CWE-248 관련 취약점
같은 약점 유형으로 분류된 취약점입니다. CWE 는 "무엇을 잘못했는가" 의 분류이고, 제품을 가리지 않고 같은 실수가 반복됩니다.
CWE-248 — 주요 취약점
악용이 확인된 것을 먼저 보여줍니다.
CVE-2026-70082Uncaught exception in Windows DNS allows an unauthorized attacker to deny service over a network.1.2%높음7.5CVE-2026-69839Uncaught exception in Windows iSCSI Target Service allows an authorized attacker to deny service ove…1.1%보통6.5CVE-2026-92905ZohoCorp ManageEngine EventLog Analyzer and Log360 before build 13071 were vulnerable to a DoS vulne…1.0%보통5.3CVE-2026-32641Parseable is a log analytics platform built for high-volume data ingestion and analysis. Prior to 3.…0.9%높음7.5CVE-2026-88099Uncaught exception in Windows Failover Cluster allows an unauthorized attacker to deny service over …0.8%보통5.9CVE-2026-96945Uncaught exception in Windows Failover Cluster allows an unauthorized attacker to deny service over …0.8%높음7.5CVE-2026-84445gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with …0.7%높음8.7CVE-2026-119052llama.cpp b2877 before b11935 contains an uncaught exception vulnerability in the ggml-rpc server th…0.6%높음8.7
전체 목록
100건
CVE-2026-94622vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handli…0.6%높음8.7
CVE-2026-102599Socket.IO enables bidirectional and low-latency communication for every platform. From Engine.IO 6.6.0 until 6…0.6%높음7.5
CVE-2026-82410Pocketbase is an open source web backend written in go. Prior to 0.22.48 and 0.39.7, PocketBase's panic-recove…0.6%높음8.7
CVE-2026-42270countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.4…0.5%높음7.5
CVE-2026-86537Uncaught exception, Loop with unreachable exit condition ('infinite loop'), Integer underflow (wrap or wraparo…0.6%높음8.7
CVE-2026-67416RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, the optimize…0.5%보통5.3
CVE-2026-101035A flaw has been found in aligungr UERANSIM up to 3.3.0. This affects the function DecodePlainMmMessage in the …0.5%보통5.5
CVE-2026-103936libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 6.0.28, the @libp2p/webrtc webR…0.5%높음7.5
CVE-2026-84994Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-…0.5%높음8.7
CVE-2026-100347kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationHandler use…0.5%보통5.3
CVE-2022-51014PocketMine-MP before 4.0.7 contains an unhandled exception vulnerability in the ModalFormResponsePacket handle…0.5%높음7.1
CVE-2026-106122The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with Rabbit…0.5%보통6.0
CVE-2026-88411Improper error handling in the GRAPH.EFFECT component (/effects/effects_apply.c) of FalkorDB (Redis module) v4…0.5%높음7.5
CVE-2026-114102adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash…0.5%높음8.7
CVE-2026-85494Improper handling of length parameter inconsistency, Uncaught exception, Inefficient Algorithmic Complexity, M…0.5%높음8.7
CVE-2026-53496ExifReader is a JavaScript Exif information parser. Prior to 4.40.1, ExifReader.load() and the asynchronous fi…0.5%보통5.3
CVE-2026-113872multer is a middleware for Node.js that handles multipart/form-data file uploads. In versions from 2.0.0 befor…0.4%높음7.5
CVE-2026-94646Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of …0.5%높음8.7
CVE-2026-62985request-filtering-agent is an http(s).Agent implementation that blocks requests to Private/Reserved IP address…0.5%높음7.5
CVE-2026-115892Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-…0.4%보통5.7
CVE-2026-97394kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts Ope…0.4%높음7.5
CVE-2026-119188Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to …0.4%높음7.5
CVE-2026-96277Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift Ruby bindings. …0.4%높음8.7
CVE-2026-96286Uncaught exception vulnerability in Apache Thrift Perl bindings. This issue affects Apache Thrift: before 0.25…0.4%높음8.2
CVE-2026-96294Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings…0.4%높음8.7
CVE-2026-85493Uncontrolled Recursion vulnerability in Apache Thrift Dart and Java ME bindings. This issue affects Apache Thr…0.4%높음8.7
