Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 785 | 0,2 % |
| ≥50 % | 3.559 | 0,9 % |
| ≥10 % | 13.141 | 3,2 % |
| <10 % | 396.070 | 95,8 % |
CVE-2026-43017 | Linux Kernel up to 6.19.11 Bluetooth mesh_send adv_data[] buffer overflow
A vulnerability labeled as critical has been found in Linux Kernel up to 6.1.167/6.6.133/6.12.80/6.18.21/6.19.11. This affects the function mesh_send of the component Bluetooth. Such manipulation of the argument adv_data[] leads to buffer o
CVE-2026-43012 | Linux Kernel up to 6.12.80/6.18.21/6.19.11 stack-based overflow
A vulnerability categorized as critical has been discovered in Linux Kernel up to 6.12.80/6.18.21/6.19.11. Affected by this vulnerability is an unknown functionality. The manipulation results in stack-based buffer overflow. This vulnerabili
CVE-2026-36959 | U-SPEED N300 1.0.0 Router Management Interface /api/login excessive authentication
A vulnerability, which was classified as problematic, was found in U-SPEED N300 1.0.0. This issue affects some unknown processing of the file /api/login of the component Router Management Interface. Such manipulation leads to improper restr
CVE-2026-36958 | U-SPEED N300 1.0.0 Web Management Interface denial of service
A vulnerability classified as problematic has been found in U-SPEED N300 1.0.0. Affected by this issue is some unknown functionality of the component Web Management Interface. The manipulation leads to denial of service. This vulnerability
CVE-2026-36957 | Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router 1.0.0 URI denial of service
A vulnerability classified as problematic was found in Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router 1.0.0. This affects an unknown part of the component URI Handler. The manipulation results in denial of service. This vulnerability was
CVE-2026-31784 | Linux Kernel up to 6.18.21/6.19.11 pxp_start denial of service
A vulnerability identified as critical has been detected in Linux Kernel up to 6.18.21/6.19.11. Affected by this vulnerability is the function pxp_start. The manipulation leads to denial of service. This vulnerability is referenced as CVE-2
CVE-2024-36058 | Koha Library up to 23.05.9 POST Parameter opac-sendbasket.pl bib_list sql injection
A vulnerability has been found in Koha Library up to 23.05.9 and classified as critical. Affected is an unknown function of the file /cgi-bin/koha/opac-sendbasket.pl of the component POST Parameter Handler. Performing a manipulation of the
CVE-2024-36057 | Koha Library up to 23.05.9 Filename os command injection
A vulnerability has been found in Koha Library up to 23.05.9 and classified as critical. This impacts an unknown function of the component Filename Handler. This manipulation causes os command injection. This vulnerability is handled as CVE
CVE-2024-33618 | Bosch DIVAR IP all-in-one 6000 up to 12.0.1 Network Interface resource consumption
A vulnerability labeled as problematic has been found in Bosch BVMS, BVMS Viewer, DIVAR IP all-in-one 7000 R3, DIVAR IP 7000 R2, DIVAR IP all-in-one 5000, DIVAR IP all-in-one 7000, DIVAR IP all-in-one 4000 and DIVAR IP all-in-one 6000 up to
CVE-2024-2104 | JBL LIVE PRO 2 TWS/TUNE FLEX Mobile App Service missing authentication (hbsa-2025-0001)
A vulnerability, which was classified as critical, was found in JBL LIVE PRO 2 TWS and TUNE FLEX. This affects an unknown function of the component Mobile App Service. Executing a manipulation can lead to missing authentication. This vulner
CVE-2024-1490 | WAGO WP400 up to 4.5.10 Web-based Management Interface code injection (VDE-2024-008)
A vulnerability was found in WAGO CC100, PFC100 G1, PFC100 G2, PFC200 G1, PFC200 G2, TP600, Edge Controller and WP400 up to 4.5.10. It has been rated as critical. The impacted element is an unknown function of the component Web-based Manage
CVE-2024-14028 | Softing smartLink HW-DP/smartLink HW-PN Webserver use after free
A vulnerability classified as critical has been found in Softing smartLink HW-DP and smartLink HW-PN. The affected element is an unknown function of the component Webserver. This manipulation causes use after free. This vulnerability is han
CVE-2025-63589 | CMSimple_XH 1.8 index.php cross site scripting
A vulnerability marked as problematic has been reported in CMSimple_XH 1.8. The impacted element is an unknown function of the file index.php. The manipulation leads to cross site scripting. This vulnerability is traded as CVE-2025-63589. I
CVE-2025-63588 | CMSimple_XH CMSimpleXH cross site scripting
A vulnerability labeled as problematic has been found in CMSimple_XH. This affects an unknown function of the component CMSimpleXH Handler. Such manipulation leads to cross site scripting. This vulnerability is referenced as CVE-2025-63588.
