Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 786 | 0,2 % |
| ≥50 % | 3.560 | 0,9 % |
| ≥10 % | 13.158 | 3,2 % |
| <10 % | 396.051 | 95,8 % |
🗂️ …
CVE-2023-36910 | Microsoft Windows up to Server 2022 Message Queuing integer overflow
A vulnerability identified as very critical has been detected in Microsoft Windows. Affected by this vulnerability is an unknown functionality of the component Message Queuing. Performing a manipulation results in integer overflow. This vul
CVE-2023-36908 | Microsoft Windows up to Server 2022 Hyper-V information disclosure
A vulnerability, which was classified as problematic, has been found in Microsoft Windows. Affected by this issue is some unknown functionality of the component Hyper-V. This manipulation causes information disclosure. This vulnerability is
CVE-2023-36907 | Microsoft Windows up to Server 2022 Cryptographic Services information disclosure
A vulnerability classified as problematic was found in Microsoft Windows. Affected by this vulnerability is an unknown functionality of the component Cryptographic Services. The manipulation results in information disclosure. This vulnerabi
CVE-2023-36906 | Microsoft Windows up to Server 2022 Cryptographic Services information disclosure
A vulnerability classified as problematic has been found in Microsoft Windows. Affected is an unknown function of the component Cryptographic Services. The manipulation leads to information disclosure. This vulnerability is listed as CVE-20
CVE-2022-4955 | Google Chrome DevTools privilege escalation
A vulnerability identified as problematic has been detected in Google Chrome. This affects an unknown function of the component DevTools. This manipulation causes privilege escalation. This vulnerability is registered as CVE-2022-4955. The
CVE-2022-4925 | Google Chrome up to 96.0.4664.110 QUIC input validation (FEDORA-2023-ea7128b5ce)
A vulnerability marked as problematic has been reported in Google Chrome. Affected is an unknown function of the component QUIC. This manipulation causes improper input validation. The identification of this vulnerability is CVE-2022-4925.
CVE-2022-34453 | Dell XtremIO X2 XMS prior 1.116-4-1.11 access control (dsa-2022-290)
A vulnerability was found in Dell XtremIO X2 XMS and classified as critical. The affected element is an unknown function. Executing a manipulation can lead to improper access controls. The identification of this vulnerability is CVE-2022-34
CVE-2022-26838 | Cybozu Remote Service 3.1.2 Mobile Device Data Import path traversal
A vulnerability classified as critical has been found in Cybozu Remote Service 3.1.2. Affected is an unknown function of the component Mobile Device Data Import. The manipulation leads to path traversal. This vulnerability is documented as
CVE-2022-2416 | Octopus Deploy Request information disclosure
A vulnerability, which was classified as problematic, has been found in Octopus Deploy. This impacts an unknown function of the component Request Handler. This manipulation causes information disclosure. This vulnerability is registered as
CVE-2022-2346 | Octopus Deploay Extension Endpoint access control
A vulnerability classified as critical was found in Octopus Deploay. This affects an unknown function of the component Extension Endpoint Handler. The manipulation results in improper access controls. This vulnerability is cataloged as CVE-
CVE-2026-58114 | Siemens SIMATIC Batch up to 7.5/8.0/8.1/9.1 improper authentication (WID-SEC-2026-4441)
A vulnerability, which was classified as very critical, has been found in Siemens SIMATIC Batch, SIMATIC Information Server, SIMATIC PCS 7, SIMATIC Process Historian, SIMATIC WinCC and SIMATIC WinCC Runtime Professional up to 7.5/8.0/8.1/9.
