CWE-639 관련 취약점
같은 약점 유형으로 분류된 취약점입니다. CWE 는 "무엇을 잘못했는가" 의 분류이고, 제품을 가리지 않고 같은 실수가 반복됩니다.
CWE-639 — 주요 취약점
악용이 확인된 것을 먼저 보여줍니다.
● 실제 악용이 확인됨CVE-2026-55255Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an In…0.9%높음8.4CVE-2026-100885A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the…1.0%보통5.5CVE-2026-85873Improper authorization in Skype for Business and Microsoft Lync allows an authorized attacker to ele…0.8%보통6.5CVE-2026-86465Apache Airflow Akeyless provider: the Akeyless secrets backend's team-scope guard can be bypassed wi…0.8%보통6.5CVE-2026-69865Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthori…0.8%심각10.0CVE-2026-75517Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu inte…0.7%보통6.5CVE-2026-86678ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user t…0.7%높음8.8CVE-2026-115748**UNSUPPORTED WHEN ASSIGNED** Authorization bypass in Apache Vysper, all versions. Apache Vysper is …0.6%높음8.8
전체 목록
120건
CVE-2026-97638The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to …0.6%높음7.5
CVE-2026-69375Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to…0.6%보통6.5
CVE-2026-84791ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken …0.6%높음7.1
CVE-2026-84789ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken …0.6%높음7.1
CVE-2026-83711Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorize…0.6%심각10.0
CVE-2026-110620Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyActio…0.6%보통6.1
CVE-2026-20342A vulnerability in a specific file download API of Cisco Secure FMC Software could allow an authenticated, rem…0.5%높음7.7
CVE-2026-54671WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an empty res…0.6%높음8.8
CVE-2026-120425Chatify before 1.6.4 contains an authorization bypass vulnerability in the Pusher channel authorization endpoi…0.5%높음7.1
CVE-2026-53639Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18…0.5%보통6.3
CVE-2026-93746The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress i…0.5%높음7.5
CVE-2026-92469zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the file-center…0.5%높음7.2
CVE-2026-78462Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypa…0.5%높음8.8
CVE-2026-47156MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass i…0.5%심각9.3
CVE-2026-61744InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, POST /api/barcode/ accepts an attacke…0.5%보통6.5
CVE-2026-63506Tina is a headless content management system. Prior to @tinacms/auth 1.1.4 and next-tinacms-azure 15.0.1, isAu…0.5%높음8.8
CVE-2026-84860ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authorization Bypass Spring Security gates DWR endp…0.5%높음8.8
CVE-2026-82685Authorization Bypass Through User-Controlled Key vulnerability in team-alembic AshAuthentication allows an aut…0.5%높음7.6
CVE-2026-113727OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workf…0.5%높음7.4
CVE-2026-63647CordysCRM is an open source AI-powered customer relationship management system that supports private deploymen…0.5%심각9.3
CVE-2026-119646Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to re…0.5%보통5.3
CVE-2026-103366The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulne…0.5%높음7.5
CVE-2026-95655Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authent…0.5%높음8.6
CVE-2026-48975HomeBox is a home inventory and organization system. Prior to 0.26.0, MaintenanceEntryRepository.Update and Ma…0.5%높음8.1
CVE-2026-48826HomeBox is a home inventory and organization system. Prior to 0.26.0, HandleWipeInventory in backend/app/api/h…0.5%높음8.1
CVE-2026-94534lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpo…0.5%높음7.1
CVE-2026-77426Unleash is an open-source feature management platform. Prior to 8.0.3, the Unleash admin API contains five aut…0.5%높음7.1
CVE-2026-85607Blinko 1.8.7 contains an authorization bypass (IDOR) vulnerability in multiple tRPC procedures (message.list, …0.5%높음8.7
CVE-2026-110238Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated …0.5%높음8.7
CVE-2026-94535lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the deleteMyNotice endpoint that a…0.5%높음7.1
CVE-2026-81505Convoy is a cloud native webhooks gateway. Prior to 26.6.8, Convoy's GET /api/v1/projects/{projectID}/sources/…0.5%높음7.1
CVE-2026-89333The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Obj…0.5%보통6.5
