Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 730 | 0,2 % |
| ≥50 % | 3.213 | 0,9 % |
| ≥10 % | 22.093 | 5,9 % |
| <10 % | 347.808 | 93,0 % |
CVE-2026-5985 | code-projects Simple IT Discussion Forum 1.0 /crud.php user_Id sql injection
A vulnerability classified as critical was found in code-projects Simple IT Discussion Forum 1.0. The affected element is an unknown function of the file /crud.php. The manipulation of the argument user_Id results in sql injection. This vul
CVE-2026-5973 | FoundationAgents MetaGPT up to 0.8.1 metagpt/utils/common.py get_mime_type os command injection (Issue 1930)
A vulnerability, which was classified as critical, was found in FoundationAgents MetaGPT up to 0.8.1. Impacted is the function get_mime_type of the file metagpt/utils/common.py. The manipulation results in os command injection. This vulnera
CVE-2026-5961 | code-projects Simple IT Discussion Forum 1.0 /topic-details.php post_id sql injection
A vulnerability has been found in code-projects Simple IT Discussion Forum 1.0 and classified as critical. This vulnerability affects unknown code of the file /topic-details.php. The manipulation of the argument post_id leads to sql injecti
CVE-2026-40093 | nimiq core-rs-albatross up to 1.3.0 Block blockchain/src/reward.rs Policy::supply_at improper validation of specified quantity in input (GHSA-49xc-52mp-cc9j)
A vulnerability identified as problematic has been detected in nimiq core-rs-albatross up to 1.3.0. This affects the function Policy::supply_at of the file blockchain/src/reward.rs of the component Block Handler. The manipulation leads to i
CVE-2026-40088 | MervinPraison PraisonAI up to 4.5.120 execute_command os command injection
A vulnerability has been found in MervinPraison PraisonAI up to 4.5.120 and classified as critical. The affected element is the function execute_command. The manipulation leads to os command injection. This vulnerability is documented as CV
CVE-2026-40069 | sgbett bsv-ruby-sdk up to 0.8.1 Transaction BSV::Network txStatus unusual condition
A vulnerability was found in sgbett bsv-ruby-sdk up to 0.8.1. It has been declared as problematic. Affected by this vulnerability is the function BSV::Network of the component Transaction Handler. Such manipulation of the argument txStatus
CVE-2026-40046 | Apache ActiveMQ/ActiveMQ MQTT up to 6.2.3 MQTT Control Packet length integer overflow
A vulnerability was found in Apache ActiveMQ and ActiveMQ MQTT up to 6.2.3. It has been classified as critical. This vulnerability affects unknown code of the component MQTT Control Packet Handler. This manipulation of the argument length c
CVE-2026-39843 | makeplane up to 1.2.x fetch_and_encode_favicon server-side request forgery
A vulnerability has been found in makeplane plane up to 1.2.x and classified as critical. This affects the function fetch_and_encode_favicon. This manipulation causes server-side request forgery. This vulnerability is handled as CVE-2026-39
CVE-2026-5848 | jeecgboot JimuReport up to 2.3.0 Data Source testConnection DriverManager.getConnection dbUrl code injection (Issue 4587)
A vulnerability has been found in jeecgboot JimuReport up to 2.3.0 and classified as critical. The affected element is the function DriverManager.getConnection of the file /drag/onlDragDataSource/testConnection of the component Data Source
CVE-2026-5379 | runZero Platform up to 2.x/3.0 Organization authorization
A vulnerability was found in runZero Platform up to 2.x/3.0. It has been classified as problematic. The affected element is an unknown function of the component Organization Handler. This manipulation causes incorrect authorization. This vu
CVE-2026-39319 | ChurchCRM up to 7.0.x Endpoint /FundRaiserEditor.php iCurrentFundraiser sql injection (GHSA-vg4m-hc29-jgqj)
A vulnerability classified as critical was found in ChurchCRM up to 7.0.x. This affects an unknown part of the file /FundRaiserEditor.php of the component Endpoint. Executing a manipulation of the argument iCurrentFundraiser can lead to sql
CVE-2026-35487 | oobabooga text-generation-webui up to 4.2 API Response load_prompt path traversal
A vulnerability, which was classified as critical, was found in oobabooga text-generation-webui up to 4.2. Affected by this vulnerability is the function load_prompt of the component API Response Handler. Such manipulation leads to path tra
CVE-2026-5670 | Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f upload.php move_uploaded_file unrestricted upload
