Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 720 | 0,2 % |
| ≥50 % | 3.222 | 0,9 % |
| ≥10 % | 22.115 | 6,0 % |
| <10 % | 343.213 | 92,9 % |
PoC Exploit Released for Critical Fortinet FortiClient EMS Authentication Bypass Vulnerability
A public proof-of-concept exploit is available for CVE-2026-35616, a critical authentication and authorization bypass vulnerability affecting Fortinet FortiClient Endpoint Management Server (EMS). Published by GitHub user Alaatk, the reposi
CISA Warns Hackers Are Exploiting Ivanti VPN Zero-Day to Steal Credentials and Data
CISA has warned that hackers are actively exploiting a newly disclosed Ivanti Connect Secure vulnerability to steal credentials and exfiltrate data. Tracked as CVE-2026-104935, the authentication bypass enables remote, unauthenticated comma
CVE-2015-4732 | Oracle Java SE 6u95/7u80/8u45 Library Remote Code Execution (RHSA-2015:1229 / Nessus ID 84930)
A vulnerability, which was classified as critical, was found in Oracle Java SE 6u95/7u80/8u45. The impacted element is an unknown function of the component Library Handler. Executing a manipulation can lead to Remote Code Execution. This vu
CVE-2015-4731 | Oracle Java SE 6u95/7u80/8u45 JMX information disclosure (RHSA-2015:1229 / EUVD-2015-4748)
A vulnerability, which was classified as critical, has been found in Oracle Java SE 6u95/7u80/8u45. The affected element is an unknown function of the component JMX. Performing a manipulation results in information disclosure. This vulnerab
CVE-2015-2477 | Microsoft Office up to 2016 memory corruption (MS15-081 / Nessus ID 85349)
A vulnerability was found in Microsoft Office up to 2016. It has been rated as critical. Impacted is an unknown function. Performing a manipulation results in memory corruption. This vulnerability is cataloged as CVE-2015-2477. It is possib
CVE-2015-2470 | Microsoft Office up to Word Viewer numeric error (MS15-081 / EDB-37924)
A vulnerability was found in Microsoft Office. It has been declared as critical. This issue affects some unknown processing. Such manipulation leads to numeric error. This vulnerability is listed as CVE-2015-2470. The attack may be performe
CVE-2015-2468 | Microsoft Office up to Word Viewer memory corruption (MS15-081 / EDB-37912)
A vulnerability was found in Microsoft Office and classified as critical. This affects an unknown part. The manipulation results in memory corruption. This vulnerability is identified as CVE-2015-2468. The attack can be executed remotely. A
CVE-2026-101956 | Juniper Junos OS up to 25.2R2-S1/25.4R1-S2/26.2R1-S1 J-Web improper authentication (EUVD-2026-101440)
A vulnerability categorized as very critical has been discovered in Juniper Junos OS up to 25.2R2-S1/25.4R1-S2/26.2R1-S1. This affects an unknown part of the component J-Web. Such manipulation leads to improper authentication. This vulnerab
CVE-2026-102084 | Juniper Junos OS up to 25.4R1-S2 VPN Daemon buffer overflow (EUVD-2026-101458)
A vulnerability identified as very critical has been detected in Juniper Junos OS up to 25.4R1-S2. This vulnerability affects unknown code of the component VPN Daemon. Performing a manipulation results in buffer overflow. This vulnerability
CVE-2026-102079 | Juniper Networks Junos OS up to 24.4R2-S3/25.2R2-S0/25.4R1-S2 CLI os command injection (EUVD-2026-101465)
A vulnerability, which was classified as very critical, has been found in Juniper Networks Junos OS up to 24.4R2-S3/25.2R2-S0/25.4R1-S2. The affected element is an unknown function of the component CLI. This manipulation causes os command i
CVE-2026-101986 | Juniper Networks Junos OS/Junos OS Evolved J-Web improper authentication (EUVD-2026-101450)
A vulnerability has been found in Juniper Networks Junos OS and Junos OS Evolved and classified as very critical. This vulnerability affects unknown code of the component J-Web. This manipulation causes improper authentication. This vulnera
CVE-2026-102062 | Juniper Networks Junos OS up to 26.2R1-S1 ipfd daemon format string (EUVD-2026-101467)
A vulnerability was found in Juniper Networks Junos OS up to 26.2R1-S1 and classified as very critical. The affected element is an unknown function of the component ipfd daemon. Such manipulation leads to format string. This vulnerability i
