Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 786 | 0,2 % |
| ≥50 % | 3.561 | 0,9 % |
| ≥10 % | 13.157 | 3,2 % |
| <10 % | 396.051 | 95,8 % |
🗂️ …
Code-Analyse: Telekom braucht rund um die Uhr KI-Modelle gegen Zero-Day-Lücken
Der Chief Security Officer der Telekom räumt mit verbreiteten Mythen rund um KI auf. Ein besonderes Sicherheitsprobleme sieht er bei Open Source. (Softwareentwicklung, KI) Weiterlesen
CVE-2024-58086 | Linux Kernel up to 6.1.128/6.6.78/6.12.15/6.13.3 v3d privilege escalation (Nessus ID 232251 / WID-SEC-2025-0499)
A vulnerability has been found in Linux Kernel up to 6.1.128/6.6.78/6.12.15/6.13.3 and classified as problematic. This affects an unknown part of the component v3d. This manipulation causes privilege escalation. This vulnerability is handle
CVE-2023-52927 | Linux Kernel up to 6.1.129 nf_conntrack_in use after free (Nessus ID 234058 / WID-SEC-2025-1439)
A vulnerability classified as problematic was found in Linux Kernel up to 6.1.129. This impacts the function nf_conntrack_in. Such manipulation leads to use after free. This vulnerability is documented as CVE-2023-52927. The attack requires
Threat Actors Exploit Openwave, Cisco BroadWorks Vulnerabilities
The flaws, CVE-2026-111793 and CVE-2026-20320, let attackers leak sensitive information, including configuration data. The post Threat Actors Exploit Openwave, Cisco BroadWorks Vulnerabilities appeared first on SecurityWeek. Weiterlesen
CVE-2026-121885 | Red Hat Enterprise Linux Auto-Update Mechanism denial of service (EUVD-2026-121147)
A vulnerability labeled as critical has been found in Red Hat Enterprise Linux, Hardened Images and OpenShift Container Platform. The affected element is an unknown function of the component Auto-Update Mechanism. The manipulation results i
CVE-2026-119302 | NotificationX Plugin up to 3.3.6 on WordPress Notification Preview authorization (EUVD-2026-123276)
A vulnerability categorized as critical has been discovered in NotificationX Plugin up to 3.3.6 on WordPress. Affected by this vulnerability is an unknown functionality of the component Notification Preview. Executing a manipulation can lea
CVE-2026-119171 | WooCommerce Advanced Product Fields for WooCommerce Plugin up to 1.7.3 on WordPress input validation (EUVD-2026-123275)
A vulnerability labeled as problematic has been found in WooCommerce Advanced Product Fields for WooCommerce Plugin up to 1.7.3 on WordPress. This affects an unknown part. The manipulation results in improper input validation. This vulnerab
CVE-2026-123668 | GetPaid Plugin up to 2.8.64 on WordPress improper validation of specified quantity in input (EUVD-2026-123278)
A vulnerability marked as problematic has been reported in GetPaid Plugin up to 2.8.64 on WordPress. This vulnerability affects unknown code. This manipulation causes improper validation of specified quantity in input. This vulnerability is
CVE-2026-123659 | ProfilePress Plugin up to 4.17.5 on WordPress authorization (EUVD-2026-123277)
A vulnerability described as problematic has been identified in ProfilePress Plugin up to 4.17.5 on WordPress. This issue affects some unknown processing. Such manipulation leads to incorrect authorization. This vulnerability is uniquely id
CVE-2026-92408 | WooCommerce WPS Bookings for WooCommerce Plugin up to 3.13.0 on WordPress price external control of assumed-immutable web parameter (EUVD-2026-123279)
A vulnerability identified as problematic has been detected in WooCommerce WPS Bookings for WooCommerce Plugin up to 3.13.0 on WordPress. Affected by this issue is some unknown functionality. The manipulation of the argument price leads to
CVE-2026-12062 | Zoho Corporation ADAudit Plus prior 8703 Reports sql injection (EUVD-2026-123280)
A vulnerability was found in Zoho Corporation ADAudit Plus. It has been classified as critical. Affected by this vulnerability is an unknown functionality of the component Reports. Performing a manipulation results in sql injection. This vu
CVE-2024-56719 | Linux Kernel up to 6.6.67/6.12.6 stmmac_tso_xmit allocation of resources (Nessus ID 231924 / WID-SEC-2025-1439)
