Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 720 | 0,2 % |
| ≥50 % | 3.224 | 0,9 % |
| ≥10 % | 22.096 | 6,0 % |
| <10 % | 345.228 | 93,0 % |
Warning Over High-Risk Vulnerabilities in Widely Used LLM Gateway Tool
CVE-2026-35029 and CVE-2026-59823 affect LiteLLM, which is commonly used by enterprises to connect their AI applications to providers like OpenAI and Anthropic This article has been indexed from www.infosecurity-magazine.com Read the origin
Cisco schliesst bereits ausgenutzte Sicherheitslücke im Secure Email Gateway
... Cybersecurity. News · Wissen · Specials · IT-Markt. Schlüsselwörter. Webcode. News. Remote Code Execution ... Das Product Security Incident Response ... Weiterlesen
CVE-2026-106464 | Eclipse NetX Duo up to 6.5.2.202603 X.509 Parser _nx_secure_x509_parse_signature_data tlv_length out-of-bounds (EUVD-2026-101502)
A vulnerability described as critical has been identified in Eclipse NetX Duo up to 6.5.2.202603. This impacts the function _nx_secure_x509_parse_signature_data of the component X.509 Parser. The manipulation of the argument tlv_length resu
CVE-2026-79957 | ServiceNext GetUsuarios endpoint /api/Usuario/GetUsuarios ID authorization (EUVD-2026-101517)
A vulnerability marked as critical has been reported in ServiceNext. This vulnerability affects unknown code of the file /api/Usuario/GetUsuarios of the component GetUsuarios endpoint. Performing a manipulation of the argument ID results in
CVE-2026-106465 | Eclipse NetX Duo up to 6.5.2.202603 ClientHello parser improper authentication (EUVD-2026-101504)
A vulnerability labeled as critical has been found in Eclipse NetX Duo up to 6.5.2.202603. The impacted element is an unknown function of the component ClientHello parser. Executing a manipulation can lead to improper authentication. This v
CVE-2026-110816 | ljharb qs up to 6.16.0 String Coercion lib/stringify.js qs.stringify input validation (a952e75 / EUVD-2026-101710)
A vulnerability identified as problematic has been detected in ljharb qs up to 6.16.0. This vulnerability affects the function qs.stringify of the file lib/stringify.js of the component String Coercion. The manipulation leads to improper in
CVE-2026-102631 | Canonical authd up to 0.7.0 User Identity Matching manager.go UpdateUser improper authentication (EUVD-2026-102198)
A vulnerability was found in Canonical authd up to 0.7.0. It has been rated as very critical. The impacted element is the function UpdateUser of the file internal/users/manager.go of the component User Identity Matching. Performing a manipu
CVE-2026-108337 | Hitachi Vantara Remot Ops Agent up to 2.0 privileges management (EUVD-2026-101707)
A vulnerability was found in Hitachi Vantara Remot Ops Agent up to 2.0. It has been classified as problematic. Affected is an unknown function. This manipulation causes improper privilege management. This vulnerability is tracked as CVE-202
CVE-2026-107349 | PostgreSQL PgBouncer up to 1.26.0 Ignore Startup Parameter List Lookup options infinite loop (EUVD-2026-101499)
A vulnerability classified as problematic has been found in PostgreSQL PgBouncer up to 1.26.0. Affected is an unknown function of the component Ignore Startup Parameter List Lookup. This manipulation of the argument options causes infinite
Google Warns China-Linked Hackers Exploited BeyondTrust Zero-Day
Google says China-linked hackers exploited a critical BeyondTrust zero-day. See affected versions, patch guidance, and what defenders should check now. This article has been indexed from eSecurityPlanet Read the original article: Google War
CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE Vulnerability
IntroductionOn September 27, 2026, Citrix disclosed CVE-2026-88771, a critical remote code execution (RCE) vulnerability affecting NetScaler Application Delivery Controller (ADC) and NetScaler Gateway. The vulnerability carries a CVSS v3.1
BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs
Ivanti, Cisco, and Palo Alto Networks all had vulnerabilities in edge devices come under fire this week. Now BeyondTrust joins the group. This article has been indexed from darkreading Read the original article: BeyondTrust Remote Support Z