A vulnerability has been found in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f and classified as critical. This issue affects the function move_uploaded_file of the file /AssignmentSection/submission/up
CVE-2026-35052 | man-group dtale up to 3.21.x cross site scripting (GHSA-436g-fhfc-9g5w)
A vulnerability was found in man-group dtale up to 3.21.x. It has been rated as problematic. This affects an unknown part. This manipulation causes cross site scripting. This vulnerability is handled as CVE-2026-35052. The attack can be ini
CVE-2026-35050 | oobabooga text-generation-webui up to 4.1.0 Setting download-model.py path traversal (GHSA-jg96-p5p6-q3cv)
A vulnerability was found in oobabooga text-generation-webui up to 4.1.0. It has been classified as critical. Affected by this vulnerability is an unknown functionality of the file download-model.py of the component Setting Handler. The man
CVE-2026-35047 | Ajax30 BraveCMS up to 2.0.5 CKEditor Endpoint unrestricted upload (GHSA-9rcc-w59j-965v)
A vulnerability, which was classified as critical, has been found in Ajax30 BraveCMS up to 2.0.5. Affected is an unknown function of the component CKEditor Endpoint. Performing a manipulation results in unrestricted upload. This vulnerabili
CVE-2026-35046 | TandoorRecipes recipes up to 2.6.3 bleach.clean cross site scripting (GHSA-9hhh-g2fc-r8x2)
A vulnerability, which was classified as problematic, was found in TandoorRecipes recipes up to 2.6.3. Affected by this vulnerability is the function bleach.clean. Executing a manipulation can lead to cross site scripting. This vulnerabilit
CVE-2026-30613 | AZIOT 1.1.9 UART Interface information disclosure
A vulnerability was found in AZIOT 1.1.9. It has been declared as problematic. This issue affects some unknown processing of the component UART Interface. Such manipulation leads to information disclosure. This vulnerability is traded as CV
CVE-2025-61166 | SigningHub User 10.0 URL redirect
A vulnerability identified as problematic has been detected in SigningHub User 10.0. The impacted element is an unknown function of the component URL Handler. The manipulation leads to open redirect. This vulnerability is uniquely identifie
CVE-2025-59440 | Samsung Mobile Processor/Wearable Processor/Modem Exynos up to 9110 USIM denial of service
A vulnerability marked as problematic has been reported in Samsung Mobile Processor, Wearable Processor and Modem Exynos up to 9110. The affected element is an unknown function of the component USIM. The manipulation leads to denial of serv
Microsoft Authenticator für Android: Sicherheitslücke lieferte Zugriffsschlüssel ohne App-Berechtigungen
Sicherheitsforscher haben im Microsoft Authenticator unter Android eine Schwachstelle namens AuthMask aufgedeckt. Das Problem daran: Eine ganz gewöhnliche App auf dem Smartphone, die nicht einmal besondere...Zum Beitrag: Microsoft Authentic
Das iPhone Duo hat eine gewaltige Schwachstelle
(Bildquelle: Apple und Bildbearbeitung GIGA)Apples erstes Falt-Handy ist da. Ein YouTube-Experte spricht jedoch eine deutliche Warnung aus.Tech-Experte Zack Nelson nimmt sich das iPhone Duo vor. Auf seinem YouTube-Kanal JerryRigEverything u
CVE-2026-5669 | Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f Parameter /login.php password sql injection (Issue 240)
A vulnerability, which was classified as critical, was found in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This vulnerability affects unknown code of the file /login.php of the component Parameter Ha
CVE-2026-5668 | Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f add%20notice.php $_SERVER['PHP_SELF'] cross site scripting (Issue 239)
A vulnerability, which was classified as problematic, has been found in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This affects an unknown part of the file /admin/Add%20notice/add%20notice.php. This
CVE-2026-5665 | code-projects Online FIR System 1.0 Login /Login/checklogin.php email/password sql injection
A vulnerability classified as critical has been found in code-projects Online FIR System 1.0. Affected by this vulnerability is an unknown functionality of the file /Login/checklogin.php of the component Login. The manipulation of the argum
CVE-2026-35042 | nearform fast-jwt crit Header Extension data authenticity
A vulnerability described as problematic has been identified in nearform fast-jwt. This impacts an unknown function of the component crit Header Extension. Executing a manipulation can lead to insufficient verification of data authenticity.
