Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 786 | 0,2 % |
| ≥50 % | 3.561 | 0,9 % |
| ≥10 % | 13.157 | 3,2 % |
| <10 % | 396.051 | 95,8 % |
🗂️ …
Microsoft November 2026 Patch Tuesday Addresses Critical RCE Flaws and Outlook Zero-Day Attacks
Microsoft released its November 2026 Patch Tuesday updates, addressing 1,093 newly disclosed vulnerabilities across Windows, Office, SQL Server, SharePoint, Exchange Server, Azure services, and developer tools. The release includes 63 Criti
Barracuda Email Security Gateway (ESG) im Nov. 2026 gehackt
Anbieter Barracuda hat zum 2. November 2026 die beiden Schwachstellen CVE-2026-116606 und CVE-2026-111560 gepatcht. Beides sind Pre-Authentication Authorization Bypass and Command Injection-Schwachstellen in diversen Produkten. Nun hat Barr
Microsoft Outlook Zero-Day Vulnerability Actively Exploited to Steal NTLM Authentication Hashes
Microsoft has patched an actively exploited Outlook zero-day that lets attackers steal Windows authentication information through a malicious message file. Tracked as CVE-2026-124194, the spoofing vulnerability was released on November 10,
CVE-2026-118302 | Microsoft Office heap-based overflow (Nessus ID 378498)
A vulnerability was found in Microsoft Office. It has been rated as critical. Affected by this issue is some unknown functionality. The manipulation leads to heap-based buffer overflow. This vulnerability is referenced as CVE-2026-118302. R
CVE-2026-118299 | Microsoft Excel heap-based overflow (Nessus ID 378498)
A vulnerability was found in Microsoft Excel. It has been declared as critical. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to heap-based buffer overflow. The identification of this vulnerab
CVE-2026-118298 | Microsoft Office heap-based overflow (Nessus ID 378498)
A vulnerability was found in Microsoft Office and classified as critical. This impacts an unknown function. Such manipulation leads to heap-based buffer overflow. This vulnerability is uniquely identified as CVE-2026-118298. The attack can
CVE-2026-118297 | Microsoft 365 Apps for Enterprise buffer overflow (Nessus ID 378498)
A vulnerability was found in Microsoft 365 Apps for Enterprise, Office 365 for Mac, Office LTSC 2021, Office LTSC 2024, Office LTSC for Mac 2021, Office LTSC for Mac 2024 and Office Online Server. It has been classified as critical. Affecte
CVE-2023-4345 | Broadcom RAID Controller Web Interface information disclosure
A vulnerability was found in Broadcom RAID Controller. It has been classified as problematic. Affected by this issue is some unknown functionality of the component Web Interface. Performing a manipulation results in information disclosure.
CVE-2023-4343 | Broadcom RAID Controller Web Interface search information disclosure
A vulnerability identified as problematic has been detected in Broadcom RAID Controller. Affected by this vulnerability is an unknown functionality of the component Web Interface. The manipulation of the argument Search leads to information
CVE-2023-4342 | Broadcom RAID Controller Web Interface unprotected transport of credentials
A vulnerability was found in Broadcom RAID Controller. It has been rated as problematic. This impacts an unknown function of the component Web Interface. Performing a manipulation results in unprotected transport of credentials. This vulner
CVE-2023-4341 | Broadcom RAID Controller Web GUI privilege escalation
A vulnerability was found in Broadcom RAID Controller. It has been classified as critical. This issue affects some unknown processing of the component Web GUI. The manipulation leads to privilege escalation. This vulnerability is listed as
CVE-2023-4340 | Broadcom RAID Controller log file
A vulnerability categorized as problematic has been discovered in Broadcom RAID Controller. Affected is an unknown function. Executing a manipulation can lead to sensitive information in log files. This vulnerability is registered as CVE-20
CVE-2023-4339 | Broadcom RAID Controller Web Interface permission
A vulnerability was found in Broadcom RAID Controller. It has been classified as critical. The impacted element is an unknown function of the component Web Interface. This manipulation causes permission issues. This vulnerability is tracked
