Package 1
Basic Scan
Where can you be attacked from the outside?
€499one-off
- Public security analysis
- Identification of access points
- Initial risk assessment
- Report as PDF and HTML
Security Watch
When a flaw appears, you hear it first.
We watch newly discovered vulnerabilities and zero-days, put them in context for your business and tell you in plain language what to do today — before your website makes the news.
Live picture
Current advisories
Current advisories
Every advisory says what is affected, what does not help and what to do, in which order.
Guides
Understand security before something happens.
Practical and sourced: how cyber security changes when AI agents act on their own, how to patch websites properly and how to secure remote access to assets.
Start hereCyber security in the age of agents: what changes when AI acts on its own
AI agents change cyber security because they do not just answer — they act: they read untrusted content, call tools and use credentials. Attackers no longer need to break into a server; redirecting the agent is enough. Three things protect effectively: limited permissions, vetted integrations and human approval for actions that cannot be undone.
Read the guide→- AI agents & security
Prompt injection in AI agents: why filters are not enough and what actually protects
Prompt injection redirects AI agents through untrusted content. Direct and indirect explained, why filters alone fall short and which measures limit the impact.
Updated27 Oct 2026 - AI agents & security
Permissions and approvals for AI agents: avoiding excessive agency
What an AI agent is allowed to do determines the damage when it errs or is attacked. How to limit functions, permissions and autonomy, add approvals and log actions.
Updated27 Oct 2026 - AI agents & security
MCP security: how to protect AI agents and their tool integrations
The Model Context Protocol connects AI agents to tools and data. Which risks that creates and how to vet, limit and monitor MCP servers before you rely on them.
Updated27 Oct 2026 - AI agents & security
Credentials for AI agents: managing keys, tokens and identities safely
AI agents need credentials to act. How to scope keys and tokens tightly, keep them out of prompts and logs, store them in a vault and respond correctly to a leak.
Updated27 Oct 2026 - Patching & vulnerabilities
Securing WordPress and PHP: a patch routine for website operators
Which PHP version do you run, who patches it, and what happens before an update? A routine for WordPress, plugins, hosting and emergencies, with verified figures.
Updated27 Oct 2026 - Energy & assets (OT)
Securing remote access to wind and solar farms: access points, VPN and segmentation
Web interfaces, remote maintenance, VPN gateways and default passwords are the entry points of connected plants. How to inventory, close and securely run access, backed by BSI and CISA.
Updated27 Oct 2026
Look back
The threat picture of the last 12 months.
309 vulnerabilities were demonstrably exploited in the wild in this period — as listed by the US agency CISA in its catalogue. Not every one affects you; use the filter to find what matches your technology.
- exploited flaws
- 309
- Web & hosting
- 19
- used by ransomware
- 29
- most affected vendor
- Microsoft42
-
PHP Memory Corruption Vulnerability
PHP Group · PHP
-
PHP Stale Internal Request-State Vulnerability
PHP Group · PHP
-
Collabora Online – Built-in CODE Server OS Command Injection Vulnerability
Collabora · Collabora Online – Built-in CODE Server
-
Arista VeloCloud Orchestrator SQL Injection Vulnerability
Arista · VeloCloud Orchestrator
-
EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability
EG Secure Solutions · SiteGuard Server Edition
-
Siemens Software Center Uncontrolled Search Path Element Vulnerability
Siemens · Software Center
-
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
Plex · Media Server
-
Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
Plex · Media Server
-
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
Plex · Media Server
-
Plex Media Server External Control of File Name or Path Vulnerability
Plex · Media Server
-