CVE-2026-89649 | Linux Kernel up to 6.12.108/6.18.49/7.2.3 Ceph __build_xattrs val_len out-of-bounds (EUVD-2026-76561)
A vulnerability has been found in Linux Kernel up to 6.12.108/6.18.49/7.2.3 and classified as problematic. Affected by this vulnerability is the function __build_xattrs of the component Ceph. The manipulation of the argument val_len leads t
CVE-2026-89652 | Linux Kernel up to 6.12.108/6.18.49/7.2.3 Ceph NFS Export ceph_get_name/__get_snap_name dname_len out-of-bounds write (EUVD-2026-76564)
A vulnerability identified as very critical has been detected in Linux Kernel up to 6.12.108/6.18.49/7.2.3. Affected by this vulnerability is the function ceph_get_name/__get_snap_name of the component Ceph NFS Export. This manipulation of
CVE-2026-89650 | Linux Kernel up to 6.12.108/6.18.49/7.2.3 CephFS Client fs/ceph/mdsmap.c ceph_mdsmap_decode num_export_targets out-of-bounds (EUVD-2026-76562)
A vulnerability labeled as problematic has been found in Linux Kernel up to 6.12.108/6.18.49/7.2.3. The affected element is the function ceph_mdsmap_decode of the file fs/ceph/mdsmap.c of the component CephFS Client. Executing a manipulatio
CVE-2026-89653 | Linux Kernel up to 6.12.108/6.18.49/7.2.3 ceph check_new_map stack-based overflow (EUVD-2026-76565)
A vulnerability labeled as problematic has been found in Linux Kernel up to 6.12.108/6.18.49/7.2.3. Affected by this issue is the function check_new_map of the component ceph. Such manipulation leads to stack-based buffer overflow. This vul
CVE-2026-89655 | Linux Kernel up to 6.12.108/6.18.49/7.2.3 ceph __kick_flushing_caps use after free (EUVD-2026-76567)
A vulnerability marked as very critical has been reported in Linux Kernel up to 6.12.108/6.18.49/7.2.3. This affects the function __kick_flushing_caps of the component ceph. Performing a manipulation results in use after free. This vulnerab
CVE-2026-89654 | Linux Kernel up to 7.2.3 Ceph md.c check_new_map s use after free (EUVD-2026-76566)
A vulnerability labeled as very critical has been found in Linux Kernel up to 7.2.3. This vulnerability affects the function check_new_map of the file md.c of the component Ceph. Such manipulation of the argument s leads to use after free.
CVE-2026-89656 | Linux Kernel up to 6.12.108/6.18.49/7.2.3 libceph bucket_perm_choose out-of-bounds write (EUVD-2026-76568)
A vulnerability described as very critical has been identified in Linux Kernel up to 6.12.108/6.18.49/7.2.3. This affects the function bucket_perm_choose of the component libceph. The manipulation results in out-of-bounds write. This vulner
BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs
Ivanti, Cisco, and Palo Alto Networks all had vulnerabilities in edge devices come under fire this week. Now BeyondTrust joins the group. Weiterlesen
CVE-2026-89659 | Linux Kernel up to 6.18.50/7.2.3 NFSD nfs4_laundromat use after free (EUVD-2026-76571)
A vulnerability classified as very critical has been found in Linux Kernel up to 6.18.50/7.2.3. This issue affects the function nfs4_laundromat of the component NFSD. The manipulation leads to use after free. This vulnerability is traded as
CVE-2026-89662 | Linux Kernel up to 6.12.108/6.18.49/7.2.3 NFSD __destroy_client use after free (EUVD-2026-76574)
A vulnerability classified as very critical was found in Linux Kernel up to 6.12.108/6.18.49/7.2.3. Impacted is the function __destroy_client of the component NFSD. The manipulation results in use after free. This vulnerability is known as
CVE-2026-89675 | Linux Kernel up to 6.18.50/7.2.3 NFSd Async Copy nfsd4_do_async_copy refcount/nf_src/nf_dst/copy_task use after free (EUVD-2026-76587 / Nessus ID 364483)
A vulnerability has been found in Linux Kernel up to 6.18.50/7.2.3 and classified as very critical. This affects the function nfsd4_do_async_copy of the component NFSd Async Copy. Performing a manipulation of the argument refcount/nf_src/nf
CVE-2026-89672 | Linux Kernel up to 6.12.108/6.18.49/7.2.3 NFSACL nfsacld_proc_setacl mask input validation (EUVD-2026-76584)
