#CVE

[CVE-2010-0249] Microsoft Internet Explorer Use-After-Free Vulnerability

CISA

분석: AI가 바꾼 사이버 위협 지형 — 소프트웨어 취약점이 최대 침해 경로

버라이존 2026 DBIR에 따르면 전체 침해 사고의 31%가 소프트웨어 취약점 악용에서 시작되며, AI 기술의 발전이 공격 속도를 가속화하고 있습니다. 국내 기업은 CISA KEV 카탈로그 기반 취약점 관리, 자동화된 패치 프로세스, …

Drupal PostgreSQL 사이트를 노리는 CVE-2026-9082 SQL 인젝션 긴급 대응 가이드

CVE-2026-9082는 PostgreSQL 기반 Drupal 코어의 고위험 SQL 인젝션 취약점으로, 인증 없는 공격자가 데이터 유출, 권한 상승, RCE 등의 공격이 가능합니다. CISA가 긴급 패치를 권장하며, 2026년 5월 27일까지 대응이 필요합니다.

MiniPlasma 재등장: CVE-2020-17103 Windows cldflt.sys 권한 상승 취약점 점검

CVE-2020-17103 MiniPlasma 취약점이 최신 Windows 11에서도 재현됨. 2020년에 패치되었으나 PoC가 SYSTEM 권한 상승을 성공시킴. 완전한 패치는 없으나 초기 유입 차단, EDR 탐지 규칙 적용 등 완화 조치가 필요함.

CVE-2026-34926: Trend Micro Apex One 디렉토리 트래버설 KEV 등록과 엔드포인트 보안 점검

Trend Micro Apex One 온프레미스 디렉토리 트래버설 취약점 CVE-2026-34926이 CISA KEV에 등재되었습니다. 이 취약점은 로컬 관리자 권한을 가진 공격자가 보안 에이전트에 악성 코드를 배포할 수 있어 기업 엔드포인트 보안에 심각한 …

CVE-2025-34291: Langflow Origin 검증 오류 KEV 등록과 AI 워크플로우 서버 노출 점검

CVE-2025-34291은 Langflow의 보안 구성 결함(CORS 과도 설정, CSRF 방어 부족, 코드 실행 엔드포인트)이 결합하여 발생하는 취약점입니다. 사용자가 악성 웹페이지를 방문하기만 하면 계정 탈취와 원격 코드 실행이 가능합니다. 1.6.9 이하 버전을 …

구조적 보안 위기의 본질, 생성형 AI와 양자 시대에 대응하는 포스트 퀀텀 암호화와 자동화 기반 혁신 전략

2026-05-23 보안 인사이트

10년 전 Microsoft 레거시 취약점이 다시 위험해지는 이유: CISA KEV 등재와 기업 대응 전략

CISA가 10년 이상된 Microsoft 레거시 취약점 4개를 KEV 카탈로그에 등록했습니다. 본 분석은 CVE-2010-0249, CVE-2010-0806, CVE-2009-1537, CVE-2008-4250의 기술적 특성과 현실적 위협, 그리고 기업 보안 담당자를 위한 즉시/단기/장기 대응 전략을 제시합니다.

CVE-2026-41091: Microsoft Defender 링크 추적 취약점 대응 가이드

CVE-2026-41091 Microsoft Defender 링크 추적 취약점 분석: CVSS 7.8(HIGH), CWE-59, 영향 버전 및 패치 정보, 즉시 대응 조치 포함

CVE-2010-0806: Internet Explorer Peer Objects Use-After-Free 취약점 대응 가이드

CVE-2010-0806은 IE 6/7의 Peer Objects 컴포넌트에서 발생하는 Use-After-Free 취약점으로, 원격 코드 실행이 가능하며 CISA KEV 카탈로그에 포함된 지속적인 위협입니다. 즉시 대응으로 MS10-018 보안 업데이트 적용과 IE 8 이상으로 업그레이드가 필요합니다.

CVE-2009-1537: Microsoft DirectX NULL 바이트 오버라이트 취약점 분석 및 대응 가이드

Microsoft DirectX DirectShow 컴포넌트의 CVE-2009-1537 취약점 분석. QuickTime 미디어 파일을 통한 원격 코드 실행 위협과 영향받는 시스템, MS09-028 패치 및 완화 조치 안내.

CVE-2026-45498: Microsoft Defender 서비스 거부(DoS) 취약점 대응 가이드

Microsoft Defender DoS 취약점(CVE-2026-45498) 분석 및 대응 가이드. NVD 7.5 HIGH vs Microsoft 4.0 MEDIUM 평가 차이, 영향 범위, 패치 정보, 즉시 대응 조치 포함

CVE-2008-4250: Windows Server Service 버퍼 오버플로우 취약점 대응 가이드

CVE-2008-4250은 Windows Server Service의 치명적인 버퍼 오버플로우 취약점으로, Conficker 랜섬웨어에 악용되어 전 세계적으로 수백만 대의 시스템을 감염시켰습니다. 본 가이드는 기술적 원리, 영향 범위, 실제 공격 사례 및 기업 대응 전략을 …

CVE-2009-3459: Adobe Acrobat and Reader 힙 기반 버퍼 오버플로우 취약점 대응 가이드

CVE-2009-3459는 Adobe Acrobat과 Reader의 힙 기반 버퍼 오버플로우 취약점으로 악성 PDF 파일을 통해 원격 코드 실행이 가능하다. 2009년 야생에서 실제 공격이 확인되었으며 현재까지도 CISA KEV 카탈로그에 등록되어 주의가 필요하다.

오래된 KEV 취약점이 다시 위험해지는 이유: IE·DirectX·Windows 레거시 자산 점검 가이드

CISA가 2026년 5월 20일, 10년 이상 된 4가지 Microsoft 취약점을 KEV 카탈로그에 등록했다. 국내 기업 환경에서는 여전히 레거시 자산으로 운영되는 시스템이 많아 실제 보안 위험으로 남아 있다. 본 가이드는 자산 …

MiniPlasma: 6년 만에 되살아난 SYSTEM 권한 상승 (CVE-2020-17103)

SK쉴더스

[CVE-2026-9082] Drupal Core SQL Injection Vulnerability

CISA

붕괴하는 디지털 경계와 공격 자동화 속에서, 아이덴티티와 공급망 무결성을 확보하여 보안을 기업 생존을 견인하는 핵심 전략 자산으로 재편하라

2026-05-20 보안 인사이트

[CVE-2025-34291] Langflow Origin Validation Error Vulnerability

CISA

[CVE-2026-34926] Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability

CISA

Drupal 코어 데이터베이스 API SQL 인젝션 취약점 (CVE-2026-9082)

SK쉴더스

AI 자율 공격과 양자 컴퓨팅으로 무너지는 보안 경계, 자율형 SOC와 신원 기반 보안을 통한 선제적 방어 진화와 투자 재조정의 시점

2026-05-19 보안 인사이트

APT·AI 자동화 공격에 대한 스마트팩토리 OT 보안 점검 가이드

최근 이란 연합 APT가 미국 주요 인프라 OT 장비를 겨냥한 공격과 드라고스(Dragos)의 AI 활용 공격 조사에 따르면, 스마트팩토리 OT 보안의 초점이 단순 침입 탐지에서 인증 통제로 이동하고 있다. 본 가이드는 …

[CVE-2008-4250] Microsoft Windows Buffer Overflow Vulnerability

CISA

[CVE-2009-1537] Microsoft DirectX NULL Byte Overwrite Vulnerability

CISA

[CVE-2009-3459] Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability

CISA

[CVE-2010-0806] Microsoft Internet Explorer Use-After-Free Vulnerability

CISA

[CVE-2026-41091] Microsoft Defender Link Following Vulnerability

CISA

[CVE-2026-45498] Microsoft Defender Denial of Service Vulnerability

CISA

공급망과 물리적 인프라로 위협이 확산되는 지금, 제로 트러스트와 거버넌스 고도화가 기업 생존을 위한 핵심 전략이 되어야 한다.

2026-05-18 보안 인사이트

AI 자율 공격과 공급망 리스크가 확산되는 가운데, 보안 생존을 위한 전략 재설계와 투자 우선순위의 과감한 전환이 시급하다.

2026-05-17 보안 인사이트

CISA KEV 등재 Microsoft Exchange XSS(CVE-2026-42897) 긴급 대응 가이드

CVE-2026-42897은 실제 악용이 확인된 Microsoft Exchange Server XSS 취약점으로, CISA KEV 카탈로그에 등재되었습니다. 2026-05-29까지 패치 및 완화 조치를 완료해야 합니다.

WooCommerce 결제 스키밍으로 악용 중인 Funnel Builder 취약점 대응 체크리스트

Funnel Builder 플러그인 3.15.0.3 이전 버전의 취약점이 Magecart 스타일의 결제 스키밍 공격에 활용되고 있습니다. 40,000개 이상의 WooCommerce 스토어가 영향받을 수 있으며, 즉시 플러그인 업데이트와 외부 스크립트 검사가 필요합니다.

PoC 공개된 18년 묵은 NGINX 치명적 취약점: 인증 없는 서버 장악 리스크 점검

CVE-2026-42945는 2008년부터 존재한 NGINX의 힙 버퍼 오버플로우 취약점(CVSS 9.2)으로, 이미 PoC가 공개되어 실제 원격 코드 실행(RCE) 공격이 가능합니다. 즉시 1.30.1+로 패치하고 rewrite+set 지시문 조합을 제거해야 합니다.

Cisco Catalyst SD-WAN Controller 인증 우회 취약점(CVE-2026-20182) 긴급 대응 가이드

Cisco Catalyst SD-WAN Controller/Manager의 인증 우회 취약점(CVE-2026-20182)이 발견되었으며, 이미 야외에서 악용되고 있습니다. CISA는 연방기관에 2026년 5월 17일까지 완화 조치를 명령했습니다.

Cisco SD-WAN 인증 우회 제로데이 취약점 (CVE-2026-20182)

SK쉴더스

붕괴된 보안 경계와 고조되는 물리적 위협, 이제는 하드웨어 공급망 검증과 프로세스 분리로 방어 패러다임의 근본적 혁신을 단행해야 한다

2026-05-16 보안 인사이트

AI 융합이 초래한 보안 패러다임 붕괴, 양자 기술과 거버넌스 혁신으로 공급망 위협을 선제 차단하고 투자를 재편하라

2026-05-15 보안 인사이트

붕괴된 경계 기반 방어를 제로 트러스트와 지속적 위협 관리로 혁신하고 비즈니스 연속성을 위한 통제권을 확보해야 합니다.

2026-05-14 보안 인사이트

[CVE-2026-42897] Microsoft Exchange Server Cross-Site Scripting Vulnerability

CISA

NGINX ngx_http_rewrite_module 힙 버퍼 오버플로우 취약점(CVE-2026-42945)

SK쉴더스

애플·구글 RCS 종단간 암호화 도입이 모바일 메시징 보안에 주는 의미

애플과 구글이 iOS-Android 간 RCS 통신에 종단간 암호화(E2EE)를 도입하며 모바일 메시징 보안의 새로운 표준을 수립했습니다. 본 문서에서는 기술적 구조, 기업 보안 영향(백엔드 접근 불가, BYOD 데이터 관리, 통신사 의존성 등), …

[CVE-2026-20182] Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

CISA

CVE-2026-0265: Authentication Bypass in Palo Alto Networks PAN-OS

Rapid7

CVE-2026-20182: Critical authentication bypass in Cisco Catalyst SD-WAN Controller (FIXED)

Rapid7

Network-AI MCP 인증 결함 분석 및 취약점 제보 사례 (CVE-2026-42856)

SK쉴더스

디지털 공격이 물리적 재난으로 확산되는 위기, 인프라 격리와 거버넌스 강화를 통해 기술적 통제권을 선제적으로 확보해야 한다.

2026-05-10 보안 인사이트

BerriAI LiteLLM SQL Injection 취약점(CVE-2026-42208) 긴급점검 가이드

LiteLLM Proxy v1.81.16 ~ v1.83.6에 영향을 치명적인 SQL Injection 취약점(CVE-2026-42208, CVSS 9.3)이 발견되었습니다. 인증 이전 단계에서 API 키, 제공자 자격증명명, DB 연결 정보 탈취 가능하며, 공개 36시간 만에 실제 악용 …

Palo Alto Networks PAN-OS CVE-2026-0300 메모리 손상 취약점 대응 전략

CVE-2026-0300은 PAN-OS 방화벽의 Captive Portal에 있는 치명적인 버퍼 오버플로우 취약점으로, CISA KEV 카탈로그에 등재되어 활발히 악용 중입니다. 5월 9일 CISA 완화 기한 전에 Captive Portal 인터넷 노출 차단이 필수적입니다.