Fortinet Multiple Products Path Traversal Vulnerability
Fortinet · Multiple Products
-
BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
BeyondTrust · Remote Support
-
Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
Atlassian · Multiple Products
-
Palo Alto Networks PAN-OS Code Injection Vulnerability
Palo Alto Networks · PAN-OS
-
Ahsay AhsayCBS Improper Authentication Vulnerability
Ahsay · AhsayCBS
-
Ahsay AhsayCBS Command Injection Vulnerability
Ahsay · AhsayCBS
-
Cisco Secure Email Gateway Relative Path Traversal Vulnerability
Cisco · Secure Email Gateway
-
Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
Ivanti · Connect Secure
-
Microsoft Windows Command Injection Vulnerability
Microsoft · Windows
-
ProFTPD Improper Access Control Vulnerability
ProFTPD · ProFTPD
-
ISC BIND Data Processing Errors Vulnerability
ISC · BIND
-
Apache Struts Command Injection Vulnerability
Apache · Struts
-
ONLYOFFICE Docs Server Path Traversal Vulnerability
ONLYOFFICE · Docs
-
Strapi Cleartext Storage of Sensitive Information Vulnerability
Strapi · Strapi
-
Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Citrix · NetScaler
-
Zammad GmbH Zammad Session Fixation Vulnerability
Zammad GmbH · Zammad
-
Zammad GmbH Zammad Improper Privilege Management Vulnerability
Zammad GmbH · Zammad
-
Fortinet FortiMail Path Traversal Vulnerability
Fortinet · FortiMail
-
Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
Cisco · Catalyst SD-WAN Manager
-
Apple Multiple Products Out-of-Bounds Write Vulnerability
Apple · Multiple Products
-
Citrix NetScaler Improper Input Validation Vulnerability
Citrix · NetScaler
-
Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Citrix · NetScaler
-
Microsoft SharePoint Code Injection Vulnerability
Microsoft · SharePoint
-
Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability
MikroTik · RouterOS
-
WordPress Core Remote File Inclusion Vulnerability
WordPress · Core
-
WSO2 Multiple Products Path Traversal Vulnerability
WSO2 · Multiple Products
-
Adobe Commerce and Magento Incorrect Authorization Vulnerability
Adobe · Commerce and Magento
-
Check Point Multiple Products Improper Certificate Validation Vulnerability
Check Point · Multiple Products
-
Check Point Multiple Products Path Traversal Vulnerability
Check Point · Multiple Products
-
Arista VeloCloud Orchestrator Improper Input Validation Vulnerability
Arista · VeloCloud Orchestrator
-
F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability
F5 · BIG-IP APM
-
Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
Zyxel · GS1900 Series Switches
-
Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability
Linux · Kernel
-
Linux Kernel Race Condition Vulnerability
Linux · Kernel
-
Linux Kernel Out-of-Bounds Write Vulnerability
Linux · Kernel
-
Google Pixel Improper Authorization Vulnerability
Google · Pixel
-
Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
Cisco · Identity Services Engine
-
Acronis Backup Incorrect Default Permissions Vulnerability
Acronis · Backup
-
Cisco Secure Email Gateway SQL Injection Vulnerability
Cisco · Secure Email Gateway
-
JFrog Artifactory Incorrect Authorization Vulnerability
JFrog · Artifactory
-
JFrog Artifactory Improper Authentication Vulnerability
JFrog · Artifactory
-
ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability
ConnectWise · ScreenConnect
-
GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
GitLab · Community Edition and Enterprise Edition
-
MikroTik RouterOS Missing Authentication for Critical Function Vulnerability
MikroTik · RouterOS
-
MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability
MikroTik · RouterOS
-
Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability
Fortinet · Multiple Products
-
Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability
Citrix · NetScaler
-
Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability
Cisco · Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management
-
Google Chromium V8 Out of Bounds Write Vulnerability
Google · Chromium V8
-
Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
Adobe · Commerce and Magento
-
Microsoft Windows Link Following Vulnerability
Microsoft · Windows
-
