Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 725 | 0,2 % |
| ≥50 % | 3.222 | 0,9 % |
| ≥10 % | 22.089 | 5,9 % |
| <10 % | 347.419 | 93,0 % |
GitHub Release: trufflesecurity/trufflehog v3.99.5 (24.10.2026)
🛡️ Security Fix trufflesecurity/trufflehogv3.99.524.10.2026@dustin-deckerCVE-2026-111497 is an out-of-bounds write in the brotli decoder when a stream contains an invalid block switch. It was fixed upstream in google/brotli commit 0ed4268a
AIStore's legacy ETL API accepted Kubernetes security settings from the caller
AIStore's legacy ETL API accepted Kubernetes security settings from the caller Storage systems for AI workloads sit between a cluster and a dataset, and increasingly they do more than store bytes: they run transformation jobs next to t
CVE-2026-92709 | rsyslog up to 8.2610.0 Dynafacility path traversal (WID-SEC-2026-4119)
A vulnerability identified as very critical has been detected in rsyslog up to 8.2610.0. This affects an unknown function of the component Dynafacility. Performing a manipulation results in path traversal. This vulnerability is identified a
CVE-2026-102253 | esnet iperf3 up to 3.21 denial of service (WID-SEC-2026-4121)
A vulnerability, which was classified as problematic, was found in esnet iperf3 up to 3.21. Affected is an unknown function. Executing a manipulation can lead to denial of service. The identification of this vulnerability is CVE-2026-102253
CVE-2026-20338 | Cisco ClamAV up to 8.4.5.30483 Zip Archive Parser double free (Nessus ID 335452 / WID-SEC-2026-2708)
A vulnerability described as critical has been identified in Cisco ClamAV. The impacted element is an unknown function of the component Zip Archive Parser. The manipulation results in double free. This vulnerability is reported as CVE-2026-
CVE-2026-20337 | Cisco ClamAV Zip Archive Parser out-of-bounds write (Nessus ID 335452 / WID-SEC-2026-2708)
A vulnerability labeled as critical has been found in Cisco ClamAV. Impacted is an unknown function of the component Zip Archive Parser. Executing a manipulation can lead to out-of-bounds write. This vulnerability is registered as CVE-2026-
CVE-2026-111813 | Apache Traffic Server up to 8.1.11/9.2.15/10.1.4/10.2.0 magick plugin data authenticity (WID-SEC-2026-4112)
A vulnerability was found in Apache Traffic Server up to 8.1.11/9.2.15/10.1.4/10.2.0. It has been declared as critical. Affected is an unknown function of the component magick plugin. The manipulation results in insufficient verification of
CVE-2026-111812 | Apache Traffic Server up to 8.1.11/9.2.15/10.1.4/10.2.0 origin_server_auth plugin privileges management (WID-SEC-2026-4112)
A vulnerability described as critical has been identified in Apache Traffic Server up to 8.1.11/9.2.15/10.1.4/10.2.0. This affects an unknown function of the component origin_server_auth plugin. Such manipulation leads to improper privilege
CVE-2022-47859 | SourceCodester Lead Management System 1.0 changePassword.php user_id sql injection (EUVD-2022-50616)
A vulnerability was found in SourceCodester Lead Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file changePassword.php. Such manipulation of the argument user_id leads to sql injection. Thi
CVE-2022-47854 | i-librarian 4.10 ajaxsupplement.php unrestricted upload (Issue 155 / EUVD-2022-50611)
A vulnerability described as critical has been identified in i-librarian 4.10. Affected by this vulnerability is an unknown functionality of the file ajaxsupplement.php. Executing a manipulation can lead to unrestricted upload. This vulnera
CVE-2022-47853 | TOTOlink A7100RU 7.4cu.2313_B20191024 httpd Service command injection (EUVD-2022-50610)
A vulnerability described as critical has been identified in TOTOlink A7100RU 7.4cu.2313_B20191024. Affected by this issue is some unknown functionality of the component httpd Service. Such manipulation leads to command injection. This vuln
CVE-2022-47848 | Bezeq Vtech NB403-IL/Vtech IAD604-IL UPnP Service rootDesc.xml information disclosure (EUVD-2022-50605)
A vulnerability was found in Bezeq Vtech NB403-IL and Vtech IAD604-IL. It has been rated as problematic. Impacted is an unknown function of the file rootDesc.xml of the component UPnP Service. This manipulation causes information disclosure