CVE-2026-35039 | nearform fast-jwt up to 6.0.x data authenticity (GHSA-rp9m-7r4c-75qg)
A vulnerability marked as critical has been reported in nearform fast-jwt up to 6.0.x. This vulnerability affects unknown code. Performing a manipulation results in insufficient verification of data authenticity. This vulnerability is ident
CVE-2026-35037 | lin-snow Ech0 up to 4.2.7 Endpoint /api/website/title website_url server-side request forgery (GHSA-cqgf-f4x7-g6wc)
A vulnerability classified as critical was found in lin-snow Ech0 up to 4.2.7. The affected element is an unknown function of the file /api/website/title of the component Endpoint. The manipulation of the argument website_url results in ser
CVE-2026-35035 | ci4-cms-erp ci4ms 0.28.5.0/0.31.0.0 Setting cross site scripting (GHSA-5ghq-42rg-769x)
A vulnerability classified as problematic has been found in ci4-cms-erp ci4ms 0.28.5.0/0.31.0.0. Impacted is an unknown function of the component Setting Handler. The manipulation leads to cross site scripting. This vulnerability is listed
CVE-2026-34989 | ci4-cms-erp ci4ms 0.28.5.0/0.31.0.0 cross site scripting
A vulnerability has been found in ci4-cms-erp ci4ms 0.28.5.0/0.31.0.0 and classified as problematic. The affected element is an unknown function. This manipulation causes cross site scripting. This vulnerability appears as CVE-2026-34989. T
CVE-2026-34969 | Nhost up to 0.47.x information disclosure (GHSA-g2qj-prgh-4g9r)
A vulnerability was found in Nhost up to 0.47.x. It has been classified as problematic. This issue affects some unknown processing. The manipulation leads to information disclosure. This vulnerability is referenced as CVE-2026-34969. Remote
CVE-2026-28736 | Mattermost Focalboard up to 8.0 authorization
A vulnerability was found in Mattermost Focalboard up to 8.0. It has been classified as problematic. Affected is an unknown function. Performing a manipulation results in authorization bypass. This vulnerability only affects products that a
CVE-2022-48021 | Zammad 5.3.0 Message privilege escalation (EUVD-2022-50735)
A vulnerability identified as critical has been detected in Zammad 5.3.0. Affected by this issue is some unknown functionality of the component Message Handler. Performing a manipulation results in privilege escalation. This vulnerability i
CVE-2022-48020 | Vinteo VCC 2.36.4 conference cross site scripting (EUVD-2022-50734)
A vulnerability has been found in Vinteo VCC 2.36.4 and classified as problematic. Affected is an unknown function. This manipulation of the argument conference causes cross site scripting. This vulnerability is handled as CVE-2022-48020. T
CVE-2022-48013 | Opencats 0.9.7 index.php?m=calendar Description/Title cross site scripting (EUVD-2022-50727)
A vulnerability, which was classified as problematic, was found in Opencats 0.9.7. Affected by this vulnerability is an unknown functionality of the file /opencats/index.php?m=calendar. The manipulation of the argument Description/Title res
CVE-2022-48012 | Opencats 0.9.7 index.php?m=settings&a=ajax_tags_upd cross site scripting (EUVD-2022-50726)
A vulnerability was found in Opencats 0.9.7. It has been declared as problematic. This issue affects some unknown processing of the file /opencats/index.php?m=settings&amp;a=ajax_tags_upd. Executing a manipulation can lead to cross site
CVE-2022-48011 | Opencats 0.9.7 Import viewerrors importID sql injection (EUVD-2022-50725)
