최근 6개월의 모든 CVE를 매일 업데이트합니다.

5개 중 5개 표시

• 치명CVE-2026-85724CVSS 점수 9.62026. 9. 23.

  Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an

  CWE-155CWE-863
• 높음CVE-2026-87016CVSS 점수 8.12026. 9. 9.

  Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.41 until 0.11.1, get_user_by_oauth_sub and get_user_by_scim_external_id in backend/open_webui/models/users.py used JSON contains matching that compiled to SQL LIKE s

  CWE-155CWE-287openwebui open_webui
• 낮음CVE-2026-68939CVSS 점수 2.02026. 8. 18.

  Pyenv provides simple Python version management. Prior to 2.8.0, is_version_safe() in libexec/pyenv-version-file-read accepts shell glob metacharacters in .python-version values, and unquoted PYENV_VERSION expansion in libexec/pyenv-version-name, libexec/pyenv

  CWE-78CWE-88CWE-155
• 중간CVE-2026-73412CVSS 점수 6.32026. 8. 12.

  Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, this impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or true when the default shell is Zsh, using the escape and escapeAll. The Zsh options E

  CWE-78CWE-155
• 중간CVE-2026-49482CVSS 점수 4.32026. 6. 12.

  ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #141, ClipBucket v5 contains an improper neutralization of SQL wildcard characters in the subtitle editing endpoint. An authenticated user can send a % character as the number par

  CWE-155CWE-943