CWE-441 관련 취약점
같은 약점 유형으로 분류된 취약점입니다. CWE 는 "무엇을 잘못했는가" 의 분류이고, 제품을 가리지 않고 같은 실수가 반복됩니다.
CWE-441 — 주요 취약점
악용이 확인된 것을 먼저 보여줍니다.
● 실제 악용이 확인됨CVE-2026-83548A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to …8.0%심각10.0CVE-2026-69399Azure Arc Elevation of Privilege Vulnerability0.9%심각10.0CVE-2026-100706kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath…0.6%심각9.4CVE-2026-45723Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and 1.7.3, ma…0.5%낮음2.7CVE-2026-102255A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to …0.5%심각10.0CVE-2026-61793Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.0.2 until 6.7.0, nuxt-og-image …0.5%보통6.9CVE-2026-86003CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-ove…0.4%높음7.5CVE-2026-109373ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that …0.4%심각9.2
전체 목록
89건
CVE-2026-101907Axios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetch adapter …0.4%높음7.0
CVE-2026-77255MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to …0.4%높음8.6
CVE-2026-50022Metacat is data repository software that helps researchers preserve, share, and discover data. Prior to 3.4.2,…0.4%보통5.8
CVE-2026-101897Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript…0.4%보통5.1
CVE-2026-87582Confused deputy in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had comp…0.4%높음8.3
CVE-2026-70148Improper authorization in Windows Broadcast DVR User Service allows an authorized attacker to disclose informa…0.4%보통6.5
CVE-2026-54628Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes URL-capable SQ…0.3%높음8.6
CVE-2026-106228Confused deputy in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compr…0.4%높음8.3
CVE-2026-53999Radius is a cloud-native, portable application platform that makes app development easier for teams building c…0.3%높음7.7
CVE-2026-94205Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the even…0.3%심각9.8
CVE-2026-114612LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.…0.3%심각9.9
CVE-2026-86600In affected Snowflake drivers, WORKLOAD_IDENTITY authentication requests a cloud workload-identity token and a…0.3%높음8.2
CVE-2026-69531Unintended proxy or intermediary ('confused deputy') in Microsoft Windows Speech allows an authorized attacker…0.3%보통5.5
CVE-2026-86115Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalizati…0.3%보통5.3
CVE-2026-106221Confused deputy in WebAPKs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker lev…0.3%높음8.3
CVE-2026-81303A flaw was found in hawtio-operator. The operator holds routes/custom-host:create permission cluster-wide and …0.3%보통6.3
CVE-2026-101905Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adap…0.3%높음7.6
CVE-2026-83837Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges loc…0.3%높음7.8
CVE-2026-87442Confused deputy in Prerender in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had comprom…0.3%낮음3.1
CVE-2026-105311The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Con…0.3%높음7.7
CVE-2026-114478Insufficient preservation of the original sender in the forwarding of Progressive Robot hMailServer 6.0.0 thro…0.3%보통5.9
CVE-2026-93294A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Man…0.3%보통6.3
CVE-2026-87453Confused deputy in BackgroundFetch in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had c…0.3%보통5.3
CVE-2026-106359Confused deputy in DeviceBoundSessionCredentials in Google Chrome prior to 155.0.8059.39 allowed a remote atta…0.3%미평가
CVE-2026-95361Confused deputy in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging socia…0.3%보통4.3
CVE-2026-100625Capgo (capgo.app) exposes a native build TUS upload proxy (supabase/functions/_backend/public/build/upload.ts)…0.3%높음8.7
CVE-2026-75886A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in th…0.3%높음7.2
CVE-2026-107336Malcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive…0.2%보통6.5
CVE-2026-106301Confused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had …0.2%높음8.1
CVE-2026-106266Confused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had …0.2%미평가
CVE-2026-91742Confused deputy in PriceTracking in Google Chrome on on iOS prior to 153.0.8010.47 allowed a remote attacker l…0.2%미평가
CVE-2026-95328Confused deputy in Mobile in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker lever…0.2%보통6.5
CVE-2026-106487Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kuberne…0.2%낮음3.5
CVE-2026-106188Confused deputy in SignIn in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to b…0.2%미평가
CVE-2026-106286Confused deputy in Omnibox in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web ori…0.2%미평가
CVE-2026-77246MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to …0.2%높음7.4
CVE-2026-107232The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously …0.2%높음7.5
CVE-2026-103922Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3…0.2%심각9.3
CVE-2026-118687Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.3…0.2%높음8.3
CVE-2026-107282The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously …0.2%심각9.4
