CWE-918 관련 취약점
같은 약점 유형으로 분류된 취약점입니다. CWE 는 "무엇을 잘못했는가" 의 분류이고, 제품을 가리지 않고 같은 실수가 반복됩니다.
CWE-918 — 주요 취약점
악용이 확인된 것을 먼저 보여줍니다.
● 랜섬웨어 캠페인에 사용됨CVE-2024-21893A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.…100.0%높음8.2● 랜섬웨어 캠페인에 사용됨CVE-2021-40438A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by…100.0%심각9.0● 랜섬웨어 캠페인에 사용됨CVE-2021-34473Microsoft Exchange Server Remote Code Execution Vulnerability100.0%심각9.1● 랜섬웨어 캠페인에 사용됨CVE-2021-21985The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input valid…100.0%심각9.8● 랜섬웨어 캠페인에 사용됨CVE-2021-26855Microsoft Exchange Server Remote Code Execution Vulnerability100.0%심각9.1● 랜섬웨어 캠페인에 사용됨CVE-2022-41040Microsoft Exchange Server Elevation of Privilege Vulnerability100.0%높음8.8● 랜섬웨어 캠페인에 사용됨CVE-2021-22986On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x befo…99.9%심각9.8● 실제 악용이 확인됨CVE-2021-22054VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prio…99.7%높음7.5
전체 목록
120건
CVE-2021-21311악용 확인Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4…98.5%높음7.2
CVE-2025-61884랜섬웨어 악용Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported…95.9%높음7.5
CVE-2020-7796악용 확인Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet J…93.6%심각9.8
CVE-2026-20230악용 확인A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager …88.5%높음8.6
CVE-2021-21973악용 확인The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper valida…88.0%보통5.3
CVE-2019-9621악용 확인Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 …81.0%높음7.5
CVE-2021-21975랜섬웨어 악용Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malic…78.0%높음7.5
CVE-2016-3718악용 확인The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers t…75.6%보통5.5
CVE-2021-22175악용 확인When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in…53.4%심각9.8
CVE-2021-39935악용 확인An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all vers…36.1%높음7.5
CVE-2021-27103랜섬웨어 악용Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The …11.4%심각9.8
CVE-2026-64849악용 확인MLflow is an open source AI engineering platform for agents, large language models, and machine learning model…10.0%심각9.3
CVE-2026-83548악용 확인A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an uninten…8.0%심각10.0
CVE-2026-15409랜섬웨어 악용A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place int…6.8%심각10.0
CVE-2026-49869악용 확인Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilte…2.1%심각10.0
CVE-2026-96652악용 확인Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token v…1.8%보통5.3
CVE-2026-96655악용 확인Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external a…1.6%보통5.3
CVE-2026-85917Server-side request forgery (ssrf) in Azure AI Foundry allows an unauthorized attacker to elevate privileges o…1.0%높음7.5
CVE-2026-77987A server-side request forgery (SSRF) vulnerability was identified in the notebook viewer of GitHub Enterprise …0.9%심각9.3
CVE-2026-70259Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose in…0.8%보통6.5
CVE-2026-69683Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose in…0.8%높음7.7
CVE-2026-82013Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could resu…0.8%심각9.9
CVE-2026-81999Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery (SSRF) vulnerability that coul…0.8%높음8.7
CVE-2026-96204Server-side request forgery (ssrf) in Azure Arc allows an authorized attacker to elevate privileges over a net…0.8%보통6.5
CVE-2026-69361Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoof…0.8%보통6.5
CVE-2026-34633ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege es…0.7%높음7.7
CVE-2026-108456Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges ove…0.7%높음7.7
CVE-2026-82000Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery (SSRF) vulnerability that coul…0.7%심각9.6
CVE-2026-106622ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege es…0.7%심각10.0
CVE-2026-66304Server-side request forgery (ssrf) in Skype for Business allows an unauthorized attacker to disclose informati…0.7%높음7.5
CVE-2026-19233CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized command executi…0.7%높음8.6
CVE-2026-34634ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege es…0.7%높음8.6
CVE-2026-77524KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace admi…0.6%심각9.9
CVE-2026-54734Prebid Server Java is the Java version of Prebid Server. Prior to 3.43.0, certain bidder adapters interpolate …0.6%심각10.0
