Warum die Überwachung von Schwachstellen für Ihr Unternehmen kritisch ist
Im Jahr 2025 wurden 48 185 neue Schwachstellen (CVE) veröffentlicht: ein Anstieg von 20 % gegenüber 2024. Jeden Tag werden mehr als 130 Sicherheitslücken öffentlich gemacht, von denen einige die Software betreffen, die Ihr Unternehmen täglich nutzt.
Laut dem Verizon Data Breach Investigations Report nutzen 60 % der Datenverletzungen Schwachstellen aus, für die zum Zeitpunkt des Angriffs bereits ein Patch vorhanden war. Kein IT-Team kann manuell 130 CVE pro Tag verfolgen.
Avec CVE Find, explorez la plus grande base de données de vulnérabilités au monde.
Le CVE (Common Vulnerabilities and Exposures) est une liste de failles de sécurité informatique divulguées publiquement. Le programme CVE a pour objectif de faciliter le partage des données entre les différentes capacités de détection des vulnérabilités, qu'il s'agisse d'outils, de bases de données ou de services. Il fournit également une norme pour évaluer la couverture de ces outils et services.
Accédez à CVE Find
Was CVE Find für Sie tut
Wie werde ich in Echtzeit gewarnt?
CVE Find benachrichtigt Sie per E-Mail und SMS, sobald eine Schwachstelle Ihre Produkte betrifft. Konfigurierbare Frequenz: von der sofortigen Benachrichtigung bis zur monatlichen Zusammenfassung.
Sind meine Softwareprodukte anfällig?
Konfigurieren Sie Ihre Produkte (CMS, Server, Bibliotheken) über den CPE-Katalog. CVE Find überwacht die MITRE-Datenbank kontinuierlich und warnt Sie automatisch. 338 000+ CVE indexiert.
Wie priorisiere ich Patches?
Die CVSS-Bewertung (Schweregrad) und EPSS (Wahrscheinlichkeit einer tatsächlichen Ausnutzung) zeigen Ihnen, was zuerst korrigiert werden muss, ohne Fehlalarme.
Welche Schwachstellen werden aktiv ausgenutzt?
Der integrierte CISA KEV-Katalog identifiziert Schwachstellen, die bereits in der Praxis ausgenutzt werden. Dies sind die Lücken, die mit absoluter Priorität zu schliessen sind.
Ist die Plattform auf Deutsch verfügbar?
Ja. CVE Find ist auf Französisch, Englisch und Deutsch verfügbar. Die Plattform wird in der Schweiz von Bexxo entwickelt.
Sind die Daten zuverlässig und aktuell?
Echtzeit-Synchronisierung mit MITRE, NVD, CISA und FIRST.org: Die Datenbank wird stündlich aktualisiert.
Bleiben Sie einen Schritt voraus mit den neuesten kritischen Sicherheitslücken.
CVE-2026-85035 - HIGH
03/11/2026
The can_add_rx_filter_msgq() system call installs a CAN RX filter whose callback (can_msgq_put() in drivers/can/can_common.c) is handed the caller's struct k_msgq * as user_data. The controller driver stores that raw pointer in its filter table and dereferences it from the RX path every time a matching frame arrives. The system call verifier z_vrfy_can_add_rx_filter_msgq() in drivers/can/can_handl...
memorycorruption
CVE-2026-76124 - HIGH
03/11/2026
The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the send_feedback function. This is due to insufficient file type validation that relies solely on the client-supplied Content-Type header without server-side content inspection or extension validation. This makes it possible for authenticated attackers, with subscriber-lev...
fileinclusionOWSAP: A04
CVE-2026-105978 - HIGH
03/11/2026
Improper input validation in management control functions may allow a remote attacker with high privileges to inject operating system commands and execute them with root privileges.
oscommandinjectionOWSAP: A03
CVE-2026-4052 - CRITICAL
03/11/2026
This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint.
authorisationproblemOWSAP: A01
CVE-2026-13594 - CRITICAL
03/11/2026
Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product.
OWSAP: A01
CVE-2026-120534 - CRITICAL
03/11/2026
The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. This is due to insufficient validation of form configuration parameters before merging into field settings and passing to call_user_func_array in the render_field method. This makes it possible for unauthenticated attacke...
fileinclusionOWSAP: A04
CVE-2026-120518 - CRITICAL
03/11/2026
The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.1.0. This is due to bpxp_image_field_update_on_user_activation() calling unlink() on a path built from visitor-supplied signup metadata with no realpath() resolution, no containment check against the profile-image directory and no extension allow-list. Submittin...
directorytraversalOWSAP: A01
CVE-2026-76955 - HIGH
03/11/2026
A buffer overflow vulnerability in the zdp_wtp binary in Zyxel NWA110AX firmware versions through 7.12(ABTG.0)C0 could allow a LAN-based attacker to escalate privileges on an affected device.
overflow
CVE-2026-107441 - HIGH
03/11/2026
An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
overflow
CVE-2026-71450 - HIGH
02/11/2026
Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO Neo EC and CW Edge Controller allows Authentication Bypass. This issue affects EasyIO Neo EC and CW Edge Controller: from EC 3.3b62 through EC 3.3b63 and from CW 3.3b24 through CW 3.3b25.
OWSAP: A07
CVE-2026-86596 - CRITICAL
02/11/2026
The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. This is due to insufficient sanitization in strip_php_tags_deep(), which only strips literal '
codeinjectionOWSAP: A03
CVE-2026-115215 - HIGH
02/11/2026
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server allocates a session from its fixed session pool for the first datagram from any unrecognised address and port, before the cookie exchange, and never releases a session whose handshake stalls. A remote, unauthenticated attacker can exhaust the pool with one spoofed datagram per source and deny DTLS service t...
CVE-2026-115403 - HIGH
02/11/2026
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, built with BSD raw socket and IPv6 support, the IPv6 raw send path uses the destination-table entry it adds without checking that the add succeeded. When the destination table is full and an off-link destination is reached through a default router whose neighbour cache entry is unknown, sending on an IPv6 raw socket with header inclus...
memorycorruption
CVE-2026-58873 - HIGH
02/11/2026
In addDragDropListener of WindowManagerService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
authorisationproblemOWSAP: A01
CVE-2026-29508 - HIGH
02/11/2026
ReadyMedia (formerly MiniDLNA) versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow vulnerability that allows remote attackers to corrupt stack memory by crafting a malicious DFF audio file with an oversized PROP chunk size value that is used unvalidated to allocate a variable-length stack array and read file data into it. Attackers can place a crafted DFF file in a directory monitor...
CVE-2026-105476 - HIGH
02/11/2026
Improper link resolution before file access in cPanel allows remote authenticated users to write arbitrary root-owned files and escalate privileges.
OWSAP: A01
CVE-2026-59044 - HIGH
02/11/2026
In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
memorycorruption
CVE-2026-59028 - HIGH
02/11/2026
In resolveAidConflictLocked of RegisteredAidCache.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
OWSAP: A01
CVE-2026-59000 - HIGH
02/11/2026
In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
OWSAP: A01
CVE-2026-58984 - HIGH
02/11/2026
In multiple locations, there is a possible memory corruption due to a use-after-free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
memorycorruption
