CWE-400 관련 취약점
같은 약점 유형으로 분류된 취약점입니다. CWE 는 "무엇을 잘못했는가" 의 분류이고, 제품을 가리지 않고 같은 실수가 반복됩니다.
CWE-400 — 주요 취약점
악용이 확인된 것을 먼저 보여줍니다.
● 랜섬웨어 캠페인에 사용됨CVE-2021-44228Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI …100.0%심각10.0● 실제 악용이 확인됨CVE-2023-44487The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancell…100.0%높음7.5● 실제 악용이 확인됨CVE-2026-45498Microsoft Defender Denial of Service Vulnerability63.1%높음7.5● 실제 악용이 확인됨CVE-2026-28318SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service wi…43.7%높음7.5● 실제 악용이 확인됨CVE-2023-38180.NET and Visual Studio Denial of Service Vulnerability14.1%높음7.5● 실제 악용이 확인됨CVE-2004-1464Cisco IOS 12.2(15) and earlier allows remote attackers to cause a denial of service (refused VTY (vi…4.8%보통5.9● 실제 악용이 확인됨CVE-2020-3566A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR So…3.7%높음8.6● 실제 악용이 확인됨CVE-2020-3569Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco …3.3%높음8.6
전체 목록
120건
CVE-2026-72923In Microsoft.OpenApi.YamlReader from 2.0.0-preview.11 until 2.12.0 and from 3.0.0 until 3.10.0, and in Microso…1.2%높음7.5
CVE-2026-45769Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring …1.2%높음7.5
CVE-2026-68498StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single …0.9%높음7.5
CVE-2026-75632CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to a…0.9%높음7.5
CVE-2026-75996ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application de…0.9%높음7.5
CVE-2026-96541A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP co…0.8%높음7.5
CVE-2026-57576plone.app.dexterity is a content-type system for the Plone content management system, and plone.app.contenttyp…0.8%보통6.5
CVE-2026-117503A vulnerability was determined in a2aproject a2a-go up to 2.4.0. Impacted is an unknown function of the file a…0.7%보통6.9
CVE-2026-97775Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.0.7%높음8.8
CVE-2026-101895Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript…0.7%높음8.7
CVE-2026-63448Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring …0.7%보통5.9
CVE-2026-101896Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript…0.7%높음8.2
CVE-2026-93310A vulnerability was identified in O-RAN-SC SMO OAM 2025-06-10. This affects an unknown part of the component V…0.7%보통5.5
CVE-2026-57227Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring …0.7%높음7.5
CVE-2026-68495The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength…0.7%높음7.5
CVE-2026-68496The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLengt…0.7%높음7.5
CVE-2026-106627CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to a…0.6%높음7.5
CVE-2026-100138CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to a…0.6%높음7.5
CVE-2026-75507GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1…0.6%높음7.5
CVE-2026-81876HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior…0.6%높음7.5
CVE-2026-81875HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior…0.6%높음7.5
CVE-2026-88975Http4s is a Scala interface for HTTP services. Prior to 0.23.37 and 1.0.0-M48, Ember’s HTTP/2 read loop parses…0.6%높음7.5
CVE-2026-79651A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core ser…0.6%높음7.5
CVE-2026-89407NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stringified numbers" with two regu…0.6%높음7.5
CVE-2026-63452Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring …0.6%높음7.5
CVE-2026-111759markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2, when typographer: true is enabled, specially cra…0.6%높음7.5
CVE-2026-100650vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented medi…0.6%높음7.1
CVE-2026-75508GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1…0.6%높음7.5
CVE-2026-67626Uncontrolled resource consumption in SQL Server allows an authorized attacker to deny service over a network.0.6%보통6.5
CVE-2026-94640A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of…0.6%높음7.5
CVE-2026-68537`fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tena…0.6%높음7.5
CVE-2026-68523`fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tena…0.6%높음7.5
CVE-2026-118779Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to …0.6%높음7.5
CVE-2026-108545SillyTavern 1.12.13 through 1.19.0 contains a denial of service vulnerability that allows unauthenticated remo…0.6%높음8.2
