CWE-345 관련 취약점
같은 약점 유형으로 분류된 취약점입니다. CWE 는 "무엇을 잘못했는가" 의 분류이고, 제품을 가리지 않고 같은 실수가 반복됩니다.
CWE-345 — 주요 취약점
악용이 확인된 것을 먼저 보여줍니다.
● 랜섬웨어 캠페인에 사용됨CVE-2023-38831RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a …99.8%높음7.8● 실제 악용이 확인됨CVE-2022-26871An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated re…19.5%심각9.8CVE-2026-85431MOOS essential-moos through version 10.0.1 contains an unauthenticated UDP packet injection vulnerab…1.9%높음8.7CVE-2026-85430MOOS essential-moos through 10.0.1 contains an authentication bypass vulnerability in pShare that ac…1.0%높음8.8CVE-2026-28324SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code exec…0.7%심각9.8CVE-2026-62874Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to e…0.4%심각10.0CVE-2025-12999UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URL…0.3%심각9.1CVE-2026-114612LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 un…0.3%심각9.9
전체 목록
120건
CVE-2026-54239Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the…0.3%높음8.8
CVE-2026-102695OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.…0.3%높음8.2
CVE-2026-110607BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows au…0.3%높음7.1
CVE-2026-80172Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00,…0.3%심각9.8
CVE-2026-116254A vulnerability was identified in rathena FluxCP up to 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d. This issue af…0.3%보통5.5
CVE-2026-112101A vulnerability was determined in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. The affected element is …0.3%낮음2.1
CVE-2026-92161FriendsOfFlarum OAuth allows users to log in to Flarum with GitHub, Twitter, Facebook, and other providers. Pr…0.3%심각9.8
CVE-2026-94612authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an authentik SAML So…0.3%높음7.4
CVE-2026-66874For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic ski…0.3%보통6.5
CVE-2026-94455An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any sess…0.3%높음7.1
CVE-2026-115933Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker o…0.2%심각9.9
CVE-2026-107102This vulnerability exists in the ERP system due to improper validation of payment callback parameters and inad…0.3%심각9.3
CVE-2026-119422Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated …0.2%높음8.2
CVE-2026-102682Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. …0.2%보통5.6
CVE-2026-54581mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_bootstrap_index() function in libmpo…0.2%높음8.3
CVE-2026-104805DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker w…0.2%높음8.5
CVE-2026-89238WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted …0.2%심각9.1
CVE-2026-103878Cleartext transmission of sensitive information vulnerability in Apache Directory LDAP API. A StartTLS extende…0.2%미평가
CVE-2026-105741Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.5.0 until 1.10.3, an IP …0.2%높음7.1
CVE-2026-55459The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From ve…0.2%높음7.4
CVE-2026-26950Dell SmartFabric Manager, versions prior to 2.2.1, contains an Insufficient Verification of Data Authenticity …0.2%높음8.1
CVE-2026-114050vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check…0.2%높음7.1
CVE-2026-111392SGLang through 0.5.21 trusts caller-supplied mm_hashes values as the multimodal prefix-cache key, allowing rem…0.2%보통6.3
CVE-2026-63405AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, t…0.2%보통5.9
CVE-2026-73316XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider that allows …0.2%높음8.7
CVE-2026-73437On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an …0.2%보통6.5
CVE-2026-63127RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's OAuth implementa…0.2%높음8.2
CVE-2026-103402An Insufficient Verification of Data Authenticity vulnerability in PCLI in Juniper Networks Session Smart Rout…0.2%높음8.8
CVE-2026-55103Discourse ActivityPub adds ActivityPub support to Discourse. Prior to commit 1c8518b0f2abdf31cbea3e0b242f74d89…0.2%높음8.6
CVE-2026-54608MythicalDash is a Pterodactyl client area. In 3.5.4-aurora and earlier, GET /api/stripe/process in backend/app…0.2%높음7.1
CVE-2026-19941An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which coul…0.2%보통5.9
CVE-2026-102831JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Noteb…0.2%높음8.1
CVE-2026-54167Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior…0.2%높음8.2
CVE-2026-86039libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-s…0.2%높음8.2