CVE-2023-4338 | Broadcom RAID Controller Web Interface Remote Code Execution
A vulnerability was found in Broadcom RAID Controller. It has been declared as critical. This affects an unknown function of the component Web Interface. Such manipulation leads to Remote Code Execution. This vulnerability is listed as CVE-
CVE-2023-40021 | Oppia up to 3.3.2-hotfix-1 information exposure (GHSA-49jp-pjc3-2532)
A vulnerability classified as problematic has been found in Oppia up to 3.3.2-hotfix-1. This vulnerability affects unknown code. The manipulation leads to information exposure through discrepancy. This vulnerability is listed as CVE-2023-40
CVE-2023-34412 | Red Lion mbNET/mbNET.rokey prior 7.3.2 cross site scripting (VDE-2023-012)
A vulnerability was found in Red Lion mbNET and mbNET.rokey. It has been classified as problematic. This issue affects some unknown processing. Performing a manipulation results in cross site scripting. This vulnerability is reported as CVE
CVE-2023-3160 | ESET NOD32 Antivirus File permission
A vulnerability was found in ESET NOD32 Antivirus, Internet Security, Smart Security Premium, Endpoint Antivirus, Endpoint Security, Server Security for Windows Server, Mail Security for Microsoft Exchange Server, Mail Security for IBM Domi
CVE-2023-2110 | Obsidian Desktop up to 1.2.7 App Scheme path traversal
A vulnerability labeled as critical has been found in Obsidian Desktop up to 1.2.7. This vulnerability affects unknown code of the component App Scheme Handler. Such manipulation leads to path traversal. This vulnerability is listed as CVE-
CVE-2022-4894 | HP/Samsung Printer Software Package uncontrolled search path
A vulnerability, which was classified as problematic, was found in HP/Samsung Printer Software Package. The affected element is an unknown function. Such manipulation leads to uncontrolled search path. This vulnerability is documented as CV
CVE-2023-39406 | Huawei EMUI/Magic UI XLayout permission
A vulnerability marked as critical has been reported in Huawei EMUI and Magic UI. The affected element is an unknown function of the component XLayout Component. Performing a manipulation results in permission issues. This vulnerability is
CVE-2023-39404 | Huawei EMUI/Magic UI Window Management denial of service
A vulnerability labeled as problematic has been found in Huawei EMUI and Magic UI. Impacted is an unknown function of the component Window Management Module. Such manipulation leads to denial of service. This vulnerability is traded as CVE-
CVE-2023-39394 | Huawei EMUI/Magic UI API access control
A vulnerability was found in Huawei EMUI and Magic UI and classified as critical. Affected is an unknown function of the component API. Such manipulation leads to improper access controls. This vulnerability is listed as CVE-2023-39394. The
CVE-2026-126559 | Semantic MediaWiki up to 7.3.1 FacetedSearch OptionsBuilder::profiles cross site scripting (EUVD-2026-123074)
A vulnerability classified as problematic was found in Semantic MediaWiki up to 7.3.1. Affected by this issue is the function OptionsBuilder::profiles of the component FacetedSearch. Executing a manipulation can lead to cross site scripting
CVE-2026-126560 | Semantic MediaWiki up to 7.4.0 DataTables integration data-search/data-filter cross site scripting (EUVD-2026-123075)
A vulnerability, which was classified as problematic, has been found in Semantic MediaWiki up to 7.4.0. This affects an unknown part of the component DataTables integration. The manipulation of the argument data-search/data-filter leads to
CVE-2026-126562 | Semantic MediaWiki up to 7.4.0 ElasticStore ConceptDescriptionInterpreter api.php recursion (EUVD-2026-123077)
A vulnerability, which was classified as problematic, was found in Semantic MediaWiki up to 7.4.0. This vulnerability affects unknown code of the file api.php of the component ElasticStore ConceptDescriptionInterpreter. The manipulation res
CVE-2026-126561 | SemanticMediaWiki Semantic MediaWiki up to 7.4.0 TitleQuickPermissions Hook improper authorization (EUVD-2026-123076)