CVE-2026-55625GoCD is a continuous deliver server. From 16.1.0 until 26.1.0, the internal material connection test APIs at /…0.5%보통4.9
CVE-2026-88877Traefik is a HTTP reverse proxy and load balancer. In versions >= v3.7.0 and <= v3.7.11, the Kubernetes ingres…0.4%심각9.3
CVE-2026-94497jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multi…0.5%높음8.7
CVE-2026-102298In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check. A…0.4%높음7.5
CVE-2026-75101An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed any authenticate…0.4%보통6.0
CVE-2026-48976HomeBox is a home inventory and organization system. Prior to 0.26.0, NotifierRepository.Update in backend/int…0.4%높음8.1
CVE-2026-115546Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. An authenticate…0.4%높음8.1
CVE-2026-113610Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method…0.4%보통5.3
CVE-2026-119658PowerDNS-Admin through 2026.08.1 contains an authorization bypass vulnerability that allows authenticated User…0.4%보통5.3
CVE-2026-82441Description A submitted topology carries two lists of blobstore keys, `dependency_jars` and `dependency_artifa…0.4%심각9.1
CVE-2026-79409An issue in Webkul Bagisto 2.4.9 allows a remote attacker to obtain sensitive information via the add-to-cart …0.4%보통6.5
CVE-2026-111702ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remot…0.4%높음8.7
CVE-2026-69857Authorization bypass through user-controlled key in Azure Cosmos DB allows an authorized attacker to perform s…0.4%높음8.5
CVE-2026-79758Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. …0.4%보통5.4
CVE-2026-102986Plane is an open-source project management tool. In 1.3.1 and earlier, EntityAssetEndpoint at the public proje…0.4%높음8.1
CVE-2026-94532lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the getUserInfoById endpoint that …0.4%높음7.1
CVE-2026-94533lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in FileAnyoneController that allows a…0.4%높음7.1
CVE-2026-93991Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkf…0.4%높음8.3
CVE-2026-61838Lychee is a free, open-source photo-management tool. Prior to 7.6.3, GET /api/v2/Zip authorizes album and phot…0.4%높음8.2
CVE-2026-111366cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited …0.4%높음8.6
CVE-2026-66091In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or aut…0.4%보통6.9
CVE-2026-93660SQLBot through 1.10.1 fails to verify dashboard ownership in update_resource and update_canvas endpoints, allo…0.4%높음7.1
CVE-2026-120426OpenCSG CSGHub through v2.6.0-ce contains an authorization bypass vulnerability in the unauthenticated file re…0.4%높음8.7
CVE-2026-110613youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated me…0.4%높음7.1
CVE-2026-86263A vulnerability was detected in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This impac…0.4%보통5.5
CVE-2026-86262A security vulnerability has been detected in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384…0.4%보통5.5
CVE-2026-86261A weakness has been identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. The impa…0.4%보통5.5
CVE-2026-44084An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. I…0.4%높음8.7
CVE-2026-61708SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior …0.4%높음8.5
CVE-2026-69190Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update…0.4%보통6.3
CVE-2026-61748InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, ReportPrint at POST /api/report/print…0.4%보통4.3
CVE-2026-93678IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive informat…0.4%높음7.6
CVE-2026-77937Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate ot…0.4%높음8.6
CVE-2026-92714The Download Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to,…0.4%보통6.5
CVE-2026-89063The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure D…0.4%높음7.5
CVE-2026-116239In server mode pgAdmin 4 keeps an account per authentication source, so the same username can exist as, for ex…0.4%높음8.9
CVE-2026-93955A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected by this vulnerability is t…0.4%낮음2.1
CVE-2026-119645ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authen…0.4%높음7.1
CVE-2026-108924A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Affected by this issue is the function Opt…0.4%보통5.3
CVE-2026-90521A vulnerability was found in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70…0.4%낮음2.1
