Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 753 | 0,2 % |
| ≥50 % | 3.316 | 0,9 % |
| ≥10 % | 22.070 | 5,7 % |
| <10 % | 360.967 | 93,2 % |
Zimbra CVE-2026-73570: Patched in July? Check Whether Someone Got In First
Zimbra fixed CVE-2026-73570 in version 10.1.20 on 20 July 2026. The flaw lets anyone who can send mail to a Zimbra server run shell commands on it, with no login and no user action, as long as the optional zimbra-snmp package is installed a
CVE-2026-118070 | Welcart E-Commerce Plugin up to 2.12.5 on WordPress gid cross site scripting (EUVD-2026-114609)
A vulnerability categorized as problematic has been discovered in Welcart E-Commerce Plugin up to 2.12.5 on WordPress. Impacted is an unknown function. Such manipulation of the argument gid leads to cross site scripting. This vulnerability
CVE-2026-116548 | e4jvikwp VikRentCar Car Rental Management System Plugin up to 1.4.10 on WordPress optionals cross site scripting (EUVD-2026-114612)
A vulnerability, which was classified as problematic, has been found in e4jvikwp VikRentCar Car Rental Management System Plugin up to 1.4.10 on WordPress. Affected by this issue is some unknown functionality. Performing a manipulation of th
CVE-2026-119065 | arosoft Shipping Zones by Drawing for WooCommerce Plugin up to 3.3.0 on WordPress Checkout Field szbd_checkout_field_update_order_meta szbd-picked cross site scripting (EUVD-2026-114614)
A vulnerability classified as problematic has been found in arosoft Shipping Zones by Drawing for WooCommerce Plugin up to 3.3.0 on WordPress. The impacted element is the function szbd_checkout_field_update_order_meta of the component Check
CVE-2026-111592 | PublishPress Authors Plugin up to 4.17.0 on WordPress name cross site scripting (EUVD-2026-114646)
A vulnerability, which was classified as problematic, has been found in PublishPress Authors Plugin up to 4.17.0 on WordPress. This issue affects some unknown processing. The manipulation of the argument Name leads to cross site scripting.
CVE-2026-120019 | BoldGrid W3 Total Cache Plugin up to 2.10.7 on WordPress Input Sanitization comment cross site scripting (EUVD-2026-114597)
A vulnerability has been found in BoldGrid W3 Total Cache Plugin up to 2.10.7 on WordPress and classified as problematic. This vulnerability affects unknown code of the component Input Sanitization. The manipulation of the argument Comment
CVE-2026-119089 | ThirstyAffiliates Plugin up to 3.12.1 on WordPress Comment Content comment cross site scripting (EUVD-2026-114598)
A vulnerability, which was classified as problematic, was found in ThirstyAffiliates Plugin up to 3.12.1 on WordPress. This affects an unknown part of the component Comment Content. Executing a manipulation of the argument Comment can lead
CVE-2026-116522 | comesio Relevanssi Plugin up to 4.28.5 on WordPress comment cross site scripting (EUVD-2026-114599)
A vulnerability classified as problematic was found in comesio Relevanssi Plugin up to 4.28.5 on WordPress. Affected by this vulnerability is an unknown functionality. Such manipulation of the argument Comment leads to cross site scripting.
