Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 786 | 0,2 % |
| ≥50 % | 3.560 | 0,9 % |
| ≥10 % | 13.154 | 3,2 % |
| <10 % | 396.055 | 95,8 % |
Google fixes the eighth actively exploited Chrome zero-day of 2026
Google patched nine Chrome flaws, including a V8 vulnerability tracked as CVE-2026-125350, that attackers have been actively exploiting in the wild. Google has addressed multiple security vulnerabilities, one of which, tracked as CVE-2026-1
[UPDATE] [hoch] RPM: Schwachstelle ermöglicht Codeausführung
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in RPM ausnutzen, um beliebigen Programmcode auszuführen. Weiterlesen
Anthropic Launches Claude Mythos 5.2, Scoring 76.3% on Cybersecurity Benchmark to Identify 0-Day Flaws
Anthropic has launched Claude Mythos 5.2, its latest AI model for cybersecurity engineering, reporting a 76.3% score on CyScenarioBench. Released on November 9 alongside Claude Fable 5.2, the model is designed to help security teams find, r
[NEU] [hoch] Atlassian Confluence: Schwachstelle ermöglicht Codeausführung
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Atlassian Confluence ausnutzen, um beliebigen Programmcode auszuführen. Weiterlesen
[NEU] [mittel] Google Cloud Service Mesh: Schwachstelle ermöglicht Denial of Service
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Google Cloud Service Mesh ausnutzen, um einen Denial of Service Angriff durchzuführen. Weiterlesen
[NEU] [mittel] Infoblox NIOS: Schwachstelle ermöglicht Cross-Site Scripting
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Infoblox NIOS ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen. Weiterlesen
[NEU] [mittel] Ghostscript: Schwachstelle ermöglicht Codeausführung
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Ghostscript ausnutzen, um beliebigen Programmcode auszuführen. Weiterlesen
[NEU] [UNGEPATCHT] [mittel] Tinyproxy: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Tinyproxy ausnutzen, um Sicherheitsvorkehrungen zu umgehen. Weiterlesen
[NEU] [niedrig] ImageMagick: Schwachstelle ermöglicht Offenlegung von Informationen
Ein lokaler Angreifer kann eine Schwachstelle in ImageMagick ausnutzen, um Informationen offenzulegen. Weiterlesen
Chrome-Zero-Day wird angegriffen: Nutzer sollten dringend updaten
Google hat ein Sicherheitsupdate für seinen Chrome-Browser veröffentlicht, das neun Schwachstellen beseitigt. In einem Fall handelt es sich um eine Zero-Day-Lücke, die nach Angaben des Unternehmens bereits für Angriffe ausgenutzt wird. (Wei
N-able nimmt MSP-Software nach 33 Zero-Day-Lücken vom Netz
Ein Forscher veröffentlichte Exploits für die Fernwartungsplattform ohne Absprache. Auch lokale Server sollen bis zum Hotfix abgeschaltet werden. Der Softwareanbieter N-able hat seine gehosteten Umgebungen der Plattform N-central in Nord- u
Critical Apache Airflow Flaw Allows Hackers to Execute Code Without Authentication
A missing-authentication defect in Apache Airflow’s CeleryExecutor lets any actor with write access to the Celery broker run arbitrary Python callables on every worker. The bug is tracked as CVE-2026-68982 and classified under CWE-306 (Miss
[UPDATE] [mittel] RPM: Schwachstelle ermöglicht Codeausführung
Ein lokaler Angreifer kann eine Schwachstelle in RPM ausnutzen, um potenziell Code auszuführen, Daten zu manipulieren oder um einen Denial-of-Service-Zustand herbeizuführen. Weiterlesen
CVE-2026-88833 | BusyBox udhcpc integer underflow
A vulnerability was found in BusyBox and classified as critical. Impacted is an unknown function of the component udhcpc. The manipulation results in integer underflow. This vulnerability was named CVE-2026-88833. The attack may be performe
CVE-2026-83844 | Microsoft Windows up to 11.3.9 out-of-bounds
A vulnerability, which was classified as critical, was found in Microsoft Windows. This affects an unknown part. Such manipulation leads to out-of-bounds read. This vulnerability is documented as CVE-2026-83844. The attack can be executed r
CVE-2026-76459 | Cisco NX-OS Software out-of-bounds write (EUVD-2026-94462)
A vulnerability was found in Cisco NX-OS Software, NX-OS System Software in ACI Mode and Unified Computing System. It has been rated as very critical. This affects an unknown function. This manipulation causes out-of-bounds write. This vuln
CVE-2026-76285 | Splunk Enterprise up to 9.4.14/10.0.9/10.2.6/10.4.2 isolation
A vulnerability was found in Splunk Enterprise up to 9.4.14/10.0.9/10.2.6/10.4.2. It has been classified as critical. This affects an unknown part. The manipulation leads to improper isolation or compartmentalization. This vulnerability is
CVE-2026-76284 | Splunk Enterprise up to 9.4.14/10.0.9/10.2.6/10.4.2 neutralization
A vulnerability was found in Splunk Enterprise up to 9.4.14/10.0.9/10.2.6/10.4.2 and classified as very critical. Affected by this issue is some unknown functionality. Executing a manipulation can lead to improper neutralization. The identi
CVE-2026-76283 | Splunk Enterprise up to 9.4.14/10.0.9/10.2.6/10.4.2 protection mechanism
A vulnerability has been found in Splunk Enterprise up to 9.4.14/10.0.9/10.2.6/10.4.2 and classified as critical. Affected by this vulnerability is an unknown functionality. Performing a manipulation results in protection mechanism failure.