CVE-2026-125652 | Red Hat Keycloak/Single Sign-On keycloak-services improper authorization (WID-SEC-2026-4446)
A vulnerability marked as critical has been reported in Red Hat Keycloak and Single Sign-On. This issue affects some unknown processing of the component keycloak-services. This manipulation causes improper authorization. This vulnerability
CVE-2024-28235 | Contao up to 4.13.39/5.3.3 Broken Link information disclosure (WID-SEC-2026-4445)
A vulnerability has been found in Contao up to 4.13.39/5.3.3 and classified as problematic. Affected is an unknown function of the component Broken Link Handler. This manipulation causes information disclosure. This vulnerability is registe
CVE-2022-4924 | Google Chrome up to 96.0.4664.110 WebRTC use after free (FEDORA-2023-ea7128b5ce)
A vulnerability was found in Google Chrome and classified as critical. This vulnerability affects unknown code of the component WebRTC. The manipulation results in use after free. This vulnerability is reported as CVE-2022-4924. The attack
CVE-2022-4923 | Google Chrome up to 98.0.4758.102 Omnibox channel accessible (FEDORA-2023-ea7128b5ce)
A vulnerability was found in Google Chrome. It has been declared as problematic. Impacted is an unknown function of the component Omnibox. Such manipulation leads to channel accessible by non-endpoint. This vulnerability is traded as CVE-20
CVE-2022-4922 | Google Chrome up to 98.0.4758.102 Blink (FEDORA-2023-ea7128b5ce)
A vulnerability, which was classified as problematic, was found in Google Chrome. Affected by this issue is some unknown functionality of the component Blink. Executing a manipulation can lead to an unknown weakness. This vulnerability is r
CVE-2022-4915 | Google Chrome up to 103.0.5060.114 URL Format clickjacking (FEDORA-2023-6c8de2cd15)
A vulnerability described as problematic has been identified in Google Chrome. This affects an unknown function of the component URL Format Handler. The manipulation results in clickjacking. This vulnerability is identified as CVE-2022-4915
CVE-2022-4914 | Google Chrome up to 103.0.5060.134 PrintPreview heap-based overflow (FEDORA-2023-6c8de2cd15)
A vulnerability identified as critical has been detected in Google Chrome. This affects an unknown function of the component PrintPreview. The manipulation leads to heap-based buffer overflow. This vulnerability is uniquely identified as CV
CVE-2022-4913 | Google Chrome up to 104.0.5112.102 Extensions (FEDORA-2023-6c8de2cd15)
A vulnerability marked as problematic has been reported in Google Chrome. The impacted element is an unknown function of the component Extensions. The manipulation leads to an unknown weakness. This vulnerability is referenced as CVE-2022-4
CVE-2022-4912 | Google Chrome up to 104.0.5112.102 MathML type confusion (FEDORA-2023-6c8de2cd15)
A vulnerability labeled as critical has been found in Google Chrome. The affected element is an unknown function of the component MathML. Executing a manipulation can lead to type confusion. The identification of this vulnerability is CVE-2
CVE-2022-4911 | Google Chrome up to 106.0.5249.61 DevTools ui layer (FEDORA-2023-6c8de2cd15)
A vulnerability identified as problematic has been detected in Google Chrome. Impacted is an unknown function of the component DevTools. Performing a manipulation results in improper restriction of rendered ui layers. This vulnerability was
CVE-2022-4910 | Google Chrome up to 106.0.5249.119 Autofill Remote Code Execution (FEDORA-2023-8a94349e38)
A vulnerability categorized as critical has been discovered in Google Chrome. This issue affects some unknown processing of the component Autofill. Such manipulation leads to Remote Code Execution. This vulnerability is uniquely identified
CVE-2022-4909 | Google Chrome up to 106.0.5249.119 XML (FEDORA-2023-8a94349e38)
A vulnerability was found in Google Chrome. It has been rated as problematic. This vulnerability affects unknown code of the component XML Handler. This manipulation causes an unknown weakness. This vulnerability is handled as CVE-2022-4909
CVE-2022-4908 | Google Chrome up to 106.0.5249.119 iFrame cross-domain policy (FEDORA-2023-8a94349e38)
A vulnerability was found in Google Chrome. It has been declared as problematic. This affects an unknown part of the component iFrame Handler. The manipulation results in permissive cross-domain policy with untrusted domains. This vulnerabi
CVE-2022-4907 | Google Chrome up to 107.0.5304.121 FFmpeg uninitialized pointer (FEDORA-2023-8a94349e38)
A vulnerability described as critical has been identified in Google Chrome. Impacted is an unknown function of the component FFmpeg. Executing a manipulation can lead to uninitialized pointer. This vulnerability is tracked as CVE-2022-4907.