Microsoft Windows Heap-Based Buffer Overflow Vulnerability
Microsoft · Windows
-
N-able N-central Static Code Injection Vulnerability
N-able · N-central
-
Google Chromium V8 Type Confusion Vulnerability
Google · Chromium V8
-
Kludex Starlette HTTP Request/Response Smuggling Vulnerability
Kludex · Starlette
-
Kestra OSS OS Command Injection Vulnerability
Kestra · Kestra OSS
-
BerriAI LiteLLM Improper Authentication Vulnerability
BerriAI · LiteLLM
-
JFrog Artifactory Improper Authentication Vulnerability
JFrog · Artifactory
-
SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
SonicWall · SMA1000 Appliances
-
SonicWall SMA1000 Appliances OS Command Injection Vulnerability
SonicWall · SMA1000 Appliances
-
Sangoma Switchvox SQL Injection Vulnerability
Sangoma · Switchvox
-
PaperCut NG/MF Missing Authentication for Critical Function Vulnerability
PaperCut · NG/MF
-
PaperCut NG/MF Unsafe Reflection Vulnerability
PaperCut · NG/MF
-
ownCloud Improper Authentication Vulnerability
ownCloud · ownCloud
-
Linux Kernel Unspecified Vulnerability
Linux · Kernel
-
JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability
JFrog · Artifactory
-
Red Hat Libuser Race Condition Vulnerability
Red Hat · Libuser
-
Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability
Red Hat · Automatic Bug Reporting Tool
-
Microsoft SQL Server Remote Code Execution Vulnerability
Microsoft · SQL Server
-
Ajax.NET Professional Deserialization of Untrusted Data Vulnerability
Ajax.NET Professional · Ajax.NET Professional
-
Linux Kernel Out-of-Bounds Write Vulnerability
Linux · Kernel
-
Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Citrix · NetScaler ADC and NetScaler Gateway
-
Gitea Code Injection Vulnerability
Gitea · Gitea
-
Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
Oracle · HTTP Server and Oracle Weblogic Server Proxy Plug-in
-
Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
Synacor · Zimbra Collaboration Suite (ZCS)
-
TrueConf Server Missing Authentication for Critical Function Vulnerability
TrueConf · Server
-
TrueConf Server Code Injection Vulnerability
TrueConf · Server
-
MLflow Server-Side Request Forgery Vulnerability
MLflow · MLflow
-
Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability
Microsoft · Internet Key Exchange (IKE) Service Extensions
-
Microsoft SharePoint Weak Authentication Vulnerability
Microsoft · SharePoint
-
Broadcom VMware vCenter Path Traversal Vulnerability
Broadcom · VMware vCenter
-
Apple macOS Improper Authentication Vulnerability
Apple · macOS
-
Ray-Project Ray Code Injection Vulnerability
Ray-Project · Ray
-
Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability
Cisco · Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD)
-
Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability
Microsoft · Windows Ancillary Function Driver for WinSock
-
Metabase SQL Injection Vulnerability
Metabase · Metabase
-
Progress LoadMaster Command Injection Vulnerability
Progress · LoadMaster
-
JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
JetBrains · TeamCity
-
N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
N-able · N-central
-
Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
Apache · Tomcat
-
IBM Langflow Code Injection Vulnerability
IBM · Langflow
-
N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
N-able · N-central
-
Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
Cisco · Secure Firewall Management Center (FMC)
-
Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
Fortinet · FortiOS
-
Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability
Arista · VeloCloud Orchestrator
-
Check Point SmartConsole Improper Authentication Vulnerability
Check Point · SmartConsole
-
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Microsoft · SharePoint
-
DD-WRT Stack-Based Buffer Overflow Vulnerability
DD-WRT · DD-WRT
-
Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability
Langflow · Langflow
-
WordPress Core SQL Injection Vulnerability
WordPress · Core
-
WordPress Core Interpretation Conflict Vulnerability
WordPress · Core
-
Fortinet FortiSandbox OS Command Injection Vulnerability
Fortinet · FortiSandbox
-
Fortinet FortiSandbox OS Command Injection Vulnerability