CVE-2022-47790 | SourceCodester Dynamic Transaction Queuing System 1.0 index.php?page=display id sql injection (EUVD-2022-50547)
A vulnerability identified as critical has been detected in SourceCodester Dynamic Transaction Queuing System 1.0. This affects an unknown function of the file /queuing/index.php?page=display. The manipulation of the argument ID leads to sq
CVE-2022-31259 | beego up to 2.0.2 Route Lookup /p1/p2/:name access control (Issue 4946 / EUVD-2022-5053)
A vulnerability was found in beego up to 2.0.2. It has been declared as critical. The affected element is an unknown function of the file /p1/p2/:name of the component Route Lookup Handler. The manipulation results in improper access contro
CVE-2022-47780 | Bangresto 1.0 itemID sql injection (EUVD-2022-50537)
A vulnerability classified as critical was found in Bangresto 1.0. Affected is an unknown function. Executing a manipulation of the argument itemID can lead to sql injection. This vulnerability is handled as CVE-2022-47780. The attack can o
CVE-2023-24564 | Siemens Solid Edge SE2022/Solid Edge SE2023 DWG File memory corruption (ssa-491245)
A vulnerability marked as critical has been reported in Siemens Solid Edge SE2022 and Solid Edge SE2023. This impacts an unknown function of the component DWG File Handler. The manipulation leads to memory corruption. This vulnerability is
CVE-2023-24562 | Siemens Solid Edge SE2022/Solid Edge SE2023 PAR File uninitialized pointer (ssa-491245)
A vulnerability identified as critical has been detected in Siemens Solid Edge SE2022 and Solid Edge SE2023. The impacted element is an unknown function of the component PAR File Handler. Performing a manipulation results in uninitialized p
CVE-2023-24556 | Siemens Solid Edge SE2022/Solid Edge SE2023 PAR File out-of-bounds (ssa-491245)
A vulnerability has been found in Siemens Solid Edge SE2022 and Solid Edge SE2023 and classified as problematic. Affected by this issue is some unknown functionality of the component PAR File Handler. Performing a manipulation results in ou
CVE-2023-24552 | Siemens Solid Edge SE2022/Solid Edge SE2023 PAR File out-of-bounds (ssa-491245)
A vulnerability classified as problematic has been found in Siemens Solid Edge SE2022 and Solid Edge SE2023. This affects an unknown function of the component PAR File Handler. The manipulation leads to out-of-bounds read. This vulnerabilit
CVE-2023-24550 | Siemens Solid Edge SE2022/Solid Edge SE2023 PAR File heap-based overflow (ssa-491245)
A vulnerability marked as critical has been reported in Siemens Solid Edge SE2022 and Solid Edge SE2023. The affected element is an unknown function of the component PAR File Handler. Performing a manipulation results in heap-based buffer o
CVE-2023-24549 | Siemens Solid Edge SE2022/Solid Edge SE2023 PAR File stack-based overflow (ssa-491245)
A vulnerability labeled as critical has been found in Siemens Solid Edge SE2022 and Solid Edge SE2023. Impacted is an unknown function of the component PAR File Handler. Such manipulation leads to stack-based buffer overflow. This vulnerabi
CVE-2023-22794 | activerecord Gem on Ruby ActiveRecord Comment sql injection (Nessus ID 256761)
A vulnerability classified as critical was found in activerecord Gem on Ruby. This affects an unknown part of the component ActiveRecord Comment Handler. The manipulation results in sql injection. This vulnerability is identified as CVE-202
CVE-2022-47936 | Siemens JT Open/JT Utilities/Parasolid JT File stack-based overflow (ssa-836777)
A vulnerability was found in Siemens JT Open, JT Utilities and Parasolid. It has been declared as critical. Affected by this issue is some unknown functionality of the component JT File Handler. Executing a manipulation can lead to stack-ba
CVE-2022-47762 | Gin-Vue-Admin up to 2.5.4 Download path traversal (Issue 1309 / EUVD-2023-0818)
A vulnerability marked as critical has been reported in Gin-Vue-Admin up to 2.5.4. This affects an unknown part of the component Download Module. This manipulation causes path traversal. The identification of this vulnerability is CVE-2022-
