Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 720 | 0,2 % |
| ≥50 % | 3.223 | 0,9 % |
| ≥10 % | 22.115 | 6,0 % |
| <10 % | 342.373 | 92,9 % |
Attackers Are Already Exploiting SonicWall’s Freshly Patched Max-Severity SMA1000 Flaw
Just three days after SonicWall shipped a patch for a maximum-severity vulnerability in its SMA1000 secure remote access appliances, attackers have started scanning for and exploiting the flaw in the wild. The vulnerability, tracked as CV
CVE-2025-8787 | Portabilis i-Diario up to 1.5.0 Registro das atividades registros-de-conteudos-por-disciplina Registro de atividades/Conteúdos cross site scripting (EUVD-2025-24066)
A vulnerability, which was classified as problematic, was found in Portabilis i-Diario up to 1.5.0. The affected element is an unknown function of the file /registros-de-conteudos-por-disciplina/ of the component Registro das atividades. Th
CVE-2025-8786 | Portabilis i-Diario up to 1.5.0 Registro das atividades registros-de-conteudos-por-areas-de-conhecimento Registro de atividades/Conteúdos cross site scripting (EUVD-2025-24067)
A vulnerability, which was classified as problematic, has been found in Portabilis i-Diario up to 1.5.0. Impacted is an unknown function of the file /registros-de-conteudos-por-areas-de-conhecimento/ of the component Registro das atividades
Atlassian CVE-2026-21589 Exploited Hours After Public Disclosure
Attackers started scanning the systems vulnerable to the Atlassian flaw several hours after the researchers published the technical details and proof-of-concept code. Assigned the identifier CVE-2026-21589, the vulnerability impacts sever
CVE-2025-8511 | Portabilis i-Diario 1.5.0 Observações /diario-de-observacoes/ Descrição cross site scripting (EUVD-2025-23479)
A vulnerability marked as problematic has been reported in Portabilis i-Diario 1.5.0. Impacted is an unknown function of the file /diario-de-observacoes/ of the component Observações. Performing a manipulation of the argument Descrição resu
CVE-2026-107794 | ExtUtils::Typemaps::STL::List up to 1.6 Typemaps av_extend memory allocation (EUVD-2026-96315)
A vulnerability classified as problematic has been found in ExtUtils::Typemaps::STL::List up to 1.6. The affected element is the function av_extend of the component Typemaps. This manipulation causes uncontrolled memory allocation. This vul
CVE-2026-108162 | smp46 Pingvin Share X up to 1.21.x Proxy Header backend/src/main.ts X-Forwarded-For authentication bypass (EUVD-2026-96317)
A vulnerability categorized as critical has been discovered in smp46 Pingvin Share X up to 1.21.x. This issue affects some unknown processing of the file backend/src/main.ts of the component Proxy Header Handler. Executing a manipulation of
CVE-2026-108161 | FusionPBX up to 5.6.5 Call Recordings Download download Caller-ID name/Caller-ID number os command injection (EUVD-2026-96316)
A vulnerability labeled as critical has been found in FusionPBX up to 5.6.5. The affected element is the function call_recordings::download of the component Call Recordings Download. The manipulation of the argument Caller-ID name/Caller-ID
CVE-2026-108165 | immich-app Immich up to 3.3.1 Partner Synchronization Stream /api/sync/stream authorization (EUVD-2026-96320)
A vulnerability marked as problematic has been reported in immich-app Immich up to 3.3.1. The impacted element is an unknown function of the file /api/sync/stream of the component Partner Synchronization Stream. This manipulation causes mis
CVE-2026-108164 | opensource-socialnetwork OSSN up to 10.1 OssnMessages ossn_com.php guid resource injection (EUVD-2026-96319)