A vulnerability identified as problematic has been detected in Linux Kernel up to 6.6.67/6.12.6. The impacted element is the function stmmac_tso_xmit. Performing a manipulation results in allocation of resources. This vulnerability is known
Microsoft Patches Over 1,093 Security Flaws, Including Outlook Zero-Day Exploited in Attacks
Microsoft released its November 2026 Patch Tuesday updates, addressing 1,093 newly disclosed security flaws across Windows, Office, SQL Server, SharePoint, Exchange Server, Azure services, and developer tools. The release includes 63 Critic
Critical Fortinet2Shell Vulnerability Enables RCE Attacks in FortiClient with FortiPAM Enabled
Fortinet has warned about a critical flaw in FortiClient that lets a remote attacker run code on a user’s computer. The attacker only needs the user to visit a malicious website. The bug is tracked as CVE-2026-121529 and carries a CVSS scor
USN-9040-1: Linux kernel (Low Latency NVIDIA) vulnerabilities
It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds con
Chrome-User sollten schnell updaten: Diese Schwachstelle des Browsers wird aktiv ausgenutzt
Wer Chrome als Browser nutzt, sollte zeitnah ein Update anstoßen. Wie Google berichtet, wird dadurch eine Sicherheitslücke geschlossen, die schon aktiv ausgenutzt wird. Welche Gefahren drohen, wenn du das Update auslässt. Weiterlesen
Hackers Exploit Microsoft Outlook Zero-Day to Steal NTLM Credentials in Active Attacks
Microsoft has patched an actively exploited Outlook spoofing flaw, tracked as CVE-2026-124194, that coerces the mail client into leaking NTLMv2 authentication material to attacker-controlled infrastructure. Released on November 10, 2026, th
CVE-2023-40530 | Skylark App up to 6.2.13 on Android/iOS Custom URL Scheme improper authorization
A vulnerability identified as critical has been detected in Skylark App up to 6.2.13 on Android/iOS. This issue affects some unknown processing of the component Custom URL Scheme Handler. This manipulation causes improper authorization. Thi
CVE-2023-39062 | Spipu HTML2PDF up to 5.2.7 forms.php cross site scripting
A vulnerability described as problematic has been identified in Spipu HTML2PDF up to 5.2.7. The affected element is an unknown function of the file forms.php. Executing a manipulation can lead to cross site scripting. This vulnerability is
CVE-2023-38030 | Saho ADM100/ADM-100FP missing authentication
A vulnerability classified as critical was found in Saho ADM100 and ADM-100FP. Affected is an unknown function. The manipulation results in missing authentication. This vulnerability is reported as CVE-2023-38030. The attack can be launched
CVE-2023-38029 | Saho ADM100/ADM-100FP unrestricted upload
A vulnerability classified as very critical has been found in Saho ADM100 and ADM-100FP. This impacts an unknown function. The manipulation leads to unrestricted upload. This vulnerability is documented as CVE-2023-38029. The attack can be
CVE-2023-34973 | QNAP QTS/QuTS Hero entropy (qsa-23-59)
A vulnerability has been found in QNAP QTS and QuTS Hero and classified as problematic. Affected by this vulnerability is an unknown functionality. This manipulation causes insufficient entropy. The identification of this vulnerability is C
CVE-2026-97034 | cmdgo up to 1.26.10/1.27.3 cgo libgomp.spec command injection (Nessus ID 378578)
A vulnerability labeled as problematic has been found in cmdgo up to 1.26.10/1.27.3. This vulnerability affects unknown code of the file libgomp.spec of the component cgo. Executing a manipulation can lead to command injection. This vulnera
CVE-2026-97041 | Google cmd compile link up to 1.26.10/1.27.3 cgo/linker argument injection (Nessus ID 378581)
A vulnerability categorized as critical has been discovered in Google cmd compile link up to 1.26.10/1.27.3. Affected by this issue is some unknown functionality of the component cgo/linker. Such manipulation leads to argument injection. Th
CVE-2026-109478 | Microsoft .NET/Visual Studio resource consumption (Nessus ID 378583)
A vulnerability, which was classified as problematic, has been found in Microsoft .NET and Visual Studio. Affected is an unknown function. The manipulation leads to resource consumption. This vulnerability is referenced as CVE-2026-109478.