CVE-2026-116546 | WP Job Portal Job Portal Plugin up to 2.7.0 on WordPress degreetitle cross site scripting (EUVD-2026-114600)
A vulnerability was found in WP Job Portal Job Portal Plugin up to 2.7.0 on WordPress. It has been classified as problematic. Impacted is an unknown function. This manipulation of the argument degreetitle causes cross site scripting. This v
CVE-2026-119162 | specialk User Submitted Posts Plugin up to 20260916 on WordPress user-submitted-content cross site scripting (EUVD-2026-114603)
A vulnerability labeled as problematic has been found in specialk User Submitted Posts Plugin up to 20260916 on WordPress. The impacted element is an unknown function. Executing a manipulation of the argument user-submitted-content can lead
CVE-2026-107765 | marketingfire Discussion Board Plugin up to 2.6.0 on WordPress Output Escaping ctdb_filter_comment_author_name user_url cross site scripting (EUVD-2026-114602)
A vulnerability was found in marketingfire Discussion Board Plugin up to 2.6.0 on WordPress. It has been declared as problematic. This vulnerability affects the function ctdb_filter_comment_author_name of the component Output Escaping. The
CVE-2026-88942 | Woobewoo Product Filter for WooCommerce by WBW Plugin up to 3.4.6 on WordPress Setting getVar wpf_fid cross site scripting (EUVD-2026-114606)
A vulnerability described as problematic has been identified in Woobewoo Product Filter for WooCommerce by WBW Plugin up to 3.4.6 on WordPress. This impacts the function getVar of the component Setting Handler. The manipulation of the argum
CVE-2026-120242 | Ruijie RG-ES205GC ESW_1.0(1)B1P48 Cloud Management set_cloud_serverUrl.cgi url cross site scripting (EUVD-2026-114884)
A vulnerability labeled as problematic has been found in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P ESW_1.0(1)B1P48. The affected element is an unknown function of the file set_cloud_serverUrl.cgi of the com
CVE-2026-99094 | Linux Kernel up to 6.12.112/6.18.56/7.2.10 btintel_pcie btintel_pcie_prepare_tx memory corruption
A vulnerability classified as very critical has been found in Linux Kernel up to 6.12.112/6.18.56/7.2.10. Affected by this vulnerability is the function btintel_pcie_prepare_tx of the component btintel_pcie. This manipulation causes memory
CVE-2026-116340 | iFlytek astron-agent up to 1.1.2 Console Knowledge-List Endpoint FileInfoV2Service.java FileInfoV2Service.listKnowledgeByPage space-id authorization
A vulnerability classified as problematic was found in iFlytek astron-agent up to 1.1.2. This impacts the function FileInfoV2Service.listKnowledgeByPage of the file FileInfoV2Service.java of the component Console Knowledge-List Endpoint. Su
CVE-2026-116283 | Kameleo up to 5.0.1.26 Local API /profiles information disclosure
A vulnerability was found in Kameleo up to 5.0.1.26. It has been rated as problematic. This affects an unknown part of the file /profiles of the component Local API. This manipulation causes information disclosure. This vulnerability is tra
CVE-2026-116257 | BillaBear up to 2025.01.03 Installation InstallController.php processInstall missing authentication
A vulnerability identified as critical has been detected in BillaBear up to 2025.01.03. Affected by this issue is the function processInstall of the file src/BillaBear/Controller/InstallController.php of the component Installation Handler.
CVE-2026-116254 | rathena FluxCP up to 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d PayPal IPN PaymentNotifyRequest.php verifyiprange X-Real-IP origin validation
A vulnerability, which was classified as critical, has been found in rathena FluxCP up to 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d. This issue affects the function verifyiprange of the file lib/Flux/PaymentNotifyRequest.php of the component
CVE-2026-116236 | Oray Pugongying X5 Pro 7.6.1 PPPoE WAN Setting /tmp/upload_files plugin_init pppd_options unrestricted upload
A vulnerability described as critical has been identified in Oray Pugongying X5 Pro 7.6.1. Affected by this issue is the function plugin_init of the file /tmp/upload_files of the component PPPoE WAN Setting Handler. Such manipulation of the
CVE-2026-116233 | Oray Pugongying X5 Pro 7.6.1 Dnsmasq rent_time crlf injection
A vulnerability identified as very critical has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the component Dnsmasq. The manipulation of the argument rent_time leads to crlf injection. This vulnerability
CVE-2026-116227 | Edimax BR-6208AC 1.32 Virtual Server Page cross site scripting
A vulnerability has been found in Edimax BR-6208AC 1.32 and classified as problematic. This vulnerability affects unknown code of the component Virtual Server Page. The manipulation leads to cross site scripting. This vulnerability is refer
CVE-2026-116563 | NextGEN Gallery Plugin up to 4.5.4 on WordPress Output Escaping comment cross site scripting (EUVD-2026-114573)
A vulnerability was found in NextGEN Gallery Plugin up to 4.5.4 on WordPress. It has been rated as problematic. This impacts an unknown function of the component Output Escaping. Performing a manipulation of the argument Comment results in
CVE-2026-109997 | kstover Ninja Forms Plugin up to 3.15.5 on WordPress Input Sanitization nf_ajax_submit formData.extra cross site scripting (EUVD-2026-114576)
A vulnerability has been found in kstover Ninja Forms Plugin up to 3.15.5 on WordPress and classified as problematic. Impacted is the function nf_ajax_submit of the component Input Sanitization. The manipulation of the argument formData.ext
CVE-2026-109234 | tigroumeow Meow Lightbox Plugin up to 5.6.4 on WordPress post_content cross site scripting (EUVD-2026-114574)
A vulnerability was found in tigroumeow Meow Lightbox Plugin up to 5.6.4 on WordPress and classified as problematic. The affected element is an unknown function. The manipulation of the argument post_content results in cross site scripting.