CVE-2026-94642Uncaught exception vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.…0.4%높음8.7
CVE-2026-94639improper handling of exceptional conditions, Allocation of resources without limits or throttling, Uncaught ex…0.4%높음8.2
CVE-2026-90440Uncaught exception, improper handling of exceptional conditions, improper resource shutdown vulnerability in A…0.4%높음8.2
CVE-2026-95842Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, SessionEventLoop.run catches only InterruptedExce…0.4%높음8.7
CVE-2026-92081fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route register…0.4%보통5.9
CVE-2026-67418RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, th…0.4%보통5.3
CVE-2026-111181body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from…0.4%높음7.5
CVE-2026-19534undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server respond…0.4%높음7.5
CVE-2026-54529SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to 0.27.1, ModelView.sort_query in sqladmi…0.4%보통5.3
CVE-2026-114051vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null ma…0.4%높음7.1
CVE-2026-63341Aedes is an MQTT broker that can run on any stream server. Prior to 1.1.1, the MQTT broker does not bound topi…0.4%높음7.5
CVE-2026-76493As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series s…0.4%높음7.5
CVE-2026-111107A NULL pointer dereference vulnerability in WatchGuard Fireware OS’s management interface allows a remote, una…0.4%높음8.7
CVE-2026-102281Nest is a framework for building scalable Node.js server-side applications. Prior to 11.2.4 and 12.0.2, a sing…0.4%높음7.5
CVE-2026-88015rclone is a command-line program to sync files and directories to and from different cloud storage providers. …0.4%보통5.3
CVE-2026-85014undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the T…0.4%보통5.9
CVE-2026-92954vm2 is a sandbox library for running untrusted JavaScript in Node.js. In versions >= 3.10.0 and <= 3.11.7, Pro…0.3%심각9.2
CVE-2026-102984Astro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a requ…0.4%높음8.2
CVE-2022-51009PocketMine-MP before 4.7.2 fails to properly handle exceptions from the adhocore/json-comment library when par…0.3%높음8.7
CVE-2026-101101A vulnerability has been found in ag-ui-protocol ag-ui up to 2026-09-07. This issue affects the function JSON.…0.4%보통5.3
CVE-2026-96399A repository's external issue tracker regular expression containing alternating capture groups could produce i…0.4%높음7.5
CVE-2026-109301Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file references lacking a URL befo…0.3%높음8.2
CVE-2026-105661Requesting `/{username}/-/repositories` for an individual user instead of an organization made the organizatio…0.3%보통5.3
CVE-2026-109869undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.…0.3%높음7.5
CVE-2026-116589Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing ins…0.3%높음8.2
CVE-2026-117541svg-sanitizer from 0.11.0 before 1.1.0 contains an uncaught exception vulnerability that allows attackers to c…0.3%보통6.9
CVE-2026-89090An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 …0.3%높음8.2
CVE-2026-92608Improper handling of property-encoding exceptions in AMQP 1.0-to-AMQP 0-10 message conversion allows authentic…0.3%높음7.5
CVE-2026-103387A weakness has been identified in garycourt uri-js up to 4.4.1. This affects the function URI.parse of the fil…0.3%낮음2.1
CVE-2026-105757vLLM is an inference and serving engine for large language models. Prior to 0.30.0, structured-output request …0.3%보통6.5
CVE-2026-105756vLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible request …0.3%보통6.5
CVE-2026-110816### Summary `qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Cannot convert object to primitive v…0.3%보통6.3
CVE-2026-109338SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the…0.3%높음7.1
CVE-2026-82058A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite p…0.3%높음7.1