CVE-2026-110608BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerability in the O…0.4%보통5.3
CVE-2026-74864sogo_yhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" …0.4%심각9.3
CVE-2026-119049FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim …0.4%높음7.2
CVE-2026-94510Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elev…0.4%심각9.9
CVE-2026-85624Blinko 1.8.7 contains a cross-user private note disclosure vulnerability in the noteReferenceList procedure th…0.4%높음7.1
CVE-2026-107762The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure…0.4%높음7.5
CVE-2026-119661ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries end…0.4%낮음2.3
CVE-2026-76901CordysCRM is an open source AI-powered customer relationship management system that supports private deploymen…0.4%보통5.8
CVE-2026-62279LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6…0.4%높음7.1
CVE-2026-112240The download link for files uploaded through a form relied on a token that could be predicted. The file name i…0.4%보통6.3
CVE-2026-54529SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to 0.27.1, ModelView.sort_query in sqladmi…0.4%보통5.3
CVE-2026-105639Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User …0.4%심각9.8
CVE-2026-120461Jpom through 2.11.12 contains a cross-workspace authorization bypass in POST /node/ssh_command/batch that reso…0.4%높음8.7
CVE-2026-111697HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp M…0.4%높음7.1
CVE-2026-120460Jpom through 2.11.12 contains a cross-workspace authorization bypass vulnerability that allows authenticated u…0.4%높음8.7
CVE-2026-88065`tts-be` is a backend for a timetable selector that aims to help students better choose their class schedules.…0.4%높음7.5
CVE-2026-118668langgraph-api implements the LangGraph API for rapid development and testing. From 0.1.2 until 0.15.0, JavaScr…0.4%높음8.6
CVE-2026-47094SIMAC MyPHR 1.1 contains an insecure direct object reference (IDOR) vulnerability that allows authenticated at…0.4%높음8.7
CVE-2026-91144ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the downl…0.4%높음8.7
CVE-2026-55382InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional in…0.4%높음7.6
CVE-2026-113643A vulnerability was found in EspoCRM up to 9.3.10/10.0.10. This affects the function ImageSourceProvider::get …0.4%보통5.3
CVE-2026-81915Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated. Th…0.4%보통5.1
CVE-2026-55178GeoLens is a self-hosted geospatial data catalog with semantic search, OGC and STAC APIs, and a map builder. P…0.4%높음7.5
CVE-2026-95683In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. …0.4%보통5.3
CVE-2026-85105A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is the function _sess_nowait…0.4%보통6.9
CVE-2026-92468zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the search-cent…0.4%높음7.1
CVE-2026-102775Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca C…0.4%높음8.7
CVE-2026-93736Mealie before 3.21.0 fails to validate user ownership in the ratings and favorites endpoints, allowing authent…0.4%보통5.3
CVE-2026-103525The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Ins…0.4%높음7.5
CVE-2026-97657The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via Malleab…0.4%심각9.8
CVE-2026-115325Netmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClient handler that allo…0.4%높음8.7
CVE-2026-74865sogo_yhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be b…0.4%심각9.2
CVE-2026-77293TREK is a collaborative travel planner. Prior to 3.3.0, the DELETE /api/trips/:tripId/collab/notes/:noteId/fil…0.4%높음7.1
CVE-2026-78433Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 Ja…0.4%미평가
CVE-2026-54178backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel pa…0.4%높음8.1
CVE-2026-87739An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigg…0.4%보통6.9
CVE-2026-89202A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not prope…0.4%높음7.1
CVE-2026-118760Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. From 0.5.1…0.4%보통6.5
CVE-2026-97636Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-scope guard can be bypassed with…0.4%보통6.5
CVE-2026-94152A security vulnerability has been detected in Omega Solution FBP Fulfillment by People 2025. This impacts an u…0.4%낮음2.1
이 원장은 전체 CVE 가 아닙니다. NVD 에는 30만 건이 넘습니다. 여기 있는 것은 ① 악용이 확인된 것 ② 최근 공개된 것 ③ 국산 SW 관련 ④ KISA 권고에 등장한 것입니다. 무엇을 담았는지 밝히지 않으면 "없다" 를 "안전하다" 로 읽게 됩니다.