CWE-1188 관련 취약점
같은 약점 유형으로 분류된 취약점입니다. CWE 는 "무엇을 잘못했는가" 의 분류이고, 제품을 가리지 않고 같은 실수가 반복됩니다.
CWE-1188 — 주요 취약점
악용이 확인된 것을 먼저 보여줍니다.
● 실제 악용이 확인됨CVE-2020-13927The previous default setting for Airflow's Experimental API was to allow all API requests without au…99.8%심각9.8● 실제 악용이 확인됨CVE-2023-27524Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that…98.1%심각9.8● 실제 악용이 확인됨CVE-2022-24706In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation …92.5%심각9.8● 실제 악용이 확인됨CVE-2025-48927The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump…11.6%보통5.3● 실제 악용이 확인됨CVE-2023-6448Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default a…2.1%심각9.8CVE-2026-52824Kimai is an open-source time tracking application. Prior to 2.58.0, the official Docker image sets A…2.1%심각9.1CVE-2026-87827Certain KGUARD DVR devices running vulnerable firmware expose a system command execution service on …1.1%심각10.0CVE-2026-57127PraisonAI is a multi-agent teams system. Prior to 4.6.58, recipe serve installs APIKeyAuthMiddleware…0.9%심각9.8
전체 목록
65건
CVE-2026-57147PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonai_platform/services/auth_service.py assigns t…0.8%심각9.8
CVE-2026-110631Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauth…0.7%심각9.3
CVE-2026-109437Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its …0.6%심각9.2
CVE-2026-111764A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, the default In…0.6%높음7.5
CVE-2026-89139Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module register…0.6%높음8.7
CVE-2026-77934Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute…0.5%높음8.7
CVE-2026-93338Grandstream GWN7660ELR before firmware version 1.0.27.6 contains an information disclosure vulnerability that …0.5%보통6.9
CVE-2026-103091Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MC…0.5%심각9.3
CVE-2026-120091Temporal Server compiles a Worker Controller Instance module, go.temporal.io/auto-scaled-workers, into its Wor…0.5%높음8.7
CVE-2026-112255Initialization of a resource with an insecure default vulnerability in OpenText Advanced Authentication Server…0.5%낮음2.9
CVE-2026-77936Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware…0.5%심각9.3
CVE-2026-61793Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.0.2 until 6.7.0, nuxt-og-image exposes th…0.5%보통6.9
CVE-2026-103956Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 all…0.5%심각10.0
CVE-2026-85494Improper handling of length parameter inconsistency, Uncaught exception, Inefficient Algorithmic Complexity, M…0.5%높음8.7
CVE-2026-53709MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env…0.5%심각9.8
CVE-2026-102676Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior …0.5%높음8.3
CVE-2026-114123D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365 Finance & Operations X++ code…0.4%높음7.5
CVE-2026-114397Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODE_E…0.4%높음8.3
CVE-2026-57139PraisonAI is a multi-agent teams system. From 1.5.0 until 1.7.2, MCPServer.startHttp() in src/praisonai-ts/src…0.4%심각9.8
CVE-2026-94634Allocation of resources without limits or throttling, Initialization of a resource with an insecure default vu…0.4%높음8.2
CVE-2026-97055SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret (tokenizer::jwt::secret, set via …0.4%심각9.2
CVE-2026-14765Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default configuration for th…0.4%높음7.7
CVE-2026-57148PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonai_platform/services/auth_service.py falls bac…0.4%심각9.8
CVE-2026-86464In the current development version of Eclipse aeriOS, for which no official release has yet been published, th…0.4%심각9.9
CVE-2026-25784Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container i…0.3%심각9.3
CVE-2026-53660Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the default configuration i…0.3%높음7.4
CVE-2026-105744Docling simplifies document processing by parsing diverse formats and providing integrations with the generati…0.3%높음7.5
CVE-2026-100291In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, several ONVIF service endpoints process management request…0.3%심각9.3
CVE-2026-118691xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message e…0.3%보통6.3
CVE-2026-49462NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residen…0.3%보통5.3
CVE-2026-110769holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that al…0.3%높음8.3
CVE-2026-116244When a pgAdmin 4 connection was not meant to use a Kerberos user's delegated credentials, pgAdmin removed KRB5…0.3%높음7.1
CVE-2026-116672Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the document…0.3%높음8.8
CVE-2026-54907Caddy Proxy Manager is a web interface for managing Caddy Server reverse proxies and certificates. Prior to 1.…0.3%보통5.3
CVE-2026-77427FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. From 3…0.3%보통5.9
CVE-2026-86246Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure o…0.3%심각9.1
CVE-2026-100260In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset0.3%보통5.3
CVE-2026-93354Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated a…0.3%높음8.5
CVE-2026-85086Improper certificate validation, Initialization of a resource with an insecure default vulnerability in Apache…0.3%보통6.9
CVE-2026-104077Obsidian Desktop before 1.14.0 contains a remote code execution vulnerability that allows attackers to craft m…0.3%높음8.5
CVE-2026-116242pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither host_pkey_directories nor ssh_confi…0.2%높음7.1
CVE-2026-89120A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakne…0.2%높음7.1
CVE-2026-114618Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, the default RFC 752…0.2%보통6.8
CVE-2026-78192WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via t…0.2%미평가
CVE-2026-116273MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing m…0.2%미평가
CVE-2026-76276In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the …0.2%보통4.3
CVE-2026-73596Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Initialization of …0.2%낮음3.8
CVE-2026-104078Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bundled MathJax 3.2.2 Safe compon…0.2%높음8.4
CVE-2026-71448: Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32 allows : Authentic…0.1%보통5.6
CVE-2026-89105The HybridTokenAuthenticator component of the SAP/cloud-security-services-integration-library accepts tokens f…0.1%보통4.2
CVE-2026-33586Authenticated users are able to manipulate both the SMTP envelope “Envelope-from” and “From” fields when sendi…0.1%보통6.3
CVE-2026-116247When a server in pgAdmin 4 had no password file, client certificate or client key configured, or the configure…0.1%높음7.1
CVE-2026-110952A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled JWKS-backed validator always…0.1%미평가
CVE-2026-109569sandboxed.sh through 1.3.0 contains a container escape vulnerability that allows code in container workspaces …0.1%심각9.3
CVE-2026-78013Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Initialization of …0.1%보통5.2
CVE-2026-78018Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Initialization of …0.1%보통6.3
CVE-2026-95860node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.42.0 until 2.180.0, namespace-level …심각9.1
이 원장은 전체 CVE 가 아닙니다. NVD 에는 30만 건이 넘습니다. 여기 있는 것은 ① 악용이 확인된 것 ② 최근 공개된 것 ③ 국산 SW 관련 ④ KISA 권고에 등장한 것입니다. 무엇을 담았는지 밝히지 않으면 "없다" 를 "안전하다" 로 읽게 됩니다.