CVE-2026-125332 | DigitalBazaar forge up to 1.4.2 TLS Client forge.tls tls.createConnectionState input validation (Nessus ID 378586)
A vulnerability identified as problematic has been detected in DigitalBazaar forge up to 1.4.2. This affects the function tls.createConnectionState of the file forge.tls of the component TLS Client. Performing a manipulation results in impr
CVE-2026-114155 | Microsoft .NET DotNet.HotReload.Watch.Aspire toctou (Nessus ID 378585)
A vulnerability labeled as problematic has been found in Microsoft .NET. Impacted is an unknown function of the component DotNet.HotReload.Watch.Aspire. Executing a manipulation can lead to time-of-check time-of-use. This vulnerability appe
CVE-2022-4233 | SourceCodester Event Registration System 1.0 list First Name/Last Name cross site scripting (EUVD-2022-51591)
A vulnerability described as problematic has been identified in SourceCodester Event Registration System 1.0. This affects an unknown part of the file /event/admin/?page=user/list. The manipulation of the argument First Name/Last Name resul
CVE-2022-4232 | SourceCodester Event Registration System 1.0 cmd unrestricted upload (EUVD-2022-51590)
A vulnerability marked as critical has been reported in SourceCodester Event Registration System 1.0. Affected by this issue is some unknown functionality. The manipulation of the argument cmd leads to unrestricted upload. This vulnerabilit
CVE-2022-4229 | SourceCodester Book Store Management System 1.0 /bsms_ci/index.php access control (EUVD-2022-51588)
A vulnerability identified as critical has been detected in SourceCodester Book Store Management System 1.0. Affected is an unknown function of the file /bsms_ci/index.php. Performing a manipulation results in improper access controls. This
CVE-2026-97036 | Google Go up to 1.26.10/1.27.3 Cgo Directive Parser argument injection (Nessus ID 378587)
A vulnerability was found in Google Go up to 1.26.10/1.27.3 and classified as critical. This affects an unknown function of the component Cgo Directive Parser. Executing a manipulation can lead to argument injection. This vulnerability is h
CVE-2026-97054 | Google net/http up to 1.26.10/1.27.3 Synchronization MaxBytesReader missing synchronization (Nessus ID 378588)
A vulnerability classified as problematic has been found in Google net and http up to 1.26.10/1.27.3. The affected element is the function MaxBytesReader of the component Synchronization. This manipulation causes missing synchronization. Th
CVE-2026-97042 | Google cmd cgo compile link up to 1.26.10/1.27.3 cgo/link argument injection (Nessus ID 378589)
A vulnerability marked as critical has been reported in Google cmd cgo compile link up to 1.26.10/1.27.3. This issue affects some unknown processing of the component cgo/link. The manipulation leads to argument injection. This vulnerability
Windows Active Directory RCE Vulnerability Allows Attacker to Execute Code Over a Network
Microsoft has released security updates for a Windows Active Directory vulnerability that allows an authorized attacker to execute code over a network. Tracked as CVE-2026-119948, the flaw was disclosed on November 10, 2026, and affects mul
CVE-2023-40612 | OpenMNS Horizon/Meridian xml injection
A vulnerability was found in OpenMNS Horizon and Meridian. It has been classified as critical. This issue affects some unknown processing. Performing a manipulation results in xml injection. This vulnerability is cataloged as CVE-2023-40612
CVE-2023-34972 | QNAP QTS/QuTS Hero cleartext transmission (qsa-23-58)
A vulnerability classified as problematic has been found in QNAP QTS and QuTS Hero. This affects an unknown part. This manipulation causes cleartext transmission of sensitive information. This vulnerability appears as CVE-2023-34972. The at
CVE-2023-34971 | QNAP QTS/QuTS Hero inadequate encryption (qsa-23-60)