A vulnerability, which was classified as critical, has been found in Opencats 0.9.7. This affects an unknown part of the component Import viewerrors Handler. This manipulation of the argument importID causes sql injection. This vulnerabilit
CVE-2022-48008 | LimeSurvey 5.4.15 Plugin Manager unrestricted upload (EUVD-2022-50722)
A vulnerability was found in LimeSurvey 5.4.15. It has been classified as problematic. This vulnerability affects unknown code of the component Plugin Manager. Performing a manipulation results in unrestricted upload. This vulnerability is
CVE-2022-48007 | Piwigo 13.4.0 identification.php User-Agent cross site scripting (Issue 1835 / EUVD-2022-50721)
A vulnerability has been found in Piwigo 13.4.0 and classified as problematic. Affected by this issue is some unknown functionality of the file identification.php. This manipulation of the argument User-Agent causes cross site scripting. Th
PHP2Shell security flaws now sucessfully exploited in the wild
Two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the wild. [...] Weiterlesen
PHP Publishes Mitigation Advice for New RCE Flaw
PHP warns of critical RCE vulnerability CVE-2026-115560, but says limited exploit conditions mean most deployments are unlikely to be affected Weiterlesen
CVE-2026-116233 | A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the component Dnsmasq. The manipulation of the argument rent_time leads to crlf injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the component Dnsmasq. The manipulation of the argument rent_time leads to crlf injection. The attack can be initiated remotely.
CVE-2026-115425 | Multiple cross site scripting (XSS) vulnerabilities affect OPNsense firewall vesrion 26.7.1_1 and earlier allows low privileged attacker to execute Javascript in the context of another user visiting a specific page or clicking on a specifically crafted link.
Multiple cross site scripting (XSS) vulnerabilities affect OPNsense firewall vesrion 26.7.1_1 and earlier allows low privileged attacker to execute Javascript in the context of another user visiting a specific page or clicking on a specific
CVE-2026-116232 | A weakness has been identified in Oray Pugongying X5 Pro 7.6.1. This affects the function snmp_set of the component SNMP Handler. Executing a manipulation of the argument info.community can lead to crlf injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
A weakness has been identified in Oray Pugongying X5 Pro 7.6.1. This affects the function snmp_set of the component SNMP Handler. Executing a manipulation of the argument info.community can lead to crlf injection. It is possible to launch t
CVE-2026-116231 | A security flaw has been discovered in Oray Pugongying X5 Pro 7.6.1. The impacted element is an unknown function of the component Ser2net. Performing a manipulation of the argument regmsg results in crlf injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
A security flaw has been discovered in Oray Pugongying X5 Pro 7.6.1. The impacted element is an unknown function of the component Ser2net. Performing a manipulation of the argument regmsg results in crlf injection. It is possible to initiat
CVE-2026-116230 | A vulnerability was identified in Ndemic Creations Plague Inc Evolved up to 1.24.0.3. The affected element is an unknown function of the component Workshop Scenario Loader. Such manipulation leads to deserialization. The attack may be performed from remote. Upgrading to version 1.24.0.4 is sufficient to fix this issue. It is recommended to upgrade the affected component.
