CWE-693 관련 취약점
같은 약점 유형으로 분류된 취약점입니다. CWE 는 "무엇을 잘못했는가" 의 분류이고, 제품을 가리지 않고 같은 실수가 반복됩니다.
CWE-693 — 주요 취약점
악용이 확인된 것을 먼저 보여줍니다.
● 랜섬웨어 캠페인에 사용됨CVE-2024-21412Internet Shortcut Files Security Feature Bypass Vulnerability99.4%높음8.1● 랜섬웨어 캠페인에 사용됨CVE-2013-2465Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update…98.8%심각9.8● 실제 악용이 확인됨CVE-2019-1003030A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml…97.1%심각9.9● 랜섬웨어 캠페인에 사용됨CVE-2013-0431Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 throug…90.1%보통5.3● 실제 악용이 확인됨CVE-2025-40536SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that…73.6%심각9.8● 실제 악용이 확인됨CVE-2026-32202Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing ov…70.9%보통4.3● 실제 악용이 확인됨CVE-2026-21510Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security f…61.2%높음8.8● 실제 악용이 확인됨CVE-2025-04117-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the…47.6%높음7.0
전체 목록
120건
CVE-2026-21513악용 확인Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature …15.9%높음8.8
CVE-2026-58704악용 확인In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to …0.6%높음8.8
CVE-2026-94603Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an …0.9%심각10.0
CVE-2026-53710MCP Context Forge is an AI gateway, registry, and proxy for MCP, A2A, REST, and gRPC APIs. Prior to 1.0.2, the…0.8%심각10.0
CVE-2026-120338Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, …0.8%심각10.0
CVE-2026-92934vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revi…0.7%심각9.5
CVE-2026-93605vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist…0.7%심각10.0
CVE-2026-93606vm2 (npm) versions 3.12.0 and earlier contain a sandbox escape in `VM` and `NodeVM`. When an embedder exposes …0.7%심각10.0
CVE-2026-81376Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a s…0.7%심각9.6
CVE-2026-84318Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginx_con…0.6%높음8.8
CVE-2026-92122Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check the method called through the …0.6%높음8.8
CVE-2026-92944vm2 versions 3.10.2 through 3.11.6 contain a sandbox escape vulnerability on Node.js 26 where Promise.prototyp…0.6%심각9.3
CVE-2026-92124Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier checks the operations Groovy will perform wit…0.6%높음8.8
CVE-2026-92123Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not intercept operations performed on a …0.6%높음8.8
CVE-2026-76825RestrictedPython is a tool that helps define a subset of the Python language for accepting program input in a …0.6%높음8.4
CVE-2026-101900Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig read…0.5%보통6.9
CVE-2026-114139Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.…0.5%심각9.1
CVE-2026-101899Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypass…0.5%보통6.9
CVE-2026-41510OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, …0.5%높음7.2
CVE-2026-41508OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.4.0 until 3.8.0, …0.5%보통5.8
CVE-2026-76059IBM Langflow OSS 1.0.0 through 1.11.5 An attacker who could submit custom component source code could bypass t…0.5%높음8.8
CVE-2026-16760In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to t…0.5%높음8.8
CVE-2026-92948vm2 versions >= 3.9.6 and <= 3.11.6 are affected by a NodeVM builtin allowlist bypass that permits a sandbox e…0.4%심각9.4
CVE-2026-106439Hydra is a framework for elegantly configuring complex applications. From 1.3.4 until 1.3.7 and 1.4.0.dev10, H…0.5%높음8.5
CVE-2026-92129Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check calls from sandboxed scripts t…0.4%높음7.5
CVE-2026-91949FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthen…0.4%심각9.2
CVE-2026-57133PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, the shell() helper exported from src/praisona…0.4%높음8.8
CVE-2026-97673IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code du…0.4%높음8.8
CVE-2026-39353InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1…0.4%심각9.1
CVE-2026-92938vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeVM when tha…0.4%심각9.4
CVE-2026-16916IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allo…0.4%높음8.8
CVE-2026-92956vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default `new VM()` sandbox when r…0.4%심각10.0
CVE-2026-97678IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code du…0.4%높음8.8
