CVE-2026-20841

🛡️ CVE-2026-20841 - Windows 메모장 보안 테스트 도구 ⚠️ CVE-2026-20841이란 무엇인가요? CVE-2026-20841은 Windows 메모장 애플리케이션의 알려진 보안 취약점입니다. 이 취약점은 메모장이 클릭 가능한 링크로 서식 있는 텍스트를 표시할 수 있게 해주는 마크다운 기능에 영향을 미칩니다. 이 문제는 메모장 내에서 실행되는 마크다운 엔진이 허용하는 링크 유형URL 프로토콜이라고 함을 제한하지 않기 때문에 발생합니다. 즉, 공격자가 클릭 시 사용자가 의도하지 않은 프로그램이나 명령을 메모장이...

CVE-2023-43770-PoC

CVE-2023-43770-PoC 저장형 XSSCVE-2023-43770 취약점에 대한 PoC 설명 Roundcube 1.4.14 이전 버전, 1.5.4 이전 1.5.x 버전, 1.6.3 이전 1.6.x 버전은 program/lib/Roundcube/rcubestringreplacer.php 동작으로 인해 조작된 링크가 포함된 text/plain 이메일 메시지를 통해 XSS를 허용합니다. 공격 체인 조작된 이메일 - 피해자가 이메일을 수신하고 열람 - 자바스크립트 실행 저장형 PoC 영상:...

CVE-2023-43770-POC

CVE-2023-43770 POC 최근 발견된 CVE-2023-43770 취약점에 대한 개념 증명Proof-of-Concept입니다. 1.4.14 이전의 Roundcube, 1.5.4 이전의 1.5.x, 1.6.3 이전의 1.6.x 버전은 program/lib/Roundcube/rcubestringreplacer.php의 동작으로 인해 조작된 링크가 포함된 text/plain 이메일 메시지를 통한 XSS를 허용합니다. 사용법 python cve-2023-43770.py -e [email protected] -p...

Rocky Linux 9 [CIQ] Security Update: cockpit / cockpit-bridge / cockpit-debuginfo / cockpit-debugsource / etc (crlsa-2026_21468)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202621468 advisory. cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI CVE-2026-4802 Tenable has extracted the preceding description block directly from...

Rocky Linux 8 [CIQ] Security Update: cockpit / cockpit-bridge / cockpit-debuginfo / cockpit-debugsource / etc (crlsa-2026_21700)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202621700 advisory. cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI CVE-2026-4802 Tenable has extracted the preceding description block directly from...

Astra Linux – Vulnerability in LibreOffice

In the LibreOffice 7-1 series in versions prior to 7.1.2, and in the 7-0 series in versions prior to 7.0.5, the denylist can be circumvented by manipulating the link so that it does not match the denylist, resulting in ShellExecute attempting to launch an executable file...

CVE-2026-76960

SAP S/4HANA Finance (Advanced Payment Management) is affected by a Cross-Site Request Forgery (CSRF) vulnerability caused by insufficient CSRF protection on certain requests. An attacker with low privileges can craft a malicious link or page; when an authenticated victim interacts with it, uninte...

CVE-2026-61899

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...

CVE-2026-61899 Apache Tapestry: Possible classpath file download through URL manipulation

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...

EUVD-2026-54296

A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon for example, https://trusted.com:[email protected]/, the address bar and security menus will...

CVE-2026-48911

Insufficient Verification of Data Authenticity vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. A missing authorization check in the external-login email binding flow allows unauthenticated attackers to take over arbitrary user accounts by tricking victims into...

CVE-2026-66300

SNOMED International Snowstorm contains a reflected XSS vulnerability within the "Web Route" redirection functionality. An attacker can inject arbitrary JavaScript which will execute upon a target user navigating to a crafted, malicious link. Fixed in 10.12.2 and 10.9.3...

CVE-2026-66300 SNOMED International Snowstorm reflected XSS

SNOMED International Snowstorm contains a reflected XSS vulnerability within the "Web Route" redirection functionality. An attacker can inject arbitrary JavaScript which will execute upon a target user navigating to a crafted, malicious link. Fixed in 10.12.2 and 10.9.3...

CVE-2026-66300

SNOMED International Snowstorm contains a reflected XSS vulnerability within the "Web Route" redirection functionality. An attacker can inject arbitrary JavaScript which will execute upon a target user navigating to a crafted, malicious link. Fixed in 10.12.2 and 10.9.3...

EUVD-2026-52869

SNOMED International Snowstorm contains a reflected XSS vulnerability within the "Web Route" redirection functionality. An attacker can inject arbitrary JavaScript which will execute upon a target user navigating to a crafted, malicious link. Fixed in 10.12.2 and 10.9.3...

CVE-2026-47615

NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause server-side request forgery by supplying a crafted URL in a multimodal request. A successful exploit of this vulnerability might lead to information disclosure...

SNOMED International Snowstorm reflected XSS

RISK EVALUATION SNOMED International Snowstorm contains a reflected XSS vulnerability within the "Web Route" redirection functionality. The function does not properly validate user input, allowing an attacker to inject arbitrary JavaScript which will execute upon a target user navigating to a...

GHSA-5VJC-7CXW-4W6J Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter

Summary The regular expression used to parse the convolution filter exhibits exponential-time backtracking for certain inputs, enabling a Regular Expression Denial of Service ReDoS. Details The RegExp for convolution is defined as...

CVE-2026-66390 Apache Wicket: crafted Link URL strings can break out of the JavaScript sequence

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0. Users are recommended to upgrade to version 10.10.0, which fixes the issue...

PT-2026-64214

Name of the Vulnerable Software and Affected Versions React Router versions 6.30.2 through 6.30.4 React Router versions 7.9.6 through 7.12.0 Description Applications that allow open redirects are susceptible to Cross-Site Scripting XSS, a technique where malicious scripts are injected into truste...