CWE-290 관련 취약점
같은 약점 유형으로 분류된 취약점입니다. CWE 는 "무엇을 잘못했는가" 의 분류이고, 제품을 가리지 않고 같은 실수가 반복됩니다.
CWE-290 — 주요 취약점
악용이 확인된 것을 먼저 보여줍니다.
● 실제 악용이 확인됨CVE-2024-4358In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthentica…97.5%심각9.8● 실제 악용이 확인됨CVE-2022-24112An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Adm…96.1%심각9.8● 실제 악용이 확인됨CVE-2022-23131In the case of instances where the SAML SSO authentication is enabled (non-default), session data ca…95.7%심각9.8● 실제 악용이 확인됨CVE-2026-104935Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated att…86.8%높음8.6● 실제 악용이 확인됨CVE-2024-54085AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely t…60.7%심각10.0● 실제 악용이 확인됨CVE-2023-50224TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vul…20.0%보통6.5● 실제 악용이 확인됨CVE-2026-102764The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The com…18.9%심각9.3CVE-2026-84731An unauthenticated remote attacker can bypass authentication and gain full access to administrative …1.3%심각9.3
전체 목록
120건
CVE-2026-69843Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate privileges ov…0.9%심각10.0
CVE-2026-76949Authentication Bypass by Spoofing vulnerability in team-alembic ash_authentication allows an attacker who can …0.8%심각9.1
CVE-2026-108131No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perfo…0.7%높음7.5
CVE-2026-87663An authentication bypass and command injection vulnerability exists in the inter-switch remote execution servi…0.7%높음7.1
CVE-2026-94422An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to…0.7%높음8.7
CVE-2026-82117Authentication Bypass by Spoofing Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-…0.6%심각9.8
CVE-2026-76938Authentication Bypass Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic…0.6%심각9.8
CVE-2026-77903Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges…0.7%심각9.0
CVE-2022-51026Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attac…0.6%심각9.3
CVE-2026-105008No cwe for this issue in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.0.6%심각9.0
CVE-2026-70179Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a n…0.6%높음7.5
CVE-2026-76423A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker…0.5%심각10.0
CVE-2026-85751Mailu is a mail server distributed as a set of Docker images. From Mailu 2.0 until 2024.06.55 and prior to Mai…0.6%심각9.8
CVE-2026-87785Authentication bypass by spoofing vulnerability in Apache Syncope. When the configured JWKS settings for inter…0.5%심각9.1
CVE-2026-92899Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It st…0.5%보통4.8
CVE-2026-57489FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior …0.5%높음8.1
CVE-2026-112241Authentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart surecart allows Authentication Ab…0.5%심각9.8
CVE-2026-59157webhookd is a minimalist webhook server that triggers shell scripts and external processes through HTTP reques…0.5%보통6.5
CVE-2026-55210Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prio…0.5%높음7.4
CVE-2026-21391An improper validation vulnerability exists within PingAM where a well-crafted request allows arbitrary or pro…0.4%심각9.5
CVE-2026-113703SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mod…0.4%심각9.1
CVE-2026-94416An authorization bypass was found in the Ansible Automation Platform (AAP) gateway. The gateway API allows an …0.5%보통6.8
CVE-2026-118653Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-F…0.4%보통5.3
CVE-2026-62108Unauthenticated Broken Authentication in Headless Single Sign On <= 1.7.0 versions.0.4%심각9.8
CVE-2026-91039Authentication Bypass by Spoofing vulnerability in team-alembic ash_authentication allows an attacker who oper…0.4%심각9.1
CVE-2026-75120The OpenText™ (EnCase SAFE Agents) component utilized by OpenText™ Endpoint Investigator, OpenText™ Endpoint F…0.4%심각9.3
CVE-2026-111691WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to imperso…0.4%심각9.1
CVE-2026-107147The twofactor_gauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client…0.4%보통6.3
CVE-2026-101280A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the function opendma…0.4%보통5.5
CVE-2026-94197An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC…0.4%높음8.7
CVE-2026-104445YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bi…0.4%높음8.8