A vulnerability was found in opensource-socialnetwork OSSN up to 10.1. It has been rated as problematic. This vulnerability affects unknown code of the file components/OssnMessages/ossn_com.php of the component OssnMessages. Performing a ma
CVE-2026-108163 | smp46 Pingvin Share X up to 1.21.x Rate Limiting excessive authentication (EUVD-2026-96318)
A vulnerability identified as problematic has been detected in smp46 Pingvin Share X up to 1.21.x. Impacted is an unknown function of the component Rate Limiting. The manipulation leads to improper restriction of excessive authentication at
CVE-2026-105885 | 10Web Slider Plugin up to 1.2.62 on WordPress deserialization (EUVD-2026-96322)
A vulnerability classified as problematic was found in 10Web Slider Plugin up to 1.2.62 on WordPress. Affected is an unknown function. Executing a manipulation can lead to deserialization. This vulnerability is handled as CVE-2026-105885. T
CVE-2026-102388 | WPMU DEV Forminator Plugin up to 1.57.3 on WordPress cross site scripting (EUVD-2026-96321)
A vulnerability classified as problematic has been found in WPMU DEV Forminator Plugin up to 1.57.3 on WordPress. This impacts an unknown function. Performing a manipulation results in cross site scripting. This vulnerability is known as CV
CVE-2026-97263 | Greg Winiarski WPAdverts Plugin up to 2.3.4 on WordPress cross site scripting (EUVD-2026-96324)
A vulnerability, which was classified as problematic, was found in Greg Winiarski WPAdverts Plugin up to 2.3.4 on WordPress. Affected by this issue is some unknown functionality. The manipulation results in cross site scripting. This vulner
CVE-2026-94676 | Tainacan Plugin up to 1.3.0 on WordPress deserialization (EUVD-2026-96323)
A vulnerability, which was classified as problematic, has been found in Tainacan Plugin up to 1.3.0 on WordPress. Affected by this vulnerability is an unknown functionality. The manipulation leads to deserialization. This vulnerability is u
CVE-2026-97264 | Greg Winiarski WPAdverts Plugin up to 2.3.4 on WordPress cross site scripting (EUVD-2026-96325)
A vulnerability has been found in Greg Winiarski WPAdverts Plugin up to 2.3.4 on WordPress and classified as problematic. This affects an unknown part. This manipulation causes cross site scripting. The identification of this vulnerability
CVE-2026-66435 | Devin Walker Rollback Plugin up to 3.1.2 on WordPress information disclosure (EUVD-2026-96326)
A vulnerability described as problematic has been identified in Devin Walker Rollback Plugin up to 3.1.2 on WordPress. This affects an unknown function. Such manipulation leads to information disclosure. This vulnerability is traded as CVE-
Telegram Desktop 7.2.9 corrige CVE-2026-107181 de robo de cuenta
Un clic en un link dentro de un chat de grupo bastaba para que un atacante leyera cualquier archivo del equipo de la víctima y, con él, robara la sesión activa de su cuenta. El hallazgo, publicado por el investigador detrás del blog beaksec
CVE-2026-98382 | Linux Kernel up to 7.3-rc4 BPF drivers/net/veth.c __bpf_offload_dev_match null pointer dereference (EUVD-2026-95537 / WID-SEC-2026-3822)
A vulnerability was found in Linux Kernel up to 6.6.157/6.12.111/6.18.54/7.2.8/7.3-rc4. It has been classified as very critical. This issue affects the function __bpf_offload_dev_match of the file drivers/net/veth.c of the component BPF. Pe
CVE-2026-98381 | Linux Kernel up to 7.3-rc4 veth drivers/net/veth.c veth_set_channels xdp_prog memory corruption (EUVD-2026-95536 / WID-SEC-2026-3822)
A vulnerability was found in Linux Kernel up to 7.3-rc4 and classified as very critical. This vulnerability affects the function veth_set_channels of the file drivers/net/veth.c of the component veth. Such manipulation of the argument xdp_p
