CWE-863 관련 취약점
같은 약점 유형으로 분류된 취약점입니다. CWE 는 "무엇을 잘못했는가" 의 분류이고, 제품을 가리지 않고 같은 실수가 반복됩니다.
CWE-863 — 주요 취약점
악용이 확인된 것을 먼저 보여줍니다.
● 랜섬웨어 캠페인에 사용됨CVE-2023-22518All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. Th…100.0%심각9.8● 랜섬웨어 캠페인에 사용됨CVE-2023-38035A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below,…100.0%심각9.8● 실제 악용이 확인됨CVE-2022-46169Cacti is an open source platform which provides a robust and extensible operational monitoring and f…99.8%심각9.8● 실제 악용이 확인됨CVE-2024-38856Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.1…99.4%심각9.8● 실제 악용이 확인됨CVE-2026-71362Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privileg…90.5%심각9.1● 실제 악용이 확인됨CVE-2025-54253Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerabilit…88.8%심각10.0● 랜섬웨어 캠페인에 사용됨CVE-2019-7192This improper access control vulnerability allows remote attackers to gain unauthorized access to th…88.1%심각9.8● 실제 악용이 확인됨CVE-2021-40655An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker ca…87.0%높음7.5
전체 목록
120건
CVE-2018-13382랜섬웨어 악용An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10…81.7%높음7.5
CVE-2021-3493악용 확인The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the…49.2%높음7.8
CVE-2023-20269랜섬웨어 악용A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco…26.6%심각9.1
CVE-2021-3560악용 확인It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating t…23.7%높음7.8
CVE-2021-30533악용 확인Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attack…16.7%보통6.5
CVE-2025-55177악용 확인Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, W…13.5%보통5.4
CVE-2026-42016악용 확인JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due t…8.6%높음8.8
CVE-2025-24200악용 확인An authorization issue was addressed with improved state management. This issue is fixed in iOS 15.8.4 and iPa…4.5%보통6.1
CVE-2024-21287악용 확인Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Developmen…1.7%높음7.5
CVE-2025-21479악용 확인Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of …0.8%높음8.6
CVE-2025-21480악용 확인Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of …0.4%높음8.6
CVE-2026-86102An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with networ…1.8%심각9.3
CVE-2026-75745Adobe Experience Manager Forms JEE is affected by an Incorrect Authorization vulnerability that could result i…1.2%심각10.0
CVE-2026-75723Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbi…1.2%심각10.0
CVE-2026-75728Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbi…1.0%심각9.1
CVE-2026-107333Malcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based role…1.0%높음8.1
CVE-2026-68791Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose information over…1.0%높음8.6
CVE-2026-93643When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing s…1.0%심각9.8
CVE-2026-57200Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, …0.9%높음7.5
CVE-2026-85978An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platf…0.9%심각10.0
CVE-2026-111231Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI u…0.8%높음8.6
CVE-2026-74036Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust is determ…0.8%높음8.6
CVE-2026-48383Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrar…0.8%심각10.0
CVE-2026-48382Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrar…0.8%심각10.0
CVE-2026-102865Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information o…0.8%보통6.5
CVE-2026-77910Incorrect authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over …0.8%높음8.8
CVE-2026-70246Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges ove…0.7%높음8.8
CVE-2026-77459Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15, 3.4.10, 3.…0.7%심각9.9
CVE-2026-102862Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges ove…0.7%높음8.8
CVE-2026-70229Incorrect authorization in Active Directory Domain Services allows an unauthorized attacker to execute code ov…0.7%높음8.1
CVE-2026-77226Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's…0.7%심각9.2
CVE-2026-114623baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, an authent…0.7%보통6.5
CVE-2026-101880OpenClaw Windows Node before 2026.7.1 contains an incorrect authorization vulnerability in the system.run exec…0.7%높음8.7
CVE-2026-90532Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrar…0.7%심각10.0
CVE-2026-55701The OpenTelemetry Collector Contrib repository contains components for the OpenTelemetry Collector. Prior to 0…0.7%보통6.9
CVE-2026-110630VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management tha…0.6%높음7.0
CVE-2026-92909Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in arbitrary code exe…0.6%심각9.8
CVE-2026-69640Incorrect authorization in Windows Key Distribution Center allows an authorized attacker to bypass a security …0.6%보통5.3
CVE-2026-88616An issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to execute arbitrary code via the FlwTaskController.…0.6%높음8.8
CVE-2026-92908Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature…0.6%높음8.3
CVE-2026-77560Tinyauth is an authentication and authorization server. Prior to 5.1.2, Tinyauth compares forwarded hostnames …0.6%높음8.1
CVE-2026-111627HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators…0.6%높음8.6
CVE-2026-75732Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrar…0.6%심각9.9
CVE-2026-63414Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, `token-exchange` au…0.5%높음7.6
CVE-2026-97380MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11…0.6%높음8.8
CVE-2026-100560OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability where Allow Always approvals f…0.6%높음7.7
CVE-2026-19232Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrar…0.6%심각9.9
CVE-2026-27552A low-privileged remote attacker can exploit improper authorization in the /index.php/attached_devices_tab/do_…0.6%높음8.1
CVE-2026-105797SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded in…0.6%높음8.8
CVE-2026-19863An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the reque…0.5%심각9.3
CVE-2026-6922The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to Incorrect Authorization…0.6%높음7.1
CVE-2026-115642In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyo…0.5%높음8.3
CVE-2026-85619AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization c…0.5%높음7.7
CVE-2026-105938Apache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix subscription …0.5%낮음2.3