CVE-2025-63585 | OSSN Open Source Social Network 8.6 status timestamp sql injection
A vulnerability has been found in OSSN Open Source Social Network 8.6 and classified as critical. Affected is an unknown function of the file /action/rtcomments/status. Performing a manipulation of the argument timestamp results in sql inje
CVE-2025-63560 | KiloView Dual Channel 4k HDMI & 3G-SDI HEVC 1.20.0006 API denial of service
A vulnerability was found in KiloView Dual Channel 4k HDMI &amp; 3G-SDI HEVC 1.20.0006. It has been classified as problematic. This issue affects some unknown processing of the component API. This manipulation causes denial of service.
CVE-2025-63416 | SelfBest Platform 2023.3 Chat /admin/users cross site scripting
A vulnerability categorized as problematic has been discovered in SelfBest Platform 2023.3. This impacts an unknown function of the file /admin/users of the component Chat. Executing a manipulation can lead to cross site scripting. This vul
CVE-2025-63307 | alexusmai laravel-file-manager 3.3.1 Content-Type cross site scripting
A vulnerability identified as problematic has been detected in alexusmai laravel-file-manager 3.3.1. This affects an unknown function of the component Content-Type Handler. The manipulation leads to cross site scripting. This vulnerability
CVE-2025-60784 | XiaozhangBang Voluntary Like System 8.8 Pay Module /topfirst.php zhekou improper authorization
A vulnerability labeled as critical has been found in XiaozhangBang Voluntary Like System 8.8. This vulnerability affects unknown code of the file /topfirst.php of the component Pay Module. Such manipulation of the argument zhekou leads to
CVE-2025-59392 | Elspec G5 up to 1.2.2.19 authentication bypass
A vulnerability was found in Elspec G5 up to 1.2.2.19. It has been declared as critical. This impacts an unknown function. The manipulation results in authentication bypass using alternate channel. This vulnerability was named CVE-2025-5939
CVE-2025-56232 | GOG Galaxy 2.0.0.2 certificate validation
A vulnerability was found in GOG Galaxy 2.0.0.2 and classified as critical. Impacted is an unknown function. The manipulation results in improper certificate validation. This vulnerability is cataloged as CVE-2025-56232. The attack may be l
CVE-2025-56231 | Tonec Internet Download Manager up to 6.42.41.1 certificate validation
A vulnerability labeled as critical has been found in Tonec Internet Download Manager up to 6.42.41.1. Affected by this vulnerability is an unknown functionality. The manipulation results in improper certificate validation. This vulnerabili
CVE-2025-55343 | Quipux up to 4.0.1 busqueda/busqueda.php sql injection
A vulnerability classified as critical has been found in Quipux up to 4.0.1. Affected by this vulnerability is an unknown functionality of the file busqueda/busqueda.php. This manipulation causes sql injection. The identification of this vu
CVE-2025-55342 | Quipux up to 4.0.1 cambiar_password_olvido_validar.php txt_login information disclosure
A vulnerability classified as problematic was found in Quipux up to 4.0.1. Affected by this issue is some unknown functionality of the file Administracion/usuarios/cambiar_password_olvido_validar.php. Such manipulation of the argument txt_l
CVE-2025-55341 | Quipux up to 4.0.1 anexos/anexos_nuevo.php asocImgRad cross site scripting
A vulnerability was found in Quipux up to 4.0.1. It has been declared as problematic. The impacted element is an unknown function of the file anexos/anexos_nuevo.php. Such manipulation of the argument asocImgRad leads to cross site scriptin
CVE-2025-63601 | Snipe-IT up to 8.3.2 Backup File unrestricted upload (EUVD-2025-37899)
A vulnerability was found in Snipe-IT up to 8.3.2. It has been classified as critical. This affects an unknown function of the component Backup File Handler. This manipulation causes unrestricted upload. This vulnerability appears as CVE-20
CVE-2025-61304 | Dynatrace ActiveGate Ping Extension up to 1.016 IP Address os command injection
A vulnerability, which was classified as critical, has been found in Dynatrace ActiveGate Ping Extension up to 1.016. The impacted element is an unknown function of the component IP Address Handler. The manipulation leads to os command inje