Fortinet · FortiSandbox
-
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Microsoft · SharePoint
-
KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability
KNX Association · KNX Protocol Connection Authorization Option 1
-
Oracle E-Business Suite Improper Privilege Management Vulnerability
Oracle · E-Business Suite
-
SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
SonicWall · SMA1000 Appliances
-
SonicWall SMA1000 Appliances Code Injection Vulnerability
SonicWall · SMA1000 Appliances
-
Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability
Microsoft · Active Directory Federation Services
-
Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability
Microsoft · SharePoint Server
-
Cisco IOS Cross-Site Request Forgery Vulnerability
Cisco · IOS
-
iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability
iCagenda · iCagenda
-
Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability
Balbooa · Forms
-
Adobe ColdFusion Path Traversal Vulnerability
Adobe · ColdFusion
-
JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability
JoomShaper · SP Page Builder
-
Langflow Authorization Bypass Through User-Controlled Key Vulnerability
Langflow · Langflow
-
Joomlack Page Builder Improper Access Control Vulnerability
Joomlack · Page Builder
-
Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability
Microsoft · SharePoint Server
-
SimpleHelp Authentication Bypass Vulnerability
SimpleHelp · SimpleHelp
-
PTC Windchill and FlexPLM Improper Input Validation Vulnerability
PTC · Windchill and FlexPLM
-
Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability
Cisco · Unified Communications Manager
-
Lantronix EDS5000 Code Injection Vulnerability
Lantronix · EDS5000
-
Ubiquiti UniFi OS Improper Access Control Vulnerability
Ubiquiti · UniFi OS
-
Ubiquiti UniFi OS Path Traversal Vulnerability
Ubiquiti · UniFi OS
-
Ubiquiti UniFi OS Improper Input Validation Vulnerability
Ubiquiti · UniFi OS
-
Splunk Enterprise Missing Authentication for Critical Function Vulnerability
Splunk · Enterprise
-
Widget Factory Joomla Content Editor Improper Access Control Vulnerability
Widget Factory · Joomla Content Editor
-
Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability
Cisco · Catalyst SD-WAN Manager
-
LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability
LiteSpeed · cPanel Plugin
-
Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability
Oracle · PeopleSoft Enterprise PeopleTools
-
Ivanti Sentry OS Command Injection Vulnerability
Ivanti · Sentry
-
Google Chromium V8 Out-of-Bounds Read and Write Vulnerability
Google · Chromium V8
-
Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability
Cisco · Catalyst SD-WAN Manager
-
Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability
Arista · Extensible Operating System
-
BerriAI LiteLLM Command Injection Vulnerability
BerriAI · LiteLLM
-
Check Point Security Gateway Improper Authentication Vulnerability
Check Point · Security Gateway
-
SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability
SolarWinds · Serv-U
-
Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability
Mirasvit · Mirasvit Full Page Cache Warmer
-
Linux Kernel Improper Authentication Vulnerability
Linux · Kernel
-
Android Framework Integer Overflow Vulnerability
Android · Framework
-
Oracle WebLogic Server Unspecified Vulnerability
Oracle · WebLogic Server
-
Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
Palo Alto Networks · PAN-OS
-
TanStack Unspecified Vulnerability
TanStack · TanStack
-
Nx Console Embedded Malicious Code Vulnerability
Nx · Nx Console
-
Daemon Tools Lite Embedded Malicious Code Vulnerability
Daemon · Daemon Tools Lite
-
LiteSpeed cPanel Plugin Privilege Escalation Vulnerability
LiteSpeed · cPanel Plugin
-
Drupal Core SQL Injection Vulnerability
Drupal · Core
-
Langflow Origin Validation Error Vulnerability
Langflow · Langflow
-
Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability
Trend Micro · Apex One
-
Microsoft Windows Buffer Overflow Vulnerability
Microsoft · Windows
-
Microsoft DirectX NULL Byte Overwrite Vulnerability
Microsoft · DirectX
-
Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability
Adobe · Acrobat and Reader
-
Microsoft Internet Explorer Use-After-Free Vulnerability
Microsoft · Internet Explorer
-
Microsoft Internet Explorer Use-After-Free Vulnerability
Microsoft · Internet Explorer
-
Microsoft Defender Link Following Vulnerability
Microsoft · Defender
-
Microsoft Defender Denial of Service Vulnerability
Microsoft · Defender
-
Microsoft Exchange Server Cross-Site Scripting Vulnerability
Microsoft · Microsoft
-
Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
Cisco · Catalyst SD-WAN
-
BerriAI LiteLLM SQL Injection Vulnerability
BerriAI · LiteLLM
-
Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability
Ivanti · Endpoint Manager Mobile (EPMM)
-
Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability
Palo Alto Networks · PAN-OS
-
Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability
Linux · Kernel
-
WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability
WebPros · cPanel & WHM and WP2 (WordPress Squared)
-
ConnectWise ScreenConnect Path Traversal Vulnerability
ConnectWise · ScreenConnect
-
Microsoft Windows Protection Mechanism Failure Vulnerability
Microsoft · Windows
-
SimpleHelp Missing Authorization Vulnerability
SimpleHelp · SimpleHelp
-
SimpleHelp Path Traversal Vulnerability
SimpleHelp · SimpleHelp
-
Samsung MagicINFO 9 Server Path Traversal Vulnerability
Samsung · MagicINFO 9 Server
-
D-Link DIR-823X Command Injection Vulnerability
D-Link · DIR-823X
-
Marimo Remote Code Execution Vulnerability
Marimo · Marimo
-
Microsoft Defender Insufficient Granularity of Access Control Vulnerability
Microsoft · Defender
-
PaperCut NG/MF Improper Authentication Vulnerability
PaperCut · NG/MF
-
JetBrains TeamCity Relative Path Traversal Vulnerability
JetBrains · TeamCity
-
Kentico Xperience Path Traversal Vulnerability
Kentico · Kentico Xperience
-
Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability
Quest · KACE Systems Management Appliance (SMA)
-
Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability
Synacor · Zimbra Collaboration Suite (ZCS)
-
Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability
Cisco · Catalyst SD-WAN Manger
-
Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability
Cisco · Catalyst SD-WAN Manager
-
Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
Cisco · Catalyst SD-WAN Manager
-
Apache ActiveMQ Improper Input Validation Vulnerability
Apache · ActiveMQ
-
Microsoft Office Remote Code Execution
Microsoft · Office
-
Microsoft SharePoint Server Improper Input Validation Vulnerability
Microsoft · SharePoint Server
-
Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability
Microsoft · Visual Basic for Applications (VBA)
-
Adobe Acrobat Use-After-Free Vulnerability
Adobe · Acrobat
-
Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability
Microsoft · Exchange Server
-
Microsoft Windows Out-of-Bounds Read Vulnerability
Microsoft · Windows
-
Microsoft Windows Link Following Vulnerability
Microsoft · Windows
-
Fortinet FortiClient EMS SQL Injection Vulnerability
Fortinet · FortiClient EMS
-
Adobe Acrobat and Reader Prototype Pollution Vulnerability
Adobe · Acrobat and Reader
-
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
Ivanti · Endpoint Manager Mobile (EPMM)
-
Fortinet FortiClient EMS Improper Access Control Vulnerability
Fortinet · FortiClient EMS
-
TrueConf Client Download of Code Without Integrity Check Vulnerability
TrueConf · Client
-
Google Dawn Use-After-Free Vulnerability
Google · Dawn
-
Citrix NetScaler Out-of-Bounds Read Vulnerability
Citrix · NetScaler
-
F5 BIG-IP Stack-Based Buffer Overflow Vulnerability
F5 · BIG-IP
-
Aquasecurity Trivy Embedded Malicious Code Vulnerability
Aquasecurity · Trivy
-
Langflow Code Injection Vulnerability
Langflow · Langflow
-
Apple Multiple Products Buffer Overflow Vulnerability
Apple · Multiple Products
-
Craft CMS Code Injection Vulnerability
Craft CMS · Craft CMS
-
Apple Multiple Products Improper Locking Vulnerability
Apple · Multiple Products
-
Apple Multiple Products Classic Buffer Overflow Vulnerability
Apple · Multiple Products
-
Laravel Livewire Code Injection Vulnerability
Laravel · Livewire
-
Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability
Cisco · Secure Firewall Management Center (FMC)
-
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability
Synacor · Zimbra Collaboration Suite (ZCS)
-
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Microsoft · SharePoint
-
Wing FTP Server Information Disclosure Vulnerability
Wing FTP Server · Wing FTP Server
-
Google Skia Out-of-Bounds Write Vulnerability
Google · Skia
-
Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability
Google · Chromium V8
-
n8n Improper Control of Dynamically-Managed Code Resources Vulnerability
n8n · n8n
-
Omnissa Workspace ONE Server-Side Request Forgery
Omnissa · Workspace One UEM
-
SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability
SolarWinds · Web Help Desk
-
Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability
Ivanti · Endpoint Manager (EPM)
-
Hikvision Multiple Products Improper Authentication Vulnerability
Hikvision · Multiple Products
-
Rockwell Multiple Products Insufficient Protected Credentials Vulnerability
Rockwell · Multiple Products
-
Apple Multiple Products Integer Overflow or Wraparound Vulnerability
Apple · Multiple Products
-
Apple iOS and iPadOS Use-After-Free Vulnerability
Apple · iOS and iPadOS
-
Apple Multiple products Use-After-Free Vulnerability
Apple · Multiple Products
-
Qualcomm Multiple Chipsets Memory Corruption Vulnerability
Qualcomm · Multiple Chipsets
-
Broadcom VMware Aria Operations Command Injection Vulnerability
Broadcom · VMware Aria Operations
-
Cisco SD-WAN Path Traversal Vulnerability
Cisco · SD-WAN
-
Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability
Cisco · Catalyst SD-WAN Controller and Manager
-
Soliton Systems K.K FileZen OS Command Injection Vulnerability
Soliton Systems K.K · FileZen
-
RoundCube Webmail Deserialization of Untrusted Data Vulnerability
Roundcube · Webmail
-
RoundCube Webmail Cross-site Scripting Vulnerability
Roundcube · Webmail
-
GitLab Server-Side Request Forgery (SSRF) Vulnerability
GitLab · GitLab
-
Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability
Dell · RecoverPoint for Virtual Machines (RP4VMs)
-
Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability
Microsoft · Windows
-
Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability
Synacor · Zimbra Collaboration Suite
-
TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type Vulnerability
TeamT5 · ThreatSonar Anti-Ransomware
-
Google Chromium CSS Use-After-Free Vulnerability
Google · Chromium
-
BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability
BeyondTrust · Remote Support (RS) and Privileged Remote Access (PRA)
-
Microsoft Configuration Manager SQL Injection Vulnerability
Microsoft · Configuration Manager
-
Notepad++ Download of Code Without Integrity Check Vulnerability
Notepad++ · Notepad++
-
SolarWinds Web Help Desk Security Control Bypass Vulnerability
SolarWinds · Web Help Desk
-
Apple Multiple Buffer Overflow Vulnerability
Apple · Multiple Products
-
Microsoft Windows Shell Protection Mechanism Failure Vulnerability
Microsoft · Windows
-
Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability
Microsoft · Windows
-
Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability
Microsoft · Office
-
Microsoft Windows Type Confusion Vulnerability
Microsoft · Windows
-
Microsoft Windows NULL Pointer Dereference Vulnerability
Microsoft · Windows
-
Microsoft Windows Improper Privilege Management Vulnerability
Microsoft · Windows
-
React Native Community CLI OS Command Injection Vulnerability
React Native Community · CLI
-
SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability
SmarterTools · SmarterMail
-
Sangoma FreePBX Improper Authentication Vulnerability
Sangoma · FreePBX
-
GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability
GitLab · Community and Enterprise Editions
-
SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability
SolarWinds · Web Help Desk
-
Sangoma FreePBX OS Command Injection Vulnerability
Sangoma · FreePBX
-
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
Ivanti · Endpoint Manager Mobile (EPMM)
-
Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability
Fortinet · Multiple Products
-