CVE-2026-86391Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release…0.4%보통6.4
CVE-2026-93582The HTTP Basic Authentication modules in ((OTRS)) Community Edition 6 and prior accept the authenticated usern…0.4%심각9.4
CVE-2026-105863Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.…0.4%심각9.2
CVE-2026-105640Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gite…0.4%심각9.1
CVE-2026-4894A vulnerability has been identified regarding insufficient validation in the Frappe Cloud/ERPNext authenticati…0.4%보통6.9
CVE-2026-61682kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workload…0.4%심각9.9
CVE-2026-103512Perforce P4 Search prior to 2026.4.2 trusts a client-supplied address when validating certain authentication r…0.4%보통5.3
CVE-2026-86478In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed …0.4%심각9.8
CVE-2026-111623Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows unauthenti…0.4%보통6.3
CVE-2026-84186Vulnerability involving incorrect access control in the Tools::getRemoteAddr() function in PrestaShop, which a…0.3%보통6.9
CVE-2026-86863pgAdmin 4's Webserver authentication source is intended to accept an identity asserted by the web server or re…0.3%심각9.3
CVE-2025-30052The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Access is grant…0.3%높음8.8
CVE-2026-39772Unauthenticated Bypass Vulnerability in Captcha by BestWebSoft <= 5.2.8 versions.0.4%보통5.3
CVE-2026-119703xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerability in WebSocketServer._handle_…0.3%보통6.3
CVE-2026-92929OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 trusts an X-Forwarded-For header supplied by an a…0.4%보통5.3
CVE-2026-97146Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a secondary la…0.3%보통4.8
CVE-2026-83864Improper access control in Windows NTFS allows an authorized attacker to disclose information locally.0.3%보통5.5
CVE-2026-77089Command Center API contained an authentication bypass issue affecting privilege management. Software customers…0.3%심각9.3
CVE-2026-110723In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives th…0.3%높음7.5
CVE-2026-105215ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI becaus…0.3%심각9.3
CVE-2026-119425OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roam…0.3%보통5.3
CVE-2026-18065IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to gain access to sensitive informa…0.3%보통5.3
CVE-2026-106465The NetX Secure DTLS server sends a HelloVerifyRequest carrying a freshly generated cookie, but never checks t…0.3%높음8.7
CVE-2026-57210Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17,…0.3%높음7.0
CVE-2026-92395@fastify/proxy-addr is a Fastify plugin that determines a request's client address behind trusted reverse prox…0.3%심각9.1
CVE-2026-92546Authentication bypass by spoofing vulnerability in Keepnet Labs Cybersecurity Inc. Agentic AI / Agentic Ally a…0.3%높음7.5
CVE-2026-40854WNC T-Mobile 5G Box IDU router contains an authentication bypass vulnerability in the portal.cgi component. Th…0.3%높음8.7
CVE-2025-68624N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated …0.3%보통4.3
CVE-2026-103302The Payment Gateway for Idram WordPress plugin before 2.1.6 does not verify the authenticity of incoming payme…0.3%보통5.3
CVE-2026-89022BookStack before 26.05.5 contains an authentication bypass vulnerability in its social login implementation th…0.3%심각9.1
CVE-2026-63329Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, copy_server_request i…0.3%보통4.9
CVE-2026-49446Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, a…0.3%보통6.1
CVE-2026-97274Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO (OAuth Client) <= 7.1.2 versions.0.3%심각9.8
CVE-2026-85432MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowing authent…0.3%높음8.8
CVE-2026-15640Under certain conditions a valid SAML IdP response may be used to impersonate another Secret Server user.0.3%심각9.5
CVE-2026-83845Improper privilege management in Windows Internet (wininet.dll) allows an authorized attacker to perform spoof…0.3%높음8.4
CVE-2026-104623A security vulnerability exists in the authorization handling for the local (management) cluster shell feature…0.3%보통6.3
CVE-2026-100390Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting…0.3%심각9.1
CVE-2026-90447A routing rule selects between two different authentication mechanisms for the same downstream service based o…0.3%높음7.1
