過去6か月のすべてのCVEを、毎日更新します。

9件中9件を表示

• 緊急CVE-2026-89422CVSSスコア 9.32026/09/22

  Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the intended server. A pre_shared_key extension in the ServerHello that the client never offered causes the client

  CWE-322
• 中CVE-2026-18654CVSSスコア 6.82026/08/03

  Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the clie

  CWE-322
• 高CVE-2026-58065CVSSスコア 8.12026/07/13

  The Apache Airflow Git provider runs its git-over-SSH operations with `StrictHostKeyChecking=no` by default, disabling SSH host-key verification. An attacker who can intercept the network path between an Airflow worker and the Git server can impersonate the se

  CWE-322apache apache-airflow-providers-git
• 高CVE-2026-11745CVSSスコア 8.82026/06/22

  A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not verify remote host keys for git+ssh:// connections, allowing an on-path attacker to perform man-in-the-middle attacks and c

  CWE-322
• 高CVE-2026-45361CVSSスコア 8.12026/05/25

  Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers who can intercept or modify the session. Users are advis

  CWE-322apache apache-airflow-providers-google
• 中CVE-2026-44467CVSSスコア 6.82026/05/13

  The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side. From 1.2581.0 to before 1.4304.0, Claude Desktop's SSH remote development feature verified only whether a hostname existed in ~/.ssh/known

  CWE-297CWE-322anthropic claude_desktop
• 中CVE-2026-1354CVSSスコア 6.42026/04/21

  Zero Motorcycles firmware versions 44 and prior enable an attacker to forcibly pair a device with the motorcycle via Bluetooth. Once paired, an attacker can utilize over-the-air firmware updating functionality to potentially upload malicious firmware to the mo

  CWE-322
• 高CVE-2025-13914CVSSスコア 8.72026/04/09

  A Key Exchange without Entity Authentication vulnerability in the SSH implementation of Juniper Networks Apstra allows a unauthenticated, MITM attacker to impersonate managed devices. Due to insufficient SSH host key validation an attacker can perform a machin

  CWE-322juniper apstra
• 高CVE-2026-33697CVSSスコア 7.52026/03/27

  Cocos AI is a confidential computing system for AI. The current implementation of attested TLS (aTLS) in CoCoS is vulnerable to a relay attack affecting all versions from v0.4.0 through v0.8.2. This vulnerability is present in both the AMD SEV-SNP and Intel TD

  CWE-322CWE-346ultraviolet cocos_ai