Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 720 | 0,2 % |
| ≥50 % | 3.224 | 0,9 % |
| ≥10 % | 22.120 | 6,0 % |
| <10 % | 345.022 | 93,0 % |
CVE-2026-85296 | Apache Camel AS2 state issue (WID-SEC-2026-4006)
A vulnerability categorized as critical has been discovered in Apache Camel. The affected element is an unknown function of the component AS2. Executing a manipulation can lead to state issue. This vulnerability is registered as CVE-2026-85
CVE-2026-85260 | Apache Camel information disclosure (WID-SEC-2026-4006)
A vulnerability, which was classified as problematic, was found in Apache Camel. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to information disclosure. The identification of this vulnerabili
CVE-2026-85257 | Apache Camel Camel-CXF information disclosure (WID-SEC-2026-4006)
A vulnerability was found in Apache Camel. It has been classified as problematic. The affected element is an unknown function of the component Camel-CXF. Performing a manipulation results in information disclosure. This vulnerability is ide
CVE-2026-85254 | Apache Camel HTTP information disclosure (WID-SEC-2026-4006)
A vulnerability described as problematic has been identified in Apache Camel. The impacted element is an unknown function of the component HTTP. The manipulation results in information disclosure. This vulnerability is known as CVE-2026-852
CVE-2026-85251 | Apache Camel HTTP information disclosure (WID-SEC-2026-4006)
A vulnerability labeled as problematic has been found in Apache Camel. Impacted is an unknown function of the component HTTP. Executing a manipulation can lead to information disclosure. This vulnerability appears as CVE-2026-85251. The att
CVE-2026-85250 | Apache Camel XPath xml external entity reference (WID-SEC-2026-4006)
A vulnerability, which was classified as critical, has been found in Apache Camel. Affected is an unknown function of the component XPath. Performing a manipulation results in xml external entity reference. This vulnerability was named CVE-
CVE-2026-85249 | Apache Camel Tika injection (WID-SEC-2026-4006)
A vulnerability was found in Apache Camel. It has been rated as critical. Impacted is an unknown function of the component Tika. Performing a manipulation results in injection. This vulnerability is cataloged as CVE-2026-85249. It is possib
CVE-2026-85248 | Apache Camel Camel-PQC signature verification (WID-SEC-2026-4006)
A vulnerability categorized as critical has been discovered in Apache Camel. This impacts an unknown function of the component Camel-PQC. The manipulation results in improper verification of cryptographic signature. This vulnerability is ca
CVE-2026-16755 | Lenovo Smart Camera XW1 prior 05.02.31.140 information disclosure (EUVD-2026-102533)
A vulnerability was found in Lenovo Smart Camera C33, Smart Camera C33 Pro, Smart Camera C35, Smart Camera C5X, Smart Camera RQ3, Smart Camera X6Q, Smart Camera X6T, Smart Camera X9T, Smart Network PTZ X5E, Smart Network PTZ X5Q, Smart Netw
CVE-2026-16754 | Lenovo Smart Camera C33 prior 05.02.31.140 certificate validation (EUVD-2026-102532)
A vulnerability was found in Lenovo Smart Camera C33, Smart Camera C35, Smart Camera C5X, Smart Camera RQ3, Smart Camera X5E, Smart Camera X5Q, Smart Camera X5T, Smart Camera X6Q, Smart Camera X6T and Smart Camera X9T. It has been declared
CVE-2026-11732 | NETGEAR CAX30/RAX30/RAX5/RAXE300 Block Sites input validation (EUVD-2026-98774)
A vulnerability described as very critical has been identified in NETGEAR CAX30, RAX30, RAX5 and RAXE300. Impacted is an unknown function of the component Block Sites. Executing a manipulation can lead to improper input validation. This vul
CVE-2026-111368 | ClassroomIO up to 1.0.0 Hono API Course Submission Routes authorization (EUVD-2026-102508)
A vulnerability was found in ClassroomIO up to 1.0.0 and classified as critical. The affected element is an unknown function of the component Hono API Course Submission Routes. Such manipulation leads to authorization bypass. This vulnerabi
Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)
Overview On October 12, 2026, GitLab released 19.4.2, 19.3.5, and 19.2.8 to fix CVE-2026-97229, an integer overflow in its CI/CD regular-expression handling. The issue was reported through HackerOne by joaxcar. GitLab assigned it a CVSS sco
CVE-2022-46698 | Apple iOS/iPadOS up to 16.1.2 WebKit information disclosure (HT213530 / EUVD-2022-49487)
A vulnerability categorized as problematic has been discovered in Apple iOS and iPadOS up to 16.1.2. This issue affects some unknown processing of the component WebKit. Executing a manipulation can lead to information disclosure. This vulne
CVE-2026-110143 | Google Chrome up to 155.0.8059.39 lmza_sdk uninitialized pointer (Nessus ID 366230)
A vulnerability classified as problematic has been found in Google Chrome. This affects an unknown function of the component lmza_sdk. Performing a manipulation results in uninitialized pointer. This vulnerability is known as CVE-2026-11014
CVE-2026-110142 | Google Chrome up to 155.0.8059.39 FileSystem use after free (Nessus ID 366230)