CVE-2026-81630The Botslab G980H dash camera firmware does not adequately verify the authenticity of firmware updates. The up…0.2%심각9.2
CVE-2026-85429MOOS-IvP uFldNodeComms through 24.8.1 trusts the source node identity from the message body rather than valida…0.2%높음8.7
CVE-2026-88592kkFileView >= 4.2.0 is vulnerable to Server-Side Request Forgery (SSRF). The cross-origin file proxy endpoint …0.2%심각9.1
CVE-2026-118377mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows un…0.2%높음8.7
CVE-2026-59357Insufficient verification of data authenticity (CWE-345) in the external OIDC login callback in Cloud Foundry …0.2%보통6.5
CVE-2026-92360A weakness has been identified in ag-ui-protocol ag-ui 1.0. The impacted element is the function prepareRunAge…0.2%보통5.3
CVE-2026-119289Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.10.0, the @zuke/gh githubWor…0.2%높음7.1
CVE-2026-49450Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prio…0.2%높음7.1
CVE-2026-100872Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing u…0.2%높음8.7
CVE-2026-104422The block sync download path in Zebra (zebrad) before 6.3.0 reads a block's height from its unvalidated coinba…0.2%높음8.7
CVE-2026-104108FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior …0.2%높음8.1
CVE-2026-85435MOOS-IvP uFldNodeBroker through 24.8.1 fails to validate the source of TRY_SHORE_HOST messages on the vehicle …0.2%심각9.3
CVE-2026-85434MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity before creating outbound bridge…0.2%심각9.3
CVE-2026-61591djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance.…0.2%높음8.1
CVE-2026-104850MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in …0.2%높음7.5
CVE-2026-16487A flaw was found in bootc when operating with the default containers signature policy. Automatic or manual upg…0.2%높음8.1
CVE-2026-73435On affected platforms running Arista EOS with Open Shortest Path First version 2 (OSPFv2) configured, a specia…0.2%높음7.0
CVE-2026-86038libp2p is a JavaScript implementation of the libp2p networking stack. From 15.0.0 until 16.0.5, @libp2p/gossip…0.2%높음7.5
CVE-2026-115937The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that th…0.2%높음8.7
CVE-2026-103330The Sadad QA Payment WordPress plugin through 1.28 does not correctly verify the authenticity of incoming paym…0.2%보통5.3
CVE-2026-103313The BitPay Gateway for WooCommerce WordPress plugin through 4.1.3 does not bind the payment provider's transac…0.2%보통5.3
CVE-2026-85621LobeChat (LobeHub) 2.2.1 does not properly verify inbound chat-platform webhook signatures in the QQ and Feish…0.2%보통6.9
CVE-2026-45057matrix-sdk-ui provides GUI-centric utilities on top of matrix-rust-sdk. The message edit validation logic in t…0.2%보통4.9
CVE-2026-89251AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ad impressions in plugin/AD_S…0.2%높음7.1
CVE-2026-92400The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming p…0.2%보통5.3
CVE-2026-115910Python Social Auth is a social authentication and registration mechanism. Prior to 6.2.0, OpenIdConnectAuth in…0.2%보통6.8
CVE-2026-107852Jexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/client/bill…0.2%높음7.1
CVE-2026-108069The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted to access …0.2%보통5.3
CVE-2026-107160The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or input saniti…0.2%보통5.3
CVE-2026-13720An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app…0.2%보통5.4
CVE-2026-85515In Bouncy Castle for Java before 1.86, a truncated OpenPGP encrypted message was accepted with no error report…0.2%높음8.2
CVE-2026-102267PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected b…0.2%높음7.4
CVE-2026-116608A security vulnerability has been detected in DAMO Academy VideoLLaMA2 up to 1.1. Affected by this issue is th…0.1%낮음2.1
CVE-2026-112265LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated …0.2%높음8.3
CVE-2026-93008A flaw was found in dnsmasq. When following a CNAME in a DNS response, the resolver can cache records for the …0.1%보통6.8
CVE-2026-84906The Eventin WordPress plugin before 4.1.24 does not verify that a completed payment corresponds to the order i…0.1%보통5.3
CVE-2026-43835A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged…0.2%높음8.6
CVE-2026-56832PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.DiscordAp…0.1%높음8.8
CVE-2026-102250CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmwar…0.2%높음8.6