[CVE-2026-42208] BerriAI LiteLLM SQL Injection Vulnerability

CISA

Apache HTTP Server HTTP/2 Double Free 취약점 (CVE-2026-23918)

SK쉴더스

노출된 AI 서비스 보안 실황: Ollama 취약점과 공개 AI 인프라 정보유출 위험

최근 보안 연구에 따르면, 전 세계적으로 노출된 AI 서비스의 보안 상태가 매우 취약한 것으로 밝혀졌습니다. The Hacker News의 보고서는 100만 개 이상의 노출된 AI 서비스를 스캔한 결과, 인증이 없는 기본 …

Weaver E-cology·MetInfo CMS RCE 취약점 악용: 기업용 웹 시스템 제로데이/원데이 대응 전략

중국 기반 기업용 웹 시스템 Weaver E-cology(CVE-2026-22679)와 MetInfo CMS(CVE-2026-29014)의 치명적인 RCE 취약점이 실제 악용 중. 패치 출시 후 며칠 내 제로데이/원데이 공격 시작으로 기업에 긴급 대응 필요.

CVE-2026-31431 "Copy Fail": CISA KEV 등록 Linux 루트 권한 상승 취약점 대응 가이드

CISA가 KEV 카탈로그에 등록한 Linux 루트 권한 상승 취약점 CVE-2026-31431의 기술적 배경, 영향 범위, 대응 시나리오를 분석한 Deep Dive 콘텐츠입니다. 2017년 도입된 in-place 최적화 결함으로 732바이트 Python 스크립트로 루트 권한 …

[CVE-2026-6973] Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability

CISA

MOVEit Automation 인증 우회 취약점(CVE-2026-4670)

SK쉴더스

[CVE-2026-0300] Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability

CISA

세미콜론 하나로 연결된 GitHub RCE: AI가 발견한 코드 취약점과 개발 플랫폼 보안

2026년 4월 28일, Wiz Research가 GitHub의 심각한 RCE 취약점(CVE-2026-3854)을 공개했다. AI 도구(IDA MCP)를 활용해 발견된 이 취약점은 git push 푸시 옵션의 세미콜론을 통한 환경 변수 주입으로, 인증된 사용자가 GitHub 서버에서 …

AI 어시스턴트를 탑재한 Bluekit 피싱 킷: 피싱-as-a-Service의 자동화 진화

AI 어시스턴트를 탑재한 Bluekit 피싱 킷 분석. 피싱-as-a-Service의 자동화 진화, 국내 리스크, 대응 방안 포함.

Oracle 2026년 4월 Critical Patch Update: 481개 취약점 분석

Oracle 2026년 4월 CPU는 전체 제품군에 걸쳐 481개의 보안 패치를 포함하며, 34개가 Critical 심각도로 분류됨. Oracle Communications(139개), Financial Services(75개), Fusion Middleware(59개)가 가장 큰 영향을 받음. 제3자 컴포넌트(오픈소스 라이브러리) 취약점 비중 …

CVE-2026-40050: CrowdStrike LogScale 경로 순회 취약점 분석

CVE-2026-40050은 CrowdStrike LogScale 플랫폼의 치명적인 경로 순회(Path Traversal) 취약점입니다. 이 취약점은 인증 없이 원격 공격자가 서버 파일 시스템에서 임의의 파일을 읽을 수 있게 합니다.

CVE-2026-41940: cPanel & WHM 치명적 인증 우회 취약점 심층 분석 리포트

CVE-2026-41940은 cPanel & WHM의 로그인 플로우에 존재하는 치명적 인증 우회 취약점으로, CVSS 9.3점으로 평가되며 2026년 2월부터 제로데이로 악용되어 약 150만 개의 cPanel 인스턴스가 위험에 노출되었습니다. 즉시 패치 적용, 로그 분석, …

[CVE-2026-31431] Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability

CISA

SBOM (Software Bill of Materials) 채택의 현실과 과제

SBOM(Software Bill of Materials)은 글로벌 규제 압박과 보안 요구사항 증가로 필수 도구로 자리 잡고 있습니다. 본 기사는 NIST SSDF, EO 14028, EU CRA 등 주요 규제 동향과 실제 도입 시 …

[CVE-2026-41940] WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

CISA

ORM Injection (CVE-2026-30951, CVE-2026-0603, CVE-2026-34220)

SK쉴더스

CVE-2026-41940: cPanel & WHM Authentication Bypass

Rapid7

스마트 항만 보안: 물류 인프라 위협과 보안 강화 방안

스마트 항만의 디지털 전환에 따른 사이버 보안 위협을 분석하고, IT/OT 통합 보안, 네트워크 분리, 공급망 보안 강화 방안을 제시합니다. 물류 시스템 공격 벡터와 최근 보안 사례를 바탕으로, 실무자를 위한 체크리스트와 …

[CVE-2024-1708] ConnectWise ScreenConnect Path Traversal Vulnerability

CISA

[CVE-2026-32202] Microsoft Windows Protection Mechanism Failure Vulnerability

CISA

CVE-2023-27351: PaperCut NG/MF 인증 우회 취약점 심층 분석

CVE-2023-27351은 PaperCut NG/MF의 인증 우회 취약점으로 CVSS 8.2점(HIGH)입니다. 원격 공격자가 자격증명 없이 인증을 우회하여 사용자 정보와 해시된 비밀번호를 획득할 수 있습니다. 20.1.7, 21.2.11, 22.0.9 버전으로 패치해야 합니다.

CVE-2026-5752: Cohere AI Terrarium 샌드박스 탈출 취약점 분석

CVE-2026-5752는 Cohere AI Terrarium 샌드박스의 치명적인 탈출 취약점으로 CVSS 9.3점(Critical)입니다. 공격자가 루트 권한으로 임의 코드를 실행할 수 있으며, v1.0.1로 패치되었습니다. mock document 객체의 Object.prototype 상속 문제로 인해 발생했습니다.

Trigona 랜섬웨어의 커스텀 데이터 추출 도구 심층 분석

Trigona 랜섬웨어 그룹이 데이터 탈취 공격에 사용하는 커스텀 개발 도구가 발견

국가 차원 사이버 공격 동향 분석 리포트

2025년부터 2026년 초까지 중국 연합 APT 그룹 UAT-4356이 미국 연방기관의 Cisco 방화벽 장비를 표적으로 한 Firestarter 백도어 공격과 동시에 진행된 방산 기관 대상 피싱 공격 패턴을 분석한 보고서. 백도어의 기술적 …

[CVE-2025-29635] D-Link DIR-823X Command Injection Vulnerability

CISA

[CVE-2024-7399] Samsung MagicINFO 9 Server Path Traversal Vulnerability

CISA

[CVE-2024-57728] SimpleHelp Path Traversal Vulnerability

CISA

[CVE-2024-57726] SimpleHelp Missing Authorization Vulnerability

CISA

[CVE-2026-39987] Marimo Remote Code Execution Vulnerability

CISA

[CVE-2026-33825] Microsoft Defender Insufficient Granularity of Access Control Vulnerability

CISA

Apache ActiveMQ CVE-2026-34197 취약점 심층 분석

CVE-2026-34197 취약점에 대한 심층 기술 분석. CVSS 8.8(HIGH) 점수, RCE 공격 경로, 영향 시스템, 패치 가이드, 탐지/대응 방안 포함

Kubernetes RBAC 취약점 - 클라우드 네이티브 보안 위협 심층 분석

Kubernetes Role-Based Access Control (RBAC)은 쿠버네티스 클러스터의 핵심 보안 제어 메커니즘입니다. 그러나 잘못된 구성, 과도한 권한 부여, 그리고 알려진 취약점으로 인해 침해자가 권한을 상승시키고 클러스터 전체를 장악할 수 있는 심각한 …

Supply Chain Attack - 소프트웨어 공급망 보안 위협과 대응 전략

소프트웨어 공급망 공격(Supply Chain Attack)은 공격자가 최종 소비자에게 도달하기 전에 제품이나 제품 배달 메커니즘을 조작하여 데이터나 시스템을 탈취하는 정교한 공격 방식입니다. 이 Deep Dive에서는 SolarWinds, Codecov, Kaseya, 3CX 등 실제 …

[CVE-2026-20122] Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability

CISA

[CVE-2026-20133] Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

CISA

[CVE-2025-2749] Kentico Xperience Path Traversal Vulnerability

CISA

[CVE-2023-27351] PaperCut NG/MF Improper Authentication Vulnerability

CISA

[CVE-2025-48700] Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

CISA

[CVE-2026-20128] Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability

CISA

[CVE-2025-32975] Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability

CISA

[CVE-2024-27199] JetBrains TeamCity Relative Path Traversal Vulnerability

CISA

CVE-2023-36424] Microsoft Windows Out-of-Bounds Read Vulnerability

CVE-2023-36424는 Microsoft Windows CLFS 드라이버의 권한 상승 취약점으로, 로컬 시스템 접근 권한이 있는 공격자가 악용 가능합니다.

CVE-2026-34621: Acrobat Prototype Pollution 취약점 메커니즘

CVE-2026-34621 취약점은 Adobe Acrobat과 Reader의 Prototype Pollution 오류로, 현재 악용 중인 Critical 레벨 보안 문제입니다. 악성 PDF 열면 원격 코드 실행 가능, 즉시 업데이트 필요.

CVE-2026-32201: SharePoint Input Validation 취약점 기술 분석

CVE-2026-32201 SharePoint Input Validation 취약점 분석. CVSS 6.5점, CISA KEV Catalog 등록, 즉시 패치 권장

Deep Dive: CVE-2020-9715 - Adobe Acrobat Use-After-Free 취약점

Adobe Acrobat과 Reader의 Use-After-Free 취약점 CVE-2020-9715에 대한 상세 분석. 조작된 PDF 파일을 통해 임의 코드 실행이 가능하며, CISA KEV 카탈로그에 포함되어 실제 악용이 확인됨.

CVE-2026-34040 분석

CVE-2026-34040: Docker AuthZ Plugin 우회 취약점 분석. 높은 위험 등급, 7일 이내 조치 필요. 원격 권한 상승 가능, 패치 버전 29.3.1 사용 권장.

[CVE-2026-34197] Apache ActiveMQ Improper Input Validation Vulnerability

CISA

CVE-2026-33032: Nginx UI Missing MCP Authentication

Rapid7

AI 위협 대응을 위한 보안 체계 재설계

AI 기반 위협의 급격한 진화와 공격 표면의 무한 확장에 대응하기 위한 보안 체계 재설계 방안을 제시합니다. AI 내부 통제 체계 구축, AI 기반 탐지 도구 도입, 자산 관리 강화, Zero …

CVE-2026-21643: FortiClient EMS 연결 제로데이 - 두 번째 인증 우회 취약점 심층 분석

Fortinet FortiClient EMS에서 연달아 발생한 두 개의 치명적 제로데이 취약점(CVE-2026-21643, CVE-2026-35616)을 심층 분석했다. 두 취약점 모두 CVSS 9.1 Critical 등급의 Pre-authentication 공격 벡터이며, 이스터 휴일을 노린 공격자의 전략적 타이밍과 패치 …

[CVE-2009-0238] Microsoft Office Remote Code Execution

CISA

[CVE-2026-32201] Microsoft SharePoint Server Improper Input Validation Vulnerability

CISA

[CVE-2012-1854] Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability

CISA

[CVE-2025-60710] Microsoft Windows Link Following Vulnerability

CISA

[CVE-2023-21529] Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability

CISA

[CVE-2023-36424] Microsoft Windows Out-of-Bounds Read Vulnerability

CISA

[CVE-2020-9715] Adobe Acrobat Use-After-Free Vulnerability

CISA

[CVE-2026-21643] Fortinet SQL Injection Vulnerability

CISA

[CVE-2026-34621] Adobe Acrobat and Reader Prototype Pollution Vulnerability

CISA

CVE-2026-1340: Ivanti Endpoint Manager Mobile (EPMM) 코드 인젝 취약점 심층 분석

Ivanti Endpoint Manager Mobile (EPMM)의 CVE-2026-1340 코드 인젝 취약점(CVSS 9.8 CRITICAL)에 대한 심층 분석. 취약점 개요, 기술적 세부사항, 영향 분석, 공격 시나리오, 즉시 대응 전략, 중장기 대응 방안, 벤치마크 등을 …

초국가적 AI 공격 시대, 기술 소유를 넘어선 신뢰 기반 보안이 디지털 패권 경쟁의 유일한 생존 전략이다.

