CWE-307 관련 취약점
같은 약점 유형으로 분류된 취약점입니다. CWE 는 "무엇을 잘못했는가" 의 분류이고, 제품을 가리지 않고 같은 실수가 반복됩니다.
CWE-307 — 주요 취약점
악용이 확인된 것을 먼저 보여줍니다.
CVE-2026-93650A vulnerability was determined in Saleor up to 3.20.118/3.21.54/3.22.47/3.23.14. This vulnerability …0.7%낮음2.9CVE-2026-91973Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints t…0.6%높음8.7CVE-2026-77561Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote at…0.6%보통5.3CVE-2026-46649Joplin is an open source note-taking and to-do application that organises notes and lists into noteb…0.6%심각9.1CVE-2026-116123A weakness has been identified in NocoDB up to 2026.07.0. The affected element is the function valid…0.5%보통6.3CVE-2026-91972Vikunja versions before 2.6.0 fail to apply rate limiting to /api/v2 public authentication endpoints…0.5%높음8.7CVE-2026-110770Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthent…0.5%심각9.2CVE-2026-111874A flaw has been found in OpenCATS 0.10.0. Affected is the function processLogin of the file modules/…0.5%낮음2.9
전체 목록
70건
CVE-2026-37603Improper Restriction of Excessive Authentication Attempts in the administration login of pH7Software pH7Builde…0.5%보통6.5
CVE-2026-566829Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.j…0.5%보통5.3
CVE-2026-103977FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior …0.4%높음8.1
CVE-2026-6223Improper restriction of excessive authentication attempts vulnerability in Bahçelievler Muncipality BiHayat Ap…0.4%심각9.4
CVE-2026-102334Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated a…0.5%심각9.1
CVE-2026-56592HCL BigFix Service Management is affected by an Improper Authentication validation vulnerability related to in…0.4%보통6.5
CVE-2026-116238In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins (3 by default). The …0.4%심각9.2
CVE-2026-111675Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability t…0.4%심각9.1
CVE-2026-105237A vulnerability was detected in linlinjava litemall up to 1.8.0. This affects an unknown part of the file lite…0.4%낮음2.9
CVE-2026-53997Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a broken authentication vulnerab…0.4%심각9.1
CVE-2026-89174Smart Video Intercom System developed by Kingdom Communication Associated has a Missing Brute-force Protection…0.4%높음8.7
CVE-2026-108109PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in…0.4%심각9.3
CVE-2026-116007A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The impacted element is the functio…0.4%낮음2.9
CVE-2026-105638Plane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login uses a six-dig…0.4%심각9.1
CVE-2026-69193FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior …0.4%보통6.5
CVE-2026-107638pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper restriction of authentication attempts v…0.4%높음7.6
CVE-2026-40538An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStati…0.4%낮음3.7
CVE-2026-49470GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, the time-based one-time pas…0.4%높음7.7
CVE-2026-61611Lychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::unlock has no throttl…0.4%높음7.5
CVE-2026-105866Payload is a free and open source headless content management system. In versions before 3.90.0 and canary ver…0.4%보통6.9
CVE-2026-85734LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login endpoint in …0.4%심각9.1
CVE-2026-111356MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing un…0.3%심각9.1
CVE-2026-109949FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtu…0.3%높음7.1
CVE-2026-84461Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the two-factor login step …0.3%보통6.9
CVE-2026-97363The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. T…0.3%높음8.7
CVE-2026-107145The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Du…0.3%보통6.3
CVE-2026-113710ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the self-service password-…0.3%보통5.9
CVE-2026-105835PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-tot…0.3%심각9.1
CVE-2026-85237A vulnerability in MISP's email-based one-time password (OTP) authentication flow allowed an attacker to perfo…0.3%높음8.6
CVE-2026-55795Craft Commerce is an ecommerce platform for Craft CMS. From 4.0.0 until 4.11.2 and 5.6.5, CartController in sr…0.3%보통6.9
CVE-2026-78490Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00,…0.3%높음7.5
CVE-2026-93637An authentication rate-limit bypass in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticate…0.3%낮음3.7
CVE-2026-77057boneIO Black does not limit authentication attempts on its web interface (POST /api/login) or SSH service, and…0.3%낮음2.3
CVE-2026-111056FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthentica…0.3%보통6.9
CVE-2026-100501Flame through 2.4.0 contains an improper restriction of excessive authentication attempts vulnerability in the…0.3%높음8.3
CVE-2026-102825Russh is a Rust SSH client and server library. Prior to 0.62.6, the USERAUTH_REQUEST path reached from server:…0.3%낮음3.7
CVE-2026-18318IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform brute-force attacks to obtain credential…0.3%보통5.3
CVE-2026-108580AniWorld Downloader before 5.3.0 contains an improper restriction of authentication attempts vulnerability in …0.3%보통6.9
CVE-2026-111892phpMyFAQ 4.2.0-alpha before 4.2.0-beta lacks effective rate limiting on the unauthenticated user/password/upda…0.3%보통6.9
CVE-2026-76779Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Restricti…0.3%높음7.4
CVE-2026-93346Wazuh from 4.0.0 before 4.14.8 contains a race condition in API login throttling that allows unauthenticated a…0.3%보통6.9
CVE-2026-92583AVideo through 29.0 contains a race condition in the enforceRateLimit() function that fails to atomically incr…0.2%보통6.9
CVE-2026-100678stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attack…0.2%높음8.3
CVE-2026-111886phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta lacks brute-force lockout in the removeTwofactorConfig() 2FA rem…0.2%높음7.1
CVE-2026-86729WWBN AVideo through commit e01e41ecc (no patched version available) exposes get_api_preauthorize in plugin/API…0.2%심각9.1
CVE-2026-111501Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Restriction of Excessive Authenticat…0.2%보통5.4
CVE-2026-65825OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In…0.2%높음7.5
CVE-2026-15586Improper restriction of excessive authentication attempts vulnerability in İdvlabs Software and Consulting Ser…0.2%보통5.3
CVE-2026-88770A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solutio…0.2%보통6.5
CVE-2026-43847A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password …0.2%높음8.2
CVE-2026-110861Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-ada…0.2%보통6.3
CVE-2026-108163Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerability because throttler TTL values…0.2%보통6.9
CVE-2026-58271Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to vers…0.2%보통6.8
CVE-2026-92082By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to…0.2%보통6.3
CVE-2026-22114HTTP basic auth enforces no retry limit or backoff. Combined with the default service password, the keyspace i…0.2%보통5.3
CVE-2026-107256Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Shield allows Brute Force. T…0.2%미평가
CVE-2026-86186AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypas…0.2%보통6.3
CVE-2024-2323The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password hi…0.2%보통4.8
CVE-2026-20514In Audio HAL, there is a possible information disclosure due to a missing permission check. This could lead to…0.1%보통4.4
CVE-2026-20512In Audio HAL, there is a possible escalation of privilege due to improper input validation. This could lead to…0.1%미평가
CVE-2026-121535A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87. This vulnerability affects the functio…낮음2.9
CVE-2026-118505Improper Restriction of Excessive Authentication Attempts vulnerability in team-alembic ash_authentication all…보통6.3
이 원장은 전체 CVE 가 아닙니다. NVD 에는 30만 건이 넘습니다. 여기 있는 것은 ① 악용이 확인된 것 ② 최근 공개된 것 ③ 국산 SW 관련 ④ KISA 권고에 등장한 것입니다. 무엇을 담았는지 밝히지 않으면 "없다" 를 "안전하다" 로 읽게 됩니다.