Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 786 | 0,2 % |
| ≥50 % | 3.560 | 0,9 % |
| ≥10 % | 13.154 | 3,2 % |
| <10 % | 396.055 | 95,8 % |
CVE-2026-88833 | BusyBox udhcpc integer underflow
A vulnerability was found in BusyBox and classified as critical. Impacted is an unknown function of the component udhcpc. The manipulation results in integer underflow. This vulnerability was named CVE-2026-88833. The attack may be performe
CVE-2026-83844 | Microsoft Windows up to 11.3.9 out-of-bounds
A vulnerability, which was classified as critical, was found in Microsoft Windows. This affects an unknown part. Such manipulation leads to out-of-bounds read. This vulnerability is documented as CVE-2026-83844. The attack can be executed r
CVE-2026-76459 | Cisco NX-OS Software out-of-bounds write (EUVD-2026-94462)
A vulnerability was found in Cisco NX-OS Software, NX-OS System Software in ACI Mode and Unified Computing System. It has been rated as very critical. This affects an unknown function. This manipulation causes out-of-bounds write. This vuln
CVE-2026-76285 | Splunk Enterprise up to 9.4.14/10.0.9/10.2.6/10.4.2 isolation
A vulnerability was found in Splunk Enterprise up to 9.4.14/10.0.9/10.2.6/10.4.2. It has been classified as critical. This affects an unknown part. The manipulation leads to improper isolation or compartmentalization. This vulnerability is
CVE-2026-76284 | Splunk Enterprise up to 9.4.14/10.0.9/10.2.6/10.4.2 neutralization
A vulnerability was found in Splunk Enterprise up to 9.4.14/10.0.9/10.2.6/10.4.2 and classified as very critical. Affected by this issue is some unknown functionality. Executing a manipulation can lead to improper neutralization. The identi
CVE-2026-76283 | Splunk Enterprise up to 9.4.14/10.0.9/10.2.6/10.4.2 protection mechanism
A vulnerability has been found in Splunk Enterprise up to 9.4.14/10.0.9/10.2.6/10.4.2 and classified as critical. Affected by this vulnerability is an unknown functionality. Performing a manipulation results in protection mechanism failure.
CVE-2026-76282 | Splunk Enterprise up to 9.4.14/10.0.9/10.2.6/10.4.2 allocation of resources (EUVD-2026-94634)
A vulnerability, which was classified as very critical, was found in Splunk Enterprise up to 9.4.14/10.0.9/10.2.6/10.4.2. Affected is an unknown function. Such manipulation leads to allocation of resources. This vulnerability is uniquely id
CVE-2026-76281 | Splunk Enterprise up to 9.4.14/10.0.9/10.2.6/10.4.2 access control
A vulnerability identified as very critical has been detected in Splunk Enterprise up to 9.4.14/10.0.9/10.2.6/10.4.2. This vulnerability affects unknown code. This manipulation causes improper access controls. This vulnerability is register
CVE-2026-109601 | Frappe Framework up to 15.116.x/16.29.x Email HTML Attribute path traversal
A vulnerability was found in Frappe Framework up to 15.116.x/16.29.x. It has been declared as problematic. This vulnerability affects unknown code of the component Email HTML Attribute Handler. Such manipulation leads to path traversal. Thi
CVE-2024-8122 | WSO2 Identity Server up to 5.10.x SMS OTP access control
A vulnerability described as critical has been identified in WSO2 Identity Server up to 5.10.x. Affected by this issue is some unknown functionality of the component SMS OTP. Such manipulation leads to improper access controls. This vulnera
CVE-2024-58391 | Frappe up to 14.57.x/15.3.x Printview cross site scripting
A vulnerability described as problematic has been identified in Frappe up to 14.57.x/15.3.x. This vulnerability affects unknown code of the component Printview. Executing a manipulation can lead to cross site scripting. This vulnerability i
Google patches eighth Chrome zero-day exploited in attacks this year