A vulnerability was found in SemanticMediaWiki Semantic MediaWiki up to 7.4.0 and classified as problematic. Impacted is an unknown function of the component TitleQuickPermissions Hook. Such manipulation leads to improper authorization. Thi
CVE-2026-126564 | Semantic MediaWiki 2.5.0/7.4.0 ValueFormatter getFormattedSubject cross site scripting (EUVD-2026-123079)
A vulnerability marked as problematic has been reported in Semantic MediaWiki 2.5.0/7.4.0. Affected by this issue is the function ValueFormatter::getFormattedSubject of the component ValueFormatter. Performing a manipulation results in cros
CVE-2026-126563 | Semantic MediaWiki up to 7.4.0 TimeValueFormatter getCaptionFromFreeFormat cross site scripting (EUVD-2026-123078)
A vulnerability identified as problematic has been detected in Semantic MediaWiki up to 7.4.0. Affected is the function TimeValueFormatter::getCaptionFromFreeFormat of the component TimeValueFormatter. This manipulation causes cross site sc
CVE-2026-126565 | Semantic MediaWiki up to 7.4.0 ElasticStore api.php ConceptDescriptionInterpreter denial of service (EUVD-2026-123080)
A vulnerability has been found in Semantic MediaWiki up to 7.4.0 and classified as problematic. This issue affects the function ConceptDescriptionInterpreter of the file api.php of the component ElasticStore. This manipulation causes denial
CVE-2026-126566 | Semantic MediaWiki up to 7.4.0 EditProtectionUpdater userMayChangeProtection improper authorization (EUVD-2026-123081)
A vulnerability was found in Semantic MediaWiki up to 7.4.0. It has been classified as problematic. The affected element is the function EditProtectionUpdater::userMayChangeProtection of the component EditProtectionUpdater. Performing a man
CVE-2026-126569 | MbinOrg Mbin up to 1.11.0 EmbedElement buildDestructed cross site scripting (EUVD-2026-123083)
A vulnerability described as problematic has been identified in MbinOrg Mbin up to 1.11.0. This affects the function EmbedElement::buildDestructed of the component EmbedElement. Executing a manipulation can lead to cross site scripting. Thi
CVE-2026-126567 | Semantic MediaWiki up to 7.4.0 ElasticStore native_result/score_set cross site scripting (EUVD-2026-123082)
A vulnerability labeled as problematic has been found in Semantic MediaWiki up to 7.4.0. Affected by this vulnerability is an unknown functionality of the component ElasticStore. Such manipulation of the argument native_result/score_set lea
CVE-2026-126571 | Padloc 4.0.0/4.3.0 MFAToken handler retrieveMFAToken excessive authentication (EUVD-2026-123085)
A vulnerability classified as problematic has been found in Padloc 4.0.0/4.3.0. This vulnerability affects the function retrieveMFAToken of the component MFAToken handler. The manipulation leads to improper restriction of excessive authenti
CVE-2026-126570 | Padloc up to 4.3.0 SCIM ScimServer._handleScimUsersPatch prototype pollution (EUVD-2026-123084)
A vulnerability was found in Padloc up to 4.3.0. It has been declared as problematic. The impacted element is the function ScimServer._handleScimUsersPatch of the component SCIM Handler. Executing a manipulation can lead to improperly contr
CVE-2026-121454 | Padloc up to 4.3.0 SCIM Server ScimServer._handleScimGet missing authentication (EUVD-2026-115886)
A vulnerability classified as problematic has been found in Padloc up to 4.3.0. This issue affects the function ScimServer._handleScimGet of the component SCIM Server. Performing a manipulation results in missing authentication. This vulner
CVE-2026-118294 | Microsoft Excel heap-based overflow (Nessus ID 378498)
A vulnerability, which was classified as critical, has been found in Microsoft Excel. The affected element is an unknown function. The manipulation leads to heap-based buffer overflow. This vulnerability is traded as CVE-2026-118294. It is
CVE-2026-116927 | Microsoft Office/Office Online Server Excel heap-based overflow (Nessus ID 378498)
A vulnerability labeled as critical has been found in Microsoft Office and Office Online Server. This vulnerability affects unknown code of the component Excel. The manipulation results in heap-based buffer overflow. This vulnerability is r