CVE-2025-59716 | ownCloud Guests up to 0.12.4 Mail Address /apps/guests/register/ showPasswordForm response discrepancy (EUVD-2025-37881)
A vulnerability, which was classified as problematic, was found in ownCloud Guests up to 0.12.4. Affected by this vulnerability is the function showPasswordForm of the file /apps/guests/register/ of the component Mail Address Handler. Such
CVE-2025-54327 | Samsung Processor and Wearable Processor Exynos 1280/1380/2200 VTS input validation
A vulnerability was found in Samsung Processor and Wearable Processor Exynos 1280/1380/2200. It has been rated as critical. This vulnerability affects unknown code of the component VTS. Performing a manipulation results in improper input va
CVE-2025-27374 | Samsung Mobile Processor/Wearable Processor Exynos up to 9825 Secure Boot out-of-bounds write
A vulnerability, which was classified as critical, has been found in Samsung Mobile Processor and Wearable Processor Exynos up to 9825. The affected element is an unknown function of the component Secure Boot Component. Performing a manipul
CVE-2024-8528 | Automated Logic WebCTRL up to 9.0 GET Parameter cross site scripting
A vulnerability classified as problematic was found in Automated Logic WebCTRL up to 9.0. This affects an unknown function of the component GET Parameter Handler. The manipulation results in cross site scripting. This vulnerability is catal
CVE-2024-8527 | Automated Logic WebCTRL up to 9.0 URL Parameter redirect
A vulnerability described as problematic has been identified in Automated Logic WebCTRL up to 9.0. The affected element is an unknown function of the component URL Parameter. Executing a manipulation can lead to open redirect. This vulnerab
CVE-2024-5539 | Automated Logic WebCTRL up to 8.5 authorization (EUVD-2024-55103 / CNNVD-202511-2982)
A vulnerability classified as problematic has been found in Automated Logic WebCTRL up to 8.5. Affected by this issue is some unknown functionality. Performing a manipulation results in incorrect authorization. This vulnerability is known a
CVE-2024-47856 | RSA Authentication Agent up to 7.4.6 unquoted search path
A vulnerability was found in RSA Authentication Agent up to 7.4.6. It has been declared as problematic. This impacts an unknown function. Executing a manipulation can lead to unquoted search path. This vulnerability is registered as CVE-202
CVE-2024-46335 | PHPGurukul Complaint Management System 2.0 between-date-userreport.php fromdate/todate cross site scripting
A vulnerability categorized as problematic has been discovered in PHPGurukul Complaint Management System 2.0. The affected element is an unknown function of the file between-date-userreport.php. Such manipulation of the argument fromdate/to
CVE-2024-44664 | PHPGurukul Online Shopping Portal 2.0 product-details.php name/summary/review/quality/price/value sql injection
A vulnerability classified as critical was found in PHPGurukul Online Shopping Portal 2.0. This impacts an unknown function of the file product-details.php. The manipulation of the argument name/summary/review/quality/price/value results in
CVE-2024-44663 | PHPGurukul Online Shopping Portal 2.0 search-result.php product sql injection
A vulnerability described as critical has been identified in PHPGurukul Online Shopping Portal 2.0. The impacted element is an unknown function of the file search-result.php. Executing a manipulation of the argument Product can lead to sql
CVE-2024-44661 | PHPGurukul Online Shopping Portal 2.0 my-cart.php quantity cross site scripting
A vulnerability identified as problematic has been detected in PHPGurukul Online Shopping Portal 2.0. The impacted element is an unknown function of the file my-cart.php. Performing a manipulation of the argument quantity results in cross s
CVE-2024-44660 | PHPGurukul Online Shopping Portal 2.0 login.php fullname/emailid/contactno sql injection
A vulnerability identified as critical has been detected in PHPGurukul Online Shopping Portal 2.0. This issue affects some unknown processing of the file login.php. This manipulation of the argument fullname/emailid/contactno causes sql inj