2026-04-09 보안 인사이트

CVE-2026-3502: TrueConf Client Download of Code Without Integrity Check Vulnerability 심층 분석

CVE-2026-3502는 TrueConf Client의 업데이트 무결성 검사 결함으로 발생한 높은 위험도 취약점. Operation TrueChaos 캠페인을 통해 실제 악용되어 동남아시아 정부 기관 타겟팅. 2026-04-16까지 패치 필수.

CVE-2025-53521: F5 BIG-IP Stack-Based Buffer Overflow 심층 분석

F5 BIG-IP APM의 스택 기반 버퍼 오버플로우 취약점으로 원격 코드 실행이 가능합니다. CVSS 4.0 최상위 점수와 CISA KEV 포함으로 인해 즉각적인 패치가 필요합니다.

클라우드 네이티브 보안 - 쿠버네티스와 컨테이너 보안 취약점

2024-2025년 쿠버네티스와 컨테이너 보안 취약점에 대한 심층 분석으로 Critical 등급 2건, High 등급 4건의 취약점을 식별하고 대응 전략과 벤치마킹 사례를 제공합니다.

[CVE-2026-1340] Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability

CISA

FortiGate CVE-2025-59718 Exploitation: Incident Response Findings

Rapid7

CVE-2026-20093: Cisco IMC "Silicon-Snare" Critical Vulnerability 심층 분석

CVE-2026-20093 취약점 분석 보고서입니다. Cisco IMC 인증 우회 취약점으로, CVSS 점수 9.8입니다.

CVE-2026-35616: Fortinet FortiClient EMS "EMS-Evasion" 심층 분석

Fortinet FortiClient EMS에서 발견된 사전 인증 API 우회 취약점 CVE-2026-35616은 CVSS 9.1의 심각도로 평가되며, 인증 없이 원격 코드 실행이 가능한다. 이 취약점은 2026년 4월 4일에 공개되었으나, 이미 3월 31일부터 실제 …

CVE-2026-3055: Citrix NetScaler "SAML-BLEED" Memory Leak 심층 분석

CVE-2026-3055는 Citrix NetScaler SAML 인증 프로세스의 메모리 오버리드 취약점입니다. CVSS 9.3점의 Critical 등급으로, 단일 GET 요청으로 관리자 세션 ID 탈취가 가능하며 이미 실제 악용이 확인되었습니다. CISA 4월 2일 패치 마감이 …

Citrix ShareFile 취약점 - 인증되지 않은 RCE 사슬 공격

CVE-2024-43035/36/37 취약점 분석 보고서입니다. Citrix ShareFile StorageZones Controller의 3단계 공격 체인(세션 ID 우회 → XXE → RCE)으로 인증 없이 원격 코드 실행이 가능하며, CVSS 점수 9.8(Critical) 등급입니다. 실제 와일드 악용이 …

IoT 봇넷 해체 - Aisuru/Kimwolf/JackSkid/Mossad

Aisuru, Kimwolf, JackSkid, Mossad 4개 IoT 봇넷의 기술적 분석 완료. Mirai 기반 봇넷의 취약점 악용 패턴과 DDoS 공격 벡터 식별. 지리적 분포 및 향후 위협 예측 포함.

모바일 공격 표면 확대: Shadow AI와 Zero-Click 위협

모바일 기기에서의 Shadow AI와 Zero-Click 공격이 기업 보안에 미치는 심각한 위협을 분석하고, 대응 방안을 제시합니다.

[CVE-2026-35616] Fortinet FortiClient EMS Improper Access Control Vulnerability

CISA

CVE-2026-5281: Chrome Dawn(WebGPU) Use-After-Free 제로데이

SK쉴더스

주간 보안 동향 요약: 2026-03-29 ~ 2026-04-05

최근 7일간 발생한 주요 보안 취약점, 이슈, 위협 동향 요약. CVE-2026-5281, AI 기반 공격 산업화, Tycoon2FA 붕괴, NoVoice Android 악성코드 등 포함.

TrueConf Zero-Day 취약점 - 아시아 정부 공격 사례 분석

CVE-2026-3502는 TrueConf 클라이언트 애플리케이션의 업데이터 유효성 검사 메커니즘 결함으로 인해 발생하는 제로데이 취약점이다. CVSS 점수 7.8로 평가되며, 공격자가 온프레미스 TrueConf 서버를 제어할 경우 연결된 모든 엔드포인트에 임의의 파일을 배포하고 실행할 …

Ubuntu Snapd CVE-2026-3888: Snapd 사용자 권한 상승 취약점 심층 분석

Ubuntu Snapd CVE-2026-3888 취약점 분석 및 대응 전략

2026 Q1 제로데이 동향: 심층 분석

2026 Q1 제로데이 취약점 동향을 심층 분석한 보고서. 클라우드, 모바일, 엔터프라이즈 소프트웨어 분야의 주요 취약점과 기술적 분석, 대응 전략을 포함합니다.

Next.js 자격증명 유출 사고: CVE-2025-55182 React2Shell 대규모 침해 분석

2025년 12월, React Server Components (RSC)의 "Flight" 프로토콜에 존재하는 치명적인 원격 코드 실행 취약점인 **CVE-2025-55182** (React2Shell)이 악용되어 대규모 자격증명 유출 사고가 발생했습니다. 이 사고로 **766대의 Next.js 호스트**가 단 24시간 만에 …

AI 융합과 규제 강화로 전통 보안이 붕괴하는 시대, 논리적 방어와 설계 단계 거버넌스로 위기를 기회로 전환하는 생존 전략

2026-04-03 보안 인사이트

AI/IoT CCTV 사이버 위협 - 스마트 보안 장치의 악용 가능성과 대응 방안

최근 AI 및 IoT 기술이 CCTV 감시 시스템에 급속도로 통합되면서, 스마트 보안 장치는 새로운 사이버 보안 위협에 직면했습니다. 전통적인 CCTV 시스템이 단순한 녹화 장치였다면, 오늘날의 AI 기반 CCTV는 실시간 영상 …

CVE-2026-5281 - Google Chrome Use-After-Free 취약점

Google Chrome의 Use-After-Free 메모리 손상 취약점(CVE-2026-5281)에 대한 기술적 분석과 대응 전략

CVE-2026-28500 - ONNX 모델 로딩 함수의 설계적 결함, 제로 상호작용 공급망 공격 가능

CVE-2026-28500은 ONNX(Open Neural Network Exchange)의 `onnx.hub.load()` 함수에 존재하는 보안 제어 우회 취약점이다. `silent=True` 파라미터 사용 시 모든 신뢰 검증 경고와 확인 프롬프트가 억제되어, 사용자 인식 없이 검증되지 않은 리포지토리에서 모델 …

[CVE-2026-3502] TrueConf Client Download of Code Without Integrity Check Vulnerability

CISA

CVE-2026-33017 - Langflow 인증되지 않은 RCE, 공개 후 20시간 만에 악용되기 시작하다

CVE-2026-33017은 Langflow의 공개 플로우 빌드 엔드포인트에 존재하는 인증되지 않은 원격 코드 실행 취약점이다. 공개된 PoC 코드가 없었음에도 어드바이저리 설명만으로 공격자가 20시간 이내에 작동하는 익스플로잇을 구축하고 실제 환경에서 악용하기 시작했다. AI …

[CVE-2026-5281] Google Dawn Use-After-Free Vulnerability

CISA

[CVE-2026-3055] Citrix NetScaler Out-of-Bounds Read Vulnerability

CISA

OpenClaw 1-Click RCE 취약점 (CVE-2026-25253)

SK쉴더스

CVE-2026-33634 Trivy 악성코드 취약점과 공급망 보안

CVE-2026-33634는 Trivy 보안 스캐너를 타겟팅한 치명적 공급망 취약점입니다. 이 Deep Dive에서는 취약점 개요, 기술적 분석, 실무적 대응 전략, 벤치마킹 사례, CISO를 위한 인사이트를 다룹니다.

[CVE-2025-53521] F5 BIG-IP Stack-Based Buffer Overflow Vulnerability

CISA

[CVE-2026-33634] Aquasecurity Trivy Embedded Malicious Code Vulnerability

CISA

[CVE-2026-33017] Langflow Code Injection Vulnerability

CISA

CVE-2026-3055: Citrix NetScaler ADC and NetScaler Gateway Out-of-Bounds Read

Rapid7

[CVE-2025-32432] Craft CMS Code Injection Vulnerability

CISA

[CVE-2025-54068] Laravel Livewire Code Injection Vulnerability

CISA

[CVE-2025-43510] Apple Multiple Products Improper Locking Vulnerability

CISA

[CVE-2025-43520] Apple Multiple Products Classic Buffer Overflow Vulnerability

CISA

[CVE-2025-31277] Apple Multiple Products Buffer Overflow Vulnerability

CISA

CVE-2026-31381, CVE-2026-31382: Gainsight Assist Information Disclosure and Cross-Site Scripting (FIXED)

Rapid7

[CVE-2026-20131] Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability

CISA

[CVE-2025-66376] Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability

CISA

[CVE-2026-20963] Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

CISA

[CVE-2025-47813] Wing FTP Server Information Disclosure Vulnerability

CISA

[CVE-2026-3910] Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability

CISA

[CVE-2026-3909] Google Skia Out-of-Bounds Write Vulnerability

CISA

[CVE-2025-68613] n8n Improper Control of Dynamically-Managed Code Resources Vulnerability

CISA

[CVE-2021-22054] Omnissa Workspace ONE Server-Side Request Forgery

CISA

[CVE-2025-26399] SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

CISA

[CVE-2026-1603] Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability

CISA

[CVE-2017-7921] Hikvision Multiple Products Improper Authentication Vulnerability

CISA

[CVE-2021-22681] Rockwell Multiple Products Insufficient Protected Credentials Vulnerability

CISA

[CVE-2023-43000] Apple Multiple products Use-After-Free Vulnerability

CISA

[CVE-2021-30952] Apple Multiple Products Integer Overflow or Wraparound Vulnerability

CISA

[CVE-2023-41974] Apple iOS and iPadOS Use-After-Free Vulnerability

CISA

[CVE-2026-22719] Broadcom VMware Aria Operations Command Injection Vulnerability

CISA

[CVE-2026-21385] Qualcomm Multiple Chipsets Memory Corruption Vulnerability

CISA

라자루스의 RaaS 전환과 AI 오용이 알리는 사이버 위협의 실용주의 시대, 제로트러스트와 AI-SPM으로 무장한 방어 체계 재편 급물살

2026-02-26 보안 인사이트

[CVE-2022-20775] Cisco SD-WAN Path Traversal Vulnerability

CISA

[CVE-2026-20127] Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability

CISA

Critical Cisco Catalyst Vulnerability Exploited in the wild (CVE-2026-20127)

Rapid7

[CVE-2026-25108] Soliton Systems K.K FileZen OS Command Injection Vulnerability

CISA

[CVE-2025-49113] RoundCube Webmail Deserialization of Untrusted Data Vulnerability

CISA

[CVE-2025-68461] RoundCube Webmail Cross-site Scripting Vulnerability

CISA

[CVE-2021-22175] GitLab Server-Side Request Forgery (SSRF) Vulnerability

CISA

[CVE-2026-22769] Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability

CISA

[CVE-2020-7796] Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability

CISA

[CVE-2024-7694] TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type Vulnerability

CISA

[CVE-2008-0015] Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability

CISA

[CVE-2026-2441] Google Chromium CSS Use-After-Free Vulnerability

CISA

[CVE-2026-1731] BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability

CISA

[CVE-2026-20700] Apple Multiple Buffer Overflow Vulnerability

CISA

[CVE-2024-43468] Microsoft Configuration Manager SQL Injection Vulnerability

CISA

[CVE-2025-15556] Notepad++ Download of Code Without Integrity Check Vulnerability

CISA

[CVE-2025-40536] SolarWinds Web Help Desk Security Control Bypass Vulnerability

CISA

[CVE-2026-21513] Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability

CISA

[CVE-2026-21525] Microsoft Windows NULL Pointer Dereference Vulnerability

CISA

[CVE-2026-21510] Microsoft Windows Shell Protection Mechanism Failure Vulnerability

CISA

[CVE-2026-21533] Microsoft Windows Improper Privilege Management Vulnerability

CISA

[CVE-2026-21519] Microsoft Windows Type Confusion Vulnerability

CISA

[CVE-2026-21514] Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability

CISA

Vulnerability Found in InsightVM & Nexpose: CVE-2026-1814 (FIXED)