A vulnerability, which was classified as problematic, has been found in QNAP QTS and QuTS Hero. Affected by this issue is some unknown functionality. This manipulation causes inadequate encryption strength. This vulnerability is handled as
CVE-2022-46884 | Mozilla Firefox up to 105 SVG Image use after free
A vulnerability was found in Mozilla Firefox up to 105. It has been declared as critical. This vulnerability affects unknown code of the component SVG Image Handler. Executing a manipulation can lead to use after free. This vulnerability is
CVE-2022-3746 | Lenovo LCFC BIOS Embedded Controller Interface access control
A vulnerability, which was classified as critical, was found in Lenovo LCFC BIOS. This issue affects some unknown processing of the component Embedded Controller Interface. Such manipulation leads to improper access controls. This vulnerabi
CVE-2022-3745 | Lenovo LCFC BIOS SMI information disclosure
A vulnerability, which was classified as problematic, has been found in Lenovo LCFC BIOS. This vulnerability affects unknown code of the component SMI Handler. This manipulation causes information disclosure. The identification of this vuln
CVE-2022-3744 | Lenovo LCFC BIOS SMI hard-coded credentials
A vulnerability classified as critical was found in Lenovo LCFC BIOS. This affects an unknown part of the component SMI Handler. The manipulation results in hard-coded credentials. This vulnerability was named CVE-2022-3744. The attack need
CVE-2022-3743 | Lenovo LCFC BIOS Embedded Controller Command information disclosure
A vulnerability classified as problematic has been found in Lenovo LCFC BIOS. Affected by this issue is some unknown functionality of the component Embedded Controller Command Handler. The manipulation leads to information disclosure. This
CVE-2022-3742 | Lenovo LCFC BIOS buffer overflow
A vulnerability described as critical has been identified in Lenovo LCFC BIOS. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to buffer overflow. This vulnerability is handled as CVE-2022-3742.
AhsayCBS Attacks Deploy Five Hidden Webshells and Python Backdoor to Maintain Access to Backup Servers
Attackers exploiting AhsayCBS backup servers deployed five webshell families, cryptocurrency miners, and a Python implant to maintain access. An organization compromised between October 8 and October 11, 2026, before security hotfixes becam
Critical SAP ICM2Shell Flaws Allow Hackers to Take Full Control of Servers Without Authentication
A newly disclosed ICM2Shell (CVE-2026-76964 and CVE-2026-89126), a pair of CVSS 10.0 pre-authentication memory corruption flaws in the SAP Kernel’s WebSocket handling. SAP fixed both in its November 2026 Security Patch Day through Security
[UPDATE] [hoch] TianoCore EDK2: Schwachstelle ermöglicht Codeausführung
Ein lokaler Angreifer kann eine Schwachstelle in TianoCore EDK2 ausnutzen, um einen Denial-of-Service-Zustand auszulösen oder beliebigen Code auszuführen. Weiterlesen
[UPDATE] [hoch] QT: Schwachstelle ermöglicht Denial of Service
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in QT ausnutzen, um einen Denial of Service Angriff durchzuführen. Weiterlesen
CVE-2026-58785 | Google Android main.rs update_user_consent uninitialized pointer (EUVD-2026-122776)
A vulnerability was found in Google Android. It has been declared as critical. The affected element is the function update_user_consent of the file main.rs. Executing a manipulation can lead to uninitialized pointer. This vulnerability is r
CVE-2026-95404 | Google Android privileges management (EUVD-2026-122681)
A vulnerability classified as very critical was found in Google Android. The impacted element is an unknown function. Executing a manipulation can lead to improper privilege management. This vulnerability appears as CVE-2026-95404. The atta
