulnerability dubbed PwnEscape lets researchers escape virtual machines and run root-privileged commands on the host. Discovered during Vercel’s $1 million Sandbox challenge, the flaw affects host networki
Google Warns Chinese Hackers Exploited Critical BeyondTrust Zero-Day to Gain Root Access
A suspected China-linked espionage group exploited a critical BeyondTrust Remote Support vulnerability as a zero-day in late August 2026 weeks before BeyondTrust disclosed it on October 15. Mandiant, which investigated the incident, found t
Google Warns Chinese Hackers Exploited Critical BeyondTrust Zero-Day to Gain Root Access
A suspected China-linked espionage group exploited a critical BeyondTrust Remote Support vulnerability as a zero-day in late August 2026 weeks before BeyondTrust disclosed it on October 15. Mandiant, which investigated the incident, found t
CVE-2017-8512 | Microsoft Office up to 2016 data processing (KB3203436 / Nessus ID 100782)
A vulnerability was found in Microsoft Office up to 2016. It has been rated as critical. This affects an unknown part. This manipulation causes data processing error. This vulnerability is registered as CVE-2017-8512. Remote exploitation of
CVE-2017-8509 | Microsoft Office up to 2016 data processing (KB3191908 / Nessus ID 100758)
A vulnerability was found in Microsoft Office up to 2016 and classified as critical. Affected is an unknown function. Executing a manipulation can lead to data processing error. This vulnerability is tracked as CVE-2017-8509. The attack can
CVE-2017-5664 | Oracle Communications Instant Messaging Server 10.0.1 Apache Tomcat exceptional condition (ID 157497 / BID-98888)
A vulnerability has been found in Oracle Communications Instant Messaging Server 10.0.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Apache Tomcat. This manipulation causes handling
CVE-2016-6794 | Apache Tomcat up to 9.0.0.M9 System Property Replacement information disclosure (RHSA-2017:0455 / Nessus ID 94684)
A vulnerability identified as problematic has been detected in Apache Tomcat up to 6.0.45/7.0.70/8.0.36/8.5.4/9.0.0.M9. This issue affects some unknown processing of the component System Property Replacement. Performing a manipulation resul
Critical Adobe Acrobat Flaw Lets Malicious PDFs Trigger One-Click Memory Corruption
Adobe has fixed a flaw in Acrobat and Acrobat Reader that lets a malicious PDF corrupt memory when a user opens it. Tracked as CVE-2026-81983, the out-of-bounds write carries a CVSS score of 7.8 and could lead to code execution with the vic
PoC Exploit Released for Critical GitLab RCE Vulnerability (CVE-2026-97229)
A public proof-of-concept (PoC) for CVE-2026-97229 published by researcher Jonah Burgess shows how a flaw in GitLab’s CI/CD regular-expression compiler could be used to run commands on a vulnerable server. GitLab rates the issue Critical wi
CVE-2017-0281 | Microsoft SharePoint 2010 SP2/2013 SP1/2016 data processing (Advisory 3162054 / ID 3162054)
A vulnerability was found in Microsoft SharePoint 2010 SP2/2013 SP1/2016. It has been rated as critical. This issue affects some unknown processing. This manipulation causes data processing error. This vulnerability is tracked as CVE-2017-0
CVE-2016-8497 | Fortinet FortiOS 5.4.3 FortiClient SSL_VPN Linux access control (BID-97478)
This issue was flagged as a false-positive. Please consult the sources mentioned and consider not using this entry at all. Weiterlesen
CVE-2016-8496 | Fortinet FortiOS 5.4.2 FortiClient SSL_VPN Linux command injection (BID-98738)
This issue appears to be a false-positive. Please verify the sources mentioned and consider not using this entry at all. Weiterlesen
Critical Linux Kernel Flaw Lets Attackers Escape Virtual Machines and Take Control of Hosts
A critical flaw in the Linux kernel may allow an attacker-controlled virtual machine (VM) to breach its isolation boundary and impact the host system. This vulnerability, identified as CVE-2026-99999 and referred to as PwnEscape by research
CVE-2017-5674 | Goahead Web Server HTTP GET Request system.ini information disclosure (ID 87283)
A vulnerability was found in Goahead Web Server and classified as critical. Affected by this vulnerability is an unknown functionality of the file system.ini of the component HTTP GET Request Handler. The manipulation results in information
CVE-2017-5648 | Apache Tomcat up to 7.0.75/8.0.41/8.5.11/9.0.0.M17 Application Listener access control (Nessus ID 99535 / ID 350987)
A vulnerability has been found in Apache Tomcat up to 7.0.75/8.0.41/8.5.11/9.0.0.M17 and classified as critical. Affected is an unknown function of the component Application Listener. This manipulation causes improper access controls. This
CVE-2016-9096 | Symantec Management Console up to 5.2.6 cross site scripting (SYM17-003 / ID 1037987)
This issue was flagged as a false-positive. Please consult the sources mentioned and consider not using this entry at all. Weiterlesen
CVE-2016-7276 | Microsoft Office 2007 SP3/2010 SP2/2013 RT SP1/2013 SP1 out-of-bounds (MS16-148 / Nessus ID 95810)
A vulnerability classified as problematic was found in Microsoft Office 2007 SP3/2010 SP2/2013 RT SP1/2013 SP1. This impacts an unknown function. Executing a manipulation can lead to out-of-bounds read. The identification of this vulnerabil
CVE-2016-3313 | Microsoft Office up to 2016 memory corruption (MS16-099 / EDB-40224)
A vulnerability labeled as critical has been found in Microsoft Office 2007/2010/2013/2013 RT/2016. The impacted element is an unknown function. The manipulation results in memory corruption. This vulnerability is reported as CVE-2016-3313.