A vulnerability classified as very critical has been found in Linux Kernel up to 6.12.108/6.18.49/7.2.3. The affected element is the function nfsacld_proc_setacl of the component NFSACL. The manipulation of the argument mask leads to improp
CVE-2026-89676 | Linux Kernel up to 6.18.49/7.2.3 nfsd nfsd4_copy use after free (EUVD-2026-76588 / Nessus ID 364483)
A vulnerability was found in Linux Kernel up to 6.18.49/7.2.3 and classified as very critical. This impacts the function nfsd4_copy of the component nfsd. Executing a manipulation can lead to use after free. The identification of this vulne
PwnEscape (CVE-2026-99999): Patched kernels available in testing
A new Linux kernel vulnerability, nicknamed PwnEscape (CVE-2026-99999), has been disclosed. It is a guest-to-host virtual machine (VM) escape: anyone who controls a guest VM can send specially crafted network packets that leak the host’s ke
CVE-2026-89685 | Linux Kernel up to 6.18.50/7.2.3 nfsd clients_still_reclaiming comparison (EUVD-2026-76597)
A vulnerability was found in Linux Kernel up to 6.18.50/7.2.3. It has been rated as critical. The affected element is the function clients_still_reclaiming of the component nfsd. Performing a manipulation results in incorrect comparison. Th
CVE-2026-89699 | Linux Kernel up to 6.12.108/6.18.49/7.2.3 nfsd nfsd4_decode_create cr_datalen out-of-bounds write (EUVD-2026-76611)
A vulnerability was found in Linux Kernel up to 6.12.108/6.18.49/7.2.3. It has been rated as critical. Affected by this issue is the function nfsd4_decode_create of the component nfsd. This manipulation of the argument cr_datalen causes out
CVE-2026-89697 | Linux Kernel up to 6.12.108/6.18.49/7.2.3 nfsd nfsd_proc_setattr authorization (EUVD-2026-76609)
A vulnerability classified as very critical has been found in Linux Kernel up to 6.12.108/6.18.49/7.2.3. The impacted element is the function nfsd_proc_setattr of the component nfsd. This manipulation causes missing authorization. This vuln
CVE-2026-89686 | Linux Kernel up to 6.12.108/6.18.49/7.2.3 nfsd nfsd4_alloc_layout_stateid locking (EUVD-2026-76598)
A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.12.108/6.18.49/7.2.3. This affects the function nfsd4_alloc_layout_stateid of the component nfsd. This manipulation causes improper locking. The ident
Ghostscript Sicherheitslücke mit 9,8, ein hochgeladenes PDF genügt für Schadcode
Lesezeit. Cybersicherheit cybersicherheit sicherheitslücke ghostscript cve-2026-39919 ghostscript lücke wordpress imagick wordfence argus pdf. Weiterlesen
Critical BlockStrap flaw lets hackers run code on Magento servers
Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers. [...] Weiterlesen
CVE-2022-46740 | Huawei WS7100-20 Wi-Fi denial of service (EUVD-2022-49526)
A vulnerability categorized as problematic has been discovered in Huawei WS7100-20. This affects an unknown function of the component Wi-Fi Module. Executing a manipulation can lead to denial of service. The identification of this vulnerabi
CVE-2022-46723 | Apache macOS privilege escalation (EUVD-2022-49512)
A vulnerability labeled as critical has been found in Apache macOS. Affected is an unknown function. Such manipulation leads to privilege escalation. This vulnerability is traded as CVE-2022-46723. The attack may be launched remotely. There
CVE-2022-46720 | Apple iOS/iPadOS up to 16.1.x integer overflow (HT213530 / EUVD-2022-49509)
A vulnerability classified as problematic was found in Apple iOS and iPadOS up to 16.1.x. This issue affects some unknown processing. Executing a manipulation can lead to integer overflow. This vulnerability appears as CVE-2022-46720. The a
CVE-2022-46718 | Apple macOS information disclosure (EUVD-2022-49507)
A vulnerability was found in Apple macOS. It has been rated as problematic. This vulnerability affects unknown code. Performing a manipulation results in information disclosure. This vulnerability was named CVE-2022-46718. The attack needs
CVE-2022-46717 | Apple iOS/iPadOS up to 16.1 Accessibility Features information disclosure (EUVD-2022-49506)