Rapid7

[CVE-2025-11953] React Native Community CLI OS Command Injection Vulnerability

CISA

[CVE-2026-24423] SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability

CISA

[CVE-2021-39935] GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability

CISA

[CVE-2025-64328] Sangoma FreePBX OS Command Injection Vulnerability

CISA

[CVE-2019-19006] Sangoma FreePBX Improper Authentication Vulnerability

CISA

[CVE-2025-40551] SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

CISA

[CVE-2026-1281] Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability

CISA

Multiple Critical SolarWinds Web Help Desk Vulnerabilities: CVE-2025-40551, CVE-2025-40552, CVE-2025-40553, CVE-2025-40554

Rapid7

[CVE-2026-24858] Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability

CISA

[CVE-2018-14634] Linux Kernel Integer Overflow Vulnerability

CISA

[CVE-2025-52691] SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability

CISA

[CVE-2026-23760] SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability

CISA

[CVE-2026-24061] GNU InetUtils Argument Injection Vulnerability

CISA

[CVE-2026-21509] Microsoft Office Security Feature Bypass Vulnerability

CISA

[CVE-2024-37079] Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability

CISA

[CVE-2025-68645] Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability

CISA

[CVE-2025-34026] Versa Concerto Improper Authentication Vulnerability

CISA

[CVE-2025-31125] Vite Vitejs Improper Access Control Vulnerability

CISA

[CVE-2025-54313] Prettier eslint-config-prettier Embedded Malicious Code Vulnerability

CISA

[CVE-2026-20045] Cisco Unified Communications Products Code Injection Vulnerability

CISA

[CVE-2026-20805] Microsoft Windows Information Disclosure Vulnerability

CISA

[CVE-2025-8110] Gogs Path Traversal Vulnerability

CISA

[CVE-2009-0556] Microsoft Office PowerPoint Code Injection Vulnerability

CISA

[CVE-2025-37164] Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability

CISA

Next.js middleware 우회 취약점(CVE-2025-29927)

SK쉴더스

Apache Struts2 원격 코드 실행 취약점(CVE-2023-50164)

SK쉴더스

ownCloud 정보 노출 및 인증 우회 취약점(CVE-2023-49103/ CVE-2023-49105)

SK쉴더스

Confluence Server 및 Data Center 원격코드 실행 취약점 (CVE-2022-26134)

SK쉴더스

Dirty Pipe 취약점(CVE-2022-0847)

SK쉴더스

CVE-2025-15070 | 지미션 WEB FAX 타 사용자 팩스 정보 노출 취약점

CVE-2025-15069 | 지미션 WEB FAX 사용자 정보 노출 및 권한 상승 취약점

CVE-2025-15068 | 지미션 WEB FAX 패스워드 강제 변경을 통한 계정 탈취 취약점

CVE-2025-15067 | 이노릭스 INNORIX WP 임의 파일 업로드 취약점

CVE-2025-15066 | 이노릭스 INNORIX WP 임의 파일 다운로드 취약점

CVE-2025-15065 | 킹스정보통신 KESS 정보 노출 및 보안 기능 우회 취약점

[CVE-2025-14847] MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability

CISA

[CVE-2023-52163] Digiever DS-2105 Pro Missing Authorization Vulnerability

CISA

[CVE-2025-14733] WatchGuard Firebox Out of Bounds Write Vulnerability

CISA

CVE-2025-37164: Critical unauthenticated RCE affecting Hewlett Packard Enterprise OneView

Rapid7

[CVE-2025-59374] ASUS Live Update Embedded Malicious Code Vulnerability

CISA

[CVE-2025-40602] SonicWall SMA1000 Missing Authorization Vulnerability

CISA

[CVE-2025-20393] Cisco Multiple Products Improper Input Validation Vulnerability

CISA

Critical vulnerabilities in Fortinet CVE-2025-59718, CVE-2025-59719, CVE-2026-24858 exploited in the wild

Rapid7

[CVE-2025-59718] Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability

CISA

[CVE-2025-14611] Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability

CISA

[CVE-2025-43529] Apple Multiple Products Use-After-Free WebKit Vulnerability

CISA

[CVE-2018-4063] Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability

CISA

[CVE-2025-14174] Google Chromium Out of Bounds Memory Access Vulnerability

CISA

[CVE-2025-58360] OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability

CISA

[CVE-2025-6218] RARLAB WinRAR Path Traversal Vulnerability

CISA

[CVE-2025-62221] Microsoft Windows Use After Free Vulnerability

CISA

CVE-2025-10573: Ivanti EPM Unauthenticated Stored Cross-Site Scripting (Fixed)

Rapid7

[CVE-2022-37055] D-Link Routers Buffer Overflow Vulnerability

CISA

[CVE-2025-66644] Array Networks ArrayOS AG OS Command Injection Vulnerability

CISA

[CVE-2025-55182] Meta React Server Components Remote Code Execution Vulnerability

CISA

React2Shell (CVE-2025-55182) - Critical unauthenticated RCE affecting React Server Components

Rapid7

[CVE-2021-26828] OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability

CISA

[CVE-2025-48633] Android Framework Information Disclosure Vulnerability

CISA

[CVE-2025-48572] Android Framework Privilege Escalation Vulnerability

CISA

[CVE-2021-26829] OpenPLC ScadaBR Cross-site Scripting Vulnerability

CISA

[CVE-2025-61757] Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability

CISA

[CVE-2025-13223] Google Chromium V8 Type Confusion Vulnerability

CISA

CVE-2025-13315, CVE-2025-13316: Critical Twonky Server Authentication Bypass (NOT FIXED)

Rapid7

[CVE-2025-58034] Fortinet FortiWeb OS Command Injection Vulnerability

CISA

[CVE-2025-64446] Fortinet FortiWeb Path Traversal Vulnerability

CISA

CVE-2025-64446: Critical Vulnerability in Fortinet FortiWeb Exploited in the Wild

Rapid7

[CVE-2025-12480] Gladinet Triofox Improper Access Control Vulnerability

CISA

[CVE-2025-62215] Microsoft Windows Race Condition Vulnerability

CISA

[CVE-2025-9242] WatchGuard Firebox Out-of-Bounds Write Vulnerability

CISA

[CVE-2025-21042] Samsung Mobile Devices Out-of-Bounds Write Vulnerability

CISA

[CVE-2025-48703] CWP Control Web Panel OS Command Injection Vulnerability

CISA

[CVE-2025-11371] Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability

CISA

[CVE-2025-41244] Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability

CISA

[CVE-2025-24893] XWiki Platform Eval Injection Vulnerability

CISA

[CVE-2025-6204] Dassault Systèmes DELMIA Apriso Code Injection Vulnerability

CISA

[CVE-2025-6205] Dassault Systèmes DELMIA Apriso Missing Authorization Vulnerability

CISA

[CVE-2025-54236] Adobe Commerce and Magento Improper Input Validation Vulnerability

CISA

[CVE-2025-59287] Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability

CISA

[CVE-2025-61932] Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability

CISA

[CVE-2022-48503] Apple Multiple Products Unspecified Vulnerability

CISA

[CVE-2025-2746] Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability

CISA

[CVE-2025-2747] Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability

CISA

[CVE-2025-33073] Microsoft Windows SMB Client Improper Access Control Vulnerability

CISA

[CVE-2025-61884] Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability

CISA

[CVE-2025-54253] Adobe Experience Manager Forms Code Execution Vulnerability

CISA

[CVE-2025-47827] IGEL OS Use of a Key Past its Expiration Date Vulnerability

CISA

[CVE-2025-24990] Microsoft Windows Untrusted Pointer Dereference Vulnerability

CISA

[CVE-2025-59230] Microsoft Windows Improper Access Control Vulnerability

CISA

[CVE-2016-7836] SKYSEA Client View Improper Authentication Vulnerability

CISA

CVE-2025-11221 | 지티원 ChangeFlow 원격 명령 실행 취약점

CVE-2025-11182 | 지티원 ChangeFlow 임의 파일 다운로드 취약점

CVE-2025-11020 | 마크애니 SafePC 원격 명령 실행 취약점

[CVE-2021-43798] Grafana Path Traversal Vulnerability

CISA

[CVE-2025-27915] Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

CISA

[CVE-2021-22555] Linux Kernel Heap Out-of-Bounds Write Vulnerability

CISA

[CVE-2010-3962] Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability

CISA

[CVE-2021-43226] Microsoft Windows Privilege Escalation Vulnerability

CISA

[CVE-2013-3918] Microsoft Windows Out-of-Bounds Write Vulnerability

CISA

[CVE-2011-3402] Microsoft Windows Remote Code Execution Vulnerability

CISA

[CVE-2010-3765] Mozilla Multiple Products Remote Code Execution Vulnerability

CISA

[CVE-2025-61882] Oracle E-Business Suite Unspecified Vulnerability

CISA

CVE-2025-61882: Critical 0day in Oracle E-Business Suite exploited in-the-wild

Rapid7

[CVE-2014-6278] GNU Bash OS Command Injection Vulnerability

CISA

[CVE-2017-1000353] Jenkins Remote Code Execution Vulnerability

CISA

[CVE-2015-7755] Juniper ScreenOS Improper Authentication Vulnerability

CISA

[CVE-2025-21043] Samsung Mobile Devices Out-of-Bounds Write Vulnerability

CISA

[CVE-2025-4008] Smartbedded Meteobridge Command Injection Vulnerability

CISA

[CVE-2025-32463] Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability

CISA

[CVE-2025-59689] Libraesva Email Security Gateway Command Injection Vulnerability

CISA

[CVE-2025-10035] Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability

CISA

[CVE-2025-20352] Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability

CISA

[CVE-2021-21311] Adminer Server-Side Request Forgery Vulnerability

CISA

[CVE-2025-20362] Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability

CISA

[CVE-2025-20333] Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability

CISA

[CVE-2025-10585] Google Chromium V8 Type Confusion Vulnerability

CISA

CVE-2025-10184: OnePlus OxygenOS Telephony provider permission bypass (FIXED as of October 11, 2025)

Rapid7

CVE-2025-10035 - Critical unauthenticated RCE in GoAnywhere MFT

Rapid7

[CVE-2025-5086] Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability

CISA

[CVE-2025-38352] Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition Vulnerability

CISA

[CVE-2025-48543] Android Runtime Use-After-Free Vulnerability

CISA

[CVE-2025-53690] Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability

CISA

[CVE-2023-50224] TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability

CISA

[CVE-2025-9377] TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability

CISA

[CVE-2020-24363] TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability

CISA

[CVE-2025-55177] Meta Platforms WhatsApp Incorrect Authorization Vulnerability

CISA

[CVE-2025-57819] Sangoma FreePBX Authentication Bypass Vulnerability

CISA

CVE-2025-7775: Critical NetScaler vulnerability exploited in-the-wild

Rapid7

[CVE-2025-7775] Citrix NetScaler Memory Overflow Vulnerability

CISA

[CVE-2025-48384] Git Link Following Vulnerability

CISA

[CVE-2024-8068] Citrix Session Recording Improper Privilege Management Vulnerability

CISA

[CVE-2024-8069] Citrix Session Recording Deserialization of Untrusted Data Vulnerability

CISA

[CVE-2025-43300] Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability

CISA

[CVE-2025-54948] Trend Micro Apex One OS Command Injection Vulnerability

CISA

[CVE-2025-8876] N-able N-Central Command Injection Vulnerability

CISA

[CVE-2025-8875] N-able N-Central Insecure Deserialization Vulnerability

CISA

[CVE-2025-8088] RARLAB WinRAR Path Traversal Vulnerability

CISA

[CVE-2007-0671] Microsoft Office Excel Remote Code Execution Vulnerability

CISA

[CVE-2013-3893] Microsoft Internet Explorer Resource Management Errors Vulnerability

CISA

[CVE-2020-25078] D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability

CISA

[CVE-2020-25079] D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability

CISA

[CVE-2022-40799] D-Link DNR-322L Download of Code Without Integrity Check Vulnerability

CISA

[CVE-2023-2533] PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability

CISA

[CVE-2025-20337] Cisco Identity Services Engine Injection Vulnerability

CISA

[CVE-2025-20281] Cisco Identity Services Engine Injection Vulnerability

CISA

[CVE-2025-2775] SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability

CISA

[CVE-2025-2776] SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability

CISA

[CVE-2025-6558] Google Chromium ANGLE and GPU Improper Input Validation Vulnerability