CVE-2026-98379 | Linux Kernel up to 7.3-rc4 ip6t_rpfilter ip6t_rpfilter.c rpfilter_mt null pointer dereference (EUVD-2026-95534 / WID-SEC-2026-3822)
A vulnerability identified as critical has been detected in Linux Kernel up to 7.3-rc4. This affects the function rpfilter_mt of the file net/ipv6/netfilter/ip6t_rpfilter.c of the component ip6t_rpfilter. This manipulation causes null point
CVE-2026-98378 | Linux Kernel up to 7.3-rc4 Link Iterator kernel/bpf/syscall.c bpf_link_put use after free (EUVD-2026-95533 / WID-SEC-2026-3822)
A vulnerability was found in Linux Kernel up to 7.3-rc4. It has been declared as very critical. Impacted is the function bpf_link_put of the file kernel/bpf/syscall.c of the component Link Iterator. Executing a manipulation can lead to use
CVE-2026-98377 | Linux Kernel up to 6.12.111/6.18.54/7.2.8/7.3-rc4 vlan __vlan_insert_inner_tag information disclosure (EUVD-2026-95532 / WID-SEC-2026-3822)
A vulnerability has been found in Linux Kernel up to 6.12.111/6.18.54/7.2.8/7.3-rc4 and classified as problematic. This affects the function __vlan_insert_inner_tag of the component vlan. This manipulation causes information disclosure. Thi
CVE-2026-106155 | Progress Telerik Report Server up to 10.3.24.1112 Shared Reporting Engine cross site scripting (WID-SEC-2026-3823)
A vulnerability described as problematic has been identified in Progress Telerik Report Server up to 10.3.24.1112. This affects an unknown function of the component Shared Reporting Engine. Such manipulation leads to cross site scripting. T
CVE-2026-97791 | Apache CXF up to 3.6.12/4.1.8/4.2.3 STSTokenValidator information disclosure (WID-SEC-2026-3824)
A vulnerability, which was classified as problematic, was found in Apache CXF up to 3.6.12/4.1.8/4.2.3. This affects the function STSTokenValidator. The manipulation results in information disclosure. This vulnerability is known as CVE-2026
CVE-2026-106145 | Progress Telerik Report Server up to 10.3.24.1112 Service Agent SignalR Hub privileges management (WID-SEC-2026-3823)
A vulnerability labeled as critical has been found in Progress Telerik Report Server up to 10.3.24.1112. The affected element is an unknown function of the component Service Agent SignalR Hub. The manipulation results in improper privilege
CVE-2026-97468 | Apache CXF up to 3.6.12/4.1.8/4.2.3 Security Token Service Cache STSTokenValidator.hashCode improper authentication (WID-SEC-2026-3824)
A vulnerability was found in Apache CXF up to 3.6.12/4.1.8/4.2.3. It has been rated as critical. This affects the function STSTokenValidator.hashCode of the component Security Token Service Cache. The manipulation leads to improper authenti
CVE-2026-86463 | Apache CXF up to 3.6.12/4.1.8/4.2.3 Query Parser resource consumption (WID-SEC-2026-3824)
A vulnerability classified as problematic has been found in Apache CXF up to 3.6.12/4.1.8/4.2.3. Impacted is an unknown function of the component Query Parser. Performing a manipulation results in resource consumption. This vulnerability is
CVE-2026-79650 | Apache CXF up to 3.6.12/4.1.8/4.2.3 OIDC relying-party component state redirect (WID-SEC-2026-3824)
A vulnerability was found in Apache CXF up to 3.6.12/4.1.8/4.2.3. It has been classified as problematic. Affected by this vulnerability is an unknown functionality of the component OIDC relying-party component. Performing a manipulation of
CVE-2026-78384 | Apache CXF up to 3.6.12/4.1.8/4.2.3 Compression Utils CompressionUtils.inflate resource consumption (WID-SEC-2026-3824)
A vulnerability was found in Apache CXF up to 3.6.12/4.1.8/4.2.3. It has been declared as problematic. Affected by this issue is the function CompressionUtils.inflate of the component Compression Utils. Executing a manipulation can lead to
