CVE-2026-118947: Schwachstellen-Eintrag (NVD)
A flaw was found in the UMA resource registration endpoint of the keycloak-services component, which provides the core logic for Keycloak's authorization and identity services. The issue occurs when remote resource management is enabled, allowing an authenticated user with specific permissions to update resources they do not own by providing a target resource ID in a request. This can lead to unauthorized modification of resource configurations, such as names, URIs, and scopes.
Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 761 | 0,2 % |
| ≥50 % | 3.394 | 0,9 % |
| ≥10 % | 22.586 | 5,7 % |
| <10 % | 366.552 | 93,2 % |
Angreifer nutzen Linux-Schwachstelle zur Rechteausweitung
Eine Sicherheitslücke im Linux-Kernel kann dazu führen, dass zwischengespeicherte Dateiinhalte überschrieben werden. Die CISA führt sie als nachweislich ausgenutzt. Korrekturen stehen für mehrere Kernel-Zweige bereit. (© cendhika - stock.a
Critical Barracuda Security Flaws Allow Attackers to Bypass Authorization and Gain Root Access
Barracuda has patched a pre-authentication authorization bypass, tracked as CVE-2026-116606, and an OS command injection flaw, tracked as CVE-2026-111560. Together, they let an attacker bypass authorization controls and gain root access on
CVE-2022-48547 | Cacti up to 0.8.7g auth_changepassword.php auth_changepassword ref cross site scripting (Issue 1882 / EUVD-2022-51243)
A vulnerability was found in Cacti up to 0.8.7g. It has been declared as problematic. This issue affects the function auth_changepassword of the file auth_changepassword.php. Executing a manipulation of the argument ref can lead to cross si
CVE-2022-48545 | Xpdf 4.02 Catalog::findDestInTree recursion (EUVD-2022-51241)
A vulnerability was found in Xpdf 4.02 and classified as problematic. This affects the function Catalog::findDestInTree. Executing a manipulation can lead to uncontrolled recursion. This vulnerability is registered as CVE-2022-48545. It is
CVE-2022-48538 | Cacti 1.2.19 Web Login cacti_ldap_auth improper authentication (Issue 5189 / EUVD-2022-51234)
A vulnerability, which was classified as critical, has been found in Cacti 1.2.19. This affects the function cacti_ldap_auth of the component Web Login. This manipulation causes improper authentication. The identification of this vulnerabil
CVE-2022-48521 | OpenDKIM up to 2.10.3/2.11.0-Beta2 Fake Authentication Result privilege escalation (Issue 148 / EUVD-2022-51217)
A vulnerability classified as critical has been found in OpenDKIM up to 2.10.3/2.11.0-Beta2. This issue affects some unknown processing of the component Fake Authentication Result Handler. This manipulation causes privilege escalation. This
CVE-2026-33699 | py-pdf pypdf up to 6.9.1 infinite loop (GHSA-87mj-5ggw-8qc3)
A vulnerability was found in py-pdf pypdf up to 6.9.1 and classified as problematic. This affects an unknown part. The manipulation results in infinite loop. This vulnerability is cataloged as CVE-2026-33699. The attack may be launched remo
CVE-2026-27612 | denpiligrim repostat up to 1.0.0 RepoCard cross site scripting (GHSA-fm8c-6m29-rp6j)
A vulnerability was found in denpiligrim repostat up to 1.0.0. It has been declared as problematic. The affected element is an unknown function of the component RepoCard. Such manipulation leads to cross site scripting. This vulnerability i
CVE-2026-25929 | OpenEMR up to 7.x patient_picture authorization (GHSA-778w-r8rm-8qhq)
A vulnerability categorized as problematic has been discovered in OpenEMR up to 7.x. Affected is the function patient_picture. Such manipulation leads to authorization bypass. This vulnerability is uniquely identified as CVE-2026-25929. The
Critical SolarWinds Dameware Flaw Allows Attackers to Execute Commands on Remote Systems
SolarWinds has released Dameware 2026.3.1 to address CVE-2026-28336, a critical command injection flaw that could compromise remotely controlled hosts. The issue carries a severity score of 9.9 and requires authentication, distinguishing it
CVE-2026-99244 | Linux Kernel up to 7.3.0 pid_namespace zap_pid_ns_processes race condition (Nessus ID 375592)
A vulnerability marked as critical has been reported in Linux Kernel up to 7.3.0. Affected is the function zap_pid_ns_processes of the component pid_namespace. This manipulation causes race condition. This vulnerability is handled as CVE-20