CISA

[CVE-2025-54309] CrushFTP Unprotected Alternate Channel Vulnerability

CISA

[CVE-2025-49704] Microsoft SharePoint Code Injection Vulnerability

CISA

[CVE-2025-49706] Microsoft SharePoint Improper Authentication Vulnerability

CISA

CVE-2025-53770 - Zero-day exploitation in the wild of Microsoft SharePoint servers

Rapid7

[CVE-2025-53770] Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

CISA

[CVE-2025-25257] Fortinet FortiWeb SQL Injection Vulnerability

CISA

CVE-2025-54309: CrushFTP Zero-Day Exploited in the Wild

Rapid7

CVE-2025-7672 | 지란지교소프트 CrossEditor4 취약점

CVE-2025-3621 | 프로티앤에스(ProTNS) ActADUR 취약점

[CVE-2025-47812] Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability

CISA

[CVE-2025-5777] Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability

CISA

CVE-2025-6759: Citrix Virtual Apps and Desktops - Local Privilege Escalation (FIXED)

Rapid7

[CVE-2019-9621] Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability

CISA

[CVE-2019-5418] Rails Ruby on Rails Path Traversal Vulnerability

CISA

[CVE-2016-10033] PHPMailer Command Injection Vulnerability

CISA

[CVE-2014-3931] Multi-Router Looking Glass (MRLG) Buffer Overflow Vulnerability

CISA

[CVE-2025-6554] Google Chromium V8 Type Confusion Vulnerability

CISA

[CVE-2025-48928] TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability

CISA

[CVE-2025-48927] TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability

CISA

[CVE-2025-6543] Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability

CISA

CVE-2025-6543: Zero Day Exploitation of NetScaler ADC and NetScaler Gateway

Rapid7

[CVE-2019-6693] Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability

CISA

[CVE-2024-0769] D-Link DIR-859 Router Path Traversal Vulnerability

CISA

[CVE-2024-54085] AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability

CISA

CVE-2025-4365/CVE-2024-12284: NetScaler Console/SDX Authenticated Arbitrary File Read/Write (FIXED)

Rapid7

[CVE-2023-0386] Linux Kernel Improper Ownership Management Vulnerability

CISA

Critical Veeam Backup & Replication CVE-2025-23121

Rapid7

[CVE-2023-33538] TP-Link Multiple Routers Command Injection Vulnerability

CISA

[CVE-2025-43200] Apple Multiple Products Unspecified Vulnerability

CISA

[CVE-2025-33053] Microsoft Windows External Control of File Name or Path Vulnerability

CISA

[CVE-2025-24016] Wazuh Server Deserialization of Untrusted Data Vulnerability

CISA

[CVE-2024-42009] RoundCube Webmail Cross-Site Scripting Vulnerability

CISA

[CVE-2025-32433] Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability

CISA

[CVE-2025-5419] Google Chromium V8 Out-of-Bounds Read and Write Vulnerability

CISA

[CVE-2025-21479] Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability

CISA

[CVE-2025-21480] Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability

CISA

[CVE-2025-27038] Qualcomm Multiple Chipsets Use-After-Free Vulnerability

CISA

[CVE-2021-32030] ASUS Routers Improper Authentication Vulnerability

CISA

[CVE-2025-3935] ConnectWise ScreenConnect Improper Authentication Vulnerability

CISA

[CVE-2025-35939] Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability

CISA

[CVE-2024-56145] Craft CMS Code Injection Vulnerability

CISA

[CVE-2023-39780] ASUS RT-AX55 Routers OS Command Injection Vulnerability

CISA

[CVE-2025-4632] Samsung MagicINFO 9 Server Path Traversal Vulnerability

CISA

[CVE-2023-38950] ZKTeco BioTime Path Traversal Vulnerability

CISA

[CVE-2024-27443] Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

CISA

[CVE-2025-27920] Srimax Output Messenger Directory Traversal Vulnerability

CISA

[CVE-2024-11182] MDaemon Email Server Cross-Site Scripting (XSS) Vulnerability

CISA

[CVE-2025-4428] Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability

CISA

[CVE-2025-4427] Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability

CISA

[CVE-2025-42999] SAP NetWeaver Deserialization Vulnerability

CISA

[CVE-2024-12987] DrayTek Vigor Routers OS Command Injection Vulnerability

CISA

[CVE-2025-32756] Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability

CISA

CVE-2025-32756 Exploited in the Wild, Affecting Multiple Fortinet Products

Rapid7

[CVE-2025-32709] Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability

CISA

[CVE-2025-30397] Microsoft Windows Scripting Engine Type Confusion Vulnerability

CISA

[CVE-2025-32706] Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability

CISA

[CVE-2025-32701] Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability

CISA

[CVE-2025-30400] Microsoft Windows DWM Core Library Use-After-Free Vulnerability

CISA

[CVE-2025-47729] TeleMessage TM SGNL Hidden Functionality Vulnerability

CISA

[CVE-2024-11120] GeoVision Devices OS Command Injection Vulnerability

CISA

[CVE-2024-6047] GeoVision Devices OS Command Injection Vulnerability

CISA

[CVE-2025-27363] FreeType Out-of-Bounds Write Vulnerability

CISA

[CVE-2025-3248] Langflow Missing Authentication Vulnerability

CISA

[CVE-2025-34028] Commvault Command Center Path Traversal Vulnerability

CISA

[CVE-2024-58136] Yiiframework Yii Improper Protection of Alternate Path Vulnerability

CISA

[CVE-2024-38475] Apache HTTP Server Improper Escaping of Output Vulnerability

CISA

[CVE-2023-44221] SonicWall SMA100 Appliances OS Command Injection Vulnerability

CISA

[CVE-2025-31324] SAP NetWeaver Unrestricted File Upload Vulnerability

CISA

[CVE-2025-1976] Broadcom Brocade Fabric OS Code Injection Vulnerability

CISA

[CVE-2025-42599] Qualitia Active! Mail Stack-Based Buffer Overflow Vulnerability

CISA

[CVE-2025-3928] Commvault Web Server Unspecified Vulnerability

CISA

Active exploitation of SAP NetWeaver Visual Composer CVE-2025-31324

Rapid7

[CVE-2025-24054] Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability

CISA

[CVE-2025-31201] Apple Multiple Products Arbitrary Read and Write Vulnerability

CISA

[CVE-2025-31200] Apple Multiple Products Memory Corruption Vulnerability

CISA

[CVE-2021-20035] SonicWall SMA100 Appliances OS Command Injection Vulnerability

CISA

Following the News: MITRE’s Common Vulnerabilities and Exposures (CVE) Funding

Rapid7

[CVE-2024-53150] Linux Kernel Out-of-Bounds Read Vulnerability

CISA

[CVE-2024-53197] Linux Kernel Out-of-Bounds Access Vulnerability

CISA

[CVE-2025-29824] Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability

CISA

[CVE-2025-30406] Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability

CISA

CVE-2024-11071 | 사이버다임 DestinyECM 취약점

[CVE-2025-31161] CrushFTP Authentication Bypass Vulnerability

CISA

[CVE-2025-22457] Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability

CISA

Ivanti Connect Secure CVE-2025-22457 exploited in the wild

Rapid7

[CVE-2025-24813] Apache Tomcat Path Equivalence Vulnerability

CISA

[CVE-2024-20439] Cisco Smart Licensing Utility Static Credential Vulnerability

CISA

[CVE-2025-2783] Google Chromium Mojo Sandbox Escape Vulnerability

CISA

[CVE-2019-9875] Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability

CISA

[CVE-2019-9874] Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability

CISA

Notable vulnerabilities in Next.js (CVE-2025-29927) and CrushFTP

Rapid7

[CVE-2025-30154] reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability

CISA

[CVE-2017-12637] SAP NetWeaver Directory Traversal Vulnerability

CISA

[CVE-2024-48248] NAKIVO Backup and Replication Absolute Path Traversal Vulnerability

CISA

[CVE-2025-1316] Edimax IC-7100 IP Camera OS Command Injection Vulnerability

CISA

Critical Veeam Backup & Replication CVE-2025-23120

Rapid7

Apache Tomcat CVE-2025-24813: What You Need to Know

Rapid7

[CVE-2025-30066] tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability

CISA

[CVE-2025-24472] Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

CISA

[CVE-2025-21590] Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability

CISA

[CVE-2025-24201] Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability

CISA

[CVE-2025-24993] Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability

CISA

[CVE-2025-24991] Microsoft Windows NTFS Out-Of-Bounds Read Vulnerability

CISA

[CVE-2025-24985] Microsoft Windows Fast FAT File System Driver Integer Overflow Vulnerability

CISA

[CVE-2025-24984] Microsoft Windows NTFS Information Disclosure Vulnerability

CISA

[CVE-2025-24983] Microsoft Windows Win32k Use-After-Free Vulnerability

CISA

[CVE-2025-26633] Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability

CISA

[CVE-2024-13161] Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability

CISA

[CVE-2024-13160] Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability

CISA

[CVE-2024-13159] Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability

CISA

[CVE-2024-57968] Advantive VeraCore Unrestricted File Upload Vulnerability

CISA

[CVE-2025-25181] Advantive VeraCore SQL Injection Vulnerability

CISA

[CVE-2025-22226] VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability

CISA

[CVE-2025-22225] VMware ESXi Arbitrary Write Vulnerability

CISA

[CVE-2025-22224] VMware ESXi and Workstation TOCTOU Race Condition Vulnerability

CISA

[CVE-2024-50302] Linux Kernel Use of Uninitialized Resource Vulnerability

CISA

[CVE-2024-4885] Progress WhatsUp Gold Path Traversal Vulnerability

CISA

[CVE-2018-8639] Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability

CISA

[CVE-2022-43769] Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability

CISA

[CVE-2022-43939] Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability

CISA

[CVE-2023-20118] Cisco Small Business RV Series Routers Command Injection Vulnerability

CISA

[CVE-2023-34192] Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

CISA

[CVE-2024-49035] Microsoft Partner Center Improper Access Control Vulnerability

CISA

[CVE-2024-20953] Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability

CISA

[CVE-2017-3066] Adobe ColdFusion Deserialization Vulnerability

CISA

[CVE-2025-24989] Microsoft Power Pages Improper Access Control Vulnerability

CISA

[CVE-2025-0111] Palo Alto Networks PAN-OS File Read Vulnerability

CISA

[CVE-2025-23209] Craft CMS Code Injection Vulnerability

CISA

Rapid7 Fills Gaps in the CVE Assessment Process with AI-Generated Vulnerability Scoring in Exposure Command

Rapid7

[CVE-2025-0108] Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

CISA

[CVE-2024-53704] SonicWall SonicOS SSLVPN Improper Authentication Vulnerability

CISA

[CVE-2024-57727] SimpleHelp Path Traversal Vulnerability

CISA

CVE-2025-1094: PostgreSQL psql SQL injection (FIXED)

Rapid7

[CVE-2025-24200] Apple iOS and iPadOS Incorrect Authorization Vulnerability

CISA

[CVE-2024-41710] Mitel SIP Phones Argument Injection Vulnerability

CISA

[CVE-2024-40891] Zyxel DSL CPE OS Command Injection Vulnerability

CISA

[CVE-2024-40890] Zyxel DSL CPE OS Command Injection Vulnerability

CISA

[CVE-2025-21418] Microsoft Windows Ancillary Function Driver for WinSock Heap-Based Buffer Overflow Vulnerability

CISA

[CVE-2025-21391] Microsoft Windows Storage Link Following Vulnerability

CISA

[CVE-2025-0994] Trimble Cityworks Deserialization Vulnerability

CISA

[CVE-2020-15069] Sophos XG Firewall Buffer Overflow Vulnerability

CISA

[CVE-2020-29574] CyberoamOS (CROS) SQL Injection Vulnerability

CISA

[CVE-2024-21413] Microsoft Outlook Improper Input Validation Vulnerability

CISA

[CVE-2022-23748] Dante Discovery Process Control Vulnerability

CISA

[CVE-2025-0411] 7-Zip Mark of the Web Bypass Vulnerability

CISA

[CVE-2024-53104] Linux Kernel Out-of-Bounds Write Vulnerability

CISA

[CVE-2018-19410] Paessler PRTG Network Monitor Local File Inclusion Vulnerability