CVE-2026-73179 | Apache CXF up to 3.6.12/4.1.8/4.2.3 JPA OAuth2 Authorization Code Grant Provider race condition (WID-SEC-2026-3824)
A vulnerability classified as problematic was found in Apache CXF up to 3.6.12/4.1.8/4.2.3. The affected element is an unknown function of the component JPA OAuth2 Authorization Code Grant Provider. Executing a manipulation can lead to race
CVE-2026-108039 | Apache CXF up to 3.6.12/4.1.8/4.2.3 StaxUtils denial of service (WID-SEC-2026-3824)
A vulnerability has been found in Apache CXF up to 3.6.12/4.1.8/4.2.3 and classified as problematic. This impacts an unknown function of the component StaxUtils. This manipulation causes denial of service. This vulnerability is handled as C
CVE-2026-107938 | Apache CXF up to 3.6.12/4.1.8/4.2.3 cxf-rt-transports-http-netty-client certificate validation (WID-SEC-2026-3824)
A vulnerability described as problematic has been identified in Apache CXF up to 3.6.12/4.1.8/4.2.3. This issue affects some unknown processing of the component cxf-rt-transports-http-netty-client. Such manipulation leads to improper certif
CVE-2026-107937 | Apache CXF up to 3.6.12/4.1.8/4.2.3 Parser denial of service (WID-SEC-2026-3824)
A vulnerability was found in Apache CXF up to 3.6.12/4.1.8/4.2.3 and classified as problematic. Affected is an unknown function of the component Parser. Such manipulation leads to denial of service. This vulnerability is uniquely identified
CVE-2026-100227 | Apache CXF up to 3.6.12/4.1.8/4.2.3 JAX-RS XML Signature Interceptors data authenticity (WID-SEC-2026-3824)
A vulnerability, which was classified as critical, has been found in Apache CXF up to 3.6.12/4.1.8/4.2.3. The impacted element is the function XmlSigInHandler/XmlSigInInterceptor/XmlSecInInterceptor of the component JAX-RS XML Signature Int
CVE-2026-98375 | Linux Kernel up to 7.3-rc6 netfront handle_incoming_queue information disclosure (EUVD-2026-95525 / WID-SEC-2026-3826)
A vulnerability was found in Linux Kernel up to 7.3-rc6. It has been rated as problematic. This vulnerability affects the function handle_incoming_queue of the component netfront. Performing a manipulation results in information disclosure.
CVE-2026-106438 | MongoDB up to 1.30.12/2.5.5 C Driver calculation (WID-SEC-2026-3830)
A vulnerability has been found in MongoDB up to 1.30.12/2.5.5 and classified as problematic. Affected by this issue is some unknown functionality of the component C Driver. This manipulation causes incorrect calculation. This vulnerability
CVE-2026-106437 | MongoDB C Driver up to 1.30.12/2.5.5 BSON buffer-reservation API bson_reserve_buffer integer underflow (WID-SEC-2026-3830)
A vulnerability marked as critical has been reported in MongoDB C Driver up to 1.30.12/2.5.5. The affected element is the function bson_reserve_buffer of the component BSON buffer-reservation API. This manipulation causes integer underflow.
CVE-2026-106435 | MongoDB Python Driver up to 4.18.2 Binary Accelerator decode buffer overflow (WID-SEC-2026-3830)
A vulnerability labeled as critical has been found in MongoDB Python Driver up to 4.18.2. The affected element is the function decode of the component Binary Accelerator. Such manipulation leads to buffer overflow. This vulnerability is doc
CVE-2026-106432 | MongoDB PHP Driver up to 1.21.10/2.1.10/2.5.3 BSON encoder heap-based overflow (WID-SEC-2026-3830)
A vulnerability identified as very critical has been detected in MongoDB PHP Driver up to 1.21.10/2.1.10/2.5.3. Affected is an unknown function of the component BSON encoder. Performing a manipulation results in heap-based buffer overflow.