CVE-2026-121397 | FreeRDP up to 3.32.1 Clipboard save_png_to_buffer heap-based overflow (Nessus ID 375593)
A vulnerability identified as problematic has been detected in FreeRDP up to 3.32.1. The impacted element is the function save_png_to_buffer of the component Clipboard. This manipulation causes heap-based buffer overflow. This vulnerability
CVE-2026-121405 | FreeRDP up to 3.32.1 Serial Redirection memory allocation (Nessus ID 375594)
A vulnerability classified as problematic has been found in FreeRDP up to 3.32.1. This affects an unknown function of the component Serial Redirection. Performing a manipulation results in uncontrolled memory allocation. This vulnerability
CVE-2026-99260 | Linux Kernel up to 7.2.12 ntfs ntfs_new_attr_flags behavioral workflow (Nessus ID 375596)
A vulnerability was found in Linux Kernel up to 7.2.12. It has been rated as very critical. This impacts the function ntfs_new_attr_flags of the component ntfs. The manipulation leads to enforcement of behavioral workflow. This vulnerabilit
CVE-2026-99255 | Linux Kernel up to 7.2.13 io-wq io_uring_cancel_generic cur_work race condition (Nessus ID 375597)
A vulnerability labeled as problematic has been found in Linux Kernel up to 6.1.190/6.6.160/6.12.114/6.18.59/7.2.13. This impacts the function io_uring_cancel_generic of the component io-wq. The manipulation of the argument cur_work results
CVE-2025-68675 | Apache Airflow up to 3.1.5 Task Log log file (Nessus ID 299663)
A vulnerability, which was classified as problematic, was found in Apache Airflow up to 3.1.5. Affected is an unknown function of the component Task Log Handler. Executing a manipulation can lead to sensitive information in log files. This
CVE-2025-63387 | Dify 1.9.1 Endpoint system-features improper authentication (EUVD-2025-204368)
A vulnerability, which was classified as critical, was found in Dify 1.9.1. This affects an unknown function of the file /console/api/system-features of the component Endpoint. Executing a manipulation can lead to improper authentication. T
CVE-2026-121386 | FreeRDP up to 3.32.1 WinPR denial of service (Nessus ID 375599)
A vulnerability labeled as problematic has been found in FreeRDP up to 3.32.1. This affects the function winpr_read_png_from_buffer/winpr_convert_from_jpeg of the component WinPR. Executing a manipulation can lead to denial of service. This
CVE-2026-121412 | FreeRDP up to 3.32.1 Proxy resource consumption (Nessus ID 375601)
A vulnerability was found in FreeRDP up to 3.32.1. It has been rated as problematic. Impacted is an unknown function of the component Proxy. The manipulation leads to resource consumption. This vulnerability is referenced as CVE-2026-121412
CVE-2026-99257 | Linux Kernel up to 7.2.12 Gpio Shared null pointer dereference (Nessus ID 375602)
A vulnerability, which was classified as critical, was found in Linux Kernel up to 7.2.12. This issue affects some unknown processing of the component Gpio Shared. The manipulation results in null pointer dereference. This vulnerability is
CVE-2026-99267 | Linux Kernel up to 6.18.59/7.2.13 zcrx io_uring io_zcrx_queue_cqe buffer overflow (Nessus ID 375603)
A vulnerability has been found in Linux Kernel up to 6.18.59/7.2.13 and classified as critical. This affects the function io_zcrx_queue_cqe of the file io_uring of the component zcrx. Performing a manipulation results in buffer overflow. Th
CVE-2026-120452 | gPhoto libgphoto2 up to 2.5.34 jl2005bcd_decompress out-of-bounds (Nessus ID 375604)
A vulnerability was found in gPhoto libgphoto2 up to 2.5.34 and classified as problematic. This affects the function jl2005bcd_decompress. Such manipulation leads to out-of-bounds read. This vulnerability is referenced as CVE-2026-120452. T
CVE-2026-121424 | Nodemailer up to 10.1.3 addressparser redirect (Nessus ID 375606)
A vulnerability categorized as problematic has been discovered in Nodemailer up to 10.1.3. The affected element is the function addressparser. The manipulation results in open redirect. This vulnerability is identified as CVE-2026-121424. T
CVE-2026-121259 | Red Hat Enterprise Linux gst-plugins-bad integer overflow (Nessus ID 375605)
