Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 786 | 0,2 % |
| ≥50 % | 3.560 | 0,9 % |
| ≥10 % | 13.154 | 3,2 % |
| <10 % | 396.055 | 95,8 % |
Google fixes the eighth actively exploited Chrome zero-day of 2026
Google patched nine Chrome flaws, including a V8 vulnerability tracked as CVE-2026-125350, that attackers have been actively exploiting in the wild. Google has addressed multiple security vulnerabilities, one of which, tracked as CVE-2026-1
CVE-2026-88833 | BusyBox udhcpc integer underflow
A vulnerability was found in BusyBox and classified as critical. Impacted is an unknown function of the component udhcpc. The manipulation results in integer underflow. This vulnerability was named CVE-2026-88833. The attack may be performe
CVE-2026-83844 | Microsoft Windows up to 11.3.9 out-of-bounds
A vulnerability, which was classified as critical, was found in Microsoft Windows. This affects an unknown part. Such manipulation leads to out-of-bounds read. This vulnerability is documented as CVE-2026-83844. The attack can be executed r
CVE-2026-76459 | Cisco NX-OS Software out-of-bounds write (EUVD-2026-94462)
A vulnerability was found in Cisco NX-OS Software, NX-OS System Software in ACI Mode and Unified Computing System. It has been rated as very critical. This affects an unknown function. This manipulation causes out-of-bounds write. This vuln
CVE-2026-76285 | Splunk Enterprise up to 9.4.14/10.0.9/10.2.6/10.4.2 isolation
A vulnerability was found in Splunk Enterprise up to 9.4.14/10.0.9/10.2.6/10.4.2. It has been classified as critical. This affects an unknown part. The manipulation leads to improper isolation or compartmentalization. This vulnerability is
CVE-2026-76284 | Splunk Enterprise up to 9.4.14/10.0.9/10.2.6/10.4.2 neutralization
A vulnerability was found in Splunk Enterprise up to 9.4.14/10.0.9/10.2.6/10.4.2 and classified as very critical. Affected by this issue is some unknown functionality. Executing a manipulation can lead to improper neutralization. The identi
CVE-2026-76283 | Splunk Enterprise up to 9.4.14/10.0.9/10.2.6/10.4.2 protection mechanism
A vulnerability has been found in Splunk Enterprise up to 9.4.14/10.0.9/10.2.6/10.4.2 and classified as critical. Affected by this vulnerability is an unknown functionality. Performing a manipulation results in protection mechanism failure.
CVE-2026-76282 | Splunk Enterprise up to 9.4.14/10.0.9/10.2.6/10.4.2 allocation of resources (EUVD-2026-94634)
A vulnerability, which was classified as very critical, was found in Splunk Enterprise up to 9.4.14/10.0.9/10.2.6/10.4.2. Affected is an unknown function. Such manipulation leads to allocation of resources. This vulnerability is uniquely id
CVE-2026-76281 | Splunk Enterprise up to 9.4.14/10.0.9/10.2.6/10.4.2 access control
A vulnerability identified as very critical has been detected in Splunk Enterprise up to 9.4.14/10.0.9/10.2.6/10.4.2. This vulnerability affects unknown code. This manipulation causes improper access controls. This vulnerability is register
CVE-2026-109601 | Frappe Framework up to 15.116.x/16.29.x Email HTML Attribute path traversal
A vulnerability was found in Frappe Framework up to 15.116.x/16.29.x. It has been declared as problematic. This vulnerability affects unknown code of the component Email HTML Attribute Handler. Such manipulation leads to path traversal. Thi
CVE-2024-8122 | WSO2 Identity Server up to 5.10.x SMS OTP access control
A vulnerability described as critical has been identified in WSO2 Identity Server up to 5.10.x. Affected by this issue is some unknown functionality of the component SMS OTP. Such manipulation leads to improper access controls. This vulnera
CVE-2024-58391 | Frappe up to 14.57.x/15.3.x Printview cross site scripting