A vulnerability classified as critical was found in Google Chrome. This impacts an unknown function of the component FileSystem. Executing a manipulation can lead to use after free. This vulnerability is handled as CVE-2026-110142. The atta
CVE-2026-110141 | Google Chrome up to 155.0.8059.39 Media information disclosure (Nessus ID 366230)
A vulnerability described as problematic has been identified in Google Chrome. Affected is an unknown function of the component Media. Executing a manipulation can lead to information disclosure. This vulnerability appears as CVE-2026-11014
CVE-2026-84016 | Microsoft Windows up to Server 2025 EAPHost Service out-of-bounds write (EUVD-2026-99453)
A vulnerability was found in Microsoft Windows. It has been rated as very critical. Affected by this issue is some unknown functionality of the component EAPHost Service. This manipulation causes out-of-bounds write. This vulnerability is t
CVE-2026-83875 | Microsoft Windows up to Server 2025 HID Parser out-of-bounds (EUVD-2026-99396)
A vulnerability labeled as problematic has been found in Microsoft Windows up to Server 2025. This affects an unknown part of the component HID Parser. The manipulation results in out-of-bounds read. This vulnerability was named CVE-2026-83
CVE-2026-85811 | Microsoft Windows up to Server 2025 Network Policy Server use after free (EUVD-2026-99522)
A vulnerability has been found in Microsoft Windows and classified as very critical. This impacts an unknown function of the component Network Policy Server. The manipulation leads to use after free. This vulnerability is traded as CVE-2026
CVE-2026-84017 | Microsoft Windows up to Server 2025 Routing/Remote Access Service null pointer dereference (EUVD-2026-99454)
A vulnerability, which was classified as critical, has been found in Microsoft Windows. This vulnerability affects unknown code of the component Routing/Remote Access Service. The manipulation leads to null pointer dereference. This vulnera
CVE-2026-85812 | Microsoft Windows up to Server 2025 Bind Filter Driver information disclosure (EUVD-2026-99523)
A vulnerability marked as problematic has been reported in Microsoft Windows up to Server 2025. This vulnerability affects unknown code of the component Bind Filter Driver. The manipulation leads to information disclosure. This vulnerabilit
CVE-2026-85933 | Microsoft Windows up to Server 2025 Print Spooler use after free (EUVD-2026-99630)
A vulnerability classified as very critical has been found in Microsoft Windows. Impacted is an unknown function of the component Print Spooler. The manipulation leads to use after free. This vulnerability is traded as CVE-2026-85933. An at
CVE-2026-85934 | Microsoft Windows up to Server 2025 AppX Deployment Service use after free (EUVD-2026-99631)
A vulnerability was found in Microsoft Windows up to Server 2025. It has been declared as very critical. This vulnerability affects unknown code of the component AppX Deployment Service. Executing a manipulation can lead to use after free.
F5 addressed critical RCE flaws in NGINX
F5 addressed multiple vulnerabilities, including critical RCE flaws in NGINX that attackers could exploit without authentication. Security and application delivery firm F5 announced fixes for eleven security issues in NGINX. Among them, cri
CVE-2026-85247 | Apache Camel Knative certificate validation (WID-SEC-2026-4006)
A vulnerability was found in Apache Camel. It has been rated as problematic. This affects an unknown function of the component Knative. The manipulation leads to improper certificate validation. This vulnerability is listed as CVE-2026-8524
CVE-2026-85246 | Apache Camel Camel-Mina information disclosure (WID-SEC-2026-4006)
A vulnerability was found in Apache Camel and classified as problematic. Impacted is an unknown function of the component Camel-Mina. Such manipulation leads to information disclosure. This vulnerability is referenced as CVE-2026-85246. It
CVE-2026-84181 | Apache Camel Shiro improper authentication (WID-SEC-2026-4006)
A vulnerability was found in Apache Camel. It has been declared as critical. The impacted element is an unknown function of the component Shiro. Executing a manipulation can lead to improper authentication. This vulnerability is tracked as
CVE-2026-84180 | Apache Camel Knative information disclosure (WID-SEC-2026-4006)
A vulnerability described as problematic has been identified in Apache Camel. This issue affects some unknown processing of the component Knative. Executing a manipulation can lead to information disclosure. This vulnerability is handled as
CVE-2026-84178 | Apache Camel cross-site request forgery (WID-SEC-2026-4006)
A vulnerability, which was classified as problematic, was found in Apache Camel. This affects an unknown function. Such manipulation leads to cross-site request forgery. This vulnerability is referenced as CVE-2026-84178. It is possible to
CVE-2026-84176 | Apache Camel Camel-Platform-HTTP-Vertx cross-domain policy (WID-SEC-2026-4006)