CISA

[CVE-2018-9276] Paessler PRTG Network Monitor OS Command Injection Vulnerability

CISA

[CVE-2024-29059] Microsoft .NET Framework Information Disclosure Vulnerability

CISA

[CVE-2024-45195] Apache OFBiz Forced Browsing Vulnerability

CISA

[CVE-2025-24085] Apple Multiple Products Use-After-Free Vulnerability

CISA

[CVE-2025-23006] SonicWall SMA1000 Appliances Deserialization Vulnerability

CISA

[CVE-2020-11023] JQuery Cross-Site Scripting (XSS) Vulnerability

CISA

[CVE-2024-50603] Aviatrix Controllers OS Command Injection Vulnerability

CISA

[CVE-2025-21335] Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability

CISA

[CVE-2025-21334] Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability

CISA

[CVE-2025-21333] Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow Vulnerability

CISA

[CVE-2024-55591] Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

CISA

[CVE-2023-48365] Qlik Sense HTTP Tunneling Vulnerability

CISA

[CVE-2024-12686] BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection Vulnerability

CISA

[CVE-2025-0282] Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability

CISA

CVE-2025-0282: Ivanti Connect Secure Zero-Day Exploited in the Wild

Rapid7

[CVE-2020-2883] Oracle WebLogic Server Unspecified Vulnerability

CISA

[CVE-2024-55550] Mitel MiCollab Path Traversal Vulnerability

CISA

[CVE-2024-41713] Mitel MiCollab Path Traversal Vulnerability

CISA

[CVE-2024-3393] Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability

CISA

[CVE-2021-44207] Acclaim Systems USAHERDS Use of Hard-Coded Credentials Vulnerability

CISA

[CVE-2024-12356] BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability

CISA

[CVE-2021-40407] Reolink RLC-410W IP Camera OS Command Injection Vulnerability

CISA

[CVE-2019-11001] Reolink Multiple IP Cameras OS Command Injection Vulnerability

CISA

[CVE-2022-23227] NUUO NVRmini2 Devices Missing Authentication Vulnerability

CISA

[CVE-2018-14933] NUUO NVRmini Devices OS Command Injection Vulnerability

CISA

[CVE-2024-55956] Cleo Multiple Products Unauthenticated File Upload Vulnerability

CISA

[CVE-2024-35250] Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability

CISA

[CVE-2024-20767] Adobe ColdFusion Improper Access Control Vulnerability

CISA

[CVE-2024-50623] Cleo Multiple Products Unrestricted File Upload Vulnerability

CISA

[CVE-2024-49138] Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability

CISA

Widespread Exploitation of Cleo File Transfer Software (CVE-2024-55956)

Rapid7

[CVE-2024-51378] CyberPanel Incorrect Default Permissions Vulnerability

CISA

[CVE-2024-11667] Zyxel Multiple Firewalls Path Traversal Vulnerability

CISA

[CVE-2024-11680] ProjectSend Improper Authentication Vulnerability

CISA

[CVE-2023-45727] North Grid Proself Improper Restriction of XML External Entity (XXE) Reference Vulnerability

CISA

[CVE-2023-28461] Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability

CISA

[CVE-2024-21287] Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability

CISA

[CVE-2024-44309] Apple Multiple Products Cross-Site Scripting (XSS) Vulnerability

CISA

[CVE-2024-44308] Apple Multiple Products Code Execution Vulnerability

CISA

[CVE-2024-38813] VMware vCenter Server Privilege Escalation Vulnerability

CISA

[CVE-2024-38812] VMware vCenter Server Heap-Based Buffer Overflow Vulnerability

CISA

[CVE-2024-9474] Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability

CISA

[CVE-2024-0012] Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability

CISA

[CVE-2024-1212] Progress Kemp LoadMaster OS Command Injection Vulnerability

CISA

[CVE-2024-9465] Palo Alto Networks Expedition SQL Injection Vulnerability

CISA

[CVE-2024-9463] Palo Alto Networks Expedition OS Command Injection Vulnerability

CISA

[CVE-2021-26086] Atlassian Jira Server and Data Center Path Traversal Vulnerability

CISA

[CVE-2014-2120] Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability

CISA

[CVE-2021-41277] Metabase GeoJSON API Local File Inclusion Vulnerability

CISA

[CVE-2024-43451] Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability

CISA

[CVE-2024-49039] Microsoft Windows Task Scheduler Privilege Escalation Vulnerability

CISA

[CVE-2019-16278] Nostromo nhttpd Directory Traversal Vulnerability

CISA

[CVE-2024-51567] CyberPanel Incorrect Default Permissions Vulnerability

CISA

[CVE-2024-43093] Android Framework Privilege Escalation Vulnerability

CISA

[CVE-2024-5910] Palo Alto Networks Expedition Missing Authentication Vulnerability

CISA

[CVE-2024-8956] PTZOptics PT30X-SDI/NDI Cameras Authentication Bypass Vulnerability

CISA

[CVE-2024-8957] PTZOptics PT30X-SDI/NDI Cameras OS Command Injection Vulnerability

CISA

[CVE-2024-37383] RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability

CISA

[CVE-2024-20481] Cisco ASA and FTD Denial-of-Service Vulnerability

CISA

[CVE-2024-47575] Fortinet FortiManager Missing Authentication Vulnerability

CISA

Fortinet FortiManager CVE-2024-47575 Exploited in Zero-Day Attacks

Rapid7

[CVE-2024-38094] Microsoft SharePoint Deserialization Vulnerability

CISA

[CVE-2024-9537] ScienceLogic SL1 Unspecified Vulnerability

CISA

[CVE-2024-40711] Veeam Backup and Replication Deserialization Vulnerability

CISA

[CVE-2024-28987] SolarWinds Web Help Desk Hardcoded Credential Vulnerability

CISA

[CVE-2024-9680] Mozilla Firefox Use-After-Free Vulnerability

CISA

[CVE-2024-30088] Microsoft Windows Kernel TOCTOU Race Condition Vulnerability

CISA

[CVE-2024-9380] Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability

CISA

[CVE-2024-9379] Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability

CISA

[CVE-2024-23113] Fortinet Multiple Products Format String Vulnerability

CISA

[CVE-2024-43573] Microsoft Windows MSHTML Platform Spoofing Vulnerability

CISA

[CVE-2024-43572] Microsoft Windows Management Console Remote Code Execution Vulnerability

CISA

[CVE-2024-43047] Qualcomm Multiple Chipsets Use-After-Free Vulnerability

CISA

[CVE-2024-45519] Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability

CISA

[CVE-2024-29824] Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability

CISA

[CVE-2019-0344] SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability

CISA

[CVE-2020-15415] DrayTek Multiple Vigor Routers OS Command Injection Vulnerability

CISA

[CVE-2023-25280] D-Link DIR-820 Router OS Command Injection Vulnerability

CISA

KARA 랜섬웨어 동향 보고서로 알아보는 RansomHub 그룹 심층분석, 랜섬웨어 대응을 위한 MDR 서비스는? (CVE-2020-1472 취약점)

SK쉴더스

[CVE-2024-7593] Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability

CISA

[CVE-2024-8963] Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability

CISA

[CVE-2020-14644] Oracle WebLogic Server Remote Code Execution Vulnerability

CISA

[CVE-2022-21445] Oracle ADF Faces Deserialization of Untrusted Data Vulnerability

CISA

[CVE-2020-0618] Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability

CISA

[CVE-2024-27348] Apache HugeGraph-Server Improper Access Control Vulnerability

CISA

[CVE-2014-0502] Adobe Flash Player Double Free Vulnerablity

CISA

[CVE-2013-0648] Adobe Flash Player Code Execution Vulnerability

CISA

[CVE-2013-0643] Adobe Flash Player Incorrect Default Permissions Vulnerability

CISA

[CVE-2014-0497] Adobe Flash Player Integer Underflow Vulnerablity

CISA

[CVE-2024-6670] Progress WhatsUp Gold SQL Injection Vulnerability

CISA

[CVE-2024-43461] Microsoft Windows MSHTML Platform Spoofing Vulnerability

CISA

[CVE-2024-8190] Ivanti Cloud Services Appliance OS Command Injection Vulnerability

CISA

[CVE-2024-38217] Microsoft Windows Mark of the Web (MOTW) Protection Mechanism Failure Vulnerability

CISA

[CVE-2024-38014] Microsoft Windows Installer Improper Privilege Management Vulnerability

CISA

[CVE-2024-38226] Microsoft Publisher Protection Mechanism Failure Vulnerability

CISA

[CVE-2024-40766] SonicWall SonicOS Improper Access Control Vulnerability

CISA

[CVE-2017-1000253] Linux Kernel PIE Stack Buffer Corruption Vulnerability

CISA

[CVE-2016-3714] ImageMagick Improper Input Validation Vulnerability

CISA

CVE-2024-40766: Critical Improper Access Control Vulnerability Affecting SonicWall Devices

Rapid7

CVE-2024-45195: Apache OFBiz Unauthenticated Remote Code Execution (Fixed)

Rapid7

[CVE-2024-7262] Kingsoft WPS Office Path Traversal Vulnerability

CISA

[CVE-2021-20124] Draytek VigorConnect Path Traversal Vulnerability

CISA

[CVE-2021-20123] Draytek VigorConnect Path Traversal Vulnerability

CISA

[CVE-2024-7965] Google Chromium V8 Inappropriate Implementation Vulnerability

CISA

[CVE-2024-38856] Apache OFBiz Incorrect Authorization Vulnerability

CISA

[CVE-2024-7971] Google Chromium V8 Type Confusion Vulnerability

CISA

[CVE-2024-39717] Versa Director Dangerous File Type Upload Vulnerability

CISA

[CVE-2021-31196] Microsoft Exchange Server Information Disclosure Vulnerability

CISA

[CVE-2022-0185] Linux Kernel Heap-Based Buffer Overflow Vulnerability

CISA

[CVE-2021-33045] Dahua IP Camera Authentication Bypass Vulnerability

CISA

[CVE-2021-33044] Dahua IP Camera Authentication Bypass Vulnerability

CISA

[CVE-2024-23897] Jenkins Command Line Interface (CLI) Path Traversal Vulnerability

CISA

[CVE-2024-28986] SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

CISA

[CVE-2024-38107] Microsoft Windows Power Dependency Coordinator Privilege Escalation Vulnerability

CISA

[CVE-2024-38106] Microsoft Windows Kernel Privilege Escalation Vulnerability

CISA

[CVE-2024-38193] Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation Vulnerability

CISA

[CVE-2024-38213] Microsoft Windows SmartScreen Security Feature Bypass Vulnerability

CISA

[CVE-2024-38178] Microsoft Windows Scripting Engine Memory Corruption Vulnerability

CISA

[CVE-2024-38189] Microsoft Project Remote Code Execution Vulnerability

CISA

[CVE-2024-32113] Apache OFBiz Path Traversal Vulnerability

CISA

[CVE-2024-36971] Android Kernel Remote Code Execution Vulnerability

CISA

[CVE-2018-0824] Microsoft COM for Windows Deserialization of Untrusted Data Vulnerability

CISA

[CVE-2024-37085] VMware ESXi Authentication Bypass Vulnerability

CISA

VMware ESXi CVE-2024-37085 Targeted in Ransomware Campaigns

Rapid7

[CVE-2023-45249] Acronis Cyber Infrastructure (ACI) Insecure Default Password Vulnerability

CISA

[CVE-2024-5217] ServiceNow Incomplete List of Disallowed Inputs Vulnerability

CISA

[CVE-2024-4879] ServiceNow Improper Input Validation Vulnerability

CISA

CVE-2024-6922: Automation Anywhere Automation 360 Server-Side Request Forgery

Rapid7

[CVE-2024-39891] Twilio Authy Information Disclosure Vulnerability

CISA

[CVE-2012-4792] Microsoft Internet Explorer Use-After-Free Vulnerability

CISA

[CVE-2022-22948] VMware vCenter Server Incorrect Default File Permissions Vulnerability

CISA

[CVE-2024-28995] SolarWinds Serv-U Path Traversal Vulnerability

CISA

[CVE-2024-34102] Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability

CISA

[CVE-2024-36401] OSGeo GeoServer GeoTools Eval Injection Vulnerability

CISA

[CVE-2024-23692] Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability

CISA

[CVE-2024-38080] Microsoft Windows Hyper-V Privilege Escalation Vulnerability

CISA

[CVE-2024-38112] Microsoft Windows MSHTML Platform Spoofing Vulnerability

CISA

[CVE-2024-20399] Cisco NX-OS Command Injection Vulnerability

CISA

[CVE-2020-13965] Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability

CISA

[CVE-2022-2586] Linux Kernel Use-After-Free Vulnerability

CISA

[CVE-2022-24816] OSGeo GeoServer JAI-EXT Code Injection Vulnerability

CISA

[CVE-2024-4358] Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability

CISA

[CVE-2024-26169] Microsoft Windows Error Reporting Service Improper Privilege Management Vulnerability