A vulnerability described as problematic has been identified in Frappe up to 14.57.x/15.3.x. This vulnerability affects unknown code of the component Printview. Executing a manipulation can lead to cross site scripting. This vulnerability i
Google patches eighth Chrome zero-day exploited in attacks this year
Google has released emergency security updates to patch a new Chrome vulnerability exploited in zero-day attacks, the eighth such flaw since the start of the year. [...] Weiterlesen
CVE-2026-80490 | Algorithm::AhoCorasick::XS up to 0.04 matches/first_match/match_details out-of-bounds
A vulnerability, which was classified as critical, was found in Algorithm::AhoCorasick::XS up to 0.04. Affected by this vulnerability is the function matches/first_match/match_details. The manipulation results in out-of-bounds read. This vu
CVE-2026-17262 | IBM i 7.3/7.4/7.5/7.6 denial of service (EUVD-2026-83295)
A vulnerability labeled as critical has been found in IBM i 7.3/7.4/7.5/7.6. The affected element is an unknown function. Such manipulation leads to denial of service. This vulnerability is uniquely identified as CVE-2026-17262. Local acces
CVE-2026-12542 | Foreman foreman-tail command injection (WID-SEC-2026-3712)
A vulnerability marked as very critical has been reported in Foreman. The impacted element is an unknown function of the component foreman-tail. The manipulation leads to command injection. This vulnerability is documented as CVE-2026-12542
CVE-2026-10841 | IBM WebSphere Application Server/WebSphere Liberty 8.5/9.0 request smuggling
A vulnerability, which was classified as problematic, has been found in IBM WebSphere Application Server and WebSphere Liberty 8.5/9.0. This vulnerability affects unknown code. The manipulation leads to http request smuggling. This vulnerab
CVE-2026-103442 | Wikimedia Foundation MediaWiki 1.43/1.45/1.46 CentralAuth code injection
A vulnerability was found in Wikimedia Foundation MediaWiki 1.43/1.45/1.46. It has been declared as critical. This affects an unknown function of the component CentralAuth. Executing a manipulation can lead to code injection. This vulnerabi
CVE-2026-103441 | Wikimedia Foundation MediaWiki 1.43/1.45/1.46 Wikibase deserialization
A vulnerability was found in Wikimedia Foundation MediaWiki 1.43/1.45/1.46. It has been classified as critical. The impacted element is an unknown function of the component Wikibase. Performing a manipulation results in deserialization. Thi
CVE-2024-58388 | Sharp/Toshiba Tec Multiple Multifunction Printers installed_emanual_down.html path path traversal
Further investigation has shown that this issues is a false-positive. Please review the sources mentioned and consider not using this entry at all. Weiterlesen
CVE-2024-58387 | Inspur Haiyue HCM Cloud Download Endpoint download index/ext information disclosure
A vulnerability identified as problematic has been detected in Inspur Haiyue HCM Cloud. This vulnerability affects unknown code of the file /api/model_report/file/download of the component Download Endpoint. This manipulation of the argumen
CVE-2024-58386 | ZoneMinder up to 1.37.x Files View output_file path path traversal
A vulnerability has been found in ZoneMinder up to 1.37.x and classified as problematic. This impacts the function output_file of the component Files View. This manipulation of the argument path causes path traversal. This vulnerability is
CVE-2024-42002 | Open Source Robotics Robot Operating System Crystal Clemmys up to Lyrical Luth Hz Verb eval filter code injection
A vulnerability marked as critical has been reported in Open Source Robotics Robot Operating System. This vulnerability affects the function eval of the component Hz Verb. This manipulation of the argument filter causes code injection. This
CVE-2026-76877 | WPML Multilingual CMS Plugin up to 4.9.7 on WordPress SSO wp-login.php process_iframe_request wpml_sso_token_domain race condition (EUVD-2026-120823)