CVE-2024-44658 | PHPGurukul Complaint Management System 2.0 subcategory.php subcategory/category sql injection
A vulnerability marked as critical has been reported in PHPGurukul Complaint Management System 2.0. The affected element is an unknown function of the file subcategory.php. Performing a manipulation of the argument subcategory/category resu
CVE-2026-77063 | expressjs multer up to 2.2.x File Stream race condition (Nessus ID 377477)
A vulnerability was found in expressjs multer up to 2.2.x and classified as problematic. Affected by this vulnerability is an unknown functionality of the component File Stream Handler. Executing a manipulation can lead to race condition. T
CVE-2023-34969 | Freedesktop D-Bus up to 1.12.27/1.14.7/1.15.5 Monitor Message denial of service (Issue 457 / Nessus ID 377482)
A vulnerability was found in Freedesktop D-Bus up to 1.12.27/1.14.7/1.15.5 and classified as problematic. Impacted is an unknown function of the component Monitor Message Handler. The manipulation results in denial of service. This vulnerab
Sophos Firewall: Hotfix für Schwachstelle (CVE-2026-98432)
Auch die Firewalls von Sophos sind von der kritischen Schwachstelle CVE-2026-98432 im Linux-Kernel betroffen. Über diese kritische (CVSS Score of 9.8) Schwachstelle im Linux Kernel IPv4 TCP-Networking Stack hatte ich berichtet. Sophos hat E
CVE-2026-18836 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinations and return the response to the attacker.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended des
CVE-2026-18689 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accepted where it should not be, which could reveal the names of other organizations.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accep
CVE-2026-17428 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization decisions without sufficient verification, which could allow access to information belonging to others.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization
CVE-2026-17411 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized before it is used in database queries.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized befo
CVE-2026-17410 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.
CVE-2026-17409 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of a request, which could allow restricted operations to be reached.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access c
CVE-2026-17408 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.
CVE-2026-17407 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before being used in a database query, which could allow SQL commands to run.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before
CVE-2026-17406 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Address checks can be bypassed, which could allow the server to reach destinations that should be blocked.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Address checks can be bypassed, which could allow the s
CVE-2026-17405 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm that the requesting user is permitted to read them, which could expose keystore information.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm
CVE-2026-17404 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17403 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.
CVE-2026-17402 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is passed to the operating system, which could allow commands to run on the underlying host.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is pas
CVE-2026-17401 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.
CVE-2026-17400 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
CVE-2026-17399 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to insufficient validation of uploaded content. Content uploaded to the product is not sufficiently checked before it is processed, which could allow code to run on the server.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to insufficient validation of uploaded content. Content uploaded to the product is not suffic
CVE-2026-17398 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.