Bekannte ausgenutzte Schwachstellen

GPUStack Improper Authentication Vulnerability

GPUStack contains an improper authentication vulnerability which could allow unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml.

Hinzugefügt: 09.11.26 · Frist: 12.11.26

OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability

OpenBSD OpenSSH on Linux contains an unexpected status code or return value vulnerability that could allow for authentication bypass.

Hinzugefügt: 09.11.26 · Frist: 12.11.26

SignalWire FreeSwitch Code Injection Vulnerability

SignalWire FreeSwitch contains a code injection vulnerability that permits configuration and credential disclosure, arbitrary call control, and command execution.

Hinzugefügt: 09.11.26 · Frist: 12.11.26

IBM Aspera Faspex Incorrect Authorization Vulnerability

IBM Aspera Faspex contains an incorrect authorization vulnerability that could allow an authenticated user to craft a specific message to bypass authorization, causing privilege escalations.

Hinzugefügt: 09.11.26 · Frist: 12.11.26

SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability

SonicWall SonicOS SSLVPN contains a use of single-factor authentication vulnerability that may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).

Hinzugefügt: 06.11.26 · Frist: 20.11.26

Apple Multiple Products Improper Authentication Vulnerability

Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication.

Hinzugefügt: 04.11.26 · Frist: 18.11.26

WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability

WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades.

Hinzugefügt: 03.11.26 · Frist: 06.11.26

Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability

Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.

Hinzugefügt: 30.10.26 · Frist: 13.11.26

Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability

Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527.

Hinzugefügt: 30.10.26 · Frist: 02.11.26

GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability

GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

Hinzugefügt: 29.10.26 · Frist: 01.11.26

Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability

Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.

Hinzugefügt: 29.10.26 · Frist: 01.11.26

Broadcom VMWare ESX Insufficient Logging Vulnerability

Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.

Hinzugefügt: 28.10.26 · Frist: 11.11.26

Linux Kernel Missing Initialization of a Variable Vulnerability

Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.

Hinzugefügt: 28.10.26 · Frist: 31.10.26

Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability

Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.

Hinzugefügt: 27.10.26 · Frist: 10.11.26

Google Brotli Unchecked Return Value Vulnerability

Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

Hinzugefügt: 27.10.26 · Frist: 10.11.26