A vulnerability categorized as critical has been discovered in Red Hat Enterprise Linux. This vulnerability affects unknown code of the component gst-plugins-bad. Such manipulation leads to integer overflow. This vulnerability is documented
CVE-2026-121441 | bytecodealliance wasmtime up to 36.0.18/48.0.6/49.0.3 wasi-http request smuggling (Nessus ID 375607)
A vulnerability, which was classified as problematic, was found in bytecodealliance wasmtime up to 36.0.18/48.0.6/49.0.3. This impacts an unknown function of the component wasi-http. The manipulation results in http request smuggling. This
Chrome 9.6 CVE — What “No Login Needed” Actually Means (And What It Doesn’t)
Your scanner dashboard is going to show CVE-2026-121114 at the top this week. CVSS 9.6. Chrome. TabStrip use-after-free. Remote code execution outside the sandbox. Here’s what the score doesn’t tell you. The vector: AV:N/AC:L/PR:N/UI:R/S:C/
CVE-2022-48506 | Dominion Voting Systems ImageCast Precinct/ImageCast Evolution Public Ballot-level Data DVSorder entropy (EUVD-2022-51202)
A vulnerability marked as critical has been reported in Dominion Voting Systems ImageCast Precinct and ImageCast Evolution. This vulnerability affects unknown code of the component Public Ballot-level Data Handler. This manipulation causes
CVE-2022-48501 | Huawei EMUI/Magic UI Configuration denial of service (EUVD-2022-51197)
A vulnerability labeled as problematic has been found in Huawei EMUI and Magic UI. This affects an unknown function of the component Configuration Handler. Executing a manipulation can lead to denial of service. This vulnerability is handle
CVE-2022-48500 | Huawei EMUI/Magic UI Configuration denial of service (EUVD-2022-51196)
A vulnerability identified as problematic has been detected in Huawei EMUI and Magic UI. The impacted element is an unknown function of the component Configuration Handler. Performing a manipulation results in denial of service. This vulner
CVE-2022-48499 | Huawei EMUI/Magic UI Configuration denial of service (EUVD-2022-51195)
A vulnerability categorized as problematic has been discovered in Huawei EMUI and Magic UI. The affected element is an unknown function of the component Configuration Handler. Such manipulation leads to denial of service. This vulnerability
CVE-2022-48498 | Huawei EMUI/Magic UI Configuration denial of service (EUVD-2022-51194)
A vulnerability was found in Huawei EMUI and Magic UI. It has been rated as problematic. Impacted is an unknown function of the component Configuration Handler. This manipulation causes denial of service. This vulnerability appears as CVE-2
CVE-2025-62402 | Apache Airflow up to 3.1.0 API /api/v2/dagReports code injection (EUVD-2025-36994)
A vulnerability, which was classified as critical, has been found in Apache Airflow up to 3.1.0. This affects an unknown part of the file /api/v2/dagReports of the component API. This manipulation causes code injection. This vulnerability i
CVE-2025-54941 | Apache Airflow up to 3.0.4 example_dag_decorator command injection (EUVD-2025-36993)
A vulnerability described as critical has been identified in Apache Airflow up to 3.0.4. This impacts the function example_dag_decorator. Such manipulation leads to command injection. This vulnerability is uniquely identified as CVE-2025-54
CVE-2025-48734 | Apache Commons BeanUtils up to 1.10.x/2.0.0-/1 org.apache.commons getProperty access control (EUVD-2025-16219 / Nessus ID 237781)
A vulnerability has been found in Apache Commons BeanUtils up to 1.10.x/2.0.0-/1 and classified as critical. This affects the function getProperty of the component org.apache.commons. The manipulation leads to improper access controls. This
CVE-2025-22442 | Google Android 13/14/15 DevicePolicyManagerService.java race condition (EUVD-2025-26596)
A vulnerability marked as problematic has been reported in Google Android 13/14/15. The impacted element is an unknown function of the file DevicePolicyManagerService.java. Performing a manipulation results in race condition. This vulnerabi
CVE-2024-54465 | Apple macOS up to 15.1 state issue (WID-SEC-2024-3692)
A vulnerability classified as problematic was found in Apple macOS up to 15.1. This affects an unknown function. The manipulation results in state issue. This vulnerability is known as CVE-2024-54465. Attacking locally is a requirement. No