CVE-2026-57866Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. Authenticated Impala users with permiss…0.6%높음8.8
CVE-2026-75748ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege es…0.6%높음7.6
CVE-2026-95679MISP's RequestHandlerComponent automatically decodes XML request bodies on all write requests. The underlying …0.6%보통6.9
CVE-2026-55864GeoNetwork is a catalog application to manage spatially referenced resources. Prior to 4.2.17 and 4.4.12, POST…0.6%높음7.8
CVE-2026-54048Specifying tblproperties('avro.schema.url'=' http://...' ) or with a 'file:///' URI on a table in Impala 2.0.0…0.6%보통5.3
CVE-2026-69904Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose in…0.6%낮음3.5
CVE-2026-80150Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware version…0.6%높음7.7
CVE-2026-80149Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware version…0.6%높음7.7
CVE-2026-80148Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware version…0.6%높음7.7
CVE-2026-76001ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege es…0.5%높음7.1
CVE-2026-70251Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate pri…0.5%높음7.5
CVE-2026-105790Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.…0.5%보통6.4
CVE-2026-113704A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of t…0.5%보통6.9
CVE-2026-116205YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote …0.5%보통6.9
CVE-2026-62284OSAC operator is a Kubernetes operator. In the affected revision identified as 8220502, the `console-proxy` `R…0.5%높음8.6
CVE-2026-113728Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.9.2, the unauthenticated …0.5%높음7.5
CVE-2026-56660GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS.…0.5%심각9.1
CVE-2026-111761A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, BasePushNotifi…0.5%보통5.8
CVE-2026-51997An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the…0.5%높음8.8
CVE-2026-101898Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 reque…0.5%높음7.0
CVE-2026-75885A flaw was found in the OpenShift console. Unauthenticated access to the `/api/devfile/` and `/api/devfile/sam…0.5%심각9.3
CVE-2026-94040A flaw has been found in vas3k TaxHacker up to 0.8.5. Affected by this vulnerability is the function testLLMPr…0.5%보통5.5
CVE-2026-86237A vulnerability was found in openagents-org openagents up to 0.8.19/0.9.3.post20. Impacted is the function tes…0.5%보통5.5
CVE-2026-90818A security flaw has been discovered in netease-youdao LobsterAI 2026.6.15/2026.8.28/2026.9.3/2026.9.4. Impacte…0.5%낮음2.1
CVE-2026-88206Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate pri…0.5%높음7.5
CVE-2026-70202Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate pri…0.5%높음7.5
CVE-2026-95656A vulnerability was found in dgtlmoon changedetection.io up to 50389b07. This vulnerability affects the functi…0.5%보통5.5
CVE-2026-94038A security vulnerability has been detected in NonceGeek dim-sum-app. This impacts the function textSearchV2Han…0.5%보통5.5
CVE-2026-92566DataGear through 6.0.0 contains a server-side request forgery vulnerability in the /dataSet/preview/Http endpo…0.5%높음8.8
CVE-2026-54637Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4-rc.3, th…0.5%보통5.5
CVE-2026-95634CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in…0.5%높음8.6
CVE-2026-76900CordysCRM is an open source AI-powered customer relationship management system that supports private deploymen…0.5%보통6.8
CVE-2026-92380A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the…0.5%보통5.5
CVE-2026-68536Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core. Older unsupported versions may also …0.5%심각9.8
CVE-2026-94039A vulnerability was detected in vas3k TaxHacker up to 0.8.5. Affected is the function generateInvoicePDF of th…0.5%보통5.5
CVE-2026-90710A vulnerability was determined in taisan tarzan-cms 1.0.0. This issue affects the function openConnection of t…0.5%보통5.5
CVE-2026-45723Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and 1.7.3, managementSe…0.5%낮음2.7
CVE-2026-105897ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege es…0.5%높음8.6
CVE-2026-85608Douyin_TikTok_Download_API through 4.1.2 contains a server-side request forgery vulnerability in the /api/down…0.5%높음8.7