CVE-2026-57013 | Google Android Secure Coprocessor access_control_enable access control (EUVD-2026-122747)
A vulnerability, which was classified as very critical, was found in Google Android. Affected is the function access_control_enable of the component Secure Coprocessor. Executing a manipulation can lead to improper access controls. This vul
CVE-2026-58813 | Google Android Memory Mapping mman.c mmap memory corruption (EUVD-2026-122628)
A vulnerability was found in Google Android and classified as very critical. Impacted is the function mmap of the file mman.c of the component Memory Mapping. Executing a manipulation can lead to memory corruption. The identification of thi
CVE-2026-58696 | Google Android heap-based overflow (EUVD-2026-122758)
A vulnerability categorized as very critical has been discovered in Google Android. Impacted is an unknown function. Executing a manipulation can lead to heap-based buffer overflow. This vulnerability appears as CVE-2026-58696. The attack m
CVE-2026-116081 | Fenrir Sleipnir Mobile up to 4.15.1 certificate validation (EUVD-2026-123153)
A vulnerability classified as problematic was found in Fenrir Sleipnir Mobile up to 4.15.1. Affected is an unknown function. Executing a manipulation can lead to improper certificate validation. This vulnerability is registered as CVE-2026-
Fast 1.100 Sicherheitslücken und eine ausgenutzte Outlook-Schwachstelle
Microsoft schließt im November fast 1.100 Schwachstellen, über 60 davon kritisch. Angreifer setzen bereits eine Outlook-Schwachstelle ein, die den NTLMv2-Hash eines Anwenders preisgibt. Windows 11 23H2 Enterprise und Education erhält zum le
CVE-2023-37369 | Qt qtbase QXmlStreamReader buffer overflow (DLA 3539-1 / EUVD-2023-41271)
A vulnerability classified as critical has been found in Qt qtbase. This impacts the function QXmlStreamReader. The manipulation leads to buffer overflow. This vulnerability is uniquely identified as CVE-2023-37369. The attack can only be i
CVE-2022-46751 | Oracle Business Intelligence Enterprise Edition 6.4.0.0.0 Visual Analyzer xml injection (Nessus ID 210929)
A vulnerability marked as critical has been reported in Oracle Business Intelligence Enterprise Edition 6.4.0.0.0. This vulnerability affects unknown code of the component Visual Analyzer. Performing a manipulation results in xml injection.
CVE-2022-44729 | Oracle Business Process Management Suite 12.2.1.4.0 BPM Composer server-side request forgery (Nessus ID 233387)
A vulnerability was found in Oracle Business Process Management Suite 12.2.1.4.0. It has been declared as critical. The affected element is an unknown function of the component BPM Composer. Such manipulation leads to server-side request fo
CVE-2022-4228 | SourceCodester Book Store Management System 1.0 edit_user password information disclosure (EUVD-2022-51587)
A vulnerability categorized as problematic has been discovered in SourceCodester Book Store Management System 1.0. This impacts an unknown function of the file /bsms_ci/index.php/user/edit_user/. Such manipulation of the argument Password l
CVE-2022-4222 | SourceCodester Canteen Management System POST Request ajax_invoice.php query search sql injection (EUVD-2022-51582)
A vulnerability classified as critical was found in SourceCodester Canteen Management System. Affected by this vulnerability is the function Query of the file ajax_invoice.php of the component POST Request Handler. Executing a manipulation
CVE-2022-4206 | GitLab DAST API Scanner prior 2.0.102 information disclosure (Issue 383083 / EUVD-2022-51566)
A vulnerability categorized as problematic has been discovered in GitLab DAST API Scanner. This affects an unknown function. Such manipulation leads to information disclosure. This vulnerability is referenced as CVE-2022-4206. It is possibl