CVE-2026-116520 | buildwps PPWP Plugin up to 1.9.26 on WordPress Shortcode desc_below_form cross site scripting (EUVD-2026-114579)
A vulnerability was found in buildwps PPWP Plugin up to 1.9.26 on WordPress. It has been declared as problematic. This affects an unknown function of the component Shortcode. Such manipulation of the argument desc_below_form leads to cross
CVE-2026-111254 | Boldgrid W3 Total Cache Plugin up to 2.10.7 on WordPress comment cross site scripting (EUVD-2026-114591)
A vulnerability marked as problematic has been reported in Boldgrid W3 Total Cache Plugin up to 2.10.7 on WordPress. This affects an unknown function. The manipulation of the argument Comment leads to cross site scripting. This vulnerabilit
CVE-2026-111109 | pfefferle Webmention Plugin up to 5.10.1 on WordPress Webmention Processing Receiver::process cross site scripting (EUVD-2026-114592)
A vulnerability classified as problematic has been found in pfefferle Webmention Plugin up to 5.10.1 on WordPress. Affected is the function Receiver::process of the component Webmention Processing. This manipulation causes cross site script
CVE-2026-120240 | WAVLINK WN553X1-B V260403_2.0.0 WireGuard CLI Group /bin/ioos sub_41A748 group_id/group_name os command injection (EUVD-2026-114882)
A vulnerability categorized as very critical has been discovered in WAVLINK WN553X1-B V260403_2.0.0. This issue affects the function sub_41A748 of the file /bin/ioos of the component WireGuard CLI Group Handler. Executing a manipulation of
CVE-2026-120238 | WAVLINK WN553X1-B 260403_2.0.0 ovpn_file /bin/ioos sub_4162A8 file_id os command injection (EUVD-2026-114880)
A vulnerability was found in WAVLINK WN553X1-B 260403_2.0.0. It has been declared as very critical. This affects the function sub_4162A8 of the file /bin/ioos of the component ovpn_file Handler. Such manipulation of the argument file_id lea
CVE-2026-107653 | SureCart Plugin up to 4.9.4 on WordPress Buy Button Block comment cross site scripting (EUVD-2026-114596)
A vulnerability was found in SureCart Plugin up to 4.9.4 on WordPress and classified as problematic. This issue affects some unknown processing of the component Buy Button Block. The manipulation of the argument Comment results in cross sit
CVE-2026-120239 | WAVLINK WN553X1-B V260403_2.0.0 WireGuard CLI /bin/ioos sub_419DA8 file_id os command injection (EUVD-2026-114881)
A vulnerability was found in WAVLINK WN553X1-B V260403_2.0.0. It has been rated as very critical. This vulnerability affects the function sub_419DA8 of the file /bin/ioos of the component WireGuard CLI Handler. Performing a manipulation of
CVE-2026-120241 | Ruijie RG-ES205GC ESW_1.0(1)B1P48 Local Firmware Upgrade Interface httpupg.cgi buffer overflow (EUVD-2026-114883)
A vulnerability identified as critical has been detected in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P ESW_1.0(1)B1P48. Impacted is an unknown function of the file httpupg.cgi of the component Local Firmware
GitLab's Critical CVSS 10.0 Wake-Up Call: Is Your CI/CD Pipeline Secure?