CVE-2026-68497jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalend…0.6%높음7.5
CVE-2026-115778Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, tw…0.5%높음7.5
CVE-2026-61814Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a singl…0.6%높음7.5
CVE-2026-61554emp3r0r is a C2 designed by Linux users for Linux environments. Prior to version 4.2.5, the `http_poll` C2 tra…0.5%높음7.5
CVE-2026-60021Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the m…0.5%미평가
CVE-2026-60018Gitea's OneDev migration downloader reads the entire remote version response into memory without a size limit …0.5%보통6.5
CVE-2026-63021Gitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manifests or the…0.5%보통6.5
CVE-2026-62925Gitea parses Alpine package uploads before enforcing package-size quotas and does not bound the decompressed .…0.5%보통6.5
CVE-2026-111985A vulnerability was found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This impacts the function read…0.5%낮음2.1
CVE-2026-45759Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring …0.6%높음7.5
CVE-2026-107166A weakness has been identified in Open5GS up to 2.7.7. This vulnerability affects the function ogs_pfcp_xact_l…0.6%보통5.5
CVE-2026-113658ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich T…0.5%높음7.5
CVE-2026-54135AirSane is a SANE frontend, and a scanner server that supports Apple's AirScan protocol. Versions prior to 0.4…0.6%높음7.5
CVE-2026-67414RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, deps/amqp10_…0.5%보통6.0
CVE-2026-92114A vulnerability was identified in a2ui-project a2ui up to 0.10.6. Affected is an unknown function of the file …0.5%보통6.9
CVE-2026-116095A vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1. Affected is the function jp…0.5%보통5.5
CVE-2026-114138Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.get_accep…0.5%높음7.5
CVE-2026-63128RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's stateful Streama…0.5%높음7.5
CVE-2026-113711ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 3.7.0 …0.5%높음7.5
CVE-2026-96640Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfPar…0.5%높음8.2
CVE-2026-83600Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversi…0.5%보통6.5
CVE-2026-84553A resource exhaustion issue was addressed with improved input validation. This issue is fixed in macOS Golden …0.5%높음7.5
CVE-2026-79895Vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct …0.5%높음7.5
CVE-2026-105659Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to…0.5%높음8.7
CVE-2026-92220A vulnerability was found in vllm-project vLLM 0.26.0/0.27.0. Affected is the function MoRIIOConnectorSchedule…0.5%보통6.9
CVE-2026-92363A flaw has been found in ag-ui-protocol ag-ui 1.0. Affected is an unknown function of the file src/stream/sse_…0.5%보통5.3
CVE-2026-109149A weakness has been identified in beautifier js-beautify up to 1.15.1/2.0.3. The affected element is an unknow…0.5%보통5.5
CVE-2026-115776Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, tw…0.5%높음7.5
CVE-2026-77791Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message ena…0.5%높음7.5
CVE-2026-93307A vulnerability has been found in O-RAN-SC SMO OAM 2025-06-10. Affected is an unknown function of the componen…0.5%낮음2.1
CVE-2026-109821Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's URI module a…0.5%보통6.3
CVE-2026-65115NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker may cause uncontrolled r…0.5%보통6.5
CVE-2026-65112NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause uncontrolled…0.5%보통6.5
CVE-2026-85100A vulnerability was detected in 2FastLabs agent-squad up to 1.1.4. Affected by this vulnerability is the funct…0.5%낮음2.1
CVE-2026-76290In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthenticated user could send repeated r…0.5%높음7.5
CVE-2026-92361A security vulnerability has been detected in ag-ui-protocol ag-ui 1.0. This affects an unknown function of th…0.5%보통5.3
CVE-2026-100137CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to a…0.5%높음7.5
CVE-2026-105902CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to a…0.5%높음7.5
CVE-2026-100139CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to a…0.5%높음7.5
