CWE-116 관련 취약점
같은 약점 유형으로 분류된 취약점입니다. CWE 는 "무엇을 잘못했는가" 의 분류이고, 제품을 가리지 않고 같은 실수가 반복됩니다.
CWE-116 — 주요 취약점
악용이 확인된 것을 먼저 보여줍니다.
● 실제 악용이 확인됨CVE-2024-38475Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attack…100.0%심각9.1● 랜섬웨어 캠페인에 사용됨CVE-2022-24682An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 pa…30.9%보통6.1● 실제 악용이 확인됨CVE-2026-20245A vulnerability in the CLI of Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Cataly…25.3%높음7.8● 실제 악용이 확인됨CVE-2022-42948Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. …2.7%심각9.8CVE-2026-105244Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net.…0.8%보통5.3CVE-2026-94545Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version …0.8%보통5.3CVE-2026-88060Angular is a development platform for building mobile and desktop web applications using TypeScript/…0.7%높음8.6CVE-2026-105429Improper neutralization of special elements in the NetBird client SSH configuration manager (client/…0.6%높음8.9
전체 목록
78건
CVE-2026-13684An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before …0.6%심각9.8
CVE-2026-102235Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code …0.6%높음8.8
CVE-2026-118256Vue I18n is the internationalization plugin for Vue.js. From 9.0.0-beta.5 until 11.4.14 and 12.0.0-alpha.5, en…0.5%낮음2.1
CVE-2026-88058Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript…0.5%높음8.6
CVE-2026-54182backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel pa…0.4%높음8.1
CVE-2026-107823MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11…0.4%높음7.2
CVE-2026-95274Improper output encoding in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had…0.4%높음8.3
CVE-2026-82756Improper Encoding or Escaping of Output vulnerability in ash-project ash_authentication_oauth2_server allows a…0.4%보통6.3
CVE-2026-95659MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject…0.4%보통4.8
CVE-2026-88921MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which is responsi…0.4%보통5.1
CVE-2026-63346Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, the header par…0.4%높음8.6
CVE-2026-63344Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, content-type k…0.4%높음8.6
CVE-2026-110592BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in render_invoice_template() that allow…0.4%보통5.1
CVE-2026-104368The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege Escalation in all ve…0.3%높음8.8
CVE-2026-113667ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of…0.4%보통5.3
CVE-2026-19641On affected platforms running Arista EOS with password authentication configured, a specially crafted password…0.3%보통6.9
CVE-2026-73195Improper Encoding or Escaping of Output vulnerability in Apache Syncope. Authenticated users can store a sprea…0.3%높음7.3
CVE-2026-104907MISP contains a cross-site scripting (XSS) vulnerability in the remote event preview page. When a linked (remo…0.4%보통4.8
CVE-2026-58504draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.5, opening or impor…0.4%보통6.1
CVE-2026-13635An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation Manager (DSM) bef…0.3%보통5.3
CVE-2026-57210Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17,…0.3%높음7.0
CVE-2026-69821Improper encoding or escaping of output in Active Directory Certificate Services (AD CS) allows an authorized …0.3%높음7.8
CVE-2026-83559Improper encoding or escaping of output in Apache Wicket. org.apache.wicket.core.util.string.JavaScriptUtils#e…0.3%높음7.4
CVE-2026-54506Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior …0.3%높음7.6
CVE-2026-110910### Summary `qs.stringify` with `allowEmptyArrays: true` writes the key of an empty array without encoding it,…0.3%보통6.3
CVE-2026-63208Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when a Microsoft Graph req…0.3%보통5.1
CVE-2026-63329Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, copy_server_request i…0.3%보통4.9
CVE-2026-106102Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR…0.3%심각10.0
CVE-2026-54694SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code flaws combin…0.3%심각9.6
CVE-2026-18516An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthentic…0.3%심각9.6
CVE-2026-106444Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handle…0.3%보통4.7
CVE-2026-118257Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 unt…0.3%높음7.2
CVE-2026-111059Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 unt…0.3%보통6.1
CVE-2026-55214GLPI is a free asset and IT management software package. From 11.0.6 until 11.0.8, an authenticated technician…0.3%높음8.5
CVE-2026-107845Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submi…0.3%심각9.3
CVE-2026-55442The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From ve…0.3%보통5.3
CVE-2026-113726virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate sc…0.3%높음7.8
CVE-2026-106107Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 3.3.0, several …0.3%높음8.3
CVE-2026-82409Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, indexer/common.go seria…0.3%높음8.4
CVE-2026-110725fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3…0.3%낮음3.7
CVE-2026-87550Improper encoding or escaping of output in CSS in Google Chrome prior to 153.0.8010.36 allowed a remote attack…0.2%보통4.3
CVE-2026-114510Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applications acr…0.2%높음7.1
CVE-2026-113870MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline in…0.2%높음8.6
CVE-2026-113732virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inheri…0.2%높음7.8
CVE-2026-112949Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.…0.2%보통4.7
CVE-2026-116815OpenPanel before 3.0.0 contains an improper escaping vulnerability in sankey.service.ts that allows authentica…0.2%보통5.3
CVE-2026-93693In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request dest…0.2%보통6.5
CVE-2026-13407The Royal Elementor Addons WordPress plugin before 1.7.1067 does not properly sanitize and escape values submi…0.2%보통5.4
CVE-2024-12139The error handling implementation fails to properly sanitize or validate user-supplied input within URL parame…0.2%보통4.3
CVE-2026-79952Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00,…0.2%보통5.3
CVE-2026-79964Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00,…0.2%보통5.3
CVE-2026-14556The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value be…0.2%보통5.4
CVE-2026-52772YesWiki is a wiki system written in PHP. Prior to version 4.6.6, Bazar form-field templates still apply |raw('…0.2%보통5.5
CVE-2026-104250The unstructured library provides open-source components for ingesting and pre-processing images and text docu…0.2%보통6.1
CVE-2026-116582Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capab…0.2%보통4.7
CVE-2026-110757Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without q…0.2%미평가
CVE-2026-110756Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged f…0.2%미평가
CVE-2026-107393FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.235, when APP_CLOUDFLARE_IS_USED is enab…0.2%보통6.1
CVE-2026-61784xhtml-purifier is a Node.js library to take in raw/unknown/untrusted HTML and output cleaned, purified, truste…0.2%보통6.1
CVE-2026-113725virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.7, the bash activate sc…0.2%높음7.8
CVE-2026-57583OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from Op…0.1%낮음3.3
CVE-2026-105801openapi-python-client generates Python clients from OpenAPI documents. Prior to 0.29.1, the generator does not…0.1%높음8.4
CVE-2026-47562NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could injec…0.1%보통4.4
CVE-2026-77404RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, URI.String in uri.go concatenates CertFile, Ke…0.1%높음8.7
CVE-2026-120647CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in…미평가
CVE-2026-120644CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and ex…미평가
CVE-2026-63471fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts …심각9.3
CVE-2026-63470fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts …심각9.3
CVE-2026-63469fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts …심각9.3
CVE-2026-44266Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, the Ruby backend in src/comp…심각9.8
이 원장은 전체 CVE 가 아닙니다. NVD 에는 30만 건이 넘습니다. 여기 있는 것은 ① 악용이 확인된 것 ② 최근 공개된 것 ③ 국산 SW 관련 ④ KISA 권고에 등장한 것입니다. 무엇을 담았는지 밝히지 않으면 "없다" 를 "안전하다" 로 읽게 됩니다.