CVE-2026-113730OGNL is an Object Graph Navigation Library for Java. Prior to 3.4.13, the optional stricter-invocation mode in…0.4%보통5.6
CVE-2026-57138PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, codeMode in src/praisonai-ts/src/tools/builti…0.4%심각9.9
CVE-2026-57136PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, CommandValidator in src/praisonai-ts/src/cli/…0.4%높음8.8
CVE-2026-104774OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, …0.4%보통5.8
CVE-2026-100676January, the media proxy/embed service of stoatchat (stoatchat/stoatchat), before version 0.15.5 improperly re…0.4%높음8.8
CVE-2026-77401Zope AccessControl provides a general security framework for use in Zope. Prior to 7.4, applications that allo…0.4%보통6.8
CVE-2026-79919MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.6-lts, function-library code runnin…0.4%보통6.3
CVE-2026-84317Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, internal/config/validation.go (Vali…0.4%높음8.8
CVE-2026-45770Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring …0.4%높음7.5
CVE-2026-57137PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, createAgentLoop() in src/praisonai-ts/src/ai/…0.4%높음8.8
CVE-2026-47424Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, GroovySandboxValueFilter pe…0.4%높음7.5
CVE-2026-55376Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to …0.4%높음8.8
CVE-2026-107226The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously …0.4%보통6.8
CVE-2026-79918MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.6-lts, the ToolExecutor LD_PRELOAD …0.4%보통6.3
CVE-2026-92121In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an intern…0.3%높음7.5
CVE-2026-78552The Okta Access Gateway does not apply its Lua directive restriction to the application-level custom configura…0.3%보통6.0
CVE-2026-92778CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle to HTML form routes, allowing…0.3%보통5.3
CVE-2026-86800The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-check reque…0.3%보통5.3
CVE-2026-86796The Hide My WP Ghost WordPress plugin before 7.0.11 does not verify that a request is a genuine WooCommerce re…0.3%보통5.3
CVE-2026-87808SiYuan versions <= 3.8.1 contain an incomplete fix for CVE-2026-32767 (GHSA-j7wh-x834-p3r7). The prior fix (co…0.3%높음8.7
CVE-2026-57120PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, execute_code sandbox mode permits ru…0.3%보통6.5
CVE-2026-115480baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the public…0.3%보통5.3
CVE-2026-105668Protection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who has …0.3%높음7.1
CVE-2026-77892No cwe for this issue in Windows Boot Manager allows an unauthorized attacker to elevate privileges with a phy…0.3%보통6.8
CVE-2026-107697FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass…0.3%보통5.3
CVE-2026-57135PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, SandboxExecutor network-isolated mode in src/…0.3%높음7.6
CVE-2026-112348Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated …0.3%보통6.9
CVE-2026-120202Highflame ramparts 0.8.1 through 0.8.10 contains a security scan bypass vulnerability that allows attackers to…0.3%높음7.1
CVE-2026-112361A vulnerability has been found in Dolibarr up to 23.0.2. The impacted element is an unknown function of the fi…0.3%보통5.3
CVE-2026-54694SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code flaws combin…0.3%심각9.6
CVE-2026-112077A vulnerability was detected in radareorg radare2 6.2.0/6.2.2. This issue affects the function r_core_cmd_str_…0.3%보통6.3
CVE-2026-110181PostgreSQL Anonymizer contains a vulnerability related to anonymization functions defined using SQL-standard f…0.3%보통6.5
CVE-2026-106016Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 157.0.1.0.3%심각9.8
CVE-2026-84319Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API …0.3%높음8.3
CVE-2026-111965The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification on all co…0.3%보통4.3
CVE-2026-92959vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While localPromise.pro…0.3%높음7.1
CVE-2026-102674Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior …0.3%높음8.2
CVE-2026-66874For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic ski…0.3%보통6.5
CVE-2026-65327A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia…0.3%높음8.4