CVE-2022-43552 | Apple macOS up to 13.2.1 curl use after free (HT213670 / Nessus ID 211153)
A vulnerability marked as problematic has been reported in Apple macOS up to 13.2.1. This vulnerability affects unknown code of the component curl. Performing a manipulation results in use after free. This vulnerability was named CVE-2022-4
CVE-2022-47770 | Serenissima Informatica Fast Checkin 1.0 sql injection (EUVD-2022-50527)
A vulnerability marked as critical has been reported in Serenissima Informatica Fast Checkin 1.0. Affected by this vulnerability is an unknown functionality. The manipulation leads to sql injection. This vulnerability is listed as CVE-2022-
CVE-2022-47767 | Solar-Log Gateway up to 4.2.7/5.1.1 slcore backdoor (EUVD-2022-50524)
A vulnerability was found in Solar-Log Gateway up to 4.2.7/5.1.1. It has been declared as critical. Affected is an unknown function of the component slcore. The manipulation results in backdoor. This vulnerability is reported as CVE-2022-47
CVE-2022-47766 | PopojiCMS 2.0.1 Backend Plugin unrestricted upload (Issue 35 / EUVD-2022-50523)
A vulnerability, which was classified as critical, has been found in PopojiCMS 2.0.1. The impacted element is an unknown function of the component Backend Plugin Handler. The manipulation leads to unrestricted upload. This vulnerability is
CVE-2022-47758 | Nanoleaf up to 7.1.1 certificate validation (EUVD-2022-50516)
A vulnerability labeled as critical has been found in Nanoleaf up to 7.1.1. This impacts an unknown function. Executing a manipulation can lead to improper certificate validation. This vulnerability is handled as CVE-2022-47758. The attack
CVE-2026-113378 | mcollina mcp-ripgrep up to 0.4.0 Advanced Search Tool src/index.ts fileType os command injection
A vulnerability was found in mcollina mcp-ripgrep up to 0.4.0. It has been declared as problematic. Affected is an unknown function of the file src/index.ts of the component Advanced Search Tool. The manipulation of the argument fileType re
CVE-2026-111811 | Apache Traffic Server up to 8.1.11/9.2.15/10.1.4/10.2.0 tsmemcache authorization (WID-SEC-2026-4112)
A vulnerability classified as critical has been found in Apache Traffic Server up to 8.1.11/9.2.15/10.1.4/10.2.0. This impacts an unknown function of the component tsmemcache. Performing a manipulation results in missing authorization. This
CVE-2025-55702 | Apache Traffic Server up to 8.1.11/9.2.15/10.1.4/10.2.0 improper synchronization (WID-SEC-2026-4112)
A vulnerability was found in Apache Traffic Server up to 8.1.11/9.2.15/10.1.4/10.2.0 and classified as critical. Impacted is an unknown function. Such manipulation leads to improper synchronization. This vulnerability is documented as CVE-2
CVE-2026-115506 | Libexpat up to 2.9.0 xmlparse.c accountingDiffTolerated denial of service (WID-SEC-2026-4123)
A vulnerability, which was classified as problematic, was found in Libexpat up to 2.9.0. This affects the function accountingDiffTolerated of the file xmlparse.c. Such manipulation leads to denial of service. This vulnerability is listed as
CVE-2025-31699 | Apache Traffic Server prior 9.2.16/10.1.5/10.2.1 access control (WID-SEC-2026-4112)
A vulnerability has been found in Apache Traffic Server and classified as critical. This issue affects some unknown processing. This manipulation causes improper access controls. This vulnerability is registered as CVE-2025-31699. Remote ex
CVE-2026-110447 | Collabora Online up to 26.4.302 CODE Server proxy.php os command injection
A vulnerability was found in Collabora Online up to 26.4.302. It has been classified as critical. This issue affects some unknown processing of the file proxy.php of the component CODE Server. Performing a manipulation results in os command
CVE-2026-108129 | Microsoft Windows up to Server 2025 DNS Server out-of-bounds (EUVD-2026-100448)
A vulnerability was found in Microsoft Windows. It has been classified as problematic. This vulnerability affects unknown code of the component DNS Server. The manipulation leads to out-of-bounds read. This vulnerability is uniquely identif
CVE-2026-108128 | Microsoft Windows up to Server 2025 out-of-bounds (EUVD-2026-100447)