CVE-2026-76664 | HPE NonStop EXPAND out-of-bounds (EUVD-2026-101822)
A vulnerability was found in HPE NonStop EXPAND. It has been classified as very critical. This vulnerability affects unknown code. The manipulation leads to out-of-bounds read. This vulnerability is uniquely identified as CVE-2026-76664. Th
CVE-2026-109832 | Red Hat Enterprise Linux gnome-remote-desktop resource consumption (EUVD-2026-98475)
A vulnerability was found in Red Hat Enterprise Linux. It has been rated as critical. Impacted is an unknown function of the component gnome-remote-desktop. Performing a manipulation results in resource consumption. This vulnerability was n
CVE-2026-106618 | Adobe ColdFusion improper authorization (WID-SEC-2026-3945)
A vulnerability marked as very critical has been reported in Adobe ColdFusion. Affected by this issue is some unknown functionality. Performing a manipulation results in improper authorization. This vulnerability is known as CVE-2026-106618
CVE-2026-106617 | Adobe ColdFusion improper authorization (WID-SEC-2026-3945)
A vulnerability was found in Adobe ColdFusion. It has been rated as very critical. This affects an unknown function. Performing a manipulation results in improper authorization. This vulnerability was named CVE-2026-106617. The attack needs
CVE-2026-106616 | Adobe ColdFusion 2023/2025 xml external entity reference (WID-SEC-2026-3945)
A vulnerability categorized as critical has been discovered in Adobe ColdFusion 2025/2023. Affected by this issue is some unknown functionality. Such manipulation leads to xml external entity reference. This vulnerability is documented as C
CVE-2026-106615 | Adobe ColdFusion improper authorization (WID-SEC-2026-3945)
A vulnerability categorized as problematic has been discovered in Adobe ColdFusion. This impacts an unknown function. Executing a manipulation can lead to improper authorization. The identification of this vulnerability is CVE-2026-106615.
CVE-2015-2637 | Oracle Java SE 6u95/7u80/8u45 2D denial of service (RHSA-2015:1241 / EUVD-2015-2729)
A vulnerability, which was classified as problematic, has been found in Oracle Java SE 6u95/7u80/8u45. This affects an unknown function of the component 2D. Performing a manipulation results in denial of service. This vulnerability was name
CVE-2015-2628 | Oracle Java SE 6u95/7u80/8u45 CORBA information disclosure (RHSA-2015:1229 / EUVD-2015-2720)
A vulnerability was found in Oracle Java SE 6u95/7u80/8u45. It has been rated as critical. Affected by this vulnerability is an unknown functionality of the component CORBA. This manipulation causes information disclosure. This vulnerabilit
CVE-2015-2627 | Oracle Java SE 6u95/7u80/8u45 Installation information disclosure (RHSA-2015:1241 / EUVD-2015-2719)
A vulnerability was found in Oracle Java SE 6u95/7u80/8u45. It has been declared as problematic. Affected is an unknown function of the component Installation. The manipulation results in information disclosure. This vulnerability is catalo
CVE-2015-2625 | Oracle Java SE 6u95/7u80/8u45 JSSE information disclosure (RHSA-2015:0809 / EUVD-2015-2717)
A vulnerability was found in Oracle Java SE 6u95/7u80/8u45 and classified as problematic. This affects an unknown function of the component JSSE. Executing a manipulation can lead to information disclosure. This vulnerability is tracked as
CVE-2015-2621 | Oracle Java SE 6u95/7u80/8u45 JMX information disclosure (RHSA-2015:1229 / Nessus ID 84930)
A vulnerability classified as problematic was found in Oracle Java SE 6u95/7u80/8u45. This issue affects some unknown processing of the component JMX. The manipulation results in information disclosure. This vulnerability was named CVE-2015
CVE-2015-2601 | Oracle Java SE 6u95/7u80/8u45 JCE information disclosure (RHSA-2015:1229 / Nessus ID 84930)
A vulnerability identified as problematic has been detected in Oracle Java SE 6u95/7u80/8u45. The impacted element is an unknown function of the component JCE. The manipulation leads to information disclosure. This vulnerability is traded a