Google has released emergency security updates to patch a new Chrome vulnerability exploited in zero-day attacks, the eighth such flaw since the start of the year. [...] Weiterlesen
CVE-2026-80490 | Algorithm::AhoCorasick::XS up to 0.04 matches/first_match/match_details out-of-bounds
A vulnerability, which was classified as critical, was found in Algorithm::AhoCorasick::XS up to 0.04. Affected by this vulnerability is the function matches/first_match/match_details. The manipulation results in out-of-bounds read. This vu
CVE-2026-17262 | IBM i 7.3/7.4/7.5/7.6 denial of service (EUVD-2026-83295)
A vulnerability labeled as critical has been found in IBM i 7.3/7.4/7.5/7.6. The affected element is an unknown function. Such manipulation leads to denial of service. This vulnerability is uniquely identified as CVE-2026-17262. Local acces
CVE-2026-12542 | Foreman foreman-tail command injection (WID-SEC-2026-3712)
A vulnerability marked as very critical has been reported in Foreman. The impacted element is an unknown function of the component foreman-tail. The manipulation leads to command injection. This vulnerability is documented as CVE-2026-12542
CVE-2026-10841 | IBM WebSphere Application Server/WebSphere Liberty 8.5/9.0 request smuggling
A vulnerability, which was classified as problematic, has been found in IBM WebSphere Application Server and WebSphere Liberty 8.5/9.0. This vulnerability affects unknown code. The manipulation leads to http request smuggling. This vulnerab
CVE-2026-103442 | Wikimedia Foundation MediaWiki 1.43/1.45/1.46 CentralAuth code injection
A vulnerability was found in Wikimedia Foundation MediaWiki 1.43/1.45/1.46. It has been declared as critical. This affects an unknown function of the component CentralAuth. Executing a manipulation can lead to code injection. This vulnerabi
CVE-2026-103441 | Wikimedia Foundation MediaWiki 1.43/1.45/1.46 Wikibase deserialization
A vulnerability was found in Wikimedia Foundation MediaWiki 1.43/1.45/1.46. It has been classified as critical. The impacted element is an unknown function of the component Wikibase. Performing a manipulation results in deserialization. Thi
CVE-2024-58388 | Sharp/Toshiba Tec Multiple Multifunction Printers installed_emanual_down.html path path traversal
Further investigation has shown that this issues is a false-positive. Please review the sources mentioned and consider not using this entry at all. Weiterlesen
CVE-2024-58387 | Inspur Haiyue HCM Cloud Download Endpoint download index/ext information disclosure
A vulnerability identified as problematic has been detected in Inspur Haiyue HCM Cloud. This vulnerability affects unknown code of the file /api/model_report/file/download of the component Download Endpoint. This manipulation of the argumen
CVE-2024-58386 | ZoneMinder up to 1.37.x Files View output_file path path traversal
A vulnerability has been found in ZoneMinder up to 1.37.x and classified as problematic. This impacts the function output_file of the component Files View. This manipulation of the argument path causes path traversal. This vulnerability is
CVE-2024-42002 | Open Source Robotics Robot Operating System Crystal Clemmys up to Lyrical Luth Hz Verb eval filter code injection
A vulnerability marked as critical has been reported in Open Source Robotics Robot Operating System. This vulnerability affects the function eval of the component Hz Verb. This manipulation of the argument filter causes code injection. This
CVE-2026-76877 | WPML Multilingual CMS Plugin up to 4.9.7 on WordPress SSO wp-login.php process_iframe_request wpml_sso_token_domain race condition (EUVD-2026-120823)