CVE-2026-73177Nozomi Networks Labs identified a CWE-345: Insufficient Verification of Data Authenticity vulnerability in the…0.1%높음8.6
CVE-2026-109365Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated pee…0.1%보통6.3
CVE-2026-104641The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is f…0.1%보통5.3
CVE-2026-103301The Payment Gateway for Telcell WordPress plugin before 2.0.5 does not verify the authenticity of incoming pay…0.1%보통5.3
CVE-2026-16516wolfSSH does not validate that the ECDSA curve identifier in a KEXDH_REPLY host key blob matches the algorithm…0.1%심각9.0
CVE-2026-88998The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integrity of incoming payment notifi…0.1%보통5.3
CVE-2026-54579mport is the MidnightBSD Package Manager. Prior to 2.7.8, ping() in libmport/ping.c accepted ICMP replies with…0.1%낮음2.3
CVE-2026-55174UltrafastSecp256k1 is a high-performance, multi-backend secp256k1 engine with reproducible audit evidence, com…0.1%보통5.9
CVE-2026-92422The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concate…0.2%보통6.5
CVE-2026-63115ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. From 1.0.0 until 1.2.6, the `Un…0.1%보통5.3
CVE-2026-53728Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the exter…0.1%높음7.1
CVE-2026-105256The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplied value that determines how mu…0.1%보통5.3
CVE-2026-82844The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed befo…0.1%보통5.3
CVE-2026-54586mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_index(), mport_fetch_bootstrap_index…0.1%보통6.0
CVE-2026-85641The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which…0.1%보통4.3
CVE-2026-105161A flaw has been found in invariant-systems-ai aiir up to 1.7.0. The affected element is an unknown function of…0.1%보통6.9
CVE-2026-73450On affected platforms running Arista EOS with MLAG Dual Primary Detection configured, an unauthenticated attac…0.1%높음7.0
CVE-2026-49483Code for IBMi is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platfo…0.1%높음8.9
CVE-2026-112939filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a for…0.1%보통4.7
CVE-2026-57122PraisonAI is a multi-agent teams system. Prior to 4.6.59, the WhatsApp and Linear bot webhook handlers verify …0.1%높음8.6
CVE-2026-104642The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify submitted product prices against a valu…0.1%낮음2.7
CVE-2026-103308The Visma Pay for WooCommerce WordPress plugin before 1.2.2 does not verify the authenticity of payment gatewa…0.1%보통6.5
CVE-2026-104381A missing authentication vulnerability in Fireware OS's FireCluster state synchronization feature allows an un…0.1%보통6.0
CVE-2026-77955In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-ch…0.1%보통4.4
CVE-2026-102140An authenticated administrator could initiate an administrative import using a file whose contents were not fu…0.1%보통4.9
CVE-2026-107284The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously …0.1%낮음3.7
CVE-2026-102275PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from…0.1%보통6.5
CVE-2026-108568A vulnerability was determined in InstantSoft icms2 up to 2.18.2. The affected element is the function validat…0.1%낮음2.1
CVE-2026-85288Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ incompletely enforces shortc…0.1%보통6.7
CVE-2026-88819In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer…0.1%보통6.3
CVE-2026-13257IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.…0.1%보통6.5
CVE-2026-101278A weakness has been identified in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the function open…0.1%낮음2.1
CVE-2026-82212The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payme…0.1%높음7.5
CVE-2026-110985A Kafka broker using SASL/OAUTHBEARER with the default validator (sasl.oauthbearer.jwt.validator.class=Default…0.1%미평가
CVE-2026-110952A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled JWKS-backed validator always…0.1%미평가
CVE-2026-104419Zebra (zebrad) 4.5.0 before 6.3.0 discards which peer supplied the block hashes in FindBlocks responses, then …0.1%보통6.3
CVE-2026-103324The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does not properly verify the authe…0.1%보통5.3
CVE-2026-107420Unauthenticated Bypass Vulnerability in Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway <= …0.1%보통5.3
이 원장은 전체 CVE 가 아닙니다. NVD 에는 30만 건이 넘습니다. 여기 있는 것은 ① 악용이 확인된 것 ② 최근 공개된 것 ③ 국산 SW 관련 ④ KISA 권고에 등장한 것입니다. 무엇을 담았는지 밝히지 않으면 "없다" 를 "안전하다" 로 읽게 됩니다.