CVE-2026-100675stoatchat versions before 0.15.5 contain a denial of service vulnerability in the acknowledgement worker that …0.3%높음7.1
CVE-2026-89312`AesGcmCryptor.Open` passed a caller-supplied nonce straight to `cipher.AEAD.Open` without checking its length…0.3%보통6.9
CVE-2026-54541Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm…0.3%낮음3.7
CVE-2026-78243Apache YuniKorn 1.8.0 and later, if configured with the LDAP group resolver, crashes due to an out of bounds r…0.3%낮음2.1
CVE-2026-101918PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get…0.3%보통5.3
CVE-2026-106170An Uncaught Exception vulnerability [CWE-248] vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, Fort…0.3%보통4.9
CVE-2026-109855undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client…0.3%높음7.5
CVE-2026-107214Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, …0.3%높음7.5
CVE-2026-87123hbs is an Express view engine wrapper for Handlebars. Version 4.3.0 can crash the Node.js process during outpu…0.3%보통5.9
CVE-2026-85024undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the i…0.3%보통5.9
CVE-2026-79833A vulnerability in HPE NonStop ANSI SQLUTIL may allow a remote unauthenticated actor to cause an affected serv…0.3%높음7.5
CVE-2026-110854Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 does not handle errors raised while sending verific…0.3%높음8.2
CVE-2026-89315`JwtClaims.MarshalJSON` built a Go struct at runtime with `reflect.StructOf`, synthesising a field named `"A" …0.3%보통6.9
CVE-2026-87029undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its …0.3%보통5.9
CVE-2026-100722vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. I…0.3%높음8.9
CVE-2026-61544libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.13.1, libp…0.2%높음8.2
CVE-2026-107382MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases.…0.2%보통5.9
CVE-2026-89316`LoadPublicKey` resolved an EC key's curve with an unchecked type assertion, `algToOptsMap[alg].(*ECDSAOptions…0.2%보통6.3
CVE-2026-107392music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles …0.2%보통6.2
CVE-2026-84947undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a respons…0.2%낮음3.7
CVE-2026-87018undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.…0.2%높음7.5
CVE-2026-55244ASTEVAL is an evaluator of Python expressions and statements. Prior to 1.0.9, FROM_PY in asteval/astutils.py e…0.2%보통5.0
CVE-2026-102511Improper Verification of Source of a Communication Channel in the ADS discovery of the Go implementation of Ap…0.2%높음8.5
CVE-2026-89318`JweRsaKeyEncryptionDecryptorImpl.Decrypt` passed the JWE's initialization vector to `cipher.AEAD.Open` withou…0.2%보통6.9
CVE-2026-96274In Baicells Nova 430H, an unauthenticated device within radio range can send a malformed uplink message during…0.2%높음8.3
CVE-2026-82231A Thrift client in Apache bRPC (version < 1.18.0, built with WITH_THRIFT which is off by default) can be crash…0.1%미평가
CVE-2026-102413Uncaught Exception (CWE-248) in Elastic Endpoint can lead to denial of service via a specially crafted file na…0.1%보통6.2
CVE-2026-110933Uncaught exception vulnerability in Samsung Open Source Vyond allows Input Data Manipulation. This issue affec…0.1%보통4.4
CVE-2026-58859In multiple places, there is a possible denial of service due to an uncaught exception. This could lead to loc…0.1%높음7.8
CVE-2026-120216fastify is a web framework for Node.js. In versions 5.8.0 through 5.12.7, when the server is configured with a…보통5.9
CVE-2026-120215@fastify/cors is the CORS plugin for the Fastify web framework. In versions 8.2.0 through 11.3.x, an applicati…낮음3.7
CVE-2026-101175Null pointer dereference vulnerability in the ArkWeb module. Impact: Successful exploitation of this vulnerabi…보통4.3
이 원장은 전체 CVE 가 아닙니다. NVD 에는 30만 건이 넘습니다. 여기 있는 것은 ① 악용이 확인된 것 ② 최근 공개된 것 ③ 국산 SW 관련 ④ KISA 권고에 등장한 것입니다. 무엇을 담았는지 밝히지 않으면 "없다" 를 "안전하다" 로 읽게 됩니다.