A vulnerability was found in WPML Multilingual CMS Plugin up to 4.9.7 on WordPress. It has been declared as critical. Affected is the function process_iframe_request of the file wp-login.php of the component SSO Handler. Such manipulation o
CVE-2026-120513 | WPEverest Everest Forms Plugin up to 3.6.2 on WordPress Save-and-Continue Addon remove_csv_file_after_email_send path traversal (EUVD-2026-120824)
A vulnerability labeled as critical has been found in WPEverest Everest Forms Plugin up to 3.6.2 on WordPress. This vulnerability affects the function remove_csv_file_after_email_send of the component Save-and-Continue Addon. The manipulati
CVE-2026-100386 | mefic Ultra Addons for Contact Form 7 Plugin up to 3.5.54 on WordPress uacf7_wpcf7_mail_components path traversal (EUVD-2026-120825)
A vulnerability categorized as problematic has been discovered in mefic Ultra Addons for Contact Form 7 Plugin up to 3.5.54 on WordPress. Affected by this issue is the function uacf7_wpcf7_mail_components. Executing a manipulation can lead
CVE-2026-93427 | ARMember Premium Plugin up to 7.8.1 on WordPress Registration Custom Field cross site scripting (EUVD-2026-120826)
A vulnerability was found in ARMember Premium Plugin up to 7.8.1 on WordPress. It has been rated as problematic. Affected by this vulnerability is an unknown functionality of the component Registration Custom Field. Performing a manipulatio
CVE-2026-84938 | mefusion Avada Builder Plugin up to 3.16.1 on WordPress Media Upload cross site scripting (EUVD-2026-120827)
A vulnerability identified as problematic has been detected in mefusion Avada Builder Plugin up to 3.16.1 on WordPress. This affects an unknown part of the component Media Upload. The manipulation leads to cross site scripting. This vulnera
CVE-2026-61949 | Bookly Plugin up to 27.7 on WordPress sql injection (EUVD-2026-48207)
A vulnerability was found in Bookly Plugin up to 27.7 on WordPress. It has been declared as critical. Impacted is an unknown function. Such manipulation leads to sql injection. This vulnerability is referenced as CVE-2026-61949. It is possi
CVE-2022-4201 | GitLab Community Edition/Enterprise Edition server-side request forgery (Issue 30376 / EUVD-2022-51562)
A vulnerability was found in GitLab Community Edition and Enterprise Edition. It has been declared as critical. This affects an unknown part. Executing a manipulation can lead to server-side request forgery. The identification of this vulne
CVE-2022-4195 | Google Chrome up to 107.0.5304.121 Safe Browsing privilege escalation (EUVD-2022-51556)
A vulnerability categorized as problematic has been discovered in Google Chrome. Affected by this vulnerability is an unknown functionality of the component Safe Browsing. Such manipulation leads to privilege escalation. This vulnerability
CVE-2022-4194 | Google Chrome up to 107.0.5304.121 Accessibility use after free (EUVD-2022-51555)
A vulnerability was found in Google Chrome. It has been rated as problematic. Affected is an unknown function of the component Accessibility. This manipulation causes use after free. This vulnerability appears as CVE-2022-4194. The attacker
CVE-2022-4193 | Google Chrome up to 107.0.5304.121 File System API privilege escalation (EUVD-2022-51554)
A vulnerability was found in Google Chrome. It has been declared as problematic. This impacts an unknown function of the component File System API. The manipulation results in privilege escalation. This vulnerability is reported as CVE-2022
CVE-2022-4192 | Google Chrome up to 107.0.5304.121 Live Caption use after free (EUVD-2022-51553)
A vulnerability was found in Google Chrome. It has been classified as problematic. This affects an unknown function of the component Live Caption. The manipulation leads to use after free. This vulnerability is documented as CVE-2022-4192.