CVE-2026-76282 | Splunk Enterprise up to 9.4.14/10.0.9/10.2.6/10.4.2 allocation of resources (EUVD-2026-94634)
A vulnerability, which was classified as very critical, was found in Splunk Enterprise up to 9.4.14/10.0.9/10.2.6/10.4.2. Affected is an unknown function. Such manipulation leads to allocation of resources. This vulnerability is uniquely id
CVE-2026-76281 | Splunk Enterprise up to 9.4.14/10.0.9/10.2.6/10.4.2 access control
A vulnerability identified as very critical has been detected in Splunk Enterprise up to 9.4.14/10.0.9/10.2.6/10.4.2. This vulnerability affects unknown code. This manipulation causes improper access controls. This vulnerability is register
CVE-2026-109601 | Frappe Framework up to 15.116.x/16.29.x Email HTML Attribute path traversal
A vulnerability was found in Frappe Framework up to 15.116.x/16.29.x. It has been declared as problematic. This vulnerability affects unknown code of the component Email HTML Attribute Handler. Such manipulation leads to path traversal. Thi
CVE-2024-8122 | WSO2 Identity Server up to 5.10.x SMS OTP access control
A vulnerability described as critical has been identified in WSO2 Identity Server up to 5.10.x. Affected by this issue is some unknown functionality of the component SMS OTP. Such manipulation leads to improper access controls. This vulnera
CVE-2024-58391 | Frappe up to 14.57.x/15.3.x Printview cross site scripting
A vulnerability described as problematic has been identified in Frappe up to 14.57.x/15.3.x. This vulnerability affects unknown code of the component Printview. Executing a manipulation can lead to cross site scripting. This vulnerability i
Google fixes Chrome XML zero-day flaw exploited in attacks
Google released a Chrome security update that addresses nine vulnerabilities, including a high-severity XML flaw exploited in the wild. The security update brings the Stable channel to version 157.0.8103.50/.51 for Windows and macOS and 157
CVE-2026-80490 | Algorithm::AhoCorasick::XS up to 0.04 matches/first_match/match_details out-of-bounds
A vulnerability, which was classified as critical, was found in Algorithm::AhoCorasick::XS up to 0.04. Affected by this vulnerability is the function matches/first_match/match_details. The manipulation results in out-of-bounds read. This vu
CVE-2026-17262 | IBM i 7.3/7.4/7.5/7.6 denial of service (EUVD-2026-83295)
A vulnerability labeled as critical has been found in IBM i 7.3/7.4/7.5/7.6. The affected element is an unknown function. Such manipulation leads to denial of service. This vulnerability is uniquely identified as CVE-2026-17262. Local acces
CVE-2026-12542 | Foreman foreman-tail command injection (WID-SEC-2026-3712)
A vulnerability marked as very critical has been reported in Foreman. The impacted element is an unknown function of the component foreman-tail. The manipulation leads to command injection. This vulnerability is documented as CVE-2026-12542
CVE-2026-10841 | IBM WebSphere Application Server/WebSphere Liberty 8.5/9.0 request smuggling
A vulnerability, which was classified as problematic, has been found in IBM WebSphere Application Server and WebSphere Liberty 8.5/9.0. This vulnerability affects unknown code. The manipulation leads to http request smuggling. This vulnerab
CVE-2026-103442 | Wikimedia Foundation MediaWiki 1.43/1.45/1.46 CentralAuth code injection
A vulnerability was found in Wikimedia Foundation MediaWiki 1.43/1.45/1.46. It has been declared as critical. This affects an unknown function of the component CentralAuth. Executing a manipulation can lead to code injection. This vulnerabi
CVE-2026-103441 | Wikimedia Foundation MediaWiki 1.43/1.45/1.46 Wikibase deserialization
A vulnerability was found in Wikimedia Foundation MediaWiki 1.43/1.45/1.46. It has been classified as critical. The impacted element is an unknown function of the component Wikibase. Performing a manipulation results in deserialization. Thi
CVE-2024-58388 | Sharp/Toshiba Tec Multiple Multifunction Printers installed_emanual_down.html path path traversal
Further investigation has shown that this issues is a false-positive. Please review the sources mentioned and consider not using this entry at all. Weiterlesen
CVE-2024-58387 | Inspur Haiyue HCM Cloud Download Endpoint download index/ext information disclosure
A vulnerability identified as problematic has been detected in Inspur Haiyue HCM Cloud. This vulnerability affects unknown code of the file /api/model_report/file/download of the component Download Endpoint. This manipulation of the argumen
CVE-2024-58386 | ZoneMinder up to 1.37.x Files View output_file path path traversal
