Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 785 | 0,2 % |
| ≥50 % | 3.559 | 0,9 % |
| ≥10 % | 13.142 | 3,2 % |
| <10 % | 396.069 | 95,8 % |
[NEU] [hoch] IBM Tape Library: Schwachstelle ermöglicht Erlangen von Benutzerrechten
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in IBM Tape Library ausnutzen, um Sicherheitsvorkehrungen zu umgehen und Benutzerrechte zu erlangen. Weiterlesen
[NEU] [hoch] Red Hat Enterprise Linux (yggdrasil-worker-package-manager): Schwachstelle ermöglicht Privilegieneskalation
Ein entfernter Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um mit Root-Rechten Dateien zu erstellen, zu überschreiben oder zu löschen. Weiterlesen
[NEU] [niedrig] JetBrains You Track: Schwachstelle ermöglicht Darstellen falscher Informationen
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in JetBrains You Track ausnutzen, um falsche Informationen darzustellen. Weiterlesen
[NEU] [mittel] JetBrains PyCharm: Schwachstelle ermöglicht Codeausführung
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in JetBrains PyCharm ausnutzen, um beliebigen Programmcode auszuführen. Weiterlesen
[NEU] [UNGEPATCHT] [hoch] PyTorch: Schwachstelle ermöglicht Privilegieneskalation
Ein lokaler Angreifer kann eine Schwachstelle in PyTorch ausnutzen, um seine Privilegien zu erhöhen und beliebigen Programmcode mit den Rechten des Dienstes auszuführen. Weiterlesen
[NEU] [hoch] Microsoft Entra Device Registration: Schwachstelle ermöglicht Privilegieneskalation
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Microsoft Entra Device Registration ausnutzen, um seine Privilegien zu erhöhen. Weiterlesen
[NEU] [niedrig] WP Royal Royal Elementor Addons: Schwachstelle ermöglicht Offenlegung von Informationen
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in WP Royal Royal Elementor Addons ausnutzen, um Informationen offenzulegen. Weiterlesen
[NEU] [UNGEPATCHT] [mittel] Webmin: Schwachstelle ermöglicht Cross-Site Scripting
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Webmin ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen. Weiterlesen
[NEU] [mittel] IBM Tivoli Netcool/OMNIbus: Schwachstelle ermöglicht Cross-Site Scripting
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in IBM Tivoli Netcool/OMNIbus ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen und Informationen offenzulegen. Weiterlesen
[NEU] [UNGEPATCHT] [hoch] Keycloak: Schwachstelle ermöglicht Codeausführung
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Keycloak ausnutzen, um Sicherheitsvorkehungen zu umgehen, beliebigen Programmcode auszuführen, Informationen auszulesen, Dateien zu manipulieren oder einen Denial-of-Servi
CVE-2024-58241 | Linux Kernel up to 6.11.5 Bluetooth privilege escalation (EUVD-2025-30957 / Nessus ID 266040)
A vulnerability classified as critical was found in Linux Kernel up to 6.11.5. This affects an unknown function of the component Bluetooth. Executing a manipulation can lead to privilege escalation. This vulnerability is handled as CVE-2024
CVE-2024-57494 | Neto E-Commerce CMS kw cross site scripting
A vulnerability was found in Neto E-Commerce CMS. It has been rated as problematic. Affected by this vulnerability is an unknown functionality. The manipulation of the argument kw leads to cross site scripting. This vulnerability is documen
CVE-2024-51317 | NetSurf 3.11 dom_node_normalize command injection (Nessus ID 272162)
A vulnerability classified as critical was found in NetSurf 3.11. Affected by this vulnerability is the function dom_node_normalize. Executing a manipulation can lead to command injection. This vulnerability is handled as CVE-2024-51317. Th
CVE-2024-45162 | Blu-Castle BCUM221E 1.0.0P2205 Phddns Client password stack-based overflow
A vulnerability, which was classified as critical, has been found in Blu-Castle BCUM221E 1.0.0P2205. This affects an unknown function of the component Phddns Client. This manipulation of the argument Password causes stack-based buffer overf
CVE-2024-25011 | Ericsson Catalog Manager/Order Care up to 22.6 API information disclosure
A vulnerability was found in Ericsson Catalog Manager and Order Care up to 22.6. It has been classified as problematic. This affects an unknown function of the component API. This manipulation causes information disclosure. This vulnerabili
[UPDATE] [mittel] IBM Storage Scale: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen
Ein lokaler Angreifer kann eine Schwachstelle in IBM Storage Scale und IBM Storage Scale System ausnutzen, um Sicherheitsvorkehrungen zu umgehen. Weiterlesen
[UPDATE] [mittel] nmap: Schwachstelle ermöglicht Denial of Service
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in nmap ausnutzen, um einen Denial of Service Angriff durchzuführen. Weiterlesen
CVE-2024-51423 | Infor Global HR GHR up to 11.23.03.00.21 class cross site scripting
A vulnerability described as problematic has been identified in Infor Global HR GHR up to 11.23.03.00.21. The impacted element is an unknown function. Such manipulation of the argument Class leads to cross site scripting. This vulnerability
CVE-2024-48705 | Wavlink AC1200 M32A3_V1410_230602/M32A3_V1410_240222 adm.cgi set_sys_adm newpass command injection
A vulnerability labeled as critical has been found in Wavlink AC1200 M32A3_V1410_230602/M32A3_V1410_240222. Impacted is the function set_sys_adm of the file adm.cgi. The manipulation of the argument newpass results in command injection. Thi
CVE-2024-45434 | OpenSynergy BlueSDK up to 6.x use after free
A vulnerability was found in OpenSynergy BlueSDK up to 6.x. It has been classified as critical. Affected by this issue is some unknown functionality. This manipulation causes use after free. This vulnerability is tracked as CVE-2024-45434.