Linux Kernel Integer Overflow Vulnerability
Linux · Kernel
-
SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability
SmarterTools · SmarterMail
-
Microsoft Office Security Feature Bypass Vulnerability
Microsoft · Office
-
SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability
SmarterTools · SmarterMail
-
GNU InetUtils Argument Injection Vulnerability
GNU · InetUtils
-
Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability
Broadcom · VMware vCenter Server
-
Vite Vitejs Improper Access Control Vulnerability
Vite · Vitejs
-
Versa Concerto Improper Authentication Vulnerability
Versa · Concerto
-
Prettier eslint-config-prettier Embedded Malicious Code Vulnerability
Prettier · eslint-config-prettier
-
Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability
Synacor · Zimbra Collaboration Suite (ZCS)
-
Cisco Unified Communications Products Code Injection Vulnerability
Cisco · Unified Communications Manager
-
Microsoft Windows Information Disclosure Vulnerability
Microsoft · Windows
-
Gogs Path Traversal Vulnerability
Gogs · Gogs
-
Microsoft Office PowerPoint Code Injection Vulnerability
Microsoft · Office
-
Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability
Hewlett Packard Enterprise (HPE) · OneView
-
MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability
MongoDB · MongoDB and MongoDB Server
-
Digiever DS-2105 Pro Missing Authorization Vulnerability
Digiever · DS-2105 Pro
-
WatchGuard Firebox Out of Bounds Write Vulnerability
WatchGuard · Firebox
-
Cisco Multiple Products Improper Input Validation Vulnerability
Cisco · Multiple Products
-
SonicWall SMA1000 Missing Authorization Vulnerability
SonicWall · SMA1000 appliance
-
ASUS Live Update Embedded Malicious Code Vulnerability
ASUS · Live Update
-
Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability
Fortinet · Multiple Products
-
Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability
Gladinet · CentreStack and Triofox
-
Apple Multiple Products Use-After-Free WebKit Vulnerability
Apple · Multiple Products
-
Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability
Sierra Wireless · AirLink ALEOS
-
Google Chromium Out of Bounds Memory Access Vulnerability
Google · Chromium
-
OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability
OSGeo · GeoServer
-
RARLAB WinRAR Path Traversal Vulnerability
RARLAB · WinRAR
-
Microsoft Windows Use After Free Vulnerability
Microsoft · Windows
-
D-Link Routers Buffer Overflow Vulnerability
D-Link · Routers
-
Array Networks ArrayOS AG OS Command Injection Vulnerability
Array Networks · ArrayOS AG
-
Meta React Server Components Remote Code Execution Vulnerability
Meta · React Server Components
-
OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability
OpenPLC · ScadaBR
-
Android Framework Privilege Escalation Vulnerability
Android · Framework
-
Android Framework Information Disclosure Vulnerability
Android · Framework
-
OpenPLC ScadaBR Cross-site Scripting Vulnerability
OpenPLC · ScadaBR
-
Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability
Oracle · Fusion Middleware
-
Google Chromium V8 Type Confusion Vulnerability
Google · Chromium V8
-
Fortinet FortiWeb OS Command Injection Vulnerability
Fortinet · FortiWeb
-
Fortinet FortiWeb Path Traversal Vulnerability
Fortinet · FortiWeb
-
Gladinet Triofox Improper Access Control Vulnerability
Gladinet · Triofox
-
Microsoft Windows Race Condition Vulnerability
Microsoft · Windows
-
WatchGuard Firebox Out-of-Bounds Write Vulnerability
WatchGuard · Firebox
-
Samsung Mobile Devices Out-of-Bounds Write Vulnerability
Samsung · Mobile Devices
-
Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability
Gladinet · CentreStack and Triofox
-
CWP Control Web Panel OS Command Injection Vulnerability
CWP · Control Web Panel
-
XWiki Platform Eval Injection Vulnerability
XWiki · Platform
-
Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability
Broadcom · VMware Aria Operations and VMware Tools
-
Dassault Systèmes DELMIA Apriso Code Injection Vulnerability
Dassault Systèmes · DELMIA Apriso
-
Dassault Systèmes DELMIA Apriso Missing Authorization Vulnerability
Dassault Systèmes · DELMIA Apriso
No matches for this filter.
