최근 6개월의 모든 CVE를 매일 업데이트합니다.

10개 중 10개 표시

• 높음CVE-2026-37008CVSS 점수 8.12026. 9. 13.

  CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. Fo

  CWE-424
• 중간CVE-2026-82754CVSS 점수 6.32026. 9. 7.

  Improper Protection of Alternate Path vulnerability in ash-project ash_authentication_oauth2_server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix. oauth2_server_protocol_routes/1 in

  CWE-424
• 높음CVE-2026-82586CVSS 점수 8.22026. 9. 7.

  Improper Protection of Alternate Path vulnerability in ash-project ash_lua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list. AshLua exposes Ash resources to Lua scripts, gated by a manifest declaring which field

  CWE-424
• 높음CVE-2026-86145CVSS 점수 8.22026. 9. 5.

  PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outco

  CWE-424
• 중간CVE-2026-58428CVSS 점수 6.52026. 8. 13.

  Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

  CWE-424CWE-434
• 치명CVE-2026-66756CVSS 점수 9.82026. 7. 30.

  Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1. Users are recommended to upgrade to version 4.0.0-beta-1, which fixes the issue.

  CWE-424apache tika
• 높음CVE-2026-54423CVSS 점수 8.22026. 7. 10.

  In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_raw step to send arbitrary IPMI commands to a node, bypassing Ironic's access control.

  CWE-424
• 중간CVE-2026-0268CVSS 점수 4.42026. 6. 10.

  A security control bypass vulnerability in Prisma Access Agent for Linux allows a local attacker to route network traffic outside the VPN tunnel. This does not impact Prisma Access Agent on Windows, macOS, iOS, Android, or ChromeOS.

  CWE-424paloaltonetworks prisma_access_agentlinux linux_kernel
• 높음CVE-2026-0237CVSS 점수 7.82026. 5. 13.

  An improper protection of alternate path vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to an internal automation bridge. This allows a locally authenticated non-admin user to leverage an exposed communication ch

  CWE-424paloaltonetworks prisma_browserapple macos
• 중간CVE-2026-4913CVSS 점수 5.72026. 4. 14.

  Improper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to retain access when their account has been disabled.

  CWE-424