CVE-2024-45433 | OpenSynergy BlueSDK up to 6.x control flow
A vulnerability marked as critical has been reported in OpenSynergy BlueSDK up to 6.x. The impacted element is an unknown function. This manipulation causes incorrect control flow. This vulnerability appears as CVE-2024-45433. The attacker
CVE-2024-36354 | AMD Ryzen Threadripper 3000 Processors SPD improper prevention of lock bit modification (EUVD-2024-54969 / WID-SEC-2025-1770)
A vulnerability has been found in AMD Ryzen Threadripper 3000 Processors, Ryzen Threadripper PRO 5000 WX-Series Processors, Ryzen 5000 Mobile Processors with Radeon Graphics, Ryzen Threadripper PRO 3000 WX-Series Processors, Ryzen 3000 Mobi
CVE-2024-36352 | AMD Ryzen 4000 Mobile Processors with Radeon Graphics AMD Graphics Driver untrusted pointer dereference (EUVD-2024-54970 / WID-SEC-2025-1770)
A vulnerability was found in AMD Ryzen 4000 Mobile Processors with Radeon Graphics, Ryzen 6000 Processors with Radeon Graphics, Athlon 3000 Mobile Processors with Radeon Graphics, Ryzen 7040 Mobile Processors with Radeon Graphics, Ryzen 702
CVE-2024-36331 | AMD EPYC 9004 Processors/EPYC Embedded 9004 Processors initialization (Nessus ID 270134 / WID-SEC-2025-1770)
A vulnerability was found in AMD EPYC 9004 Processors and EPYC Embedded 9004 Processors. It has been declared as problematic. The impacted element is an unknown function. Such manipulation leads to improper initialization. This vulnerabilit
CVE-2024-36326 | AMD Ryzen 7040 Mobile Processors with Radeon Graphics authorization (EUVD-2024-54973 / WID-SEC-2025-1770)
A vulnerability was found in AMD Ryzen 7040 Mobile Processors with Radeon Graphics and Ryzen AI 300 Processors and classified as problematic. Impacted is an unknown function. The manipulation results in missing authorization. This vulnerabi
WordPress Security Update: How to Fix CVE-2026-119977 in 15 Minutes
If you run a WordPress site, this is a good week to check your version number. A flaw in the way WordPress updates itself, tracked as CVE-2026-119977, was added to the US CISA list of known exploited vulnerabilities on November 3, 2026. The
CVE-2024-46917 | Diebold Nixdorf Vynamic Security Suite up to 4.3.0 SR1 /root integrity check
A vulnerability has been found in Diebold Nixdorf Vynamic Security Suite up to 4.3.0 SR1 and classified as critical. The impacted element is an unknown function of the file /root. Performing a manipulation results in missing support for int
CVE-2024-46916 | Diebold Nixdorf Vynamic Security Suite up to 4.3.0 SR6 Delete Call /etc/rc.d/init.d/mountfs access control
A vulnerability classified as critical has been found in Diebold Nixdorf Vynamic Security Suite up to 4.3.0 SR6. The affected element is an unknown function of the file /etc/rc.d/init.d/mountfs of the component Delete Call Handler. This man
CVE-2024-38002 | Liferay Portal/DXP Workflow authorization (EUVD-2024-37060)
A vulnerability was found in Liferay Portal and DXP. It has been rated as critical. Affected by this issue is some unknown functionality of the component Workflow. This manipulation causes incorrect authorization. This vulnerability is hand
[UPDATE] [mittel] IBM App Connect Enterprise: Schwachstelle ermöglicht Offenlegung von Informationen
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in IBM App Connect Enterprise ausnutzen, um Sicherheitsmaßnahmen zu umgehen und Informationen auszuspähen. Weiterlesen
Hackers Exploit Plex2Shell Flaws to Take Over Plex Media Servers and Deploy Crypto Miners
Hackers are now using a public exploit chain called Plex2Shell to break into unpatched Plex Media Server systems and install cryptocurrency miners and proxy software. According to SecurityWeek, the attacks began one day after the exploit co
CVE-2026-43017 | Linux Kernel up to 6.19.11 Bluetooth mesh_send adv_data[] buffer overflow
A vulnerability labeled as critical has been found in Linux Kernel up to 6.1.167/6.6.133/6.12.80/6.18.21/6.19.11. This affects the function mesh_send of the component Bluetooth. Such manipulation of the argument adv_data[] leads to buffer o
CVE-2026-43012 | Linux Kernel up to 6.12.80/6.18.21/6.19.11 stack-based overflow
A vulnerability categorized as critical has been discovered in Linux Kernel up to 6.12.80/6.18.21/6.19.11. Affected by this vulnerability is an unknown functionality. The manipulation results in stack-based buffer overflow. This vulnerabili
CVE-2026-36959 | U-SPEED N300 1.0.0 Router Management Interface /api/login excessive authentication
A vulnerability, which was classified as problematic, was found in U-SPEED N300 1.0.0. This issue affects some unknown processing of the file /api/login of the component Router Management Interface. Such manipulation leads to improper restr
CVE-2026-36958 | U-SPEED N300 1.0.0 Web Management Interface denial of service
A vulnerability classified as problematic has been found in U-SPEED N300 1.0.0. Affected by this issue is some unknown functionality of the component Web Management Interface. The manipulation leads to denial of service. This vulnerability
CVE-2026-36957 | Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router 1.0.0 URI denial of service