CVE-2026-112967 | Microsoft Windows up to 11 26H2 buffer overflow (Nessus ID 378499)
A vulnerability was found in Microsoft Windows up to 11 26H2 and classified as very critical. Affected by this issue is some unknown functionality. The manipulation results in buffer overflow. This vulnerability is identified as CVE-2026-11
CVE-2026-85844 | Microsoft Windows up to Server 2025 Kerberos improper authorization (Nessus ID 378500)
A vulnerability was found in Microsoft Windows and classified as very critical. The affected element is an unknown function of the component Kerberos. Such manipulation leads to improper authorization. This vulnerability is referenced as CV
CVE-2026-119958 | Microsoft Windows up to Server 2025 LDAP out-of-bounds write (Nessus ID 378500)
A vulnerability, which was classified as very critical, was found in Microsoft Windows. Impacted is an unknown function of the component LDAP. Executing a manipulation can lead to out-of-bounds write. This vulnerability is handled as CVE-20
CVE-2026-116928 | Microsoft Windows up to Server 2025 Search out-of-bounds write (Nessus ID 378500)
A vulnerability marked as very critical has been reported in Microsoft Windows. This affects an unknown function of the component Search Component. The manipulation leads to out-of-bounds write. This vulnerability is uniquely identified as
CVE-2026-88236 | Microsoft Windows 11/Server 2022/Server 2025 QUIC null pointer dereference (EUVD-2026-121606)
A vulnerability, which was classified as critical, has been found in Microsoft Windows 11/Server 2022/Server 2025. This affects an unknown function of the component QUIC. This manipulation causes null pointer dereference. The identification
CVE-2026-70240 | Microsoft Windows up to Server 2025 Kerberos resource consumption (EUVD-2026-121594)
A vulnerability was found in Microsoft Windows. It has been rated as critical. The affected element is an unknown function of the component Kerberos. Performing a manipulation results in resource consumption. This vulnerability is cataloged
CVE-2026-120796 | Microsoft .NET System.Text.Json resource consumption (EUVD-2026-122469)
A vulnerability labeled as problematic has been found in Microsoft .NET. This affects an unknown part of the component System.Text.Json. The manipulation results in resource consumption. This vulnerability is cataloged as CVE-2026-120796. T
CVE-2026-97015 | Microsoft Windows up to Server 2025 BitLocker heap-based overflow (EUVD-2026-121509)
A vulnerability classified as very critical has been found in Microsoft Windows. This affects an unknown function of the component BitLocker. This manipulation causes heap-based buffer overflow. This vulnerability appears as CVE-2026-97015.
CVE-2026-96115 | Microsoft Windows up to Server 2025 DHCP Client double free (EUVD-2026-121484)
A vulnerability classified as very critical was found in Microsoft Windows 11 24H2/11 25H2/11 26H1/11 26H2/Server 2025. Affected is an unknown function of the component DHCP Client. The manipulation results in double free. This vulnerabilit
CVE-2026-95692 | OpenSSL up to 3.5.9/4.0.3/4.1.0 AES-GCM-SIV EVP_CipherInit_ex out-of-bounds (WID-SEC-2026-4443)
A vulnerability, which was classified as critical, was found in OpenSSL up to 3.5.9/4.0.3/4.1.0. This impacts the function EVP_CipherInit_ex of the component AES-GCM-SIV. Such manipulation leads to out-of-bounds read. This vulnerability is
CVE-2026-119263 | Google Chrome up to 156.0.8078.73 GarbageCollection memory corruption (WID-SEC-2026-4244)
A vulnerability identified as critical has been detected in Google Chrome. Affected is an unknown function of the component GarbageCollection. The manipulation leads to memory corruption. This vulnerability is documented as CVE-2026-119263.
CVE-2026-95691 | OpenSSL up to 3.5.9/4.0.3/4.1.0 QUIC use after free (WID-SEC-2026-4443)
A vulnerability labeled as critical has been found in OpenSSL up to 3.5.9/4.0.3/4.1.0. This vulnerability affects unknown code of the component QUIC. Such manipulation leads to use after free. This vulnerability is traded as CVE-2026-95691.