CVE-2015-1683 | Microsoft Office up to 2013 SP1 memory corruption (MS15-046 / Nessus ID 83416)
A vulnerability, which was classified as critical, was found in Microsoft Office 2007 SP3/2010 SP2/2011/2013 RT SP1/2013 SP1. This affects an unknown function. The manipulation results in memory corruption. This vulnerability is identified
CVE-2015-0469 | Oracle Java SE 5.0u81/6u91/7u76/8u40 2D denial of service (Nessus ID 84087 / ID 350185)
A vulnerability was found in Oracle Java SE 5.0u81/6u91/7u76/8u40. It has been rated as very critical. Affected by this vulnerability is an unknown functionality of the component 2D. The manipulation leads to denial of service. This vulnera
CVE-2014-7810 | Apache Tomcat up to 6.0.43/7.0.58/8.0.16 Security Manager access control (USN-2654-1 / Nessus ID 83765)
A vulnerability, which was classified as critical, has been found in Apache Tomcat up to 6.0.43/7.0.58/8.0.16. This vulnerability affects unknown code of the component Security Manager. The manipulation leads to improper access controls. Th
CVE-2014-0230 | Apache Tomcat File Upload resource management (RHSA-2015:2659 / Nessus ID 83490)
A vulnerability was found in Apache Tomcat and classified as problematic. This vulnerability affects unknown code of the component File Upload. Such manipulation leads to improper resource management. This vulnerability is uniquely identifi
CVE-2026-106613 | Adobe ColdFusion input validation (WID-SEC-2026-3945)
A vulnerability has been found in Adobe ColdFusion and classified as critical. This affects an unknown part. Performing a manipulation results in improper input validation. This vulnerability is known as CVE-2026-106613. Remote exploitation
CVE-2026-106612 | Adobe ColdFusion improper authorization (WID-SEC-2026-3945)
A vulnerability was found in Adobe ColdFusion. It has been declared as critical. The impacted element is an unknown function. Such manipulation leads to improper authorization. This vulnerability is uniquely identified as CVE-2026-106612. T
CVE-2026-106090 | Adobe ColdFusion improper authorization (WID-SEC-2026-3945)
A vulnerability was found in Adobe ColdFusion. It has been classified as problematic. The affected element is an unknown function. This manipulation causes improper authorization. This vulnerability is handled as CVE-2026-106090. It is poss
CVE-2026-106089 | Adobe ColdFusion improper authorization (WID-SEC-2026-3945)
A vulnerability, which was classified as very critical, has been found in Adobe ColdFusion. Affected by this vulnerability is an unknown functionality. This manipulation causes improper authorization. This vulnerability appears as CVE-2026-
CVE-2026-105994 | Adobe ColdFusion improper authorization (WID-SEC-2026-3945)
A vulnerability was found in Adobe ColdFusion. It has been rated as problematic. The impacted element is an unknown function. The manipulation leads to improper authorization. This vulnerability is documented as CVE-2026-105994. The attack
CVE-2026-105903 | Adobe ColdFusion 2023/2025 code injection (WID-SEC-2026-3945)
A vulnerability was found in Adobe ColdFusion 2023/2025 and classified as critical. Impacted is an unknown function. The manipulation results in code injection. This vulnerability is known as CVE-2026-105903. It is possible to launch the at
CVE-2026-105901 | Adobe ColdFusion improper authorization (WID-SEC-2026-3945)
A vulnerability, which was classified as critical, was found in Adobe ColdFusion. This vulnerability affects unknown code. Executing a manipulation can lead to improper authorization. This vulnerability appears as CVE-2026-105901. The attac
CVE-2026-105900 | Adobe ColdFusion input validation (WID-SEC-2026-3945)
A vulnerability labeled as problematic has been found in Adobe ColdFusion. Affected by this vulnerability is an unknown functionality. The manipulation results in improper input validation. This vulnerability is identified as CVE-2026-10590
CVE-2026-93484 | Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper sanitization or the use of parameterized queries allows an attacker to inject arbitrary SQL commands, leading to data theft, modification, or denial of service. Specifically this is in Kernel::System::Ticket::TicketSearch and Kernel::System::Ticket::ArticleSearchIndex::DB via the ContentSearch parameter. The p
Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper sanitization or the use of parameterized queries allows an attacker to inject arbitrary
CVE-2026-93483 | In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header. Because the application incorrectly trusts this header, an attacker can impersonate any user, including administrators, without requiring a password. This grants full access to confidential data and system controls. More specifically, the HTTPBasicAuth modules for the agent
In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header. Because the application incorrectly trusts this hea
CVE-2026-110912 | In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.c) do not validate the hardware address length (ar_hln) and protocol address length (ar_pln) fields of incoming ARP packets. in_arpreply() then uses these attacker-controlled values as memcpy lengths when copying from kernel buffers that are only 6 and 4 bytes long, resulting in an out-of-bounds read of kernel heap and stack memory that is
In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.c) do not validate the hardware address length (ar_hln) and protocol address length (ar_pln) fields of incoming ARP pack
CVE-2015-1197 | GNU cpio 2.11 symlink (USN-2906-1 / Nessus ID 82319)
A vulnerability was found in GNU cpio 2.11 and classified as problematic. The impacted element is an unknown function. Such manipulation leads to symlink following. This vulnerability is documented as CVE-2015-1197. The attack needs to be p
CVE-2015-0254 | Apache Standard Taglibs up to 1.2.0 memory corruption (USN-2551-1 / Nessus ID 82471)
A vulnerability, which was classified as critical, was found in Apache Standard Taglibs up to 1.2.0. Affected is an unknown function of the component Apache. The manipulation results in memory corruption. This vulnerability is known as CVE-
CVE-2015-0204 | Oracle Internet Directory 11.1.1.9.0 SSL/TLS cryptographic issue (Nessus ID 81903 / ID 185099)
A vulnerability, which was classified as critical, has been found in Oracle Internet Directory 11.1.1.9.0. This affects an unknown part of the component SSL/TLS. This manipulation causes cryptographic issues. This vulnerability is tracked a
CVE-2015-0085 | Microsoft Office up to 2013 SP1 use after free (MS15-022 / Nessus ID 81757)
A vulnerability, which was classified as critical, was found in Microsoft Office up to 2013 SP1. Affected by this vulnerability is an unknown functionality. Such manipulation leads to use after free. This vulnerability is traded as CVE-2015
CVE-2026-110911 | Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the query builder's where(property, value) and where(property, operator, value), string/UUID-key lookup paths (findByKey, updateByKey, deleteByKey and findOrCreateBy...), and validatesUniquenessOf. The parser incorrectly treats a doubled single quote as the end of a literal. Applications passing request data
Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the query builder's where(property, value) and where(property, operator, value), string/
CVE-2026-110909 | Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code submitted through wheels reload or wheels console; console also probes common ports when the project server is down. Other commands can perform unintended state-changing operations against a different local application's serve
Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code subm
CVE-2026-110908 | Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter. An authenticated WebGUI user with only the page-status-frr privilege can supply a filter value that breaks out of a single-quoted sed expression into which escapeshellarg() output is concatenated. Shell command substitution is then evaluated by a popen() pipeline, allowing attacker-selected commands to exec
Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter. An authenticated WebGUI user with only the page-status-frr privilege can supply a filt
CVE-2026-76663 | A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption that may result in DoS.