A vulnerability has been found in ZoneMinder up to 1.37.x and classified as problematic. This impacts the function output_file of the component Files View. This manipulation of the argument path causes path traversal. This vulnerability is
CVE-2024-42002 | Open Source Robotics Robot Operating System Crystal Clemmys up to Lyrical Luth Hz Verb eval filter code injection
A vulnerability marked as critical has been reported in Open Source Robotics Robot Operating System. This vulnerability affects the function eval of the component Hz Verb. This manipulation of the argument filter causes code injection. This
CVE-2026-76877 | WPML Multilingual CMS Plugin up to 4.9.7 on WordPress SSO wp-login.php process_iframe_request wpml_sso_token_domain race condition (EUVD-2026-120823)
A vulnerability was found in WPML Multilingual CMS Plugin up to 4.9.7 on WordPress. It has been declared as critical. Affected is the function process_iframe_request of the file wp-login.php of the component SSO Handler. Such manipulation o
CVE-2026-120513 | WPEverest Everest Forms Plugin up to 3.6.2 on WordPress Save-and-Continue Addon remove_csv_file_after_email_send path traversal (EUVD-2026-120824)
A vulnerability labeled as critical has been found in WPEverest Everest Forms Plugin up to 3.6.2 on WordPress. This vulnerability affects the function remove_csv_file_after_email_send of the component Save-and-Continue Addon. The manipulati
CVE-2026-100386 | mefic Ultra Addons for Contact Form 7 Plugin up to 3.5.54 on WordPress uacf7_wpcf7_mail_components path traversal (EUVD-2026-120825)
A vulnerability categorized as problematic has been discovered in mefic Ultra Addons for Contact Form 7 Plugin up to 3.5.54 on WordPress. Affected by this issue is the function uacf7_wpcf7_mail_components. Executing a manipulation can lead
CVE-2026-93427 | ARMember Premium Plugin up to 7.8.1 on WordPress Registration Custom Field cross site scripting (EUVD-2026-120826)
A vulnerability was found in ARMember Premium Plugin up to 7.8.1 on WordPress. It has been rated as problematic. Affected by this vulnerability is an unknown functionality of the component Registration Custom Field. Performing a manipulatio
CVE-2026-84938 | mefusion Avada Builder Plugin up to 3.16.1 on WordPress Media Upload cross site scripting (EUVD-2026-120827)
A vulnerability identified as problematic has been detected in mefusion Avada Builder Plugin up to 3.16.1 on WordPress. This affects an unknown part of the component Media Upload. The manipulation leads to cross site scripting. This vulnera
CVE-2026-61949 | Bookly Plugin up to 27.7 on WordPress sql injection (EUVD-2026-48207)
A vulnerability was found in Bookly Plugin up to 27.7 on WordPress. It has been declared as critical. Impacted is an unknown function. Such manipulation leads to sql injection. This vulnerability is referenced as CVE-2026-61949. It is possi
CVE-2022-4201 | GitLab Community Edition/Enterprise Edition server-side request forgery (Issue 30376 / EUVD-2022-51562)
A vulnerability was found in GitLab Community Edition and Enterprise Edition. It has been declared as critical. This affects an unknown part. Executing a manipulation can lead to server-side request forgery. The identification of this vulne
CVE-2022-4195 | Google Chrome up to 107.0.5304.121 Safe Browsing privilege escalation (EUVD-2022-51556)
A vulnerability categorized as problematic has been discovered in Google Chrome. Affected by this vulnerability is an unknown functionality of the component Safe Browsing. Such manipulation leads to privilege escalation. This vulnerability
CVE-2022-4194 | Google Chrome up to 107.0.5304.121 Accessibility use after free (EUVD-2022-51555)
A vulnerability was found in Google Chrome. It has been rated as problematic. Affected is an unknown function of the component Accessibility. This manipulation causes use after free. This vulnerability appears as CVE-2022-4194. The attacker
CVE-2022-4193 | Google Chrome up to 107.0.5304.121 File System API privilege escalation (EUVD-2022-51554)
A vulnerability was found in Google Chrome. It has been declared as problematic. This impacts an unknown function of the component File System API. The manipulation results in privilege escalation. This vulnerability is reported as CVE-2022
CVE-2022-4192 | Google Chrome up to 107.0.5304.121 Live Caption use after free (EUVD-2022-51553)
A vulnerability was found in Google Chrome. It has been classified as problematic. This affects an unknown function of the component Live Caption. The manipulation leads to use after free. This vulnerability is documented as CVE-2022-4192.
