Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 720 | 0,2 % |
| ≥50 % | 3.224 | 0,9 % |
| ≥10 % | 22.120 | 6,0 % |
| <10 % | 344.958 | 93,0 % |
CVE-2017-5674 | Goahead Web Server HTTP GET Request system.ini information disclosure (ID 87283)
A vulnerability was found in Goahead Web Server and classified as critical. Affected by this vulnerability is an unknown functionality of the file system.ini of the component HTTP GET Request Handler. The manipulation results in information
CVE-2017-5648 | Apache Tomcat up to 7.0.75/8.0.41/8.5.11/9.0.0.M17 Application Listener access control (Nessus ID 99535 / ID 350987)
A vulnerability has been found in Apache Tomcat up to 7.0.75/8.0.41/8.5.11/9.0.0.M17 and classified as critical. Affected is an unknown function of the component Application Listener. This manipulation causes improper access controls. This
CVE-2017-0281 | Microsoft Office 2007 SP3/2010 SP2/2016 data processing (Advisory 3162054 / ID 3162054)
A vulnerability was found in Microsoft Office 2007 SP3/2010 SP2/2016. It has been declared as critical. This vulnerability affects unknown code. The manipulation results in data processing error. This vulnerability is identified as CVE-2017
CVE-2016-9096 | Symantec Management Console up to 5.2.6 cross site scripting (SYM17-003 / ID 1037987)
This issue was flagged as a false-positive. Please consult the sources mentioned and consider not using this entry at all. Weiterlesen
CVE-2016-7276 | Microsoft Office 2007 SP3/2010 SP2/2013 RT SP1/2013 SP1 out-of-bounds (MS16-148 / Nessus ID 95810)
A vulnerability classified as problematic was found in Microsoft Office 2007 SP3/2010 SP2/2013 RT SP1/2013 SP1. This impacts an unknown function. Executing a manipulation can lead to out-of-bounds read. The identification of this vulnerabil
CVE-2016-3313 | Microsoft Office up to 2016 memory corruption (MS16-099 / EDB-40224)
A vulnerability labeled as critical has been found in Microsoft Office 2007/2010/2013/2013 RT/2016. The impacted element is an unknown function. The manipulation results in memory corruption. This vulnerability is reported as CVE-2016-3313.
CVE-2016-5388 | Apache Tomcat up to 8.5.4 CGI Servlet HTTP_PROXY access control (VU#797896 / Nessus ID 94997)
A vulnerability classified as critical has been found in Apache Tomcat up to 8.5.4. This affects an unknown function of the component CGI Servlet. The manipulation of the argument HTTP_PROXY as part of Environment Variable leads to improper
CVE-2016-1182 | Oracle Real-Time Decision Server 3.2.1 Platform Installation input validation (Nessus ID 106299 / ID 371195)
A vulnerability classified as critical has been found in Oracle Real-Time Decision Server 3.2.1. The affected element is an unknown function of the component Platform Installation. Performing a manipulation results in improper input validat
CVE-2016-1181 | Oracle Communications Network Integrity up to 7.3.6 MSS Integration Cartridge memory corruption (ID 87288 / BID-91068)
A vulnerability was found in Oracle Communications Network Integrity 7.3.2/7.3.3/7.3.4/7.3.5/7.3.6. It has been rated as critical. This impacts an unknown function of the component MSS Integration Cartridge. The manipulation leads to memory
CVE-2026-87902 | An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are me
CVE-2026-93616 | A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.
A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.
CVE-2026-76460 | A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based manageme
A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker
CVE-2026-76461 | A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A s
A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vul
CVE-2026-85706 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user coul
CVE-2026-86218 | N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.
N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.
CVE-2026-85046 | Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-83549 | Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentiall
CVE-2026-82455 | The RubyGems maintainers determined that the reported symlink-following behavior during gem extraction is not a security vulnerability, so no vulnerability exists for this record to describe.
The RubyGems maintainers determined that the reported symlink-following behavior during gem extraction is not a security vulnerability, so no vulnerability exists for this record to describe.
CVE-2026-82329 | JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.
JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.
CVE-2026-82078 | An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the Pap
An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an
CVE-2026-81578 | An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations.
An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior
CVE-2026-78195 | Rejecting as a duplicate of CVE-2026-78047
Rejecting as a duplicate of CVE-2026-78047
CVE-2026-60004 | Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
CVE-2025-71407 | This CVE ID has been rejected as a duplicate.
This CVE ID has been rejected as a duplicate.
CVE-2025-71406 | This CVE ID has been rejected as a duplicate.
This CVE ID has been rejected as a duplicate.
CVE-2025-71346 | This CVE ID has been rejected as a duplicate.
This CVE ID has been rejected as a duplicate.
CVE-2024-58378 | This CVE ID has been rejected as a duplicate.
This CVE ID has been rejected as a duplicate.
CVE-2024-58377 | This CVE ID has been rejected as a duplicate.
This CVE ID has been rejected as a duplicate.
CVE-2023-54354 | This CVE ID has been rejected as a duplicate.
This CVE ID has been rejected as a duplicate.
CVE-2022-51000 | This CVE ID has been rejected as a duplicate.
This CVE ID has been rejected as a duplicate.
CVE-2022-50999 | This CVE ID has been rejected as a duplicate.
This CVE ID has been rejected as a duplicate.
CVE-2022-50998 | This CVE ID has been rejected as a duplicate.
This CVE ID has been rejected as a duplicate.
CVE-2021-47996 | This CVE ID has been rejected as a duplicate.
This CVE ID has been rejected as a duplicate.
CVE-2026-76848 | This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-63310 | This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-39909 | This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-75501 | Vendor could not replicate the vul, and reporter is unavailable to comment.
Vendor could not replicate the vul, and reporter is unavailable to comment.
CVE-2026-19490 | Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.
Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.
CVE-2026-73392 | This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate to CVE-2026-12965.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate to CVE-2026-12965.
CVE-2026-73189 | This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate to CVE-2026-14858
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate to CVE-2026-14858
CVE-2026-19478 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely mo
CVE-2026-74234 | This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-74511 | This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-74259 | This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-73570 | A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP not
CVE-2026-73327 | This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as the reported behavior is intentional. The update process is designed to write files to disk and is restricted to the highest-privilege users working with cryptographically verified Joomla archives.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as the reported behavior is intentional. The update process is designed to write files to disk and is restricted to the highest-privilege users working with cryptogra
CVE-2026-71362 | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does
CVE-2026-72746 | This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it's a duplicate of CVE-2026-73241.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it's a duplicate of CVE-2026-73241.
CVE-2026-72745 | This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it's a duplicate of CVE-2026-73242.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it's a duplicate of CVE-2026-73242.
CVE-2026-72540 | Red Hat CNA-LR concluded that this CVE is not valid.
Red Hat CNA-LR concluded that this CVE is not valid.
CVE-2026-72898 | Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.
Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.
CVE-2026-19429 | This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-72585 | Red Hat CNA-LR concluded that this CVE is not valid.
Red Hat CNA-LR concluded that this CVE is not valid.
CVE-2026-72568 | Red Hat CNA-LR concluded that this CVE is not valid.
Red Hat CNA-LR concluded that this CVE is not valid.
CVE-2026-15733 | A Remote Code Execution (RCE) vulnerability exist in WGDashboard version 4.2.3 and earlier. Multiple OS command injection allows authenticated attackers to execute arbitrary commands as root.
A Remote Code Execution (RCE) vulnerability exist in WGDashboard version 4.2.3 and earlier. Multiple OS command injection allows authenticated attackers to execute arbitrary commands as root.
CVE-2026-71269 | This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-71245 | Red Hat CNA-LR concluded that this CVE is not valid.
Red Hat CNA-LR concluded that this CVE is not valid.
CVE-2026-61485 | this attack requires control over the search index, which is considered fully trusted by Lucy.
this attack requires control over the search index, which is considered fully trusted by Lucy.
CVE-2026-18577 | An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1
An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1
CVE-2026-51291 | DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.