A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption that may result in DoS.
CVE-2026-76662 | A buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption and DoS.
A buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption and DoS.
CVE-2026-110907 | Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string (like [node:title] or [user:name]) used to automatically insert dynamic data into text. A browser is provided for selecting tokens by type. The product doesn't sufficiently limit access to the types of tokens that are available in the token browser. The names of the individual tokens are adequately protected.
Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string (like [node:title] or [user:name]) used to automatically insert dynamic data into text. A browser is provided for selec
CVE-2022-46548 | Tenda F1203 2.0.1.6 /goform/DhcpListClient page buffer overflow (EUVD-2022-49352)
A vulnerability classified as critical was found in Tenda F1203 2.0.1.6. This impacts an unknown function of the file /goform/DhcpListClient. Executing a manipulation of the argument page can lead to buffer overflow. This vulnerability is t
CVE-2022-46547 | Tenda F1203 2.0.1.6 /goform/VirtualSer page buffer overflow (EUVD-2022-49351)
A vulnerability classified as critical has been found in Tenda F1203 2.0.1.6. This affects an unknown function of the file /goform/VirtualSer. Performing a manipulation of the argument page results in buffer overflow. This vulnerability is
CVE-2022-46546 | Tenda F1203 2.0.1.6 /goform/RouteStatic entrys buffer overflow (EUVD-2022-49350)
A vulnerability described as critical has been identified in Tenda F1203 2.0.1.6. The impacted element is an unknown function of the file /goform/RouteStatic. Such manipulation of the argument entrys leads to buffer overflow. This vulnerabi
CVE-2022-46545 | Tenda F1203 2.0.1.6 /goform/NatStaticSetting page buffer overflow (EUVD-2022-49349)
A vulnerability marked as critical has been reported in Tenda F1203 2.0.1.6. The affected element is an unknown function of the file /goform/NatStaticSetting. This manipulation of the argument page causes buffer overflow. The identification
CVE-2026-76661 | A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write that can corrupt buffer data.
A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write that can corrupt buffer data.
CVE-2026-76660 | A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds write that can corrupt buffer data.
A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds write that can corrupt buffer data.
CVE-2026-76066 | IntentKit through 2.6.3 contains an authorization bypass vulnerability where the executor validates tool calls against the full tool registry rather than the per-request narrowed tool advertisement enforced by ToolBindingMiddleware, allowing owner-only state-changing tools such as wallet transfer, posting, memory-write, and call-agent to execute without any human-in-the-loop or approval gate. An unauthenticated or public caller in WEB, API, TWITTER, or TELEGR
IntentKit through 2.6.3 contains an authorization bypass vulnerability where the executor validates tool calls against the full tool registry rather than the per-request narrowed tool advertisement enforced by ToolBindingMiddleware, allowin
CVE-2026-76659 | A vulnerability in the finger daemon of HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service.
A vulnerability in the finger daemon of HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service.
CVE-2026-109430 | Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) injection vulnerability that allows remote attackers to submit crafted XML POST requests to the /WebAdvisor/WebAdvisor endpoint without disabling external entity and DTD resolution. Attackers can exploit this flaw to force the server into SSRF requests, coerce NTLMv2 hash disclosure via attacker-controlled SMB shares, and read arbitrary files from the underlying Windows host throug
Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) injection vulnerability that allows remote attackers to submit crafted XML POST requests to the /WebAdvisor/WebAdvisor endpoint without disabling external entity
CVE-2026-76656 | A vulnerability in HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service when traceroute is executed under certain conditions.
A vulnerability in HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service when traceroute is executed under certain conditions.
CVE-2026-77931 | MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by embedding malicious instructions in untrusted content processed through tools like browse_webpage, search_web, and torrent metadata parsers, which then get passed to the unrestricted ExecuteCommandTool via asyncio.create_subprocess_shell. Attackers can craft content that instructs the model to invoke execute_command with confirm_danger
MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by embedding malicious instructions in untrusted content processed through tools like browse_webpage, search_web, and