CVE-2026-76646A remote attacker could cause excessive resource consumption by supplying specially crafted request parameters…0.5%높음7.5
CVE-2026-92362A vulnerability was detected in ag-ui-protocol ag-ui 1.0. This impacts an unknown function of the file crates/…0.5%보통6.9
CVE-2026-69186c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled A…0.5%보통5.3
CVE-2026-61848Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, w…0.5%보통6.3
CVE-2026-93309A vulnerability was determined in O-RAN-SC SMO OAM 2025-06-10. Affected by this issue is some unknown function…0.5%낮음2.1
CVE-2026-93308A vulnerability was found in O-RAN-SC SMO OAM 2025-06-10. Affected by this vulnerability is an unknown functio…0.5%낮음2.1
CVE-2026-114603OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api…0.5%보통5.3
CVE-2026-101098A security vulnerability has been detected in ag-ui-protocol ag-ui up to 2026-09-23. Affected by this issue is…0.5%보통5.3
CVE-2026-17463IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Ser…0.5%보통6.5
CVE-2026-76288In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a …0.5%높음7.5
CVE-2026-113795pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, accessing a crafted PDF stream with …0.5%보통6.0
CVE-2026-115909zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0, ZipA…0.5%높음7.5
CVE-2026-89425UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for it…0.5%높음7.5
CVE-2026-93679IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to cause a denial of service…0.5%보통4.3
CVE-2026-113729Moov signedxml is a pure Go library for processing signed XML documents. Prior to 1.4.1, ExclusiveCanonicaliza…0.5%높음7.5
CVE-2026-50125MKP is a Model Context Protocol server for Kubernetes. Prior to 0.4.1, cmd/server/main.go exposes the default …0.5%높음7.5
CVE-2026-108062Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthe…0.5%보통6.9
CVE-2026-94449A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like …0.5%높음7.5
CVE-2026-76821OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to …0.5%높음7.1
CVE-2026-87277Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported ve…0.5%높음7.5
CVE-2026-87289Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webserver-static-content)…0.5%높음7.5
CVE-2026-87138Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Acces…0.5%높음7.5
CVE-2026-58483mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilitie…0.5%높음7.5
CVE-2026-69147vLLM is an inference and serving engine for large language models. Prior to 0.28.0, request bodies for Chat Co…0.5%보통6.5
CVE-2026-69203Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, An Ember server with HTTP/2 ena…0.5%높음7.5
CVE-2026-83333Vulnerability in the Oracle Net Services component of Oracle Database Server. Supported versions that are affe…0.5%높음7.5
CVE-2026-83330Vulnerability in the Helidon product of Oracle Fusion Middleware (component: WebSocket). Supported versions th…0.5%높음7.5
CVE-2026-83183Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Su…0.5%높음7.5
CVE-2026-83350Vulnerability in the Oracle Net Services component of Oracle Database Server. Supported versions that are affe…0.5%높음7.5
CVE-2026-83349Vulnerability in the Oracle Net Services component of Oracle Database Server. Supported versions that are affe…0.5%높음7.5
CVE-2026-83281Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webserver). Supported ver…0.5%높음7.5
CVE-2026-83280Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webserver-http2). Support…0.5%높음7.5
CVE-2026-83228Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Su…0.5%높음7.5
CVE-2026-33521There is s denial of service vulnerability in Esri ArcGIS Server versions 12.0 and prior that may allow a remo…0.4%높음7.5
CVE-2026-92596Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that…0.5%높음8.7
CVE-2026-45768Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring …0.5%높음7.5
CVE-2026-111758markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link r…0.5%높음7.5
CVE-2026-115775Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, th…0.4%높음8.7
CVE-2026-59951The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1…0.5%보통6.9
이 원장은 전체 CVE 가 아닙니다. NVD 에는 30만 건이 넘습니다. 여기 있는 것은 ① 악용이 확인된 것 ② 최근 공개된 것 ③ 국산 SW 관련 ④ KISA 권고에 등장한 것입니다. 무엇을 담았는지 밝히지 않으면 "없다" 를 "안전하다" 로 읽게 됩니다.