Notfall-Update stopft 0-Day-Lücke in Chrome
In den neuen Chrome-Versionen 157.0.8103.50/51 für Windows und macOS sowie 157.0.8103.50 für Linux haben die Entwickler als hohes Risiko eingestufte Schwachstellen behoben. Laut Google wird eine der gestopften Lücken bereits für Angriffe au
Notfall-Update stopft 0-Day-Lücke in Chrome
In den neuen Chrome-Versionen 157.0.8103.50/51 für Windows und macOS sowie 157.0.8103.50 für Linux haben die Entwickler als hohes Risiko eingestufte Schwachstellen behoben. Laut Google wird eine der gestopften Lücken bereits für Angriffe au
Chrome-Update schließt aktiv ausgenutzte Zero-Day-Lücke (CVE-2026-125350)
LONDON (IT BOLTWISE) – Google hat Chrome-Updates veröffentlicht, die neun Schwachstellen schließen, darunter eine aktiv ausgenutzte Zero-Day-Lücke. Betroffen ist CVE-2026-125350, laut Beschreibung ein Use-after-free-Fehler im XML-Komponente
CVE-2026-77026 | tassos.gr Convert Forms Extension up to 5.2.4 Submissions View access control (EUVD-2026-63242)
A vulnerability identified as problematic has been detected in tassos.gr Convert Forms Extension up to 5.2.4. Affected by this issue is some unknown functionality of the component Submissions View. The manipulation leads to improper access
CVE-2026-71694 | Berkeley BOOM 1.2 MRET SmallBoomTile_v1.2_state.v code injection (EUVD-2026-62483)
A vulnerability was found in Berkeley BOOM 1.2. It has been rated as critical. This affects an unknown function of the file Benchmarks/Verilog/SmallBoomTile_v1.2_state.v of the component MRET Handler. The manipulation leads to code injectio
CVE-2026-51366 | Bottinelli Informatica Vedo Suite 1.2.5 Chat Endpoint utente_chat sql injection (EUVD-2026-62481)
A vulnerability, which was classified as critical, has been found in Bottinelli Informatica Vedo Suite 1.2.5. Affected is an unknown function of the component Chat Endpoint. Performing a manipulation of the argument utente_chat results in s
CVE-2026-50720 | Ingenic T31 Boot ROM comparison
A vulnerability has been found in Ingenic T31 and classified as very critical. Affected by this issue is some unknown functionality of the component Boot ROM. The manipulation leads to incorrect comparison. This vulnerability is listed as C
CVE-2026-50719 | Ingenic T41/T32/T40/A1 SoC Boot ROM Init Table Parser signature verification
A vulnerability classified as very critical was found in Ingenic T41, T32, T40 and A1 SoC Boot ROM. This impacts an unknown function of the component Init Table Parser. Such manipulation leads to improper verification of cryptographic signa
CVE-2026-44768 | SAP CRM WebClient UI 105/106/S4FND 104 cross-domain policy (WID-SEC-2026-2308)
A vulnerability was found in SAP CRM WebClient UI 105/106/S4FND 104 and classified as problematic. This issue affects some unknown processing. The manipulation results in permissive cross-domain policy with untrusted domains. This vulnerabi
CVE-2026-11918 | IBM ContextForge MCP Gateway up to 1.0.4 privileges management (EUVD-2026-78898)
A vulnerability was found in IBM ContextForge MCP Gateway up to 1.0.4. It has been classified as critical. Impacted is an unknown function. Performing a manipulation results in improper privilege management. This vulnerability is cataloged
CVE-2024-7953 | Rockwell Automation DataEdgePlatform DataMosaix Private Cloud up to 7.07 privileges management
A vulnerability was found in Rockwell Automation DataEdgePlatform DataMosaix Private Cloud up to 7.07. It has been rated as very critical. The impacted element is an unknown function. This manipulation causes improper privilege management.
Barracuda Email Security Gateway Flaws Allow Unauthenticated Attackers to Execute Commands as Root
Two critical security vulnerabilities in Barracuda Email Security Gateway (ESG) could let unauthenticated attackers bypass authentication and run operating system commands as root. The vulnerabilities, tracked as CVE-2026-116606 and CVE-202
Chrome Update Patches Exploited XML Zero-Day, Eighth This Year
The high-severity use-after-free in Chrome’s XML component was reported anonymously on November 6 and is already exploited in attacks. This article has been indexed from SecurityWeek Read the original article: Chrome Update Patches Exploite
CVE-2026-43277 | Linux Kernel up to 6.19.5 ghes_new buffer overflow
A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.19.5. Affected by this vulnerability is the function ghes_new. This manipulation causes buffer overflow. This vulnerability is tracked as CVE-2026-432
CVE-2026-43267 | Linux Kernel up to 6.18.15/6.19.5 wifi divide by zero
A vulnerability classified as critical has been found in Linux Kernel up to 6.18.15/6.19.5. This affects an unknown function of the component wifi. Performing a manipulation results in divide by zero. This vulnerability is cataloged as CVE-
CVE-2026-26083 | Fortinet FortiSandbox Cloud/FortiSandbox/FortiSandbox PaaS up to 4.4.8/5.0.1 HTTP Request authorization (FG-IR-26-136)
A vulnerability identified as critical has been detected in Fortinet FortiSandbox Cloud, FortiSandbox and FortiSandbox PaaS up to 4.4.8/5.0.1. Affected by this vulnerability is an unknown functionality of the component HTTP Request Handler.
