Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil | Δ 7 T |
|---|---|---|---|
| ≥90 % | 786 | 0,2 % | 0 |
| ≥50 % | 3.561 | 0,9 % | -9 |
| ≥10 % | 13.157 | 3,2 % | -9.903 |
| <10 % | 396.051 | 95,8 % | +15.356 |
🗂️ …
CVE-2026-119618 | Apache HTTP Server mod_http2 assign_headers heap-based overflow (Nessus ID 379104)
A vulnerability described as very critical has been identified in Apache HTTP Server. This impacts the function assign_headers of the component mod_http2. Such manipulation leads to heap-based buffer overflow. This vulnerability is listed a
CVE-2026-106023 | Apache HTTP Server mod_md null pointer dereference (Nessus ID 379101)
A vulnerability classified as problematic has been found in Apache HTTP Server. Affected is an unknown function of the component mod_md. Performing a manipulation results in null pointer dereference. This vulnerability is cataloged as CVE-2
CVE-2026-56712 | Replicate cog up to 0.23.1 server-side request forgery (Nessus ID 379105)
A vulnerability identified as critical has been detected in Replicate cog up to 0.23.1. Affected by this issue is some unknown functionality. The manipulation leads to server-side request forgery. This vulnerability is traded as CVE-2026-56
CVE-2026-5393 | wolfSSL up to 5.9.0 out-of-bounds (Nessus ID 305879)
A vulnerability classified as problematic has been found in wolfSSL up to 5.9.0. Affected by this issue is some unknown functionality. Performing a manipulation results in out-of-bounds read. This vulnerability is known as CVE-2026-5393. Re
CVE-2026-35640 | OpenClaw up to 2026.3.24 JSON Parser incorrect behavior order (GHSA-3h52-cx59-c456)
A vulnerability classified as problematic has been found in OpenClaw up to 2026.3.24. This vulnerability affects unknown code of the component JSON Parser. Performing a manipulation results in incorrect behavior order. This vulnerability wa
CVE-2026-35629 | OpenClaw up to 2026.3.24 Destination fetch server-side request forgery (GHSA-rhfg-j8jq-7v2h)
A vulnerability described as critical has been identified in OpenClaw up to 2026.3.24. This vulnerability affects the function fetch of the component Destination Handler. Executing a manipulation can lead to server-side request forgery. Thi
Palo Alto PAN-OS RCE Flaw Allows Attackers to Execute Arbitrary Code With Root Privileges
Palo Alto Networks has disclosed a remote code execution vulnerability in PAN-OS software running on Panorama. Tracked as CVE-2026-0330, the flaw allows an authenticated administrator with network access to execute arbitrary code with root
CVE-2026-35526 | strawberry-graphql strawberry up to 0.312.2 Subscribe Message allocation of resources
A vulnerability categorized as problematic has been discovered in strawberry-graphql strawberry up to 0.312.2. This impacts an unknown function of the component Subscribe Message Handler. Executing a manipulation can lead to allocation of r
CVE-2026-35405 | libp2p rust-libp2p up to 0.17.0 libp2p-rendezvous Server allocation of resources (GHSA-cqfx-gf56-8x59)
A vulnerability identified as problematic has been detected in libp2p rust-libp2p up to 0.17.0. This issue affects some unknown processing of the component libp2p-rendezvous Server. This manipulation causes allocation of resources. This vul
CVE-2026-31350 | Feehi CMS 2.1.1 Page Sign cross site scripting (ID 82)
A vulnerability described as problematic has been identified in Feehi CMS 2.1.1. Affected by this issue is some unknown functionality. Such manipulation of the argument Page Sign leads to cross site scripting. This vulnerability is listed a
CVE-2026-31150 | Kaleris YMS 7.2.2.1 access control
A vulnerability categorized as critical has been discovered in Kaleris YMS 7.2.2.1. Impacted is an unknown function. Such manipulation leads to improper access controls. This vulnerability is referenced as CVE-2026-31150. It is possible to
CVE-2026-30460 | Daylight Studio FuelCMS 1.5.2 Blocks Remote Code Execution
A vulnerability has been found in Daylight Studio FuelCMS 1.5.2 and classified as critical. The impacted element is an unknown function of the component Blocks Module. This manipulation causes Remote Code Execution. This vulnerability appea
CVE-2026-30079 | OpenAirInterface 2.2.0 AMF Sequence Message improper authentication (Issue 77)
A vulnerability identified as critical has been detected in OpenAirInterface 2.2.0. The impacted element is an unknown function of the component AMF Sequence Message Handler. Performing a manipulation results in improper authentication. Thi
CVE-2026-1900 | Spencer Haws Link Whisper Free Plugin up to 0.9.0 on WordPress REST Endpoint authorization