CVE-2026-102255A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an uninten…0.5%심각10.0
CVE-2026-96890A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed a r…0.5%높음8.7
CVE-2026-108939A vulnerability has been found in EricLBuehler mistral.rs up to 0.9.3. Impacted is the function is_global_ip o…0.5%보통5.5
CVE-2026-61793Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.0.2 until 6.7.0, nuxt-og-image exposes th…0.5%보통6.9
CVE-2026-105290A vulnerability was determined in feelec-yishu feelcrm-os 1.0.0. This affects an unknown part of the file App/…0.5%보통5.5
CVE-2026-119545Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a server-side request forge…0.4%보통6.9
CVE-2026-77866Server-Side Request Forgery (SSRF) vulnerability in Slab safeurl allows an attacker who controls a validated U…0.5%심각9.0
CVE-2026-20362A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote …0.5%높음7.2
CVE-2026-61749InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, privileged staff users who can author…0.5%보통6.5
CVE-2026-108836A vulnerability has been found in Ollama up to 0.34.1. The affected element is the function IsValid of the fil…0.5%보통5.5
CVE-2026-104817Misskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated …0.5%높음8.7
CVE-2026-86806A weakness has been identified in opengeos GeoLibre up to 2.3.0. Impacted is the function _is_within_roots. Th…0.5%보통6.9
CVE-2026-119549Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypas…0.4%높음7.1
CVE-2026-54339Glean is a self-hosted RSS reader and personal knowledge management tool. Prior to 0.2.6, POST /api/feeds/disc…0.5%높음7.7
CVE-2026-71198In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP lo…0.4%높음7.0
CVE-2026-55385InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional in…0.5%보통6.8
CVE-2026-77274MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to …0.5%높음8.8
CVE-2026-111418A server-side request forgery (SSRF) vulnerability exists in the Foxit official website’s HTML-to-PDF conversi…0.4%높음7.5
CVE-2026-109404A vulnerability was identified in conductor-oss conductor up to 3.33.0-rc10. Affected by this issue is some un…0.5%보통5.5
CVE-2026-75511Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu accepts chat w…0.5%보통5.3
CVE-2026-109405A security flaw has been discovered in conductor-oss conductor up to 3.33.0-rc10. This affects the function Ka…0.5%보통5.5
CVE-2026-119342Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. From 2.13.1…0.4%보통5.3
CVE-2026-59823LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.9, an auth…0.4%보통5.3
CVE-2026-110718TurboDocx html-to-docx through 1.23.1 contains a server-side request forgery vulnerability that allows attacke…0.4%높음8.2
CVE-2026-100893A vulnerability was determined in Privoce VoceChat Server up to 0.5.36. This vulnerability affects the functio…0.5%보통5.5
CVE-2023-54402iDocView contains a server-side request forgery vulnerability in its /doc/upload endpoint that allows remote u…0.4%높음8.7
CVE-2026-55414NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residen…0.4%보통5.3
CVE-2026-94028A weakness has been identified in mealie-recipes Mealie up to 3.25.1. Affected is the function payload.model_d…0.4%낮음2.1
CVE-2026-54507Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior …0.4%높음8.4
CVE-2026-88056Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript…0.4%높음8.6
CVE-2026-92719Quickwit through 0.9.0 fails to validate the host and scheme of the queue_url parameter in SQS file sources, a…0.4%높음8.7
CVE-2026-63443Coder allows organizations to provision remote development environments via Terraform. Prior to 2.29.19, 2.32.…0.4%높음8.3
CVE-2026-39989A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote a…0.4%보통5.3
CVE-2026-92204Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnera…0.4%높음7.7
CVE-2026-110628Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/down…0.4%심각9.2
CVE-2026-63184Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.1, the `refitter`…0.4%높음7.1
CVE-2026-112267SGLang through 0.5.22 in prefill/decode disaggregation mode contains a server-side request forgery vulnerabili…0.4%보통6.9
CVE-2026-119709Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-…0.4%보통6.9
이 원장은 전체 CVE 가 아닙니다. NVD 에는 30만 건이 넘습니다. 여기 있는 것은 ① 악용이 확인된 것 ② 최근 공개된 것 ③ 국산 SW 관련 ④ KISA 권고에 등장한 것입니다. 무엇을 담았는지 밝히지 않으면 "없다" 를 "안전하다" 로 읽게 됩니다.