CVE-2026-49906An unprivileged application can bypass the `android.car.permission.CAR_DISPLAY_IN_CLUSTER` permission by regis…0.2%높음7.8
CVE-2026-72668Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege e…0.2%높음7.3
CVE-2026-87502Confused deputy in Fullscreen in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compro…0.2%보통4.2
CVE-2026-55225Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configu…0.2%높음8.0
CVE-2026-106462Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control acti…0.2%보통6.4
CVE-2026-106427Confused deputy in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypas…0.2%보통5.4
CVE-2026-108261Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin …0.2%심각9.3
CVE-2026-57042In multiple functions of DreamPickerReceiver.kt, there is a possible permission bypass due to a confused deput…0.1%보통6.7
CVE-2026-58877In checkNearbyDevicesPermission of WifiP2pServiceImpl.java, there is a possible permission bypass due to a con…0.1%보통4.0
CVE-2026-59015In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to loca…0.1%보통4.0
CVE-2026-67077HCL BigFix AEX is affected by a Server-Side Request Forgery vulnerability, which could allow an attacker to ca…0.1%보통4.2
CVE-2026-56986In multiple files, there is a possible out-of-bounds read due to type confusion. This could lead to local esca…0.1%높음8.4
CVE-2026-56985In multiple files, there is a possible way to obtain signatures due to type confusion. This could lead to loca…0.1%높음8.4
CVE-2026-55264In checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible information leak due to a con…0.1%보통4.0
CVE-2026-93320BuildKit may be tricked into performing file actions with special file inodes where regular files are expected…0.1%보통6.0
CVE-2026-59028In resolveAidConflictLocked of RegisteredAidCache.java, there is a possible permission bypass due to a confuse…0.1%높음8.4
CVE-2026-58885In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to loca…0.1%높음8.4
CVE-2026-58884In startTetheredHotspotRequest of WifiServiceImpl.java, there is a possible permission bypass due to a confuse…0.1%높음8.4
CVE-2026-59000In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to loca…0.1%높음8.4
CVE-2026-58965In handleAudioEffectBroadcast of MusicFxHelper.java, there is a possible permission bypass due to a confused d…0.1%높음8.4
CVE-2026-49922In queryRemoteConnectionServices of ConnectionServiceWrapper.java, there is a possible permission bypass due t…0.1%높음8.4
CVE-2026-55271In forwardToPreferredActionPickHandler of ContactsPickerActivity.kt, there is a possible intent redirection du…0.1%높음8.4
CVE-2026-58970In deliverResult of AppTimeTracker.java, there is a possible background activity launch due to a confused depu…0.1%높음8.4
CVE-2026-58957In resolveToHeavyWeightSwitcherIfNeeded of ActivityStarter.java, there is a possible background activity launc…0.1%높음8.4
CVE-2026-55289In multiple functions in multiple locations, there is a possible execution of sensitive USSD codes due to a co…0.1%높음8.4
CVE-2026-49931In onActivityResult in multiple locations, there is a possible contact leak from protected profile due to a co…0.1%높음8.4
CVE-2026-58944In moveTaskToFrontLocked of ActivityTaskManagerService.java, there is a possible background application launch…0.1%높음8.4
CVE-2026-58943In run of AddAccountSettings.java, there is a possible background activity launch due to a confused deputy. Th…0.1%높음8.4
CVE-2026-106326Confused deputy in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to bypass…0.1%보통4.4
CVE-2026-58698In ap_pmic_poll_msg_handler of ap_pmic_ipc.c, there is a possible permission bypass due to a confused deputy. …0.1%보통6.7
CVE-2026-56992In multiple files, there is a possible permission bypass due to a confused deputy. This could lead to local es…0.1%보통6.7
CVE-2026-56922In CPM, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of…0.1%보통6.7
CVE-2026-58739In platform_msg_handler_init of default_msg_handlers.c, there is a possible confused deputy due to a confused …0.1%보통6.7
CVE-2026-56879In gmc_mb_msg_handler of gmc_mba.c, there is a possible memory corruption due to a confused deputy. This could…0.1%보통6.7
CVE-2026-0183In CPM, there is a possible information disclosure due to a confused deputy. This could lead to local informat…0.1%보통4.4
CVE-2026-56945In VPU, there is a possible out-of-bounds write due to a confused deputy. This could lead to local escalation …0.1%높음7.8
CVE-2026-55270In dialInternal in multiple locations, there is a possible permission bypass due to a confused deputy. This co…0.1%높음7.8
CVE-2026-28648In Settings, there is a possible permission bypass due to a confused deputy. This could lead to local escalati…0.1%높음7.8
CVE-2026-121198Confused deputy in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social e…미평가
CVE-2026-121171Confused deputy in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging socia…미평가
CVE-2026-121108Confused deputy in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potent…미평가
이 원장은 전체 CVE 가 아닙니다. NVD 에는 30만 건이 넘습니다. 여기 있는 것은 ① 악용이 확인된 것 ② 최근 공개된 것 ③ 국산 SW 관련 ④ KISA 권고에 등장한 것입니다. 무엇을 담았는지 밝히지 않으면 "없다" 를 "안전하다" 로 읽게 됩니다.