Notfall-Update stopft 0-Day-Lücke in Chrome
In den neuen Chrome-Versionen 157.0.8103.50/51 für Windows und macOS sowie 157.0.8103.50 für Linux haben die Entwickler als hohes Risiko eingestufte Schwachstellen behoben. Laut Google wird eine der gestopften Lücken bereits für Angriffe au
CVE-2026-77026 | tassos.gr Convert Forms Extension up to 5.2.4 Submissions View access control (EUVD-2026-63242)
A vulnerability identified as problematic has been detected in tassos.gr Convert Forms Extension up to 5.2.4. Affected by this issue is some unknown functionality of the component Submissions View. The manipulation leads to improper access
CVE-2026-71694 | Berkeley BOOM 1.2 MRET SmallBoomTile_v1.2_state.v code injection (EUVD-2026-62483)
A vulnerability was found in Berkeley BOOM 1.2. It has been rated as critical. This affects an unknown function of the file Benchmarks/Verilog/SmallBoomTile_v1.2_state.v of the component MRET Handler. The manipulation leads to code injectio
CVE-2026-51366 | Bottinelli Informatica Vedo Suite 1.2.5 Chat Endpoint utente_chat sql injection (EUVD-2026-62481)
A vulnerability, which was classified as critical, has been found in Bottinelli Informatica Vedo Suite 1.2.5. Affected is an unknown function of the component Chat Endpoint. Performing a manipulation of the argument utente_chat results in s
CVE-2026-50720 | Ingenic T31 Boot ROM comparison
A vulnerability has been found in Ingenic T31 and classified as very critical. Affected by this issue is some unknown functionality of the component Boot ROM. The manipulation leads to incorrect comparison. This vulnerability is listed as C
CVE-2026-50719 | Ingenic T41/T32/T40/A1 SoC Boot ROM Init Table Parser signature verification
A vulnerability classified as very critical was found in Ingenic T41, T32, T40 and A1 SoC Boot ROM. This impacts an unknown function of the component Init Table Parser. Such manipulation leads to improper verification of cryptographic signa
CVE-2026-44768 | SAP CRM WebClient UI 105/106/S4FND 104 cross-domain policy (WID-SEC-2026-2308)
A vulnerability was found in SAP CRM WebClient UI 105/106/S4FND 104 and classified as problematic. This issue affects some unknown processing. The manipulation results in permissive cross-domain policy with untrusted domains. This vulnerabi
CVE-2026-11918 | IBM ContextForge MCP Gateway up to 1.0.4 privileges management (EUVD-2026-78898)
A vulnerability was found in IBM ContextForge MCP Gateway up to 1.0.4. It has been classified as critical. Impacted is an unknown function. Performing a manipulation results in improper privilege management. This vulnerability is cataloged
CVE-2024-7953 | Rockwell Automation DataEdgePlatform DataMosaix Private Cloud up to 7.07 privileges management
A vulnerability was found in Rockwell Automation DataEdgePlatform DataMosaix Private Cloud up to 7.07. It has been rated as very critical. The impacted element is an unknown function. This manipulation causes improper privilege management.
CVE-2026-18836 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinations and return the response to the attacker.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended des
CVE-2026-18689 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accepted where it should not be, which could reveal the names of other organizations.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accep
CVE-2026-17428 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization decisions without sufficient verification, which could allow access to information belonging to others.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization
CVE-2026-17411 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized before it is used in database queries.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized befo
CVE-2026-17410 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.