CVE-2026-14543 | Axis Communications AB AXIS OS up to 12.11.83/13.0.41 VAPIX Edge Storage API privileges management (EUVD-2026-120772)
A vulnerability was found in Axis Communications AB AXIS OS up to 12.11.83/13.0.41 and classified as problematic. Impacted is an unknown function of the component VAPIX Edge Storage API. Executing a manipulation can lead to improper privile
CVE-2026-14542 | Axis Communications AB Axis OS up to 10.12.351/11.11.227/12.11.122/13.0.82 VAPIX SIP configuration API input validation (EUVD-2026-120771)
A vulnerability was found in Axis Communications AB Axis OS up to 10.12.351/11.11.227/12.11.122/13.0.82. It has been rated as critical. This affects an unknown function of the component VAPIX SIP configuration API. This manipulation causes
CVE-2026-63288 | Axis Communications AB AXIS A1810 improper authorization (EUVD-2026-120775)
A vulnerability classified as very critical has been found in Axis Communications AB AXIS A1210, AXIS A1601, AXIS A1610, AXIS A1710 and AXIS A1810. This vulnerability affects unknown code. This manipulation causes improper authorization. Th
CVE-2026-63282 | Axis Communications Axis OS up to 13.0.83 command injection (EUVD-2026-120773)
A vulnerability was found in Axis Communications Axis OS up to 13.0.83. It has been classified as problematic. The affected element is an unknown function. The manipulation leads to command injection. This vulnerability is documented as CVE
CVE-2026-14918 | Axis Communications Signed Video Framework out-of-bounds (EUVD-2026-120774)
A vulnerability was found in Axis Communications Signed Video Framework, Signed Media Verifier and Axis File Player. It has been declared as problematic. The impacted element is an unknown function. The manipulation results in out-of-bounds
CVE-2026-8372 | Axis Communications AB AXIS Camera Station Pro up to 6.17 improper authorization (EUVD-2026-120777)
A vulnerability, which was classified as critical, has been found in Axis Communications AB AXIS Camera Station Pro up to 6.17. Impacted is an unknown function. Performing a manipulation results in improper authorization. This vulnerability
CVE-2026-4762 | Axis Communications AB AXIS Camera Station Pro up to 6.17 privileges management (EUVD-2026-120776)
A vulnerability classified as very critical was found in Axis Communications AB AXIS Camera Station Pro up to 6.17. This issue affects some unknown processing. Such manipulation leads to improper privilege management. This vulnerability is
CVE-2026-8810 | Insyde H2O up to 05.63.20/05.72.20 HDD Password information disclosure (EUVD-2026-62294 / WID-SEC-2026-3254)
A vulnerability, which was classified as problematic, was found in Insyde H2O up to 05.63.20/05.72.20. The impacted element is an unknown function of the component HDD Password. The manipulation results in information disclosure. This vulne
CVE-2026-76235 | Red Hat Enterprise Linux/OpenShift Dev Spaces 7/8/9/10 cockpit-ws CockpitLang memory leak
A vulnerability was found in Red Hat Enterprise Linux and OpenShift Dev Spaces 7/8/9/10. It has been classified as critical. This affects an unknown function of the component cockpit-ws. Performing a manipulation of the argument CockpitLang
CVE-2026-76166 | Red Hat Enterprise Application Platform Advertise Listener AdvertiseListenerImpl.java verifyDigest comparison (EUVD-2026-62367)
A vulnerability was found in Red Hat Enterprise Application Platform, Enterprise Application Platform Expansion Pack, Web Server and Single Sign-On. It has been rated as problematic. This issue affects the function verifyDigest of the file
CVE-2026-75981 | Cozmos Labs TranslatePress Plugin up to 3.2.5 on WordPress class-translation-render.php translate_page cross site scripting
A vulnerability has been found in Cozmos Labs TranslatePress Plugin up to 3.2.5 on WordPress and classified as problematic. This affects the function translate_page of the file includes/class-translation-render.php. This manipulation causes