CVE-2016-10165 | Oracle Java SE 7u151/8u144/9 Little CMS 2 out-of-bounds (Nessus ID 96818 / ID 171692)
A vulnerability was found in Oracle Java SE 7u151/8u144/9. It has been declared as problematic. This issue affects some unknown processing of the component Little CMS 2. The manipulation results in out-of-bounds read. This vulnerability is
CVE-2016-0141 | Microsoft Office up to 2016 information disclosure (MS16-107 / Nessus ID 93481)
A vulnerability identified as problematic has been detected in Microsoft Office 2007/2010/2013/2013 RT/2016. Affected is an unknown function. The manipulation leads to information disclosure. This vulnerability is documented as CVE-2016-014
CVE-2026-96204 | Microsoft Arc Enabled Servers up to 1.67 privileges management (Nessus ID 366208)
A vulnerability described as problematic has been identified in Microsoft Arc Enabled Servers up to 1.67. This issue affects some unknown processing. Such manipulation leads to improper privilege management. This vulnerability is uniquely i
CVE-2026-102235 | Microsoft Visual Studio Code up to 1.141.0 cross site scripting (Nessus ID 366207)
A vulnerability categorized as problematic has been discovered in Microsoft Visual Studio Code up to 1.141.0. This vulnerability affects unknown code. Such manipulation leads to cross site scripting. This vulnerability is uniquely identifie
CVE-2026-69877 | Microsoft Azure DevOps improper authorization (Nessus ID 366209)
A vulnerability labeled as problematic has been found in Microsoft Azure DevOps. This vulnerability affects unknown code. The manipulation results in improper authorization. This vulnerability is cataloged as CVE-2026-69877. The attack may
CVE-2026-89280 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.2.1 via the 'password' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to change the WordPress account password of any customer who has placed at l
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.2.1 via the 'password' par
CVE-2026-109207 | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:thumbnail@url' parameter in all versions up to, and including, 5.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:thumbnail@url' parameter in all versions up to, and including,
CVE-2026-107758 | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.0.390 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload survives storage because the widened comment allow-list permi
The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.0.390 due to insufficient input sanitization and output escaping. This makes it p
CVE-2026-97339 | The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter in all versions up to, and including, 7.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit bypasses WordPress's wp_ks
The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter in all versions up to, and including, 7.5.5 due to insufficient input sani
CVE-2026-104769 | The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires that the site administrator has enabled the Optimize CSS feature (wit
The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter. This makes it possible for authenticated attackers, with adm
CVE-2026-104745 | The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the `alg_wc_ev_verify_email` parameter in versions up to, and including, 3.3.0. The vulnerability exists because `alg_wc_ev_generate_user_code()` generates the per-user activation secret using `wp_rand(100)` when the plugin's 'Encoding method' is set to 'hashids', producing only ~101 possible values (~7 bits of entropy); the resulting token is a rev
The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the `alg_wc_ev_verify_email` parameter in versions up to, and including, 3.3.0. The vulnerability exists because `alg_wc_ev_gener
CVE-2026-93953 | The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field (second-order, via restore) in all versions up to, and including, 1.5.8 due to insufficient escaping on the user supplied parameter and the lack of sufficient preparation on an existing SQL query. Backuply exports the Biographical Info value verbatim inside an INSERT statement written to the backup's SQL dump (wp_usermeta). Whe
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field (second-order, via restore) in all versions up to, and including, 1.5.8 due to insufficient escaping on th
CVE-2026-109990 | The Flying Scripts: Delay JavaScript to Improve Site Speed & Performance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit bypasses WordPress core'
The Flying Scripts: Delay JavaScript to Improve Site Speed & Performance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.2.4 due to insufficient input san
CVE-2026-103518 | The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the 'products[*].variants[*].<attacker-chosen key>' parameter in all versions up to, and including, 1.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append add
The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the 'products[*].variants[*].' parameter in all versions up to, and including, 1.7.0 due to insufficient es
CVE-2026-93535 | The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'icon_light' Shortcode Attribute in all versions up to, and including, 5.3.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an inject
The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'icon_light' Shortcode Attribute in all versions up to, and including, 5.3.17 due to insufficient inp
CVE-2026-77829 | The Cooked – Recipe Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via [cooked-timer] Shortcode Content in all versions up to, and including, 1.16.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Cooked – Recipe Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via [cooked-timer] Shortcode Content in all versions up to, and including, 1.16.1 due to insufficient input sanitization and output escaping. T
CVE-2026-111446 | Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true, as it is by default in development. Before 4.1.2 these tools have no local-access restriction; in 4.1.2 the restriction trusts client-supplied headers without checking the connecting peer. Remote clients can obtain application settings, environment/datasource details and routes, and start test runs. Where application tests use
Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true, as it is by default in development. Before 4.1.2 these tools have no local-access restriction; in 4.1.2 th
CVE-2026-111445 | Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=). For exists(key=), production with error information disabled returns true for an out-of-scope key instead of throwing. Applications relying on scopes for ownership or tenant authorization can therefore load and subsequently modify or delete another user's or tenant's record when the key comes from a request. The 4.2.0 fix c
Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=). For exists(key=), production with error information disabled returns true for an out-of-scope key inste
CVE-2026-111444 | Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions in developer-written where strings that the parser does not bind, such as BETWEEN bounds, function arguments and LIKE ESCAPE literals. Doubling single quotes without accounting for backslash escapes
Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and
CVE-2026-111443 | Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production, by supplying an X-Wheels-Test-Context header or WHEELS_TEST_CONTEXT cookie with any value, or including a test-runner path anywhere in the URL, even the query string. The alternate application uses the same configuration, environment, datasource and debug settings: this is not an authentication bypass or data/debug esc
Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production, by supplying an X-Wheels-Test-Context header or WHEELS_TEST_CONTEXT cookie with any value, or incl
CVE-2026-111442 | Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack potentially dangerous SVG tags. SVG images can contain clickable links or executable scripting. By uploading a crafted SVG, it is possible to execute scripting in the browser when an SVG image is viewed. This issue is mitigated by the attacker needing to be able to upload SVG images, and that Backdrop embeds all uploaded SVG
Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack potentially dangerous SVG tags. SVG images can contain clickable links or executable scripting. By upload
CVE-2026-109813 | A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidentiality and integrity of communications.
A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to comprom
CVE-2026-109812 | A missing authorization vulnerability exists in the internal API `/api/v1/secrets/` of some of Moxa's industrial computing products. A low-privileged authenticated attacker with adjacent network access could exploit this vulnerability to access sensitive information, potentially resulting in the disclosure of confidential data, including cryptographic key material.
A missing authorization vulnerability exists in the internal API `/api/v1/secrets/` of some of Moxa's industrial computing products. A low-privileged authenticated attacker with adjacent network access could exploit this vulnerability to ac
CVE-2026-100159 | The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ays_popup_get_user_ip() function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only with sanitize_text_field() (which does not strip the bracket, quote, space, or '=' characters used by shortcode syntax), substituting the value into a popup body
The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ays_popup_get_user_ip() function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forw
CVE-2026-105228 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft.
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft.
CVE-2026-105227 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft.
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft.
CVE-2026-111389 | Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extract sensitive information from the database.
Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can se
CVE-2026-111388 | Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrict_ip allowlist for non-session authentication methods, including API key, OAuth, and header-based authentication. Attackers holding valid credentials of these types can authenticate from IP addresses outside the allowlist, defeating the configured network-based access restrictions.
Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrict_ip allowlist for non-session authentication methods, including API key, OAuth, and header-based authentication. Attackers holding valid credenti
CVE-2026-111387 | Nezha from 2.2.5 before 2.3.15 contains an information disclosure vulnerability that allows authenticated users to retrieve third-party credentials because listDDNS omits WebhookURL and WebhookRequestBody redaction. Admins or PATs with nezha:ddns:read scope can call GET /api/v1/ddns to read cleartext tokens embedded in every user's DDNS webhook profiles.
Nezha from 2.2.5 before 2.3.15 contains an information disclosure vulnerability that allows authenticated users to retrieve third-party credentials because listDDNS omits WebhookURL and WebhookRequestBody redaction. Admins or PATs with nezh
CVE-2026-111386 | Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses. Attackers can sweep sequential IDs against getServerConfig and setServerConfig, distinguishing 'permission denied' from success payloads to map other users' servers.
Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses. Attackers can sweep sequential IDs against getServerCon
CVE-2026-111385 | Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.download_url and fs.upload_url transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file uploads or capture one-time download tokens and replay them to exfiltrate files.
Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.download_url and fs.upload_url transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a
CVE-2026-111384 | Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never calls SetReadLimit, leaving message size unbounded. Authenticated users with file manager scopes can send one oversized binary message to /api/v1/ws/file/:id, triggering an OOM kill that drops all agent monitoring.
Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never calls SetReadLimit, leaving message size unbounded. Authenticated users with file manager scopes ca
CVE-2026-111383 | Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe without limits, exhausting file descriptors, memory, and goroutines and blocking agent gRPC reconnections.
Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptio
CVE-2026-111382 | FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in general_LumaToYUV444 and general_ChromaV2ToYUV444 that allows malicious RDP servers to corrupt client memory. Attackers can send RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at surface height to write past U/V planes, enabling heap corruption and potential code execution.
FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in general_LumaToYUV444 and general_ChromaV2ToYUV444 that allows malicious RDP servers to corrupt client memory. Attackers can send RDPGFX AVC444 or AVC444v