The Alpine Linux incident reveals why patching GitLab is not enough—and what every business should do to protect its software supply chain. A critical vulnerability can turn a trusted development platform into an attacker's entry point
CVE-2026-105483 remediation checklist for Node.js teams
CVE-2026-105483 remediation checklist for Node.js teams The fastest accurate response to CVE-2026-105483 starts with the runtime version and ends with evidence that the deployed client rejects the wrong certificate identity. The bug affects
CVE-2026-109782 | Mozilla Firefox up to 153.4 File unnecessary privileges (Nessus ID 374794)
A vulnerability, which was classified as critical, has been found in Mozilla Firefox up to 153.4. The affected element is an unknown function of the component File Handler. Performing a manipulation results in execution with unnecessary pri
CVE-2026-109745 | Mozilla Firefox up to 153.4/157 Web Serial uninitialized pointer (Nessus ID 374794)
A vulnerability, which was classified as critical, has been found in Mozilla Firefox up to 153.4/157. This vulnerability affects unknown code of the component Web Serial. This manipulation causes uninitialized pointer. This vulnerability is
CVE-2026-109709 | Mozilla Firefox up to 153.4/157 Process Sandboxing privileges management (Nessus ID 374794)
A vulnerability described as critical has been identified in Mozilla Firefox up to 153.4/157. Affected is an unknown function of the component Process Sandboxing. Such manipulation leads to improper privilege management. This vulnerability
CVE-2026-109724 | Mozilla Firefox up to 153.4/157 DOM/HTML use after free (Nessus ID 374794)
A vulnerability, which was classified as critical, was found in Mozilla Firefox up to 153.4/157. This impacts an unknown function of the component DOM/HTML. Executing a manipulation can lead to use after free. This vulnerability is register
CVE-2026-109713 | Mozilla Firefox up to 153.4/157 Crash Reporting use after free (Nessus ID 374794)
A vulnerability was found in Mozilla Firefox up to 153.4/157. It has been rated as critical. This affects an unknown function of the component Crash Reporting. The manipulation leads to use after free. This vulnerability is uniquely identif
CVE-2026-109740 | Mozilla Firefox up to 153.4/157 Win32 sandbox (Nessus ID 374794)
A vulnerability marked as critical has been reported in Mozilla Firefox up to 153.4/157. Affected is an unknown function of the component Win32. Performing a manipulation results in sandbox issue. This vulnerability was named CVE-2026-10974
CVE-2026-109706 | Mozilla Firefox up to 115.42/153.4/157 IndexedDB use after free (Nessus ID 374794)
A vulnerability, which was classified as critical, has been found in Mozilla Firefox up to 115.42/153.4/157. This affects an unknown part of the component IndexedDB. The manipulation leads to use after free. This vulnerability is documented
CVE-2026-109715 | Mozilla Firefox up to 115.42/153.4/157 JavaScript Engine integer overflow (Nessus ID 374794)
A vulnerability identified as critical has been detected in Mozilla Firefox up to 115.42/153.4/157. Affected is an unknown function of the component JavaScript Engine. This manipulation causes integer overflow. The identification of this vu
CVE-2026-96391 | Drupal Webform REST up to 4.2.0 improper authorization
A vulnerability was found in Drupal Webform REST up to 4.2.0. It has been classified as critical. Affected is an unknown function of the component REST. The manipulation leads to improper authorization. This vulnerability is documented as C
CVE-2026-96379 | Drupal CookieCuttr up to 2.0.3 cross site scripting
A vulnerability was found in Drupal CookieCuttr up to 2.0.3. It has been classified as problematic. The impacted element is an unknown function. Performing a manipulation results in cross site scripting. This vulnerability is reported as CV
CVE-2026-92202 | Luxion KeyShot BIP File Parser uncontrolled search path
A vulnerability marked as critical has been reported in Luxion KeyShot. This issue affects some unknown processing of the component BIP File Parser. The manipulation leads to uncontrolled search path. This vulnerability is traded as CVE-202
CVE-2026-87938 | Drupal CSP log Plugin up to 1.0.2 sql injection
A vulnerability categorized as critical has been discovered in Drupal CSP log Plugin up to 1.0.2. The affected element is an unknown function. Such manipulation leads to sql injection. This vulnerability is referenced as CVE-2026-87938. It