CVE-2026-104891mppx-condition-gate provides conditional free-access wrappers for mppx payment methods. Prior to @insumermodel…0.3%높음7.5
CVE-2026-93629An organizer authentication vulnerability in Zimbra Collaboration Suite (ZCS) allows an unauthenticated email …0.3%보통5.3
CVE-2026-93628An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) …0.3%보통5.3
CVE-2026-93627An organizer authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS)…0.3%보통5.3
CVE-2026-96333Authentication Bypass by Spoofing vulnerability in Liquid Web / StellarWP GiveWP give allows Identity Spoofing…0.3%높음7.5
CVE-2026-82530IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an access control bypass vulnerability…0.3%보통6.9
CVE-2026-96336Authentication Bypass by Spoofing vulnerability in WPMU DEV Forminator forminator allows Identity Spoofing.Thi…0.3%높음7.5
CVE-2026-85511A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-real…0.3%보통4.2
CVE-2026-107447The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enf…0.3%보통5.3
CVE-2026-115962Authentication Bypass by Spoofing vulnerability in myCred myCred mycred allows Identity Spoofing.This issue af…0.3%보통4.3
CVE-2026-62759Authentication bypass by spoofing in Windows Netlogon allows an unauthorized attacker to perform spoofing over…0.3%높음7.5
CVE-2026-86196Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot…0.3%높음8.7
CVE-2026-70381An access-control vulnerability has been identified in the web server configuration. Some resources intended f…0.3%보통6.9
CVE-2023-54411Frappe framework before 13.32.0 uses weak authentication for print view access, because the print view key can…0.3%높음8.2
CVE-2026-91914Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Authentication Bypass by Spoofing vulnerabili…0.3%높음7.1
CVE-2026-115933Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker o…0.2%심각9.9
CVE-2026-41558Subscriber Bypass Vulnerability in WP Migration Plugin DB & Files – WP Synchro <= 1.16.1 versions.0.3%높음7.5
CVE-2026-96615Description NGINX Gateway Fabric has a vulnerability when it is configured with Gateway Custom Resource Defini…0.3%높음7.1
CVE-2026-90465A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positioned on the…0.2%심각9.4
CVE-2026-88011Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12,…0.2%보통5.3
CVE-2026-45056matrix-sdk-crypto is a no-network-IO implementation of a state machine that handles end-to-end encryption for …0.2%보통6.9
CVE-2026-90717Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release…0.2%심각9.1
CVE-2026-107336Malcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive…0.2%보통6.5
CVE-2026-117656Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in …0.2%심각9.3
CVE-2026-104615A security vulnerability was discovered in SUSE Rancher Fleet's cluster registration flow, in Fleet versions b…0.2%높음7.9
CVE-2026-82180In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the certificate authentica…0.2%심각9.5
CVE-2026-110768holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram conne…0.2%보통6.3
CVE-2026-89327The FluentBoards WordPress plugin before 2.0.15 does not verify that a board member submitting a comment is th…0.2%낮음3.8
CVE-2026-84790OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certifi…0.2%높음7.6
CVE-2026-103397OpenSave before 2.4.0-beta.1 fails to validate sender identity in WAN relay requests, allowing unpaired room m…0.2%보통6.3
CVE-2026-102161An unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse p…0.2%높음8.7
CVE-2026-104733User Impersonation in ProcessOnes XMMP Server ejabberd <= 26.04 allows an attacker to impersonate arbitrary us…0.2%높음7.4
CVE-2026-88879Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through…0.2%보통5.3
CVE-2026-105741Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.5.0 until 1.10.3, an IP …0.2%높음7.1
CVE-2026-66674Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile <= 1.42.1 versions.0.2%보통5.6
CVE-2026-114640Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-N…0.2%높음7.0
CVE-2026-104988A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST full…0.2%높음8.1
이 원장은 전체 CVE 가 아닙니다. NVD 에는 30만 건이 넘습니다. 여기 있는 것은 ① 악용이 확인된 것 ② 최근 공개된 것 ③ 국산 SW 관련 ④ KISA 권고에 등장한 것입니다. 무엇을 담았는지 밝히지 않으면 "없다" 를 "안전하다" 로 읽게 됩니다.