CVE-2026-105780Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbi…0.5%심각9.9
CVE-2026-109524A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc…0.5%보통5.5
CVE-2026-94609authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an account with dele…0.5%높음8.8
CVE-2026-71195In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the call…0.5%심각9.9
CVE-2026-95654Databasement before 1.7.14 validates invitation tokens only when the acceptance page loads, caching the author…0.5%심각9.1
CVE-2026-74035Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.update_u…0.5%높음8.6
CVE-2026-86043Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.27.37, the opaAuthoriz…0.5%높음7.5
CVE-2026-105942When a configured proxy role sends a request to the broker on behalf of another user (the original principal),…0.5%높음7.7
CVE-2026-52742GoCD is a continuous deliver server. From 12.3.1 until 26.1.0, legacy routes under /go/admin/restful/* expose …0.5%보통5.1
CVE-2026-103091Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MC…0.5%심각9.3
CVE-2026-75608Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/go2rtc/api…0.5%높음7.7
CVE-2026-61744InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, POST /api/barcode/ accepts an attacke…0.5%보통6.5
CVE-2026-88044rclone is a command-line program to sync files and directories to and from different cloud storage providers. …0.5%심각9.1
CVE-2026-71184Gitea's pull request review notifier does not attach the pull request to the Actions notification, so the fork…0.5%높음8.8
CVE-2026-112001ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API to…0.5%높음8.6
CVE-2026-101000A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. This affects the function uci.apply of t…0.5%심각9.3
CVE-2026-118598A logic error in Epiphany's site permission handling can cause camera and microphone access to be granted when…0.5%보통6.5
CVE-2026-106623ColdFusion is affected by an Incorrect Authorization vulnerability that could lead to disclosure of sensitive …0.5%높음7.5
CVE-2026-92817The Ignition Perspective module does not properly validate session privileges when determining Designer-level …0.5%높음8.7
CVE-2026-77774Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature…0.5%높음8.6
CVE-2026-91157Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, sites wi…0.5%높음7.5
CVE-2026-82431Description `SimpleACLAuthorizer` evaluated the user-level command set by returning early when `nimbus.users` …0.5%심각9.8
CVE-2026-77181Incorrect Authorization vulnerability in Apache Syncope. An administrator with ClientApp's update entitlement …0.5%심각9.8
CVE-2026-73668Incorrect Authorization vulnerability in Apache Syncope. An administrator with adequate entitlements in a give…0.5%심각9.8
CVE-2026-73579Incorrect Authorization vulnerability in Apache Syncope. Any search requests are transformed into SQL, Neo4J o…0.5%심각9.8
CVE-2026-73370Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks performed by…0.5%심각9.8
CVE-2026-55563Feast is the open source feature store for AI and machine learning. Prior to 0.65.0, .github/workflows/pr_inte…0.5%높음8.9
CVE-2026-77108Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalati…0.5%높음7.5
CVE-2026-77111Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature…0.5%높음8.7
CVE-2026-102649Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator. Prior to 0.13.0, `POST /…0.5%심각9.9
CVE-2026-60010Gitea's repository-side team-link API allows a repository administrator who is not an organization owner to at…0.5%보통6.5
CVE-2026-28328SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow …0.5%높음8.8
CVE-2026-105930When package management is enabled, Pulsar Functions, Sources and Sinks can be registered or updated from a pa…0.5%보통6.0
CVE-2026-105927The Apache Pulsar WebSocket service allows a WebSocket consumer to configure a dead letter policy through quer…0.4%낮음2.3
CVE-2026-55774OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an OpenBao user with acces…0.4%낮음2.1
CVE-2026-65831ArcadeDB is a Multi-Model DBMS. Prior to 26.7.1, a reader-role user can submit POST /api/v1/command/{database}…0.4%높음7.7
CVE-2026-118264Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel fr…0.4%심각9.1
CVE-2026-55625GoCD is a continuous deliver server. From 16.1.0 until 26.1.0, the internal material connection test APIs at /…0.5%보통4.9
CVE-2026-57133PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, the shell() helper exported from src/praisona…0.4%높음8.8
CVE-2026-100744A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the fi…0.5%보통5.5
CVE-2026-106612ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code executi…0.4%심각9.9
CVE-2026-105720Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges ove…0.4%보통4.3
CVE-2026-62247Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtim…0.5%보통6.5
CVE-2026-114132Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.2, Nuxt resolves pages case-insensit…0.4%보통6.3
CVE-2024-22031A vulnerability has been identified within Rancher where a user with the ability to create a project, on a cer…0.4%높음8.5
CVE-2026-114059ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, includ…0.4%높음7.7
CVE-2026-85025IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an unauthenticated attacker to execute arbitrary co…0.4%심각9.8
CVE-2026-86274A security vulnerability has been detected in projeto-siga siga up to 11.0.2.10/11.0.2.13/11.1.1. This affects…0.4%보통5.5
CVE-2026-63443Coder allows organizations to provision remote development environments via Terraform. Prior to 2.29.19, 2.32.…0.4%높음8.3
CVE-2026-108263Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default w…0.4%심각9.9
CVE-2026-18659In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, and `jetty-eeN-servle…0.4%보통6.9
CVE-2026-93594ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 enforces its per-type/per-record access-…0.4%높음7.1
CVE-2026-113607Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows …0.4%높음7.1
CVE-2026-91998Casdoor through 4.4.0 contains an authorization bypass vulnerability in the /api/mcp endpoint that allows atta…0.4%심각9.4
CVE-2026-75157Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with `READ` ins…0.4%미평가
이 원장은 전체 CVE 가 아닙니다. NVD 에는 30만 건이 넘습니다. 여기 있는 것은 ① 악용이 확인된 것 ② 최근 공개된 것 ③ 국산 SW 관련 ④ KISA 권고에 등장한 것입니다. 무엇을 담았는지 밝히지 않으면 "없다" 를 "안전하다" 로 읽게 됩니다.