A vulnerability was found in Spencer Haws Link Whisper Free Plugin up to 0.9.0 on WordPress. It has been rated as critical. Affected by this issue is some unknown functionality of the component REST Endpoint. Performing a manipulation resul
CVE-2025-47541 | Email Marketing, Email Automation, Newsletter & Cart Abandonment and WooCommerce Plugin information disclosure
A vulnerability was found in Email Marketing, Email Automation, Newsletter &amp; Cart Abandonment and WooCommerce Plugin up to 1.17.7 on WordPress. It has been declared as problematic. Impacted is an unknown function. The manipulation r
CVE-2026-34447 | onnx up to 1.20.x symlink (GHSA-p433-9wv8-28xj)
A vulnerability labeled as critical has been found in onnx up to 1.20.x. This vulnerability affects unknown code. Executing a manipulation can lead to symlink following. This vulnerability is tracked as CVE-2026-34447. The attack is restric
CVE-2026-4748 | FreeBSD up to p0.x/p4/p9 Hash Calculation incorrect operator
A vulnerability was found in FreeBSD up to p0.x/p4/p9. It has been classified as critical. This issue affects some unknown processing of the component Hash Calculation Handler. The manipulation leads to use of incorrect operator. This vulne
CVE-2026-32241 | flannel-io flannel up to 0.28.1 command injection (GHSA-vchx-5pr6-ffx2)
A vulnerability labeled as critical has been found in flannel-io flannel up to 0.28.1. Affected by this issue is some unknown functionality. Such manipulation leads to command injection. This vulnerability is traded as CVE-2026-32241. The a
CVE-2026-30568 | SourceCodester Inventory System 1.0 Parameter view_purchase.php limit cross site scripting
A vulnerability classified as problematic was found in SourceCodester Inventory System 1.0. Affected is an unknown function of the file view_purchase.php of the component Parameter Handler. Such manipulation of the argument limit leads to c
CVE-2026-30567 | SourceCodester Inventory System 1.0 Parameter view_product.php limit cross site scripting
A vulnerability, which was classified as problematic, was found in SourceCodester Inventory System 1.0. Affected by this issue is some unknown functionality of the file view_product.php of the component Parameter Handler. Executing a manipu
CVE-2026-30289 | Tinybeans Private Family Album App 5.9.5-prod file inclusion (ID 17)
A vulnerability classified as problematic has been found in Tinybeans Private Family Album App 5.9.5-prod. This affects an unknown part. Performing a manipulation results in file inclusion. This vulnerability is known as CVE-2026-30289. Att
CVE-2026-30287 | Deep Thought Industries ACE Scanner PDF Scanner App 1.4.5 on Android File Import file inclusion (ID 16)
A vulnerability labeled as problematic has been found in Deep Thought Industries ACE Scanner PDF Scanner App 1.4.5 on Android. Affected is an unknown function of the component File Import. The manipulation results in file inclusion. This vu
CVE-2026-96442 | Red Hat Emacs up to 31.1 Flymake mode code injection (EUVD-2026-85187 / Nessus ID 349335)
A vulnerability, which was classified as problematic, has been found in Red Hat Emacs up to 31.1. Affected is an unknown function of the component Flymake mode. This manipulation causes code injection. This vulnerability appears as CVE-2026
CVE-2026-119528 | GIMP PSD plug-in stack-based overflow (EUVD-2026-113948)
A vulnerability was found in GIMP. It has been declared as problematic. The impacted element is an unknown function of the component PSD plug-in. Executing a manipulation can lead to stack-based buffer overflow. This vulnerability is handle
CVE-2026-108094 | Red Hat Enterprise Linux 10 Mutter use after free (EUVD-2026-97472)
A vulnerability, which was classified as problematic, was found in Red Hat Enterprise Linux 7, Enterprise Linux 8, Enterprise Linux 9 and Enterprise Linux 10. This impacts an unknown function of the component Mutter. The manipulation result
CVE-2026-125704 | Red Hat Enterprise Linux GStreamer use after free (EUVD-2026-120866)
A vulnerability marked as critical has been reported in Red Hat Enterprise Linux. Affected is an unknown function of the component GStreamer. The manipulation leads to use after free. This vulnerability is traded as CVE-2026-125704. It is p
CVE-2026-125712 | Red Hat Enterprise Linux RTCP SDES Packet Parser out-of-bounds (EUVD-2026-120881)
A vulnerability was found in Red Hat Enterprise Linux. It has been declared as critical. This affects an unknown function of the component RTCP SDES Packet Parser. Such manipulation leads to out-of-bounds read. This vulnerability is listed