CVE-2026-88823 | OpenSSL up to 3.5.9/4.0.3/4.1.0 AES-GCM-SIV missing cryptographic step (WID-SEC-2026-4443)
A vulnerability classified as problematic was found in OpenSSL up to 3.5.9/4.0.3/4.1.0. The impacted element is an unknown function of the component AES-GCM-SIV. The manipulation results in missing cryptographic step. This vulnerability was
CVE-2026-88822 | OpenSSL up to 3.5.9/4.0.3/4.1.0 QUIC getpeername uninitialized variable (WID-SEC-2026-4443)
A vulnerability identified as critical has been detected in OpenSSL up to 3.5.9/4.0.3/4.1.0. This affects the function getpeername of the component QUIC. This manipulation causes use of uninitialized variable. This vulnerability appears as
CVE-2026-107496 | OpenSSL up to 3.0.23/3.5.9/4.0.3/4.1.0 CMS_encrypt/CMS_encrypt_ex infinite loop (WID-SEC-2026-4443)
A vulnerability, which was classified as problematic, was found in OpenSSL up to 3.0.23/3.5.9/4.0.3/4.1.0. This affects the function CMS_encrypt/CMS_encrypt_ex. Executing a manipulation can lead to infinite loop. This vulnerability is track
CVE-2026-96010 | Microsoft Windows up to Server 2025 HID Parser integer underflow (EUVD-2026-121455)
A vulnerability, which was classified as very critical, was found in Microsoft Windows. Affected by this vulnerability is an unknown functionality of the component HID Parser. The manipulation results in integer underflow. This vulnerabilit
CVE-2026-95998 | Microsoft Windows up to Server 2025 StateRepository API missing authentication (EUVD-2026-121451)
A vulnerability has been found in Microsoft Windows up to Server 2025 and classified as problematic. The impacted element is an unknown function of the component StateRepository API. The manipulation leads to missing authentication. This vu
CVE-2026-95996 | Microsoft Windows up to Server 2025 Bluetooth Port Driver integer underflow (EUVD-2026-121770)
A vulnerability, which was classified as very critical, has been found in Microsoft Windows. Affected is an unknown function of the component Bluetooth Port Driver. The manipulation leads to integer underflow. This vulnerability is document
CVE-2026-95947 | Microsoft Windows up to Server 2025 Error Reporting privileges management (EUVD-2026-121438)
A vulnerability has been found in Microsoft Windows and classified as very critical. This impacts an unknown function of the component Error Reporting. The manipulation leads to improper privilege management. This vulnerability is traded as
CVE-2026-95944 | Microsoft Windows up to Server 2025 improper authorization (EUVD-2026-121635)
A vulnerability categorized as problematic has been discovered in Microsoft Windows. This vulnerability affects unknown code. Executing a manipulation can lead to improper authorization. The identification of this vulnerability is CVE-2026-
CVE-2026-95910 | Microsoft Windows up to Server 2025 Hyper-V certificate validation (EUVD-2026-121753)
A vulnerability was found in Microsoft Windows. It has been classified as problematic. This affects an unknown part of the component Hyper-V. This manipulation causes improper certificate validation. The identification of this vulnerability
CVE-2026-95885 | Microsoft Windows up to Server 2025 NFS use after free (EUVD-2026-121621)
A vulnerability described as very critical has been identified in Microsoft Windows. This vulnerability affects unknown code of the component NFS. Executing a manipulation can lead to use after free. This vulnerability appears as CVE-2026-9
CVE-2026-126261 | Fortinet FortiManager up to 7.2.8/7.4.5/7.6.7/8.0.0 FGFM improper authorization (EUVD-2026-123051)
A vulnerability was found in Fortinet FortiManager up to 7.2.8/7.4.5/7.6.7/8.0.0 and classified as very critical. Affected is an unknown function of the component FGFM Handler. Such manipulation leads to improper authorization. This vulnera