A vulnerability marked as problematic has been reported in Apple iOS and iPadOS up to 16.1. Affected is an unknown function of the component Accessibility Features. Performing a manipulation results in information disclosure. This vulnerabi
CVE-2022-46716 | Apple macOS Private Relay state issue (EUVD-2022-49505)
A vulnerability labeled as problematic has been found in Apple macOS. This issue affects some unknown processing of the component Private Relay Handler. The manipulation results in state issue. This vulnerability was named CVE-2022-46716. T
CVE-2022-46715 | Apple iOS/iPadOS Privacy Preferences access control (EUVD-2022-49504)
A vulnerability labeled as critical has been found in Apple iOS and iPadOS. The affected element is an unknown function of the component Privacy Preferences. The manipulation results in improper access controls. This vulnerability is identi
CVE-2022-46713 | Apple macOS File System race condition (EUVD-2022-49502)
A vulnerability was found in Apple macOS. It has been classified as problematic. Impacted is an unknown function of the component File System Handler. Performing a manipulation results in race condition. This vulnerability is cataloged as C
CVE-2022-46712 | Apple macOS up to 12.7.6 App use after free (HT213488 / EUVD-2022-49501)
A vulnerability, which was classified as critical, was found in Apple macOS. This affects an unknown part of the component App Handler. The manipulation results in use after free. This vulnerability is identified as CVE-2022-46712. The atta
CVE-2022-46709 | Apple iOS 15.x Kernel memory corruption (EUVD-2022-49498)
A vulnerability was found in Apple iOS 15.x. It has been declared as critical. The affected element is an unknown function of the component Kernel. The manipulation results in memory corruption. This vulnerability is reported as CVE-2022-46
CVE-2022-46704 | Apple macOS App state issue (EUVD-2022-49493)
A vulnerability was found in Apple macOS and classified as problematic. This issue affects some unknown processing of the component App Handler. Such manipulation leads to state issue. This vulnerability is listed as CVE-2022-46704. The att
CVE-2022-46703 | Apple iOS/iPadOS Location information disclosure (EUVD-2022-49492)
A vulnerability classified as problematic has been found in Apple iOS and iPadOS. The impacted element is an unknown function of the component Location Handler. Performing a manipulation results in information disclosure. This vulnerability
Cisco Urges Customers to Patch Email Gateway Flaw and Check for Compromise
Attackers exploit a critical Cisco email gateway flaw to gain root access. Cisco urges customers to update scanner tools and check for compromise. Cisco confirmed this week that threat actors are exploiting a critical vulnerability in Cisco
CVE-2026-85831 | Microsoft Windows up to Server 2025 Windows Biometric Service buffer overflow (EUVD-2026-99540)
A vulnerability was found in Microsoft Windows up to Server 2025. It has been classified as problematic. This vulnerability affects unknown code of the component Windows Biometric Service. Performing a manipulation results in buffer overflo
CVE-2026-85830 | Microsoft Windows up to Server 2025 Installer out-of-bounds (EUVD-2026-99539)
A vulnerability was found in Microsoft Windows and classified as problematic. This affects an unknown part of the component Installer. Such manipulation leads to out-of-bounds read. This vulnerability is traded as CVE-2026-85830. An attack
CVE-2026-85833 | Microsoft Windows up to Server 2025 Modern Device Management use after free (EUVD-2026-99542)
A vulnerability was found in Microsoft Windows. It has been classified as very critical. The affected element is an unknown function of the component Modern Device Management. The manipulation leads to use after free. This vulnerability is
CVE-2026-85832 | Microsoft Windows up to Server 2025 Background Intelligent Transfer Service buffer overflow (EUVD-2026-99541)
A vulnerability has been found in Microsoft Windows and classified as very critical. This issue affects some unknown processing of the component Background Intelligent Transfer Service. Performing a manipulation results in buffer overflow.