CVE-2024-50379 | Apache Tomcat up to 9.0.97/10.1.33/11.0.1 JSP Compilation toctou (Nessus ID 213078 / WID-SEC-2024-3722)
A vulnerability labeled as problematic has been found in Apache Tomcat up to 9.0.97/10.1.33/11.0.1. This issue affects some unknown processing of the component JSP Compilation. The manipulation results in time-of-check time-of-use. This vul
CVE-2024-12108 | Progress WhatsUp Gold up to 2024.0.1 Public API authentication spoofing (Nessus ID 214320)
A vulnerability classified as critical has been found in Progress WhatsUp Gold up to 2024.0.1. This affects an unknown function of the component Public API. Performing a manipulation results in authentication bypass by spoofing. This vulner
CVE-2024-55580 | Qlik Sense Enterprise on Windows code injection (EUVD-2024-52817)
A vulnerability classified as critical was found in Qlik Sense Enterprise on Windows. This issue affects some unknown processing. The manipulation results in code injection. This vulnerability is known as CVE-2024-55580. It is possible to l
CVE-2024-55579 | Qlik Sense Enterprise on Windows authorization (EUVD-2024-52816)
A vulnerability, which was classified as very critical, has been found in Qlik Sense Enterprise on Windows. Impacted is an unknown function. This manipulation causes incorrect authorization. This vulnerability is handled as CVE-2024-55579.
CVE-2024-53677 | Apache Struts up to 2.3.37/2.5.33/6.3.0.2 File Upload path traversal (Nessus ID 213040 / WID-SEC-2024-3660)
A vulnerability was found in Apache Struts up to 2.3.37/2.5.33/6.3.0.2. It has been rated as critical. Impacted is an unknown function of the component File Upload. This manipulation causes path traversal. This vulnerability is registered a
CVE-2024-52940 | AnyDesk up to 8.1.0 on Windows Allow Direct Connection information disclosure
A vulnerability was found in AnyDesk up to 8.1.0 on Windows and classified as problematic. The impacted element is an unknown function of the component Allow Direct Connection Handler. Such manipulation leads to information disclosure. This
CVE-2024-49112 | Microsoft Windows up to Server 2025 Lightweight Directory Access Protocol integer overflow (Nessus ID 212240)
A vulnerability classified as very critical was found in Microsoft Windows. Affected is an unknown function of the component Lightweight Directory Access Protocol. The manipulation results in integer overflow. This vulnerability is identifi
CVE-2024-45717 | SolarWinds Platform up to 2024.4 Search/Node Information Section cross site scripting (Nessus ID 212063)
A vulnerability labeled as problematic has been found in SolarWinds Platform up to 2024.4. This impacts an unknown function of the component Search/Node Information Section. Such manipulation leads to cross site scripting. This vulnerabilit
CVE-2024-20482 | Cisco Secure Firewall Management Center authorization (cisco-sa-fmc-priv-esc-CMQ4S6m7)
A vulnerability was found in Cisco Secure Firewall Management Center. It has been declared as problematic. This affects an unknown function. Such manipulation leads to incorrect authorization. This vulnerability is referenced as CVE-2024-20
CVE-2026-119146 | ProFTPD Project up to 1.3.9d/1.3.10rc4 mod_rewrite buffer overflow (EUVD-2026-113779)
A vulnerability has been found in ProFTPD Project ProFTPD up to 1.3.9d/1.3.10rc4 and classified as very critical. Impacted is an unknown function of the component mod_rewrite. The manipulation leads to buffer overflow. This vulnerability is
CVE-2026-119376 | SQLite up to 3.53.x Expression Walker sqlite3WalkExprNN stack-based overflow (EUVD-2026-113787)
A vulnerability, which was classified as problematic, has been found in SQLite up to 3.53.x. This vulnerability affects the function sqlite3WalkExprNN of the component Expression Walker. Performing a manipulation results in stack-based buff
CVE-2026-119372 | SQLite up to 3.53.x FTS3 fts3BestSnippet use after free (EUVD-2026-113783)
A vulnerability was found in SQLite up to 3.53.x. It has been rated as problematic. This impacts the function fts3BestSnippet of the component FTS3. Performing a manipulation results in use after free. This vulnerability is cataloged as CVE
CVE-2026-121615 | Linksys E5600 1.1.0.26 Login /cgi-bin/mesh_login.cgi improper authentication (EUVD-2026-116686)
