최근 6개월의 모든 CVE를 매일 업데이트합니다.

11개 중 11개 표시

• 중간CVE-2026-54248CVSS 점수 6.52026. 9. 11.

  Doco-CD is a GitOps continuous delivery tool that automatically deploys and updates Docker Compose projects/services and Swarm stacks. Prior to version 0.90.1, a trust-boundary flaw in OCI artifact verification allowed artifact-provided deployment config to in

  CWE-347CWE-501
• 치명CVE-2026-44091CVSS 점수 9.12026. 7. 30.

  An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configuration entry in the system configuration. This may lead to integrity and availability loss.

  CWE-501
• 중간CVE-2026-65902CVSS 점수 6.12026. 7. 23.

  DOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sa

  CWE-501cure53 dompurify
• 중간CVE-2026-49458CVSS 점수 6.12026. 7. 14.

  DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(node, { IN_PLACE: true }) accepted same-origin foreign-realm DOM nodes while follow-on checks used parent-realm constructors, causing instanceo

  CWE-79CWE-501CWE-693cure53 dompurify
• 치명CVE-2026-48746CVSS 점수 9.12026. 6. 22.

  vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI web servers and starlette's trust on those web servers enables an authentication bypass of the OpenAI API AuthenticationMiddleware. It al

  CWE-444CWE-501vllm vllm
• 높음CVE-2026-33828CVSS 점수 7.82026. 6. 9.

  Trust boundary violation in Windows Attestation allows an authorized attacker to elevate privileges locally.

  CWE-501microsoft windows_10_1607microsoft windows_10_1809microsoft windows_10_21h2
• 치명CVE-2026-35051CVSS 점수 10.02026. 4. 30.

  Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is an authentication bypass vulnerability in Traefik's ForwardAuth middleware when trustForwardHeader=false is configured and Traefik is deployed behin

  CWE-345CWE-501traefik traefik
• 높음CVE-2026-34780CVSS 점수 8.32026. 4. 4.

  Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From versions 39.0.0-alpha.1 to before 39.8.0, 40.0.0-alpha.1 to before 40.7.0, and 41.0.0-alpha.1 to before 41.0.0-beta.8, apps that pass VideoFrame object

  CWE-668CWE-1188CWE-501electronjs electron
• 중간CVE-2026-24153CVSS 점수 5.22026. 3. 31.

  NVIDIA Jetson Linux has a vulnerability in initrd, where the nvluks trusted application is not disabled. A successful exploit of this vulnerability might lead to information disclosure.

  CWE-501nvidia jetson_linuxnvidia jetson_agx_orin_32gbnvidia jetson_agx_orin_64gb
• 높음CVE-2026-27893CVSS 점수 8.82026. 3. 27.

  vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.18.0, two model implementation files hardcode `trust_remote_code=True` when loading sub-components, bypassing the user's explicit `--tru

  CWE-693CWE-501vllm vllm
• 높음CVE-2026-4687CVSS 점수 8.62026. 3. 24.

  Sandbox escape due to incorrect boundary conditions in the Telemetry component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

  CWE-754CWE-120CWE-501mozilla firefox