CVE-2019-8906 | libmagic 5.35 readelf.c do_core_note out-of-bounds (ID 277708 / BID-107137)
A vulnerability was found in libmagic 5.35. It has been declared as critical. This affects the function do_core_note of the file readelf.c. Executing a manipulation can lead to out-of-bounds read. This vulnerability is registered as CVE-201
CVE-2019-12086 | Oracle JD Edwards EnterpriseOne Tools 9.2 Monitoring/Diagnostics SEC information disclosure (Nessus ID 236644 / ID 176941)
A vulnerability labeled as critical has been found in Oracle JD Edwards EnterpriseOne Tools 9.2. This issue affects some unknown processing of the component Monitoring/Diagnostics SEC. Executing a manipulation can lead to information disclo
CVE-2018-14719 | FasterXML jackson-databind up to 2.9.6 Deserialization blaze-ds-opt/blaze-ds-core deserialization (RHSA-2019:0782 / Nessus ID 121251)
A vulnerability labeled as critical has been found in FasterXML jackson-databind up to 2.9.6. This affects the function blaze-ds-opt/blaze-ds-core of the component Deserialization. Executing a manipulation can lead to deserialization. The i
CVE-2018-12022 | Oracle Clusterware 12.1.0.2.0 TFA Collector deserialization (ID 176909 / BID-107585)
A vulnerability was found in Oracle Clusterware 12.1.0.2.0. It has been classified as critical. This affects an unknown function of the component TFA Collector. This manipulation causes deserialization. This vulnerability is tracked as CVE-
CVE-2026-96662 | The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via 'booking[service_id]' Parameter in all versions up to, and including, 5.7.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via 'booking[service_id]' Parameter in all versions up to, and including, 5.7.2 due to insufficient
CVE-2026-101920 | The Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment (href attribute inside comment content)' parameter in all versions up to, and including, 5.2.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user acce
The Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment (href attribute inside comment content)' parameter in all versions
CVE-2026-100147 | The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shipping_first_name' parameter in all versions up to, and including, 3.16.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shipping_first_name' parameter in all versions up to, and including, 3.16.0.5 due to insufficient input sanit
CVE-2026-96563 | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stm_f_s' parameter in all versions up to, and including, 1.4.123 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce re
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stm_f_s' parameter in all versions up to, and including, 1.4.123 due to insufficient input sanitization and
CVE-2026-96278 | The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Session History in all versions up to, and including, 9.3.03.002 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The bypass works because esc_url_raw() strips literal angle brackets but reta
The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Session History in all versions up to, and including, 9.3.03.002 due to insufficient input sanitization and output escaping. This make
CVE-2026-108504 | ZTE Z80 Ultra has an unauthorized information disclosure vulnerability. The access control for methods within the framework is insufficient. An attacker can exploit this method to read device-related information.
ZTE Z80 Ultra has an unauthorized information disclosure vulnerability. The access control for methods within the framework is insufficient. An attacker can exploit this method to read device-related information.
CVE-2026-62045 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Object Injection.This issue affects Booklovers: from n/a through 2.13.0.
Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Object Injection.This issue affects Booklovers: from n/a through 2.13.0.
CVE-2026-93945 | Deserialization of Untrusted Data vulnerability in Axiomthemes Balance balance allows Object Injection.This issue affects Balance: from n/a through 1.12.0.
Deserialization of Untrusted Data vulnerability in Axiomthemes Balance balance allows Object Injection.This issue affects Balance: from n/a through 1.12.0.
CVE-2026-93944 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Injection.This issue affects Camelia: from n/a through 1.2.15.
Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Injection.This issue affects Camelia: from n/a through 1.2.15.
CVE-2026-93943 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0.
Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0.
CVE-2026-93942 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through 1.16.0.
Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through 1.16.0.
CVE-2026-62046 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gutentype allows Object Injection.This issue affects Gutentype: from n/a through 2.1.12.
Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gutentype allows Object Injection.This issue affects Gutentype: from n/a through 2.1.12.
CVE-2026-93941 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injection.This issue affects Edema: from n/a through 1.2.2.2.
Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injection.This issue affects Edema: from n/a through 1.2.2.2.
CVE-2026-93940 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Greeny greeny allows Object Injection.This issue affects Greeny: from n/a through 2.10.0.
Deserialization of Untrusted Data vulnerability in ThemeREX Group Greeny greeny allows Object Injection.This issue affects Greeny: from n/a through 2.10.0.
CVE-2026-93938 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object Injection.This issue affects Hogwords: from n/a through 1.2.7.
Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object Injection.This issue affects Hogwords: from n/a through 1.2.7.
CVE-2026-93937 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia allows Object Injection.This issue affects Hygia: from n/a through 1.21.0.
Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia allows Object Injection.This issue affects Hygia: from n/a through 1.21.0.