CISA

[CVE-2024-32896] Android Pixel Privilege Escalation Vulnerability

CISA

[CVE-2024-4577] PHP-CGI OS Command Injection Vulnerability

CISA

[CVE-2024-4610] Arm Mali GPU Kernel Driver Use-After-Free Vulnerability

CISA

CVE-2024-28995: Trivially Exploitable Information Disclosure Vulnerability in SolarWinds Serv-U

Rapid7

[CVE-2017-3506] Oracle WebLogic Server OS Command Injection Vulnerability

CISA

[CVE-2024-1086] Linux Kernel Use-After-Free Vulnerability

CISA

[CVE-2024-24919] Check Point Quantum Security Gateways Information Disclosure Vulnerability

CISA

CVE-2024-24919: Check Point Security Gateway Information Disclosure

Rapid7

[CVE-2024-4978] Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code Vulnerability

CISA

[CVE-2024-5274] Google Chromium V8 Type Confusion Vulnerability

CISA

[CVE-2020-17519] Apache Flink Improper Access Control Vulnerability

CISA

CVE-2024-4978: Backdoored Justice AV Solutions Viewer Software Used in Apparent Supply Chain Attack

Rapid7

[CVE-2024-4947] Google Chromium V8 Type Confusion Vulnerability

CISA

[CVE-2023-43208] NextGen Healthcare Mirth Connect Deserialization of Untrusted Data Vulnerability

CISA

[CVE-2024-4761] Google Chromium V8 Out-of-Bounds Memory Write Vulnerability

CISA

[CVE-2021-40655] D-Link DIR-605 Router Information Disclosure Vulnerability

CISA

[CVE-2014-100005] D-Link DIR-600 Router Cross-Site Request Forgery (CSRF) Vulnerability

CISA

[CVE-2024-30040] Microsoft Windows MSHTML Platform Security Feature Bypass Vulnerability

CISA

[CVE-2024-30051] Microsoft DWM Core Library Privilege Escalation Vulnerability

CISA

[CVE-2024-4671] Google Chromium Visuals Use-After-Free Vulnerability

CISA

[CVE-2023-7028] GitLab Community and Enterprise Editions Improper Access Control Vulnerability

CISA

[CVE-2024-29988] Microsoft SmartScreen Prompt Security Feature Bypass Vulnerability

CISA

[CVE-2024-4040] CrushFTP VFS Sandbox Escape Vulnerability

CISA

[CVE-2024-20359] Cisco ASA and FTD Privilege Escalation Vulnerability

CISA

[CVE-2024-20353] Cisco ASA and FTD Denial of Service Vulnerability

CISA

[CVE-2022-38028] Microsoft Windows Print Spooler Privilege Escalation Vulnerability

CISA

[CVE-2024-3400] Palo Alto Networks PAN-OS Command Injection Vulnerability

CISA

CVE-2024-3400: Critical Command Injection Vulnerability in Palo Alto Networks Firewalls

Rapid7

[CVE-2024-3273] D-Link Multiple NAS Devices Command Injection Vulnerability

CISA

[CVE-2024-3272] D-Link Multiple NAS Devices Use of Hard-Coded Credentials Vulnerability

CISA

[CVE-2024-29748] Android Pixel Privilege Escalation Vulnerability

CISA

[CVE-2024-29745] Android Pixel Information Disclosure Vulnerability

CISA

CVE-2024-0394: Rapid7 Minerva Armor Privilege Escalation (FIXED)

Rapid7

Backdoored XZ Utils (CVE-2024-3094)

Rapid7

XZ-Utils 백도어 악성코드 분석(CVE-2024-3094)

SK쉴더스

[CVE-2023-24955] Microsoft SharePoint Server Code Injection Vulnerability

CISA

[CVE-2019-7256] Nice Linear eMerge E3-Series OS Command Injection Vulnerability

CISA

[CVE-2021-44529] Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability

CISA

[CVE-2023-48788] Fortinet FortiClient EMS SQL Injection Vulnerability

CISA

[CVE-2024-27198] JetBrains TeamCity Authentication Bypass Vulnerability

CISA

[CVE-2024-23225] Apple Multiple Products Memory Corruption Vulnerability

CISA

[CVE-2024-23296] Apple Multiple Products Memory Corruption Vulnerability

CISA

[CVE-2023-21237] Android Pixel Information Disclosure Vulnerability

CISA

[CVE-2021-36380] Sunhillo SureLine OS Command Injection Vulnerablity

CISA

[CVE-2024-21338] Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability

CISA

CVE-2024-27198 and CVE-2024-27199: JetBrains TeamCity Multiple Authentication Bypass Vulnerabilities (FIXED)

Rapid7

[CVE-2023-29360] Microsoft Streaming Service Untrusted Pointer Dereference Vulnerability

CISA

[CVE-2024-1709] ConnectWise ScreenConnect Authentication Bypass Vulnerability

CISA

[CVE-2020-3259] Cisco ASA and FTD Information Disclosure Vulnerability

CISA

[CVE-2024-21410] Microsoft Exchange Server Privilege Escalation Vulnerability

CISA

[CVE-2024-21412] Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability

CISA

[CVE-2024-21351] Microsoft Windows SmartScreen Security Feature Bypass Vulnerability

CISA

CVE-2023-47218: QNAP QTS and QuTS Hero Unauthenticated Command Injection (FIXED)

Rapid7

[CVE-2023-43770] Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability

CISA

Critical Fortinet FortiOS CVE-2024-21762 Exploited

Rapid7

[CVE-2024-21762] Fortinet FortiOS Out-of-Bound Write Vulnerability

CISA

[CVE-2023-4762] Google Chromium V8 Type Confusion Vulnerability

CISA

[CVE-2022-48618] Apple Multiple Products Memory Corruption Vulnerability

CISA

[CVE-2024-21893] Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability

CISA

[CVE-2023-22527] Atlassian Confluence Data Center and Server Template Injection Vulnerability

CISA

[CVE-2024-23222] Apple Multiple Products WebKit Type Confusion Vulnerability

CISA

CVE-2024-0204: Critical Authentication Bypass in Fortra GoAnywhere MFT

Rapid7

[CVE-2023-34048] VMware vCenter Server Out-of-Bounds Write Vulnerability

CISA

Critical CVEs in Outdated Versions of Atlassian Confluence and VMware vCenter Server

Rapid7

[CVE-2023-35082] Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability

CISA

[CVE-2024-0519] Google Chromium V8 Out-of-Bounds Memory Access Vulnerability

CISA

[CVE-2023-6549] Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability

CISA

[CVE-2023-6548] Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability

CISA

[CVE-2018-15133] Laravel Deserialization of Untrusted Data Vulnerability

CISA

[CVE-2023-29357] Microsoft SharePoint Server Privilege Escalation Vulnerability

CISA

[CVE-2023-46805] Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability

CISA

[CVE-2024-21887] Ivanti Connect Secure and Policy Secure Command Injection Vulnerability

CISA

[CVE-2023-23752] Joomla! Improper Access Control Vulnerability

CISA

[CVE-2016-20017] D-Link DSL-2750B Devices Command Injection Vulnerability

CISA

[CVE-2023-41990] Apple Multiple Products Code Execution Vulnerability

CISA

[CVE-2023-27524] Apache Superset Insecure Default Initialization of Resource Vulnerability

CISA

[CVE-2023-29300] Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

CISA

[CVE-2023-38203] Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

CISA

[CVE-2023-7101] Spreadsheet::ParseExcel Remote Code Execution Vulnerability

CISA

[CVE-2023-7024] Google Chromium WebRTC Heap Buffer Overflow Vulnerability

CISA

[CVE-2023-49897] FXC AE1021, AE1021PE OS Command Injection Vulnerability

CISA

[CVE-2023-47565] QNAP VioStor NVR OS Command Injection Vulnerability

CISA

[CVE-2023-6448] Unitronics Vision PLC and HMI Insecure Default Password Vulnerability

CISA

[CVE-2023-41266] Qlik Sense Path Traversal Vulnerability

CISA

[CVE-2023-41265] Qlik Sense HTTP Tunneling Vulnerability

CISA

[CVE-2023-33107] Qualcomm Multiple Chipsets Integer Overflow Vulnerability

CISA

[CVE-2023-33106] Qualcomm Multiple Chipsets Use of Out-of-Range Pointer Offset Vulnerability

CISA

[CVE-2023-33063] Qualcomm Multiple Chipsets Use-After-Free Vulnerability

CISA

[CVE-2022-22071] Qualcomm Multiple Chipsets Use-After-Free Vulnerability

CISA

[CVE-2023-42917] Apple Multiple Products WebKit Memory Corruption Vulnerability

CISA

[CVE-2023-42916] Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability

CISA

CVE-2023-49103 - Critical Information Disclosure in ownCloud Graph API

Rapid7

[CVE-2023-6345] Google Skia Integer Overflow Vulnerability

CISA

[CVE-2023-49103] ownCloud graphapi Information Disclosure Vulnerability

CISA

[CVE-2023-4911] GNU C Library Buffer Overflow Vulnerability

CISA

[Top-CERT] REST API를 활용한 원격 명령 실행 취약점 분석 CVE-2023-42793

SK쉴더스

[CVE-2023-36584] Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability

CISA

[CVE-2023-1671] Sophos Web Appliance Command Injection Vulnerability

CISA

[CVE-2020-2551] Oracle Fusion Middleware Unspecified Vulnerability

CISA

[CVE-2023-36033] Microsoft Windows Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability

CISA

[CVE-2023-36025] Microsoft Windows SmartScreen Security Feature Bypass Vulnerability

CISA

[CVE-2023-36036] Microsoft Windows Cloud Files Mini Filter Driver Privilege Escalation Vulnerability

CISA

[CVE-2023-47246] SysAid Server Path Traversal Vulnerability

CISA

[CVE-2023-36844] Juniper Junos OS EX Series PHP External Variable Modification Vulnerability

CISA

[CVE-2023-36845] Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability

CISA

[CVE-2023-36846] Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability

CISA

[CVE-2023-36847] Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability

CISA

[CVE-2023-36851] Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability

CISA

CVE-2023-5950 Rapid7 Velociraptor Reflected XSS

Rapid7

CVE-2023-47246: SysAid Zero-Day Vulnerability Exploited By Lace Tempest

Rapid7

[CVE-2023-29552] Service Location Protocol (SLP) Denial-of-Service Vulnerability

CISA

[CVE-2023-22518] Atlassian Confluence Data Center and Server Improper Authorization Vulnerability

CISA

Rapid7-Observed Exploitation of Atlassian Confluence CVE-2023-22518

Rapid7

[CVE-2023-46604] Apache ActiveMQ Deserialization of Untrusted Data Vulnerability

CISA

Suspected Exploitation of Apache ActiveMQ CVE-2023-46604

Rapid7

[CVE-2023-46748] F5 BIG-IP Configuration Utility SQL Injection Vulnerability

CISA

[CVE-2023-46747] F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability

CISA

[CVE-2023-5631] Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability

CISA

CVE-2023-4966: Exploitation of Citrix NetScaler Information Disclosure Vulnerability

Rapid7

[CVE-2023-20273] Cisco IOS XE Web UI Command Injection Vulnerability

CISA

[CVE-2023-4966] Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability

CISA

CVE-2023-20198: Active Exploitation of Cisco IOS XE Zero-Day Vulnerability

Rapid7

[CVE-2023-20198] Cisco IOS XE Web UI Privilege Escalation Vulnerability

CISA

[CVE-2023-21608] Adobe Acrobat and Reader Use-After-Free Vulnerability

CISA

[CVE-2023-20109] Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability

CISA

[CVE-2023-41763] Microsoft Skype for Business Privilege Escalation Vulnerability

CISA

[CVE-2023-36563] Microsoft WordPad Information Disclosure Vulnerability

CISA

[CVE-2023-44487] HTTP/2 Rapid Reset Attack Vulnerability

CISA

[CVE-2023-22515] Atlassian Confluence Data Center and Server Broken Access Control Vulnerability

CISA

[CVE-2023-40044] Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability

CISA

[CVE-2023-42824] Apple iOS and iPadOS Kernel Privilege Escalation Vulnerability

CISA

[CVE-2023-42793] JetBrains TeamCity Authentication Bypass Vulnerability

CISA

[CVE-2023-28229] Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability

CISA

CVE-2023-22515: Zero-Day Privilege Escalation in Confluence Server and Data Center