A vulnerability has been found in Microsoft Windows and classified as problematic. Affected by this issue is some unknown functionality. Performing a manipulation results in out-of-bounds read. This vulnerability is known as CVE-2026-108128
CVE-2026-108131 | Microsoft Windows up to Server 2025 Active Directory Federation Services improper authorization (EUVD-2026-100450)
A vulnerability identified as problematic has been detected in Microsoft Windows. The impacted element is an unknown function of the component Active Directory Federation Services. Performing a manipulation results in improper authorization
CVE-2026-108130 | Microsoft Windows up to Server 2025 VBS Enclave heap-based overflow (EUVD-2026-100449)
A vulnerability categorized as very critical has been discovered in Microsoft Windows 11 24H2/11 25H2/11 26H1/11 26H2/Server 2025. Affected by this issue is some unknown functionality of the component VBS Enclave. The manipulation results i
CVE-2026-108133 | Microsoft Windows Server 2022 memory corruption (EUVD-2026-100452)
A vulnerability labeled as very critical has been found in Microsoft Windows Server 2022. This vulnerability affects unknown code. Such manipulation leads to memory corruption. This vulnerability is referenced as CVE-2026-108133. The attack
CVE-2026-108132 | Microsoft Windows up to Server 2025 Kerberos double free (EUVD-2026-100451)
A vulnerability identified as very critical has been detected in Microsoft Windows up to Server 2025. This affects an unknown part of the component Kerberos. This manipulation causes double free. The identification of this vulnerability is
CVE-2026-108135 | Microsoft Windows up to 11 26H2 Backup Engine link following (EUVD-2026-100454)
A vulnerability described as very critical has been identified in Microsoft Windows up to 11 26H2. Impacted is an unknown function of the component Backup Engine. Executing a manipulation can lead to link following. This vulnerability is tr
CVE-2026-108134 | Microsoft Windows 11 24H2/11 25H2/11 26H2 Autopilot use after free (EUVD-2026-100453)
A vulnerability marked as very critical has been reported in Microsoft Windows 11 24H2/11 25H2/11 26H2. This issue affects some unknown processing of the component Autopilot. Performing a manipulation results in use after free. This vulnera
CVE-2026-108471 | Microsoft Windows 10 1809/Server 2019 Enclave null pointer dereference (EUVD-2026-100456)
A vulnerability was found in Microsoft Windows 10 1809/Server 2019. It has been classified as very critical. Affected by this issue is some unknown functionality of the component Enclave. The manipulation leads to null pointer dereference.
CVE-2026-108136 | Microsoft Windows up to Server 2025 Search use after free (EUVD-2026-100455)
A vulnerability labeled as very critical has been found in Microsoft Windows. Impacted is an unknown function of the component Search Component. Such manipulation leads to use after free. This vulnerability is listed as CVE-2026-108136. The
CVE-2026-83862 | Microsoft Windows up to Server 2025 Network Load Balancing use after free (EUVD-2026-99392)
A vulnerability has been found in Microsoft Windows up to Server 2025 and classified as very critical. The affected element is an unknown function of the component Network Load Balancing. The manipulation leads to use after free. This vulne
CVE-2026-102208 | Microsoft Windows up to Server 2022 Win32 Kernel Subsystem use after free (EUVD-2026-100362)
A vulnerability, which was classified as very critical, has been found in Microsoft Windows up to Server 2022. Affected is an unknown function of the component Win32 Kernel Subsystem. Performing a manipulation results in use after free. Thi
Detecting CVE-2026-96655 exploitation in Plex logs
Detecting CVE-2026-96655 exploitation in Plex logs Patching Plex Media Server to 1.43.3.10861 removes the SSRF described in CVE-2026-96655. It does not tell you whether someone already used it. That question is answerable, but only if you k
CVE-2026-114375 | leomoon-studios wiki-go up to 1.9.1 Files Rename API files.go RenameFileHandler currentPath/newName path traversal (GHSA-xg75-vx57-m5mx / EUVD-2026-107543)