Kritischer CI/CD-Fehler gefährdet selbstverwaltete GitLab-Instanzen
Eine speziell präparierte reguläre Expression in einer CI/CD-Konfiguration kann Angreifern Code-Ausführung auf GitLab-Servern ermöglichen. Die CISA führt die Sicherheitslücke als ausgenutzt, GitLab hat Sicherheitsupdates veröffentlicht. (Bi
CVE-2026-30576 | SourceCodester Pharmacy Product Management System 1.0 add-stock.php txtprice/txttotalcost logic error
A vulnerability identified as problematic has been detected in SourceCodester Pharmacy Product Management System 1.0. This affects an unknown part of the file add-stock.php. This manipulation of the argument txtprice/txttotalcost causes bus
CVE-2026-30575 | SourceCodester Pharmacy Product Management System 1.0 add-stock.php txtqty logic error
A vulnerability has been found in SourceCodester Pharmacy Product Management System 1.0 and classified as problematic. Affected is an unknown function of the file add-stock.php. Performing a manipulation of the argument txtqty results in bu
CVE-2026-30574 | SourceCodester Pharmacy Product Management System 1.0 add-sales.php txtqty behavioral workflow
A vulnerability, which was classified as problematic, was found in SourceCodester Pharmacy Product Management System 1.0. This impacts an unknown function of the file add-sales.php. Such manipulation of the argument txtqty leads to enforcem
CVE-2026-30571 | SourceCodester Inventory System 1.0 Parameter view_category.php limit cross site scripting
A vulnerability marked as problematic has been reported in SourceCodester Inventory System 1.0. The impacted element is an unknown function of the file view_category.php of the component Parameter Handler. The manipulation of the argument l
CVE-2026-30570 | SourceCodester Inventory System 1.0 Parameter view_sales.php limit cross site scripting
A vulnerability labeled as problematic has been found in SourceCodester Inventory System 1.0. The affected element is an unknown function of the file view_sales.php of the component Parameter Handler. Executing a manipulation of the argumen
CVE-2026-30569 | SourceCodester Inventory System 1.0 Parameter view_stock_availability.php limit cross site scripting
A vulnerability identified as problematic has been detected in SourceCodester Inventory System 1.0. Impacted is an unknown function of the file view_stock_availability.php of the component Parameter Handler. Performing a manipulation of the
CVE-2026-30534 | SourceCodester Food Ordering System 1.0 Parameter manage_category.php id sql injection
A vulnerability categorized as critical has been discovered in SourceCodester Food Ordering System 1.0. The affected element is an unknown function of the file admin/manage_category.php of the component Parameter Handler. Such manipulation
CVE-2026-30532 | SourceCodester Online Food Ordering System 1.0 Parameter admin/view_product.php id sql injection
A vulnerability was found in SourceCodester Online Food Ordering System 1.0. It has been declared as critical. This issue affects some unknown processing of the file admin/view_product.php of the component Parameter Handler. The manipulatio
CVE-2026-30531 | SourceCodester Online Food Ordering System 1.0 Parameter Actions.php save_category name sql injection
A vulnerability classified as critical was found in SourceCodester Online Food Ordering System 1.0. Affected by this issue is the function save_category of the file Actions.php of the component Parameter Handler. Such manipulation of the ar
CVE-2026-30530 | SourceCodester Online Food Ordering System 1.0 Parameter Actions.php save_customer username sql injection (EUVD-2026-16676)
A vulnerability categorized as critical has been discovered in SourceCodester Online Food Ordering System 1.0. This impacts the function save_customer of the file Actions.php of the component Parameter Handler. Executing a manipulation of t
CVE-2026-30529 | SourceCodester Food Ordering System 1.0 Parameter Actions.php username sql injection (EUVD-2026-16674)
A vulnerability was found in SourceCodester Food Ordering System 1.0. It has been declared as critical. The impacted element is an unknown function of the file Actions.php of the component Parameter Handler. Such manipulation of the argumen
CVE-2026-30302 | CodeRider-Kilo Parser os command injection
A vulnerability, which was classified as critical, was found in CodeRider-Kilo. This vulnerability affects unknown code of the component Parser. Executing a manipulation can lead to os command injection. This vulnerability is registered as
CVE-2026-30304 | AI Code Terminal Command injection