A vulnerability labeled as problematic has been found in Apache Camel. This affects an unknown part of the component Camel-Platform-HTTP-Vertx. Such manipulation leads to permissive cross-domain policy with untrusted domains. This vulnerabi
CVE-2026-83531 | Apache Camel Camel-Dynamic-Router Control Endpoint code injection (WID-SEC-2026-4006)
A vulnerability classified as critical was found in Apache Camel. The affected element is an unknown function of the component Camel-Dynamic-Router Control Endpoint. The manipulation results in code injection. This vulnerability was named C
CVE-2026-80344 | Apache Camel AS2 server-side request forgery (WID-SEC-2026-4006)
A vulnerability, which was classified as critical, has been found in Apache Camel. The impacted element is an unknown function of the component AS2. This manipulation causes server-side request forgery. The identification of this vulnerabil
CVE-2026-80343 | Apache Camel Camel-Netty-HTTP improper authorization (WID-SEC-2026-4006)
A vulnerability marked as critical has been reported in Apache Camel. This vulnerability affects unknown code of the component Camel-Netty-HTTP. Performing a manipulation results in improper authorization. This vulnerability is known as CVE
CVE-2026-80312 | Apache Camel Fail-Open Processors improper authentication (WID-SEC-2026-4006)
A vulnerability classified as critical has been found in Apache Camel. Impacted is an unknown function of the component Fail-Open Processors. The manipulation leads to improper authentication. This vulnerability is uniquely identified as CV
CVE-2026-79986 | Apache Camel camel-azure-files path traversal (WID-SEC-2026-4006)
A vulnerability identified as critical has been detected in Apache Camel. Affected by this issue is some unknown functionality of the component camel-azure-files. This manipulation causes path traversal. This vulnerability appears as CVE-20
CVE-2026-79985 | Apache Camel SMB path traversal (WID-SEC-2026-4006)
A vulnerability categorized as critical has been discovered in Apache Camel. Affected by this vulnerability is an unknown functionality of the component SMB. The manipulation results in path traversal. This vulnerability is reported as CVE-
CVE-2022-46697 | Apple macOS up to 13.0 IOMobileFrameBuffer out-of-bounds (HT213532 / EUVD-2022-49486)
A vulnerability was found in Apple macOS and classified as critical. This issue affects some unknown processing of the component IOMobileFrameBuffer. Executing a manipulation can lead to out-of-bounds read. This vulnerability appears as CVE
CVE-2018-7489 | Oracle Retail Invoice Matching 15.0/16.0 jackson-databind incomplete blacklist (Nessus ID 109906 / ID 236791)
A vulnerability has been found in Oracle Retail Invoice Matching 15.0/16.0 and classified as very critical. Affected is an unknown function of the component jackson-databind. The manipulation leads to incomplete blacklist. This vulnerabilit
CVE-2018-1304 | Apache Tomcat up to 7.0.84/8.0.49/8.5.27/9.0.4 URL Pattern Empty String 7pk security (RHSA-2018:0465 / Nessus ID 106975)
A vulnerability described as critical has been identified in Apache Tomcat up to 7.0.84/8.0.49/8.5.27/9.0.4. The affected element is an unknown function of the component URL Pattern Handler. Executing a manipulation as part of Empty String
CVE-2026-79984 | Apache Camel camel-mina-sftp path traversal (WID-SEC-2026-4006)
A vulnerability was found in Apache Camel. It has been rated as critical. Affected is an unknown function of the component camel-mina-sftp. The manipulation leads to path traversal. This vulnerability is documented as CVE-2026-79984. The at
CVE-2026-79983 | Apache Camel FTP path traversal (WID-SEC-2026-4006)
A vulnerability was found in Apache Camel. It has been declared as critical. This impacts an unknown function of the component FTP. Executing a manipulation can lead to path traversal. This vulnerability is registered as CVE-2026-79983. It
CVE-2026-78165 | Apache Camel Spring deserialization (WID-SEC-2026-4006)
A vulnerability was found in Apache Camel. It has been declared as critical. This issue affects some unknown processing of the component Spring. Such manipulation leads to deserialization. This vulnerability is listed as CVE-2026-78165. The
CVE-2026-78164 | Apache Camel HTTP Producer input validation (WID-SEC-2026-4006)
A vulnerability marked as critical has been reported in Apache Camel. The affected element is an unknown function of the component HTTP Producer. The manipulation leads to improper input validation. This vulnerability is traded as CVE-2026-
CVE-2026-78163 | Apache Camel Camel-Docling server-side request forgery (WID-SEC-2026-4006)
A vulnerability classified as critical was found in Apache Camel. Affected by this issue is some unknown functionality of the component Camel-Docling. Executing a manipulation can lead to server-side request forgery. This vulnerability is h
CVE-2026-99999 | Linux Kernel up to 7.3-rc6 ipv4 skb_checksum_help stack-based overflow (WID-SEC-2026-4008)
A vulnerability identified as very critical has been detected in Linux Kernel up to 7.3-rc6. The impacted element is the function skb_checksum_help of the component ipv4. This manipulation causes stack-based buffer overflow. This vulnerabil