A vulnerability classified as critical has been found in leomoon-studios wiki-go up to 1.9.1. Affected is the function RenameFileHandler of the file internal/handlers/files.go of the component Files Rename API. Performing a manipulation of
CVE-2026-19947 | Zephyr Project up to 4.4.x Device Multiplexer Pseudo-Driver devmux.c z_vrfy_devmux_select_get/z_vrfy_devmux_select_set improper authorization (EUVD-2026-107488)
A vulnerability marked as very critical has been reported in Zephyr Project Zephyr up to 4.4.x. This issue affects the function z_vrfy_devmux_select_get/z_vrfy_devmux_select_set of the file drivers/misc/devmux/devmux.c of the component Devi
CVE-2026-111804 | Apache Traffic Server up to 10.1.4/10.2.0 experimental wasm plugin transaction-close handler use after free (EUVD-2026-107490)
A vulnerability was found in Apache Traffic Server up to 10.1.4/10.2.0. It has been classified as critical. This impacts the function transaction-close handler of the component experimental wasm plugin. The manipulation leads to use after f
CVE-2026-79976 | Zephyr Project up to 4.4.2 MCTP-over-I2C+GPIO target binding mctp_i2c_gpio_target.c mctp_i2c_gpio_target_stop reg_addr/rxtx null pointer dereference (EUVD-2026-107487)
A vulnerability classified as critical was found in Zephyr Project Zephyr up to 4.4.2. The impacted element is the function mctp_i2c_gpio_target_stop of the file subsys/pmci/mctp/mctp_i2c_gpio_target.c of the component MCTP-over-I2C+GPIO ta
CVE-2026-78119 | Zephyr Project up to 4.4.x Nuvoton NPCX eSPI Driver drivers/espi/espi_npcx.c espi_taf_parse out-of-bounds write (EUVD-2026-107486)
A vulnerability described as critical has been identified in Zephyr Project Zephyr up to 4.4.x. Impacted is the function espi_taf_parse of the file drivers/espi/espi_npcx.c of the component Nuvoton NPCX eSPI Driver. The manipulation results
Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
Attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22. The flaw lets anyone who can l
CVE-2026-115929 | MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root certificate store has the recoverable eMudhra intermediate CA certificates. Issue is resolved by updating to Compass 1.53.1, which includes Electron 44.9.1.
MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root certificate store has the recoverable eMudhra intermediate CA certificates. Issue is resolved by updating to Compass 1.53.1
CVE-2025-6519 | Copeland LP E3 Supervisory Control up to 2.31F00 insufficiently protected credentials (EUVD-2025-28745)
A vulnerability labeled as critical has been found in Copeland LP E3 Supervisory Control up to 2.31F00. The impacted element is an unknown function. The manipulation results in insufficiently protected credentials. This vulnerability is cat
CVE-2025-58214 | gavias Indutri Plugin up to 1.2.x on WordPress php file inclusion
A vulnerability, which was classified as problematic, has been found in gavias Indutri Plugin up to 1.2.x on WordPress. The affected element is an unknown function. Performing a manipulation results in improper control of filename for inclu
CVE-2025-52545 | Copeland LP E3 Supervisory Control up to 2.31F00 RCI Service insufficiently protected credentials
A vulnerability was found in Copeland LP E3 Supervisory Control up to 2.31F00. It has been rated as critical. This issue affects some unknown processing of the component RCI Service. Performing a manipulation results in insufficiently prote
CVE-2025-52544 | Copeland LP E3 Supervisory Control up to 2.31F00 Floor Plan input validation
A vulnerability was found in Copeland LP E3 Supervisory Control up to 2.31F00. It has been declared as critical. This vulnerability affects unknown code of the component Floor Plan Handler. Such manipulation leads to improper input validati
CVE-2025-52543 | Copeland LP E3 Supervisory Control up to 2.31F00 password hash instead of password for authentication
A vulnerability was found in Copeland LP E3 Supervisory Control up to 2.31F00. It has been classified as problematic. This affects an unknown part. This manipulation causes use of password hash instead of password for authentication. The id