A vulnerability was found in AI Code. It has been classified as critical. This affects an unknown function of the component Terminal Command Handler. This manipulation causes injection. This vulnerability is handled as CVE-2026-30304. The a
CVE-2026-30303 | MatterAI Axon Code Parser os command injection
A vulnerability, which was classified as critical, was found in MatterAI. Impacted is an unknown function of the component Axon Code Parser. Executing a manipulation can lead to os command injection. This vulnerability appears as CVE-2026-3
CVE-2026-29871 | awesome-llm-apps e46690f99c3f08be80a9877fab52acacf7ab8251 FastAPI Backend podcast_router.py stream_audio path path traversal
A vulnerability was found in awesome-llm-apps e46690f99c3f08be80a9877fab52acacf7ab8251. It has been classified as critical. This vulnerability affects the function stream_audio of the file routers/podcast_router.py of the component FastAPI
CVE-2025-15400 | Pix Para Woocommerce Plugin up to 2.13.3 on WordPress Payment Gateway Configuration authorization (CNNVD-202602-2039)
A vulnerability categorized as problematic has been discovered in Pix Para Woocommerce Plugin up to 2.13.3 on WordPress. Affected by this vulnerability is an unknown functionality of the component Payment Gateway Configuration Handler. The
New Windows SignDrop Zero-Day Flaw Lets Attackers Gain SYSTEM Privileges and Disable Antivirus
A public proof-of-concept exploit named SignDrop targets the Common Log File System (CLFS) authentication mitigation in Windows. It converts a standard user token into NT AUTHORITY\SYSTEM and can blind antimalware engines. The privilege esc
CVE-2025-71085 | Linux Kernel up to 6.19-rc3 ipv6 net/core/skbuff.c pskb_expand_head infinite loop (Nessus ID 298928 / WID-SEC-2026-0086)
A vulnerability was found in Linux Kernel up to 6.1.159/6.6.119/6.12.63/6.18.3/6.19-rc3. It has been declared as critical. This issue affects the function pskb_expand_head of the file net/core/skbuff.c of the component ipv6. Executing a man
CVE-2025-68764 | Linux Kernel up to 6.12.62/6.17.12/6.18.1 NFS authorization (EUVD-2026-0888 / Nessus ID 281755)
A vulnerability, which was classified as critical, was found in Linux Kernel up to 6.12.62/6.17.12/6.18.1. This issue affects some unknown processing of the component NFS. Such manipulation leads to missing authorization. This vulnerability
CVE-2026-18836 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinations and return the response to the attacker.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended des
CVE-2026-18689 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accepted where it should not be, which could reveal the names of other organizations.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accep
CVE-2026-17428 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization decisions without sufficient verification, which could allow access to information belonging to others.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization
CVE-2026-17411 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized before it is used in database queries.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized befo
CVE-2026-17410 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.
CVE-2026-17409 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of a request, which could allow restricted operations to be reached.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access c
CVE-2026-17408 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.
CVE-2026-17407 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before being used in a database query, which could allow SQL commands to run.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before
CVE-2026-17406 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Address checks can be bypassed, which could allow the server to reach destinations that should be blocked.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Address checks can be bypassed, which could allow the s
CVE-2026-17405 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm that the requesting user is permitted to read them, which could expose keystore information.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm
CVE-2026-17404 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17403 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.
CVE-2026-17402 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is passed to the operating system, which could allow commands to run on the underlying host.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is pas