CVE-2026-95859 | libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.49.5, Gossipsub GRAFT control-message handling unconditionally adds attacker-supplied topic hashes to connected_peer.topics without confirming that the peer previously subscribed to those topics. A remote unauthenticated peer that can reach a Gossipsub listener can repeatedly send novel GRAFT topics, causing cumulative per-peer memory growth that is not bounded
libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.49.5, Gossipsub GRAFT control-message handling unconditionally adds attacker-supplied topic hashes to connected_peer.topics without confirmi
CVE-2026-111728 | Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper authorization, allowing unauthenticated LAN or Tailnet clients to bypass the privileged mediastream settings guard by setting transcodeHwAccel to custom and supplying attacker-controlled decodeFlags and encodeFlags via the transcodeHwAccelCustomSettings field, which are appended verbatim to the ffmpeg argument vector. Attackers can trigger execution via the medi
Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper authorization, allowing unauthenticated LAN or Tailnet clients to bypass the privileged mediastream settings guard by setting transcodeHwAccel
CVE-2026-108798 | ZKTeco BioTime 9.5.6 Build 20260130.3206 hard-coded key
A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206 and classified as critical. This issue affects some unknown processing. The manipulation results in use of hard-coded cryptographic key . This vulnerability is cataloged
CVE-2026-108797 | ZKTeco BioTime 9.5.6 Build 20260130.3206 Employee REST API employees authorization
A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206 and classified as problematic. This vulnerability affects unknown code of the file /personnel/api/employees/ of the component Employee REST API. The manipulation lea
CVE-2026-108796 | ZKTeco BioTime 9.5.6 Build 20260130.3206 Biometric Data Endpoint /iclock/finger_data/ emp_code authorization
A vulnerability, which was classified as problematic, was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/finger_data/ of the component Biometric Data Endpoint. Executing a manipulation of
CVE-2026-108795 | ZKTeco BioTime 9.5.6 Build 20260130.3206 System Settings API /base/api/systemSettings access control
A vulnerability, which was classified as problematic, has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API
CVE-2026-108794 | ZKTeco BioTime 9.5.6 Build 20260130.3206 Database Migration Functionality db_migrate_setting sql injection (EUVD-2026-97164)
A vulnerability classified as critical was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this vulnerability is an unknown functionality of the file /base/api/v1.0/systemSettings/db_migrate_setting/ of the component Database
CVE-2026-107777 | Thermo Fisher Torrent Suite Software is vulnerable to a path traversal, which could allow an authenticated attacker to read arbitrary files on the Torrent Server that are accessible to the web service account.
Thermo Fisher Torrent Suite Software is vulnerable to a path traversal, which could allow an authenticated attacker to read arbitrary files on the Torrent Server that are accessible to the web service account.
CVE-2026-105667 | In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this.
In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. Th
CVE-2026-105279 | In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and retrieve patient information and medical images. It can also use C-STORE to file fabricated study content under an existing patient identity.
In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and retrieve patient information and medical images. It can also use C-STORE to file f
CVE-2026-101021 | MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. Crafted multipart input can force excessive boundary comparisons and repeated copying.
MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. Crafted multipart input can force excessive boundary comparisons and repeated copying.
CVE-2022-46696 | Apple iOS/iPadOS up to 16.1.2 WebKit memory corruption (HT213530 / EUVD-2022-49485)
A vulnerability was found in Apple iOS and iPadOS up to 16.1.2. It has been declared as critical. This affects an unknown part of the component WebKit. Such manipulation leads to memory corruption. This vulnerability is referenced as CVE-20
CVE-2022-46691 | Apple macOS up to 13.0 WebKit memory allocation (HT213532 / EUVD-2022-49480)
A vulnerability was found in Apple macOS. It has been declared as critical. This impacts an unknown function of the component WebKit. Such manipulation leads to uncontrolled memory allocation. This vulnerability is traded as CVE-2022-46691.
CVE-2026-105273 | MP4Parser does not adequately validate MP4 box sizes. A malformed box can cause parsing to make no forward progress and repeatedly process the same input.
MP4Parser does not adequately validate MP4 box sizes. A malformed box can cause parsing to make no forward progress and repeatedly process the same input.