Data as of 26 Oct 2026 · Source: CISA Known Exploited Vulnerabilities Catalog
Names and descriptions are taken unchanged from the CISA catalogue. An entry means exploitation in the wild is documented — not that every installation is affected.
How the Watch works
Watch. Assess. Warn. Fix.
- 01
Watch
Vendor notices, CVE databases, host and security-researcher blogs: we read what the scene reports — not only once it is in the news.
- 02
Assess
Not every flaw affects you. We check which systems are affected, whether a patch exists and whether attacks have been reported.
- 03
Warn
You get a short email: what is going on, what does not help, what to do in which order. No panic, no jargon.
- 04
Fix
If you like, we apply the update for you, check for traces afterwards and document what we did.
Security packages
From the first scan to all-round protection.
Four packages that build on each other — for anyone who runs connected assets, control systems or business-critical websites. Fixed price, clear scope, a report at the end.
Who it is for
- Energy: wind, solar and storage parks
- Industry and manufacturing
- Building and utility technology
- Companies with a website, shop and hosting
Package 2
VPN configuration
Close the doors nobody should leave open.
€899one-off
- Setup and integration of VPN protection
- Protection against unauthorised access
- Access control for logins and control panels
Package 3
Deep Scan
What happens when someone really wants in?
€1,299one-off
Includes everything in the Basic Scan
- Comprehensive analysis via VPN
- Internal systems and control systems (SCADA)
- Assessment of exploitation potential
- Detailed vulnerability analysis
Package 4
360° Service
Everything from one source — and by your side for a year.
€2,999one-off, including 12 months of monitoring
Includes everything in the Deep Scan
- VPN configuration (€899 on its own)
- 12 months of monitoring and updates
- Personal security advisor
- Prioritised implementation support
- Compliance reporting
The Deep Scan and VPN configuration on their own cost €2,198 together. The 360° Service adds monitoring, advice, implementation support and compliance reporting.
All prices are one-off and net, plus statutory VAT.
We run scans and tests only with a written order and an agreed scope — on systems you own or are authorised to have tested.
Just want to stay informed for now?
The Security Watch alerts are free and independent of any package.
Frequently asked questions
Why does the PHP flaw affect almost every WordPress site?
WordPress is written in PHP and runs on the server’s PHP. If the flaw is in the PHP core, it sits below WordPress, plugins and themes. That is why a WordPress update does not protect you; only updating the server’s PHP version does.
How do I know which PHP version my site uses?
In the hosting panel under “PHP version”, in WordPress under Tools → Site Health → Info → Server, or via SSH with “php -v”. If you cannot find it, send us your website address — we will look.
Do you need my permission for a scan?
Yes, always — in writing and with an agreed scope. We only test systems you own or are authorised to have tested. That protects you and us: a test without an order would be not only unprofessional but a criminal offence.
Are the packages only for wind and solar parks?
No. They are used there a lot because assets and control systems are often reachable over the internet. The same questions apply to industry, building technology and any company with a website, shop or its own hosting. We adapt the scope to your systems.
How often will I get an email?
Only when there is an advisory that may be relevant to you. We do not send weekly newsletters or advertising disguised as a warning.
What happens to my data?
We store your email address and, if you provide them, name, company and your technology focus. The entry only becomes active after you confirm. Every email contains an unsubscribe link. Details in the privacy policy.
Does the Security Watch replace a security concept?
No. It is an early-warning system for flaws that have become known. A security concept, backups and access management remain your foundation — we are happy to help with those as part of AI consulting and hosting.
Hear it from us — not from the news.
Sign up and we will write to you when a new flaw may affect your systems.
- Free
- Only relevant advisories
- Unsubscribe any time
- Confirmation by email
Almost done: we have sent you a confirmation email. You are only signed up once you click the link in it.