A vulnerability was found in WPML Multilingual CMS Plugin up to 4.9.7 on WordPress. It has been declared as critical. Affected is the function process_iframe_request of the file wp-login.php of the component SSO Handler. Such manipulation o
CVE-2026-120513 | WPEverest Everest Forms Plugin up to 3.6.2 on WordPress Save-and-Continue Addon remove_csv_file_after_email_send path traversal (EUVD-2026-120824)
A vulnerability labeled as critical has been found in WPEverest Everest Forms Plugin up to 3.6.2 on WordPress. This vulnerability affects the function remove_csv_file_after_email_send of the component Save-and-Continue Addon. The manipulati
CVE-2026-100386 | mefic Ultra Addons for Contact Form 7 Plugin up to 3.5.54 on WordPress uacf7_wpcf7_mail_components path traversal (EUVD-2026-120825)
A vulnerability categorized as problematic has been discovered in mefic Ultra Addons for Contact Form 7 Plugin up to 3.5.54 on WordPress. Affected by this issue is the function uacf7_wpcf7_mail_components. Executing a manipulation can lead
CVE-2026-93427 | ARMember Premium Plugin up to 7.8.1 on WordPress Registration Custom Field cross site scripting (EUVD-2026-120826)
A vulnerability was found in ARMember Premium Plugin up to 7.8.1 on WordPress. It has been rated as problematic. Affected by this vulnerability is an unknown functionality of the component Registration Custom Field. Performing a manipulatio
CVE-2026-84938 | mefusion Avada Builder Plugin up to 3.16.1 on WordPress Media Upload cross site scripting (EUVD-2026-120827)
A vulnerability identified as problematic has been detected in mefusion Avada Builder Plugin up to 3.16.1 on WordPress. This affects an unknown part of the component Media Upload. The manipulation leads to cross site scripting. This vulnera
CVE-2026-61949 | Bookly Plugin up to 27.7 on WordPress sql injection (EUVD-2026-48207)
A vulnerability was found in Bookly Plugin up to 27.7 on WordPress. It has been declared as critical. Impacted is an unknown function. Such manipulation leads to sql injection. This vulnerability is referenced as CVE-2026-61949. It is possi
CVE-2022-4201 | GitLab Community Edition/Enterprise Edition server-side request forgery (Issue 30376 / EUVD-2022-51562)
A vulnerability was found in GitLab Community Edition and Enterprise Edition. It has been declared as critical. This affects an unknown part. Executing a manipulation can lead to server-side request forgery. The identification of this vulne
CVE-2022-4195 | Google Chrome up to 107.0.5304.121 Safe Browsing privilege escalation (EUVD-2022-51556)
A vulnerability categorized as problematic has been discovered in Google Chrome. Affected by this vulnerability is an unknown functionality of the component Safe Browsing. Such manipulation leads to privilege escalation. This vulnerability
CVE-2022-4194 | Google Chrome up to 107.0.5304.121 Accessibility use after free (EUVD-2022-51555)
A vulnerability was found in Google Chrome. It has been rated as problematic. Affected is an unknown function of the component Accessibility. This manipulation causes use after free. This vulnerability appears as CVE-2022-4194. The attacker
CVE-2022-4193 | Google Chrome up to 107.0.5304.121 File System API privilege escalation (EUVD-2022-51554)
A vulnerability was found in Google Chrome. It has been declared as problematic. This impacts an unknown function of the component File System API. The manipulation results in privilege escalation. This vulnerability is reported as CVE-2022
CVE-2022-4192 | Google Chrome up to 107.0.5304.121 Live Caption use after free (EUVD-2022-51553)
A vulnerability was found in Google Chrome. It has been classified as problematic. This affects an unknown function of the component Live Caption. The manipulation leads to use after free. This vulnerability is documented as CVE-2022-4192.
