최근 6개월의 모든 CVE를 매일 업데이트합니다.

17개 중 17개 표시

• 중간CVE-2026-92757CVSS 점수 5.52026. 9. 17.

  Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption.

  CWE-311
• 중간CVE-2026-92756CVSS 점수 5.52026. 9. 17.

  Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently lose TLS and schema-map settings leading to protected fields being stored unencrypted in the databas

  CWE-311
• 중간CVE-2026-84676CVSS 점수 4.32026. 9. 2.

  Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

  CWE-311
• 높음CVE-2026-81688CVSS 점수 7.52026. 8. 27.

  openssl_encrypt versions before 1.4.9 store an unkeyed SHA-256 hash of the plaintext in the cleartext file header metadata. Attackers can read this hash without the password to confirm guessed plaintexts offline or fingerprint identical plaintexts across separ

  CWE-311jahlives openssl_encrypt
• 중간CVE-2026-81681CVSS 점수 4.62026. 8. 27.

  openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption and write a marker declaring the workspace encrypted, but the workspace directory is actually stored

  CWE-311jahlives openssl_encrypt
• 치명CVE-2026-77812CVSS 점수 9.42026. 8. 21.

  DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption. When a client attempts to connect to the drone over Wi-Fi, or when the drone is switched to QuickTransfer mode, the DJI Fly applicati

  CWE-311
• 낮음CVE-2026-19891CVSS 점수 3.72026. 8. 15.

  A vulnerability was determined in TRENDnet TEW-WLC100 2.05b02. This affects an unknown function of the file /etc/racoon.conf of the component IKE Phase 1 Aggressive Mode. This manipulation of the argument exchange_mode causes missing encryption of sensitive da

  CWE-310CWE-311
• 높음CVE-2025-59325CVSS 점수 7.52026. 8. 12.

  CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to encrypt the initramfs contents, allowing for the offline recovery of secrets and cryptographic details.

  CWE-311
• 중간CVE-2026-21079CVSS 점수 6.52026. 8. 10.

  Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept transmitted data.

  CWE-311samsung smart_switch
• 높음CVE-2026-20157CVSS 점수 7.52026. 7. 15.

  As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally d

  CWE-311cisco roomoscisco roomos_cloud
• 높음CVE-2025-63579CVSS 점수 7.52026. 7. 9.

  Unauthorized use of Kyocera printers, allows all information stored in the Kyocera address book to be exported. The security measure that encrypts incoming data ian be bypassed with this vulnerability, allowing encrypted data to be decrypted. Passwords and oth

  CWE-200CWE-284CWE-311
• 높음CVE-2026-54784CVSS 점수 7.42026. 7. 8.

  CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. In version 1.9.0, CoreWCF SPNEGO SecurityContextToken negotiation can expose the proof key recovered from the RSTR when TransportWithMessageCredential with Windows cl

  CWE-311CWE-523
• 중간CVE-2026-55568CVSS 점수 5.92026. 6. 23.

  Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, in certain configurations, traffic expected to be protected by TLS on the hop to the proxy is transmitted in cleartext. Proxy authentication credentials (the Proxy-Authorization header, proxy userinfo i

  CWE-311CWE-319CWE-636guzzlephp guzzle
• 중간CVE-2026-53442CVSS 점수 5.32026. 6. 10.

  Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job configurations unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Ext

  CWE-311jenkins jenkins
• 높음CVE-2026-34486CVSS 점수 7.52026. 4. 9.

  Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.2

  CWE-311CWE-807apache tomcatredhat jboss_web_serverredhat enterprise_linux
• 높음CVE-2026-34992CVSS 점수 7.52026. 4. 6.

  Antrea is a Kubernetes networking solution intended to be Kubernetes native. Prior to 2.4.5 and 2.5.2, a missing encryption vulnerability affects inter-Node Pod traffic. In Antrea clusters configured for dual-stack networking with IPsec encryption enabled (tra

  CWE-311linuxfoundation antrea
• 치명CVE-2026-32891CVSS 점수 9.02026. 3. 20.

  Anchorr is a Discord bot for requesting movies and TV shows and receiving notifications when items are added to a media server. Versions 1.4.1 and below contain a stored XSS vulnerability in the Jellyseerr user selector. Jellyseerr allows any account holder to

  CWE-80CWE-212CWE-311openvessl anchorr