A vulnerability was identified in Ndemic Creations Plague Inc Evolved up to 1.24.0.3. The affected element is an unknown function of the component Workshop Scenario Loader. Such manipulation leads to deserialization. The attack may be perfo
CVE-2026-96581 | Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant's records via an upserting create action. Under attribute multitenancy, Ash.Actions.Create (lib/ash/actions/create/create.ex) and Ash.Actions.Create.Bulk (lib/ash/actions/create/bulk.ex) upserted on the primary key, or on an all_tenants? identity, without scoping the conflicting record to the request's
Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant's records via an upserting create action. Under attribute multitenancy, Ash.Actio
CVE-2026-116229 | A vulnerability was determined in ffxiv-teamcraft FFXIV Teamcraft up to 11.4.31. Impacted is the function clipboard.readText of the file apps/electron/src/preload.ts of the component Renderer-Process IPC Bridge. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 11.4.32 is recommended to address this issue. Patch name: def118fdf36f
A vulnerability was determined in ffxiv-teamcraft FFXIV Teamcraft up to 11.4.31. Impacted is the function clipboard.readText of the file apps/electron/src/preload.ts of the component Renderer-Process IPC Bridge. This manipulation causes cro
CVE-2026-116228 | A vulnerability was found in 777genius agent-teams-ai up to 2.17.10. This issue affects the function doStart of the file src/main/services/infrastructure/HttpServer.ts of the component Local HTTP Service. The manipulation results in missing authentication. The attack is only possible with local access. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was found in 777genius agent-teams-ai up to 2.17.10. This issue affects the function doStart of the file src/main/services/infrastructure/HttpServer.ts of the component Local HTTP Service. The manipulation results in missing
CVE-2026-116227 | A vulnerability has been found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of the component Virtual Server Page. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability has been found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of the component Virtual Server Page. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploi
CVE-2026-116224 | A vulnerability has been found in fr0tt benotes up to 2.8.1. This affects the function getUrlInfo of the file app/Http/Controllers/PostController.php of the component Bookmark Metadata Endpoint. The manipulation of the argument url leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded
A vulnerability has been found in fr0tt benotes up to 2.8.1. This affects the function getUrlInfo of the file app/Http/Controllers/PostController.php of the component Bookmark Metadata Endpoint. The manipulation of the argument url leads to
CVE-2026-107900 | V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6ComFile!CCheck::ItemCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6ComFile!CCheck::ItemCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
CVE-2026-107899 | V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::CheckSymbolMacroParam. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::CheckSymbolMacroParam. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the a
CVE-2026-107898 | V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::MacroCommandCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::MacroCommandCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affec
CVE-2026-107897 | V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6MemInIF!set_temp_type_default. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6MemInIF!set_temp_type_default. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
CVE-2026-107896 | V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6ComFile!load_gr_item. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6ComFile!load_gr_item. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
CVE-2026-107895 | V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds write vulnerability. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds write vulnerability. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
CVE-2026-107894 | V-SFT provided by FUJI ELECTRIC CO., LTD. contains a stack-based buffer overflow vulnerability. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
V-SFT provided by FUJI ELECTRIC CO., LTD. contains a stack-based buffer overflow vulnerability. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
CVE-2026-116223 | A flaw has been found in icret EasyImage up to 2.8.7. The impacted element is an unknown function of the file app/del.php. Executing a manipulation of the argument hash can lead to improper privilege management. The attack can be launched remotely. The exploit has been published and may be used. This patch is called b12cb67d447bcbb67e21c8f011d0f5638229760c. A patch should be applied to remediate this issue.
A flaw has been found in icret EasyImage up to 2.8.7. The impacted element is an unknown function of the file app/del.php. Executing a manipulation of the argument hash can lead to improper privilege management. The attack can be launched r
CVE-2026-116124 | A security vulnerability has been detected in GNOME libgsf up to 1.14.60. The impacted element is the function ole_info_read_metabat of the file gsf/gsf-infile-msole.c of the component OLE2 Parser. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The identifier of the patch is a8e25560b74f84c3f86df6ca0ac59195fa5af68a. It is recommended to apply a patch to fix this issue.
A security vulnerability has been detected in GNOME libgsf up to 1.14.60. The impacted element is the function ole_info_read_metabat of the file gsf/gsf-infile-msole.c of the component OLE2 Parser. The manipulation leads to heap-based buffe