Notfall-Update stopft 0-Day-Lücke in Chrome
In den neuen Chrome-Versionen 157.0.8103.50/51 für Windows und macOS sowie 157.0.8103.50 für Linux haben die Entwickler als hohes Risiko eingestufte Schwachstellen behoben. Laut Google wird eine der gestopften Lücken bereits für Angriffe au
CVE-2026-77026 | tassos.gr Convert Forms Extension up to 5.2.4 Submissions View access control (EUVD-2026-63242)
A vulnerability identified as problematic has been detected in tassos.gr Convert Forms Extension up to 5.2.4. Affected by this issue is some unknown functionality of the component Submissions View. The manipulation leads to improper access
CVE-2026-71694 | Berkeley BOOM 1.2 MRET SmallBoomTile_v1.2_state.v code injection (EUVD-2026-62483)
A vulnerability was found in Berkeley BOOM 1.2. It has been rated as critical. This affects an unknown function of the file Benchmarks/Verilog/SmallBoomTile_v1.2_state.v of the component MRET Handler. The manipulation leads to code injectio
CVE-2026-51366 | Bottinelli Informatica Vedo Suite 1.2.5 Chat Endpoint utente_chat sql injection (EUVD-2026-62481)
A vulnerability, which was classified as critical, has been found in Bottinelli Informatica Vedo Suite 1.2.5. Affected is an unknown function of the component Chat Endpoint. Performing a manipulation of the argument utente_chat results in s
CVE-2026-50720 | Ingenic T31 Boot ROM comparison
A vulnerability has been found in Ingenic T31 and classified as very critical. Affected by this issue is some unknown functionality of the component Boot ROM. The manipulation leads to incorrect comparison. This vulnerability is listed as C
CVE-2026-50719 | Ingenic T41/T32/T40/A1 SoC Boot ROM Init Table Parser signature verification
A vulnerability classified as very critical was found in Ingenic T41, T32, T40 and A1 SoC Boot ROM. This impacts an unknown function of the component Init Table Parser. Such manipulation leads to improper verification of cryptographic signa
CVE-2026-44768 | SAP CRM WebClient UI 105/106/S4FND 104 cross-domain policy (WID-SEC-2026-2308)
A vulnerability was found in SAP CRM WebClient UI 105/106/S4FND 104 and classified as problematic. This issue affects some unknown processing. The manipulation results in permissive cross-domain policy with untrusted domains. This vulnerabi
CVE-2026-11918 | IBM ContextForge MCP Gateway up to 1.0.4 privileges management (EUVD-2026-78898)
A vulnerability was found in IBM ContextForge MCP Gateway up to 1.0.4. It has been classified as critical. Impacted is an unknown function. Performing a manipulation results in improper privilege management. This vulnerability is cataloged
CVE-2024-7953 | Rockwell Automation DataEdgePlatform DataMosaix Private Cloud up to 7.07 privileges management
A vulnerability was found in Rockwell Automation DataEdgePlatform DataMosaix Private Cloud up to 7.07. It has been rated as very critical. The impacted element is an unknown function. This manipulation causes improper privilege management.
CVE-2026-18836 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinations and return the response to the attacker.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended des
CVE-2026-18689 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accepted where it should not be, which could reveal the names of other organizations.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accep
CVE-2026-17428 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization decisions without sufficient verification, which could allow access to information belonging to others.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization
CVE-2026-17411 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized before it is used in database queries.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized befo
CVE-2026-17410 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.
CVE-2026-17409 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of a request, which could allow restricted operations to be reached.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access c
CVE-2026-17408 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.
CVE-2026-17407 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before being used in a database query, which could allow SQL commands to run.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before
CVE-2026-17406 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Address checks can be bypassed, which could allow the server to reach destinations that should be blocked.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Address checks can be bypassed, which could allow the s
CVE-2026-17405 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm that the requesting user is permitted to read them, which could expose keystore information.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm
CVE-2026-17404 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17403 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.
CVE-2026-17402 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is passed to the operating system, which could allow commands to run on the underlying host.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is pas
CVE-2026-17401 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.
CVE-2026-17400 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
CVE-2026-17399 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to insufficient validation of uploaded content. Content uploaded to the product is not sufficiently checked before it is processed, which could allow code to run on the server.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to insufficient validation of uploaded content. Content uploaded to the product is not suffic
CVE-2026-17398 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.