A vulnerability was found in Linksys E5600 1.1.0.26 and classified as very critical. Affected is an unknown function of the file /cgi-bin/mesh_login.cgi of the component Login Handler. Executing a manipulation can lead to improper authentic
CVE-2026-119407 | Element Web/Element Desktop up to 1.12.31 Guest Session loadSession guest_user_id/guest_access_token improper authentication (EUVD-2026-113791)
A vulnerability, which was classified as problematic, has been found in Element Web and Element Desktop up to 1.12.31. This impacts the function loadSession of the component Guest Session Handler. This manipulation of the argument guest_use
CVE-2026-119415 | CakePHP up to 5.4.3 FormDataPart Message::setAttachments Content-Type/Content-ID injection (EUVD-2026-113795)
A vulnerability was found in CakePHP up to 5.4.3. It has been rated as problematic. The affected element is the function Message::setAttachments of the component FormDataPart. This manipulation of the argument Content-Type/Content-ID causes
CVE-2026-76527 | Splunk SOAR up to 8.6.x improper check or handling of exceptional conditions (EUVD-2026-107638)
A vulnerability, which was classified as critical, was found in Splunk SOAR up to 8.6.x. This affects an unknown part. Such manipulation leads to improper check or handling of exceptional conditions. This vulnerability is uniquely identifie
CVE-2026-119127 | Zitadel up to 4.19.4 Login V2 UI injection (EUVD-2026-113194)
A vulnerability classified as critical has been found in Zitadel up to 4.19.4. Affected by this vulnerability is an unknown functionality of the component Login V2 UI. Performing a manipulation of the argument x-zitadel-public-host/x-zitade
CVE-2026-119123 | ImageMagick up to 7.1.2-33 TIFF Decoder stack-based overflow (EUVD-2026-113190)
A vulnerability categorized as problematic has been discovered in ImageMagick. The affected element is an unknown function of the component TIFF Decoder. Executing a manipulation can lead to stack-based buffer overflow. This vulnerability i
CVE-2026-119139 | Bytecode Alliance Wasmtime up to 48.0.5/49.0.2 Func component::Func::call denial of service (EUVD-2026-113206)
A vulnerability categorized as problematic has been discovered in Bytecode Alliance Wasmtime up to 48.0.5/49.0.2. This impacts the function component::Func::call of the component Func. The manipulation results in denial of service. This vul
CVE-2026-119135 | Bytecode Alliance Wasmtime up to 48.0.5/49.0.2 Component Model Read Path assertion (EUVD-2026-113202)
A vulnerability was found in Bytecode Alliance Wasmtime up to 48.0.5/49.0.2 and classified as problematic. Impacted is an unknown function of the component Component Model Read Path. Such manipulation leads to reachable assertion. This vuln
CVE-2026-119131 | Bytecode Alliance Wasmtime up to 48.0.5/49.0.2 wasmtime-wasi-http set-path-with-query denial of service (EUVD-2026-113198)
A vulnerability, which was classified as problematic, has been found in Bytecode Alliance Wasmtime up to 48.0.5/49.0.2. Impacted is the function set-path-with-query of the component wasmtime-wasi-http. This manipulation causes denial of ser
CVE-2026-119143 | Bytecode Alliance Wasmtime up to 48.0.5/49.0.2 Component Model Direct::remaining out-of-bounds (EUVD-2026-113210)
A vulnerability was found in Bytecode Alliance Wasmtime up to 48.0.5/49.0.2. It has been rated as problematic. This affects the function Direct::remaining of the component Component Model. This manipulation causes out-of-bounds read. This v
CVE-2026-121608 | Qihoo 360 D603-2/D600-2/D606-6 up to 6.3.2 Timezone Push /fs2/bin/iscm on_push_message tz os command injection (EUVD-2026-116672)
A vulnerability classified as critical was found in Qihoo 360 D603-2, D600-2 and D606-6 up to 6.3.2. This vulnerability affects the function on_push_message of the file /fs2/bin/iscm of the component Timezone Push Handler. Executing a manip
CVE-2026-62374 | Openwallet Foundation sd-jwt-js up to 0.19.0 Decode SDJwtInstance.verify improper authorization (EUVD-2026-113215)
A vulnerability has been found in Openwallet Foundation sd-jwt-js up to 0.19.0 and classified as critical. Affected is the function SDJwtInstance.verify of the component Decode. The manipulation leads to improper authorization. This vulnera