Rapid7

[CVE-2023-4211] Arm Mali GPU Kernel Driver Use-After-Free Vulnerability

CISA

[CVE-2023-5217] Google Chromium libvpx Heap Buffer Overflow Vulnerability

CISA

[CVE-2018-14667] Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability

CISA

[CVE-2023-41991] Apple Multiple Products Improper Certificate Validation Vulnerability

CISA

[CVE-2023-41992] Apple Multiple Products Kernel Privilege Escalation Vulnerability

CISA

[CVE-2023-41993] Apple Multiple Products WebKit Code Execution Vulnerability

CISA

[CVE-2023-41179] Trend Micro Apex One and Worry-Free Business Security Remote Code Execution Vulnerability

CISA

[CVE-2023-28434] MinIO Security Feature Bypass Vulnerability

CISA

[CVE-2022-22265] Samsung Mobile Devices Use-After-Free Vulnerability

CISA

[CVE-2014-8361] Realtek SDK Improper Input Validation Vulnerability

CISA

[CVE-2017-6884] Zyxel EMG2926 Routers Command Injection Vulnerability

CISA

[CVE-2021-3129] Laravel Ignition File Upload Vulnerability

CISA

[CVE-2023-26369] Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability

CISA

[CVE-2023-35674] Android Framework Privilege Escalation Vulnerability

CISA

[CVE-2023-20269] Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability

CISA

[CVE-2023-4863] Google Chromium WebP Heap-Based Buffer Overflow Vulnerability

CISA

[CVE-2023-36761] Microsoft Word Information Disclosure Vulnerability

CISA

[CVE-2023-36802] Microsoft Streaming Service Proxy Privilege Escalation Vulnerability

CISA

[CVE-2023-41064] Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow Vulnerability

CISA

[CVE-2023-41061] Apple iOS, iPadOS, and watchOS Wallet Code Execution Vulnerability

CISA

CVE-2023-4528: Java Deserialization Vulnerability in JSCAPE MFT (Fixed)

Rapid7

[CVE-2023-33246] Apache RocketMQ Command Execution Vulnerability

CISA

[CVE-2023-38831] RARLAB WinRAR Code Execution Vulnerability

CISA

[CVE-2023-32315] Ignite Realtime Openfire Path Traversal Vulnerability

CISA

[CVE-2023-38035] Ivanti Sentry Authentication Bypass Vulnerability

CISA

[CVE-2023-27532] Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability

CISA

[CVE-2023-26359] Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

CISA

[CVE-2023-24489] Citrix Content Collaboration ShareFile Improper Access Control Vulnerability

CISA

[CVE-2023-38180] Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability

CISA

[CVE-2017-18368] Zyxel P660HN-T1A Routers Command Injection Vulnerability

CISA

CVE-2023-35082 - MobileIron Core Unauthenticated API Access Vulnerability

Rapid7

[CVE-2023-35081] Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability

CISA

[CVE-2023-37580] Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

CISA

[CVE-2023-38606] Apple Multiple Products Kernel Unspecified Vulnerability

CISA

CVE-2023-35078: Critical API Access Vulnerability in Ivanti Endpoint Manager Mobile

Rapid7

[CVE-2023-35078] Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability

CISA

[CVE-2023-29298] Adobe ColdFusion Improper Access Control Vulnerability

CISA

[CVE-2023-38205] Adobe ColdFusion Improper Access Control Vulnerability

CISA

[CVE-2023-3519] Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability

CISA

CVE-2023-38205: Adobe ColdFusion Access Control Bypass [FIXED]

Rapid7

[CVE-2023-36884] Microsoft Windows Search Remote Code Execution Vulnerability

CISA

[CVE-2022-29303] SolarView Compact Command Injection Vulnerability

CISA

[CVE-2023-37450] Apple Multiple Products WebKit Code Execution Vulnerability

CISA

SonicWall Recommends Urgent Patching for GMS and Analytics CVEs

Rapid7

[CVE-2023-32046] Microsoft Windows MSHTML Platform Privilege Escalation Vulnerability

CISA

[CVE-2023-32049] Microsoft Windows Defender SmartScreen Security Feature Bypass Vulnerability

CISA

[CVE-2023-35311] Microsoft Outlook Security Feature Bypass Vulnerability

CISA

[CVE-2023-36874] Microsoft Windows Error Reporting Service Privilege Escalation Vulnerability

CISA

[CVE-2022-31199] Netwrix Auditor Insecure Object Deserialization Vulnerability

CISA

CVE-2023-29298: Adobe ColdFusion Access Control Bypass

Rapid7

[CVE-2021-29256] Arm Mali GPU Kernel Driver Use-After-Free Vulnerability

CISA

[CVE-2019-17621] D-Link DIR-859 Router Command Execution Vulnerability

CISA

[CVE-2019-20500] D-Link DWL-2600AP Access Point Command Injection Vulnerability

CISA

[CVE-2021-25487] Samsung Mobile Devices Out-of-Bounds Read Vulnerability

CISA

[CVE-2021-25489] Samsung Mobile Devices Improper Input Validation Vulnerability

CISA

[CVE-2021-25394] Samsung Mobile Devices Race Condition Vulnerability

CISA

[CVE-2021-25395] Samsung Mobile Devices Race Condition Vulnerability

CISA

[CVE-2021-25371] Samsung Mobile Devices Unspecified Vulnerability

CISA

[CVE-2021-25372] Samsung Mobile Devices Improper Boundary Check Vulnerability

CISA

[CVE-2023-32434] Apple Multiple Products Integer Overflow Vulnerability

CISA

[CVE-2023-32435] Apple Multiple Products WebKit Memory Corruption Vulnerability

CISA

[CVE-2023-32439] Apple Multiple Products WebKit Type Confusion Vulnerability

CISA

[CVE-2023-20867] VMware Tools Authentication Bypass Vulnerability

CISA

[CVE-2023-27992] Zyxel Multiple NAS Devices Command Injection Vulnerability

CISA

[CVE-2023-20887] Vmware Aria Operations for Networks Command Injection Vulnerability

CISA

[CVE-2020-35730] Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability

CISA

[CVE-2020-12641] Roundcube Webmail Remote Code Execution Vulnerability

CISA

[CVE-2021-44026] Roundcube Webmail SQL Injection Vulnerability

CISA

[CVE-2016-9079] Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability

CISA

[CVE-2016-0165] Microsoft Win32k Privilege Escalation Vulnerability

CISA

CVE-2023-34362: MOVEit Vulnerability Timeline of Events

Rapid7

[CVE-2023-27997] Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability

CISA

CVE-2023-27997: Critical Fortinet Fortigate Remote Code Execution Vulnerability

Rapid7

CVE-2023-2868: Total Compromise of Physical Barracuda ESG Appliances

Rapid7

[CVE-2023-3079] Google Chromium V8 Type Confusion Vulnerability

CISA

[CVE-2023-33009] Zyxel Multiple Firewalls Buffer Overflow Vulnerability

CISA

[CVE-2023-33010] Zyxel Multiple Firewalls Buffer Overflow Vulnerability

CISA

[CVE-2023-34362] Progress MOVEit Transfer SQL Injection Vulnerability

CISA

[CVE-2023-28771] Zyxel Multiple Firewalls OS Command Injection Vulnerability

CISA

[CVE-2023-2868] Barracuda Networks ESG Appliance Improper Input Validation Vulnerability

CISA

[CVE-2023-32409] Apple Multiple Products WebKit Sandbox Escape Vulnerability

CISA

[CVE-2023-28204] Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability

CISA

[CVE-2023-32373] Apple Multiple Products WebKit Use-After-Free Vulnerability

CISA

[CVE-2004-1464] Cisco IOS Denial-of-Service Vulnerability

CISA

[CVE-2016-6415] Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure Vulnerability

CISA

[CVE-2023-21492] Samsung Mobile Devices Insertion of Sensitive Information Into Log File Vulnerability

CISA

CVE-2023-27350: Ongoing Exploitation of PaperCut Remote Code Execution Vulnerability

Rapid7

[CVE-2023-25717] Multiple Ruckus Wireless Products CSRF and RCE Vulnerability

CISA

[CVE-2021-3560] Red Hat Polkit Incorrect Authorization Vulnerability

CISA

[CVE-2014-0196] Linux Kernel Race Condition Vulnerability

CISA

[CVE-2010-3904] Linux Kernel Improper Input Validation Vulnerability

CISA

[CVE-2015-5317] Jenkins User Interface (UI) Information Disclosure Vulnerability

CISA

[CVE-2016-3427] Oracle Java SE and JRockit Unspecified Vulnerability

CISA

[CVE-2016-8735] Apache Tomcat Remote Code Execution Vulnerability

CISA

[CVE-2023-29336] Microsoft Win32K Privilege Escalation Vulnerability

CISA

[CVE-2023-1389] TP-Link Archer AX-21 Command Injection Vulnerability

CISA

[CVE-2021-45046] Apache Log4j2 Deserialization of Untrusted Data Vulnerability

CISA

[CVE-2023-21839] Oracle WebLogic Server Unspecified Vulnerability

CISA

[CVE-2023-28432] MinIO Information Disclosure Vulnerability

CISA

[CVE-2023-27350] PaperCut MF/NG Improper Access Control Vulnerability

CISA

[CVE-2023-2136] Google Chrome Skia Integer Overflow Vulnerability

CISA

[CVE-2017-6742] Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability

CISA

[CVE-2019-8526] Apple macOS Use-After-Free Vulnerability

CISA

[CVE-2023-2033] Google Chromium V8 Type Confusion Vulnerability

CISA

[CVE-2023-20963] Android Framework Privilege Escalation Vulnerability

CISA

[CVE-2023-29492] Novi Survey Insecure Deserialization Vulnerability

CISA

[CVE-2023-28252] Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability

CISA

[CVE-2023-28205] Apple Multiple Products WebKit Use-After-Free Vulnerability

CISA

[CVE-2023-28206] Apple iOS, iPadOS, and macOS IOSurfaceAccelerator Out-of-Bounds Write Vulnerability

CISA

[CVE-2021-27876] Veritas Backup Exec Agent File Access Vulnerability

CISA

[CVE-2021-27877] Veritas Backup Exec Agent Improper Authentication Vulnerability

CISA

[CVE-2021-27878] Veritas Backup Exec Agent Command Execution Vulnerability

CISA

[CVE-2019-1388] Microsoft Windows Certificate Dialog Privilege Escalation Vulnerability

CISA

[CVE-2023-26083] Arm Mali GPU Kernel Driver Information Disclosure Vulnerability

CISA

[CVE-2022-27926] Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

CISA

Microsoft Excel RCE 취약점(CVE-2023-23399), Microsoft Word RCE 취약점(CVE-2023-28311)

SK쉴더스

[CVE-2013-3163] Microsoft Internet Explorer Memory Corruption Vulnerability

CISA

[CVE-2017-7494] Samba Remote Code Execution Vulnerability

CISA

[CVE-2022-42948] Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability

CISA

[CVE-2022-39197] Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability

CISA

[CVE-2021-30900] Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability

CISA

[CVE-2022-38181] Arm Mali GPU Kernel Driver Use-After-Free Vulnerability

CISA

[CVE-2023-0266] Linux Kernel Use-After-Free Vulnerability

CISA

[CVE-2022-3038] Google Chromium Network Service Use-After-Free Vulnerability

CISA

[CVE-2022-22706] Arm Mali GPU Kernel Driver Unspecified Vulnerability

CISA

Active Exploitation of IBM Aspera Faspex CVE-2022-47986

Rapid7

CVE-2023-0391: MGT-COMMERCE CloudPanel Shared Certificate Vulnerability and Weak Installation Procedures

Rapid7

[CVE-2023-26360] Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

CISA

[CVE-2023-23397] Microsoft Office Outlook Privilege Escalation Vulnerability

CISA

[CVE-2023-24880] Microsoft Windows SmartScreen Security Feature Bypass Vulnerability

CISA

[CVE-2022-41328] Fortinet FortiOS Path Traversal Vulnerability

CISA

[CVE-2021-39144] XStream Remote Code Execution Vulnerability

CISA

[CVE-2020-5741] Plex Media Server Remote Code Execution Vulnerability

CISA

[CVE-2022-28810] Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability

CISA

[CVE-2022-33891] Apache Spark Command Injection Vulnerability

CISA

[CVE-2022-35914] Teclib GLPI Remote Code Execution Vulnerability

CISA