A vulnerability classified as problematic was found in Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router 1.0.0. This affects an unknown part of the component URI Handler. The manipulation results in denial of service. This vulnerability was
CVE-2026-31784 | Linux Kernel up to 6.18.21/6.19.11 pxp_start denial of service
A vulnerability identified as critical has been detected in Linux Kernel up to 6.18.21/6.19.11. Affected by this vulnerability is the function pxp_start. The manipulation leads to denial of service. This vulnerability is referenced as CVE-2
CVE-2024-36058 | Koha Library up to 23.05.9 POST Parameter opac-sendbasket.pl bib_list sql injection
A vulnerability has been found in Koha Library up to 23.05.9 and classified as critical. Affected is an unknown function of the file /cgi-bin/koha/opac-sendbasket.pl of the component POST Parameter Handler. Performing a manipulation of the
CVE-2024-36057 | Koha Library up to 23.05.9 Filename os command injection
A vulnerability has been found in Koha Library up to 23.05.9 and classified as critical. This impacts an unknown function of the component Filename Handler. This manipulation causes os command injection. This vulnerability is handled as CVE
CVE-2024-33618 | Bosch DIVAR IP all-in-one 6000 up to 12.0.1 Network Interface resource consumption
A vulnerability labeled as problematic has been found in Bosch BVMS, BVMS Viewer, DIVAR IP all-in-one 7000 R3, DIVAR IP 7000 R2, DIVAR IP all-in-one 5000, DIVAR IP all-in-one 7000, DIVAR IP all-in-one 4000 and DIVAR IP all-in-one 6000 up to
CVE-2024-2104 | JBL LIVE PRO 2 TWS/TUNE FLEX Mobile App Service missing authentication (hbsa-2025-0001)
A vulnerability, which was classified as critical, was found in JBL LIVE PRO 2 TWS and TUNE FLEX. This affects an unknown function of the component Mobile App Service. Executing a manipulation can lead to missing authentication. This vulner
CVE-2024-1490 | WAGO WP400 up to 4.5.10 Web-based Management Interface code injection (VDE-2024-008)
A vulnerability was found in WAGO CC100, PFC100 G1, PFC100 G2, PFC200 G1, PFC200 G2, TP600, Edge Controller and WP400 up to 4.5.10. It has been rated as critical. The impacted element is an unknown function of the component Web-based Manage
CVE-2024-14028 | Softing smartLink HW-DP/smartLink HW-PN Webserver use after free
A vulnerability classified as critical has been found in Softing smartLink HW-DP and smartLink HW-PN. The affected element is an unknown function of the component Webserver. This manipulation causes use after free. This vulnerability is han
CVE-2026-18836 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinations and return the response to the attacker.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended des
CVE-2026-18689 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accepted where it should not be, which could reveal the names of other organizations.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accep
CVE-2026-17428 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization decisions without sufficient verification, which could allow access to information belonging to others.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization
CVE-2026-17411 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized before it is used in database queries.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized befo
CVE-2026-17410 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.
CVE-2026-17409 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of a request, which could allow restricted operations to be reached.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access c
CVE-2026-17408 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.
CVE-2026-17407 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before being used in a database query, which could allow SQL commands to run.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before
CVE-2026-17406 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Address checks can be bypassed, which could allow the server to reach destinations that should be blocked.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Address checks can be bypassed, which could allow the s
CVE-2026-17405 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm that the requesting user is permitted to read them, which could expose keystore information.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm
CVE-2026-17404 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17403 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.
CVE-2026-17402 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is passed to the operating system, which could allow commands to run on the underlying host.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is pas
CVE-2026-17401 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.
CVE-2026-17400 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
CVE-2026-17399 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to insufficient validation of uploaded content. Content uploaded to the product is not sufficiently checked before it is processed, which could allow code to run on the server.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to insufficient validation of uploaded content. Content uploaded to the product is not suffic
CVE-2026-17398 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.