CVE-2026-85834 | Microsoft Windows up to Server 2025 TCP IP heap-based overflow (EUVD-2026-99543)
A vulnerability categorized as very critical has been discovered in Microsoft Windows. This impacts an unknown function of the component TCP IP. Such manipulation leads to heap-based buffer overflow. This vulnerability is uniquely identifie
CVE-2026-85835 | Microsoft Windows up to Server 2025 Servicing Stack out-of-bounds (EUVD-2026-99544)
A vulnerability was found in Microsoft Windows 11 24H2/11 25H2/11 26H1/11 26H2/Server 2025. It has been rated as problematic. Impacted is an unknown function of the component Servicing Stack. The manipulation leads to out-of-bounds read. Th
CVE-2026-30971 | ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an authenticated user with monitor-create or monitor-edit permission saves a Local monitor whose Device Path contains shell metacharacters and the monitor control or startup path runs. In this attack mechanism, the stored Device
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an au
CVE-2026-59966 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, executes user-controlled Automation regular-expression patterns with Python re.sub() without complexity validation or an execution timeout when an authenticated user stores a catastrophic-backtracking regex and any user in the same Space imports a matching recipe. Request processing uses Automation.param_2, apply_regex_replace_automation, sub,
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, executes user-controlled Automation regular-expression patterns with Python re.sub() without complexity validation or an e
CVE-2026-59963 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, recipe utility endpoints retrieve same-Space Recipe objects without invoking the private-recipe owner or sharing permission when an authenticated member of a shared Space supplies another member's private recipe identifier to AI import, file, external-link, or share-link endpoints. Request processing uses api/ai-import/, api/get_recipe_file/,
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, recipe utility endpoints retrieve same-Space Recipe objects without invoking the private-recipe owner or sharing permissio
CVE-2026-17068 | IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to bypass NFS version restrictions due to improper enforcement of the export version flag.
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to bypass NFS version restrictions due to improper enforcement of the export version flag.
CVE-2026-17275 | IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform unauthorized manipulation of distributed transactions due to improper validation of attacker-supplied transaction identifiers.
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform unauthorized manipulation of distributed transactions due to improper validation of attacker-supplied transaction identifiers.
CVE-2026-17488 | IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.
CVE-2026-17491 | IBM i 7.3, 7.4, 7.5, and 7.6 is could allow a remote authenticated attacker to bypass security restrictions due to improper enforcement of the ChrootDirectory configuration directive.
IBM i 7.3, 7.4, 7.5, and 7.6 is could allow a remote authenticated attacker to bypass security restrictions due to improper enforcement of the ChrootDirectory configuration directive.
CVE-2026-102917 | IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticated attacker elevating their privilege. A bad actor could exploit this vulnerability to perform operations with QSECOFR/Root authority on the system.
IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticated attacker elevating their privilege. A bad actor could exploit this vulnerability to perform operations with QSECOFR/Root authority on the system.
CVE-2026-111721 | Open WES through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users to modify other warehouses' stock records because GlobalGatewayFilter never enforces auth_warehouse scoping. Attackers holding the menu permission can enumerate sequential IDs on freezeContainerStock and unfreezeContainerStock endpoints to freeze or unfreeze container stock in other warehouses.
Open WES through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users to modify other warehouses' stock records because GlobalGatewayFilter never enforces auth_warehouse scoping. Attackers holding the menu pe