CVE-2022-4906 | Google Chrome up to 107.0.5304.121 Blink Remote Code Execution (FEDORA-2023-8a94349e38)
A vulnerability was found in Google Chrome. It has been classified as critical. Affected by this issue is some unknown functionality of the component Blink. The manipulation leads to Remote Code Execution. This vulnerability is traded as CV
CVE-2022-43703 | Arm Compiler 5 Installer untrusted search path
A vulnerability labeled as critical has been found in Arm Compiler 5, Compiler 6, Compiler for Embedded, Compiler for Embedded FuSa, Compiler for Linux, Development Studio, Development Studio Morello Edition, Forge, Mobile Studio, DS-5 Deve
CVE-2022-43702 | ARM Compiler 5, Compiler 6, Compiler for Embedded, Compiler for Embedded FuSa, Compiler for Linux, Development Studio, Development Studio Morello Edition, Forge, Mobile Studio, DS-5 Development Studio, Fast Models, GNU Toolchain, Install
A vulnerability classified as critical was found in ARM Compiler 5, Compiler 6, Compiler for Embedded, Compiler for Embedded FuSa, Compiler for Linux, Development Studio, Development Studio Morello Edition, Forge, Mobile Studio, DS-5 Develo
CVE-2022-30280 | Nokia NetAct 22 createuser.jsf cross-site request forgery
A vulnerability classified as problematic has been found in Nokia NetAct 22. This vulnerability affects unknown code of the file /SecurityManagement/html/createuser.jsf. Performing a manipulation results in cross-site request forgery. This
Security Awareness: Mitarbeiter als Schwachstelle erkennen - it-daily.net
Torsten Bechler: Eine wirksame Sicherheitskultur entsteht mit dem Bewusstsein, dass Cybersicherheit uns alle angeht. Awareness Trainings vermitteln ... Weiterlesen
ZDI-26-905: X.Org Server libXrender RenderQueryPictFormats Reply Heap-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of X.Org Server. User interaction is required to exploit this vulnerability in that the target must connect to a malicious X11 server. The ZDI ha
ZDI-26-906: X.Org Server libX11 XkbGetMap Reply Heap-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of X.Org Server. User interaction is required to exploit this vulnerability in that the target must connect to a malicious X11 server. The ZDI ha
ZDI-26-904: NVIDIA Megatron-LM Checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of NVIDIA Megatron-LM. User interaction is required to exploit this vulnerability in that the target must open a malicious file. The ZDI has assi
ZDI-26-901: X.Org Server ProcDRI2GetBuffers Heap-based Buffer Overflow Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of X.Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability
ZDI-26-902: X.Org Server XkbResizeKeySyms Integer Overflow Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of X.Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability
ZDI-26-903: X.Org Server Font Alias Resolution Heap-based Buffer Overflow Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of X.Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability
CVE-2026-18836 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinations and return the response to the attacker.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended des
CVE-2026-18689 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accepted where it should not be, which could reveal the names of other organizations.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accep
CVE-2026-17428 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization decisions without sufficient verification, which could allow access to information belonging to others.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization
CVE-2026-17411 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized before it is used in database queries.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized befo
CVE-2026-17410 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.
CVE-2026-17409 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of a request, which could allow restricted operations to be reached.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access c
CVE-2026-17408 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.
CVE-2026-17407 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before being used in a database query, which could allow SQL commands to run.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before
CVE-2026-17406 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Address checks can be bypassed, which could allow the server to reach destinations that should be blocked.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Address checks can be bypassed, which could allow the s
CVE-2026-17405 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm that the requesting user is permitted to read them, which could expose keystore information.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm
CVE-2026-17404 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17403 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.
CVE-2026-17402 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is passed to the operating system, which could allow commands to run on the underlying host.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is pas
CVE-2026-17401 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.
CVE-2026-17400 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
CVE-2026-17399 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to insufficient validation of uploaded content. Content uploaded to the product is not sufficiently checked before it is processed, which could allow code to run on the server.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to insufficient validation of uploaded content. Content uploaded to the product is not suffic
CVE-2026-17398 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17397 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17396 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
CVE-2026-17395 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access internal network resources due to improper validation of a user-supplied URL. Destinations are not sufficiently restricted, which could allow the server to be made to contact internal systems.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access internal network resources due to improper validation of a user-supplied URL. Destinations are not sufficiently r
CVE-2026-17394 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improperly controlled modification of object attributes. A user-supplied value could change an access-related setting that should be controlled by the system, which could expose sensitive information.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improperly controlled modification of object attributes. A user-supplied value could
CVE-2026-17392 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to gain unauthorized administrative access to other tenants due to LDAP injection. User-supplied input is not properly neutralized in directory queries, which could change the query and grant access beyond the user's own tenant.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to gain unauthorized administrative access to other tenants due to LDAP injection. User-supplied input is not properly neut
CVE-2026-17391 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CVE-2026-17390 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to execute arbitrary JavaScript in the web UI due to cross-site scripting. This could alter the intended functionality of the page and potentially lead to credential disclosure within a trusted session.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to execute arbitrary JavaScript in the web UI due to cross-site scripting. This could alter the intended functionality of the page an