CVE-2026-90957Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox. The commit e…0.2%보통5.1
CVE-2026-20331As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Sec…0.2%심각9.6
CVE-2026-109364Zebra 2.3.0 before 6.4.0 contains a protection mechanism failure that allows unauthenticated peers to evade ba…0.2%보통6.9
CVE-2026-106408Protection mechanism failure in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote atta…0.2%미평가
CVE-2026-105746Docling simplifies document processing by parsing diverse formats and providing integrations with the generati…0.2%낮음2.2
CVE-2026-86894A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27. An app may be a…0.2%높음7.5
CVE-2026-110866Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge che…0.2%보통5.3
CVE-2026-79638Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00,…0.2%보통5.3
CVE-2026-55366In IP Multimedia Subsystem, there is a possible authentication bypass due to a logic error in the code. This c…0.2%심각9.8
CVE-2026-90950The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not verify the reCAPTCHA on its registrat…0.2%보통5.3
CVE-2026-79298An issue in Howyar Technologies Inc SysReturn Versions prior to 11.3.034 and fixed in v.11.3.0.34 allows a loc…0.2%높음8.4
CVE-2026-76283Protection Mechanism Failure. Splunk addressed multiple internally identified vulnerabilities in Splunk Enterp…0.2%높음7.6
CVE-2026-94251A vulnerability in Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape …0.2%보통6.5
CVE-2026-113609Bandisoft Bandizip before 7.47 fails to propagate Mark-of-the-Web to extracted .ps1 and .psm1 files, allowing …0.2%보통4.8
CVE-2026-114614Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.comm…0.2%낮음2.6
CVE-2026-110182PostgreSQL Anonymizer contains a vulnerability related to the anon.partial() and anon.partial_email() function…0.2%보통4.3
CVE-2026-92962vm2 is a sandbox for running untrusted JavaScript. In vm2 versions up to and including 3.11.3, the defaultSand…0.2%낮음2.1
CVE-2026-76301As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a compreh…0.2%미평가
CVE-2025-71424Contrast, Edgeless Systems' runtime for confidential containers on Kubernetes, is affected in versions up to a…0.2%보통5.1
CVE-2026-54577mport is the MidnightBSD Package Manager. Prior to 2.7.8, the audit command in mport/mport.c computed option-a…0.2%낮음2.0
CVE-2026-57012In the Setup Wizard, there is a possible remote package install due to a missing permission check. This could …0.2%높음8.4
CVE-2026-104025Path Traversal (CWE-22) in the execute_obj function of the archive object viewer (peach.pas) in PeaZip 11.2.0 …0.2%높음8.4
CVE-2026-56838PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.59, PraisonAI recipe execut…0.1%높음7.8
CVE-2026-87878Linux binaries have executable stack attribute enabled. The following products are affected: Acronis Cyber Pro…0.1%보통6.3
CVE-2026-102673Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior …0.1%높음8.2
CVE-2026-76528As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a compreh…0.1%미평가
CVE-2026-56979In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead…0.1%보통6.7
CVE-2026-56881In enable_segment of remap.c, there is a possible permission bypass due to a logic error in the code. This cou…0.1%높음8.4
CVE-2026-55359In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead…0.1%높음7.8
CVE-2026-55302In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead…0.1%보통6.7
CVE-2026-0189In ac_init_policy of init.c, there is a possible permission bypass due to a logic error in the code. This coul…0.1%높음8.4
CVE-2026-58678In Bootloader, there is a possible permission bypass due to a logic error in the code. This could lead to loca…0.1%높음7.8
CVE-2026-85288Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ incompletely enforces shortc…0.1%보통6.7
CVE-2026-104024Incomplete List of Disallowed Inputs (CWE-184) in the dangerous-extension confirmation of the archive object v…0.1%보통4.6
CVE-2026-102734asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutil…0.1%보통5.5
CVE-2026-56982In VPU, there is a possible permission bypass due to a missing permission check. This could lead to local esca…0.1%높음7.8
이 원장은 전체 CVE 가 아닙니다. NVD 에는 30만 건이 넘습니다. 여기 있는 것은 ① 악용이 확인된 것 ② 최근 공개된 것 ③ 국산 SW 관련 ④ KISA 권고에 등장한 것입니다. 무엇을 담았는지 밝히지 않으면 "없다" 를 "안전하다" 로 읽게 됩니다.