CVE-2026-76529 | Splunk SOAR up to 8.6.x improper protection of alternate path
A vulnerability was found in Splunk SOAR up to 8.6.x and classified as critical. This issue affects some unknown processing. Executing a manipulation can lead to improper protection of alternate path. The identification of this vulnerabilit
CVE-2026-76408 | Splunk SOAR up to 8.6.x resource control
A vulnerability marked as very critical has been reported in Splunk SOAR up to 8.6.x. This affects an unknown function. Performing a manipulation results in improper control of resource through lifetime. This vulnerability is reported as CV
CVE-2026-76288 | Splunk Enterprise up to 9.4.15/10.0.10/10.2.7/10.4.3 JavaScript Logger Endpoint resource consumption
A vulnerability has been found in Splunk Enterprise up to 9.4.15/10.0.10/10.2.7/10.4.3 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component JavaScript Logger Endpoint. This manipulation
CVE-2026-105869 | Apache Pulsar up to 4.0.13/4.2.4 MultiRolesTokenAuthorizationProvider improper authentication
A vulnerability was found in Apache Pulsar up to 4.0.13/4.2.4. It has been declared as very critical. This issue affects some unknown processing of the component MultiRolesTokenAuthorizationProvider. Such manipulation leads to improper auth
CVE-2026-86959 | Apple iOS/iPadOS/macOS input validation
A vulnerability identified as critical has been detected in Apple iOS, iPadOS and macOS. The impacted element is an unknown function. The manipulation leads to improper input validation. This vulnerability is uniquely identified as CVE-2026
CVE-2026-86948 | Apple Xcode up to 26 sandbox
A vulnerability was found in Apple Xcode up to 26. It has been declared as problematic. The impacted element is an unknown function. Executing a manipulation can lead to sandbox issue. This vulnerability appears as CVE-2026-86948. The attac
CVE-2026-86944 | Apple iOS/iPadOS/macOS prior 26.7/26.7/15.8/26.7 out-of-bounds write
A vulnerability classified as very critical has been found in Apple iOS, iPadOS and macOS. Affected by this vulnerability is an unknown functionality. Performing a manipulation results in out-of-bounds write. This vulnerability is identifie
CVE-2026-86935 | Apple macOS up to 26 information disclosure
A vulnerability was found in Apple macOS up to 26. It has been classified as problematic. The affected element is an unknown function. Performing a manipulation results in information disclosure. This vulnerability is reported as CVE-2026-8
CVE-2026-84582 | Apple iOS/iPadOS/macOS/tvOS/visionOS/watchOS up to 26 access control
A vulnerability described as problematic has been identified in Apple iOS, iPadOS, macOS, tvOS, visionOS and watchOS up to 26. The impacted element is an unknown function. The manipulation results in improper access controls. This vulnerabi
CVE-2026-83651 | Microsoft Windows up to Server 2025 GDI out-of-bounds
A vulnerability identified as problematic has been detected in Microsoft Windows. This impacts an unknown function of the component GDI. This manipulation causes out-of-bounds read. This vulnerability is registered as CVE-2026-83651. Remote
CVE-2026-68482 | Apache Answer improper authorization
A vulnerability was found in Apache Answer. It has been declared as problematic. Affected is an unknown function. Such manipulation leads to improper authorization. This vulnerability is uniquely identified as CVE-2026-68482. The attack can
CVE-2026-113264 | Google Chrome up to 155.0.8059.84 Extensions input validation
A vulnerability marked as critical has been reported in Google Chrome. The impacted element is an unknown function of the component Extensions. This manipulation causes improper input validation. The identification of this vulnerability is
ParticleDB's Jepsen report, Lenovo's fingerprint USB stick, Karpathy's HackerTube and the Linux TCP bug CVE-2026-98432
Four developer stories from Sunday, November 1, 2026, each read from its own source. The first is a database whose home page said Full ACID. The video has the walkthrough; this article keeps the quotes, numbers and links in one place. TL;DR
CVE-2026-95117 | zserge jsmn jsmn.h jsmn_parse buffer overflow (ID 25647e6)
A vulnerability marked as problematic has been reported in zserge jsmn. The impacted element is the function jsmn_parse of the file jsmn.h. The manipulation leads to buffer overflow. This vulnerability is listed as CVE-2026-95117. The attac