CWE-943 관련 취약점
같은 약점 유형으로 분류된 취약점입니다. CWE 는 "무엇을 잘못했는가" 의 분류이고, 제품을 가리지 않고 같은 실수가 반복됩니다.
CWE-943 — 주요 취약점
악용이 확인된 것을 먼저 보여줍니다.
CVE-2026-57193Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1,…2.0%보통6.9CVE-2026-62906Improper neutralization of special elements in data query logic in Microsoft Discovery Studio allows…0.7%높음7.4CVE-2026-120201Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthentica…0.6%심각9.3CVE-2026-114396Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authent…0.5%높음7.1CVE-2026-106119LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHi…0.5%보통6.0CVE-2026-93760Mongoid does not restrict which query operators may come from caller-supplied filter data when an ap…0.5%높음8.3CVE-2026-114401Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthentic…0.4%보통6.9CVE-2025-60357AhnLab EPP Management v1.0.14.32-6249 was discovered to contain a NoSQL injection vulnerability via …0.4%높음8.1
전체 목록
58건
CVE-2026-20284A vulnerability in the SXP REST API of Cisco ISE could allow an authenticated, remote attacker to conduct SQL …0.4%심각9.1
CVE-2026-55253LangChain MongoDB provides integrations between MongoDB, Atlas, LangChain, and LangGraph. Prior to langgraph-c…0.4%높음7.7
CVE-2026-105675Ghost is a Node.js content management system. From 4.39.0 until 6.64.0, staff users with permission to view st…0.4%높음7.5
CVE-2026-104956Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint ac…0.4%보통5.3
CVE-2026-73976djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, An unauth…0.4%높음7.1
CVE-2026-100631Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to…0.4%높음8.7
CVE-2026-114648The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-…0.3%높음7.2
CVE-2026-88024Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Rust Dr…0.3%보통6.1
CVE-2026-88025Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C# Driv…0.3%보통6.1
CVE-2026-88023Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Lib…0.3%보통6.1
CVE-2026-114652A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Dr…0.3%높음7.1
CVE-2026-118641n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an OData $filter injection vulnerabi…0.3%보통6.9
CVE-2026-88022Improper neutralization of special elements in data query logic in the MongoDB integration for Laravel can cau…0.3%높음8.4
CVE-2026-113662ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module,…0.3%보통5.4
CVE-2026-103258n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an unescaped parameter interpolation vulnerability…0.3%보통6.9
CVE-2026-73975djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, an authen…0.3%높음8.4
CVE-2026-91937Flowise before 3.1.4 fails to sanitize the overrideConfig.sessionId parameter before using it in MongoDB queri…0.3%높음8.7
CVE-2026-76295In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions be…0.3%보통4.3
CVE-2026-96744Improper neutralization of special elements in data query logic in the cache lock implementation of the MongoD…0.3%높음7.1
CVE-2026-81914Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names …0.3%보통4.3
CVE-2026-91133Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenti…0.3%보통6.5
CVE-2026-105799LangChain is a framework for building LLM-powered applications. Prior to 1.1.1, @langchain/redis does not esca…0.3%낮음2.3
CVE-2026-55369Waline is a comment system with backend support. Prior to version 1.41.1, the login endpoint POST /api/token r…0.3%보통6.5
CVE-2026-55465The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From ve…0.3%보통5.3
CVE-2026-88031Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driv…0.3%보통6.1
CVE-2026-88036Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Drive…0.3%보통6.1
CVE-2026-88034Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C++ Dri…0.3%보통6.1
CVE-2026-88030Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Ruby Dr…0.3%보통6.1
CVE-2026-88029Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python …0.3%보통6.1
CVE-2026-88033Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Dr…0.3%보통6.1
CVE-2026-114647The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar si…0.3%보통5.3
CVE-2026-59962Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to …0.3%보통6.5
CVE-2026-55444The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior t…0.3%보통5.3
CVE-2026-116801Parse Server before 8.6.105 and 9.0.0 before 9.10.5-alpha.6 does not validate the owning object reference in $…0.3%보통5.3
CVE-2026-105681Ghost is a Node.js content management system. From 5.9.0 until 6.44.1, an input validation issue allowed membe…0.3%보통6.5
CVE-2026-105652Ghost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determ…0.3%낮음3.1
CVE-2026-88028Improper neutralization of special elements in data query logic in the polymorphic relation handling of the Mo…0.2%높음7.1
CVE-2026-85167n8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerability in the Elasticsearch Docume…0.2%보통6.3
CVE-2026-114510Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applications acr…0.2%높음7.1
CVE-2026-82060In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users …0.2%낮음2.3
CVE-2026-102988Plane is an open-source project management tool. Prior to 1.4.0, multiple issue-listing endpoints, including u…0.2%보통5.3
CVE-2026-97228Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-…0.2%낮음2.7
CVE-2026-118645n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a filter injection vulnerability in …0.2%높음7.0
CVE-2026-88027Improper neutralization of special elements in data query logic in the embedded-document relation handling of …0.2%높음7.1
CVE-2026-103289Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenti…0.2%높음7.1
CVE-2026-88026Improper neutralization of regular-expression metacharacters in the LINQ query translation component of the Mo…0.2%높음7.1
CVE-2026-103250n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a NoSQL injectio…0.2%높음7.0
CVE-2026-118581A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document'…0.2%보통6.9
CVE-2026-63489Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pip…높음7.6
CVE-2026-120567The MongoDB Entity Framework Core provider does not neutralize special elements when it places a caller-suppli…낮음2.3
이 원장은 전체 CVE 가 아닙니다. NVD 에는 30만 건이 넘습니다. 여기 있는 것은 ① 악용이 확인된 것 ② 최근 공개된 것 ③ 국산 SW 관련 ④ KISA 권고에 등장한 것입니다. 무엇을 담았는지 밝히지 않으면 "없다" 를 "안전하다" 로 읽게 됩니다.