최근 6개월의 모든 CVE를 매일 업데이트합니다.

11개 중 11개 표시

• 점수 미부여CVE-2026-796772026. 9. 23.

  Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a result of lost time outs for asynchronous WebSocket writes. This issue affects Apache Tomcat: from 11.0.0-M1 thr

  CWE-772CWE-1025
• 높음CVE-2026-93854CVSS 점수 7.22026. 9. 18.

  In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations (PUT /v2/leases/{lease_id} and DELETE /v2/leases/{lease_id}). The policy authorize() wrapper attempts to load the target lease t

  CWE-1025
• 높음CVE-2026-29811CVSS 점수 7.72026. 9. 13.

  CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a primary domain; normally spelled "alias") via an ORM query filter rather than a Python "if" statement.

  CWE-1025
• 높음CVE-2023-54390CVSS 점수 7.52026. 9. 9.

  PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arrays. Attackers can send malformed JSON with unexpected null elements in LoginPacket to crash the serv

  CWE-1025
• 치명CVE-2026-78619CVSS 점수 9.82026. 8. 25.

  Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totp_use_recovery compares user identifiers numerically. The helper searches the recovery model for the submitted code's digest alone, a

  CWE-305CWE-1025
• 높음CVE-2026-75840CVSS 점수 7.52026. 8. 18.

  ArcadeDB before 26.8.1 contains an arbitrary file read vulnerability in the GraalVM JavaScript sandbox allowlist enforcement, which uses unescaped regular expressions to validate package names. Attackers with trigger creation privileges can use Java.type() to

  CWE-1025
• 높음CVE-2025-71377CVSS 점수 8.72026. 7. 16.

  stoatchat (delta) versions before 20250210-1 (0.8.2) contain a logic error in the query messages route. When fetching messages 'nearby' another message, the database query can be given a message limit of zero, which the database interprets as 'no limit'. A rem

  CWE-1025
• 높음CVE-2026-9800CVSS 점수 8.12026. 6. 25.

  A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path wit

  CWE-1025redhat build_of_keycloak
• 중간CVE-2026-48860CVSS 점수 6.52026. 6. 10.

  Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-over-TLS LAN allowlist. The inet_tls_dist:check_ip/1 function, which enforces a LAN allowlist for Erlang distribu

  CWE-863CWE-1025erlang erlang\/otperlang erlang\/ssl
• 높음CVE-2026-40880CVSS 점수 8.12026. 4. 21.

  ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and zebra-consensus version 5.0.2, a logic error in Zebra's transaction verification cache could allow a malicious miner to induce a consensus split. By carefully submitting a transa

  CWE-1025zfnd zebra-consensuszfnd zebrad
• 중간CVE-2026-40227CVSS 점수 6.22026. 4. 10.

  In systemd 260 before 261, a local unprivileged user can trigger an assert via an IPC API call with an array or map that has a null element.

  CWE-1025systemd_project systemd