EUVD-2026-90983

Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker-controlled input processed by the MacTool handler. An unauthenticated attacker on the same local network can replay login challenge data to obtain an administrative session, enable a privileged service th...

CVE-2026-1492

CVE-2026-1492 User Registration & Membership = 5.1.2 - メンバーシップ登録による未認証の権限昇格 🔴 脆弱性の概要 CVE-2026-1492 — メンバーシップ登録による未認証の権限昇格 フィールド| 詳細 ---|--- CVE ID| CVE-2026-1492 深刻度| CRITICAL — CVSS v3.1 スコア: 9.8 ベクター| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CNA| Wordfence 影響を受けるソフトウェア| User Registration &...

LiteLLM: M2M JWT Handler Has Improper Authorization

A vulnerability was identified in BerriAI litellm up to 1.82.2. This affects an unknown function of the file litellm/proxy/auth/userapikeyauth.py of the component M2M JWT Handler. Such manipulation leads to improper authorization. The attack can be launched remotely. A high complexity level is...

LiteLLM: Admin Key Handler Has Improper Authorization

A vulnerability was determined in BerriAI litellm up to 1.63.1. The impacted element is an unknown function of the file litellm/proxy/managementendpoints/keymanagementendpoints.py of the component Admin Key Handler. This manipulation causes improper authorization. The attack can be initiated...

CVE-2026-26399-Disclosure

CVE-2026-26399: ArduinoCoreSTM32（旧バージョン）におけるスタックベースのUse-After-Return 概要 ArduinoCoreSTM32 のバージョン 1.7.0 より前の旧バージョンには、スタックベースのuse-after-returnの脆弱性が存在します。 この問題は pwmstart の実装にあり、TIMHandleTypeDef...

CVE-2024-40275_Scanner

CVE-2024-40725 スキャナー CVE-2024-40725 を検出するPythonベースのツールです。これはApache HTTP Serverのソースコード開示脆弱性で、バージョン 2.4.0 および 2.4.61 に影響します。 法的注意: このスキャナーは、自分が所有しているサーバー、またはテストするための明示的な書面による許可を得ているサーバーに対してのみ実行してください。無断使用は、コンピュータ不正行為に関する法律（例: CFAA、Computer Misuse Act）に違反する可能性があります。 背景 CVE-2024-40725 は、Apache...

DEBIAN-CVE-2026-42356

Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by modmime. This issue affects...

CVE-2026-42356

Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by modmime. This issue affects...

CVE-2026-101322

In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's Authorization header to outgoing requests without checking the destination origin. In deployments using authentication, an attacker could induce a us...

CVE-2026-101322

In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's Authorization header to outgoing requests without checking the destination origin. In deployments using authentication, an attacker could induce a us...

CVE-2026-42356 Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directories

Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by modmime. This issue affects...

CVE-2026-42356

Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by modmime. This issue affects...

CVE-2026-42356

The Apache HTTP Server versions 2.4.60 through 2.4.68 are affected by a deployment of wrong handler vulnerability (CVE-2026-42356). This flaw allows the target of certain internal redirects originating from CGI programs to be incorrectly treated as CGI and executed. For this to occur, the target ...

CVE-2026-42356

Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by modmime. This issue affects...

EUVD-2026-90886

Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by modmime. This issue affects...

Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses netty-handler-4.1.135.Final.jar, ion-java-1.11.1.jar, js-yaml-4.3.0.tgz, tar-7.5.20.tgz, python3.12 3.12.13-3.el98, github.com/go-jose/go-jose/v4 v4.1.3, github.com/apache/thrift v0.22.0, and google.golang.org/grpc 1.71.0 which are vulnerable to CVE-2026-62243,...

CVE-2026-25512

CVE-2026-25512: TNEF 핸들러의 명령 삽입을 통한 원격 코드 실행 - Group-Office CVSS 4.0 벡터 : CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H Table of Contents 요약 영향받는 버전 기술 세부사항 근본 원인 소스-싱크 흐름 악용 자동화 악용 수동 악용 영향 타임라인 크레딧 참고 자료 요약 Group-Office에서 심각한 원격 코드 실행RCE 취약점이 확인되었습니다. 엔드포인트...

document-viewer-link-handler-security-assessment

CVE-2026-46529 - Atril Evince XReader PDF 클릭 가능한 링크 RCE 컨설턴트 스타일 사이버 보안 보고서 문서 뷰어 링크 처리기 위험에 대한 전문 취약점 평가 보고서로, 영향 분석, 수정 방안 및 완화 전략을 포함합니다. 📍 보고서 개요 필드| 세부 정보 ---|--- 보고서 유형| 취약점 평가 보고서 수행 컨텍스트| 보안 연구 주요 초점| 애플리케이션 보안 대상 독자| 보안 팀, 엔지니어링 팀, 채용 담당자 출력 스타일| 경영진 요약, 기술 분석, 비즈니스 영향, 수정 로드맵 공개 상태| 공개...

CVE-2024-6387

취약점 설명 CVE-2024-6387 취약점은 glibc 기반 Linux 시스템의 sshd에서 OpenSSH 서버의 신호 처리기 경쟁 조건을 대상으로 합니다. SIGALRM 처리기에서 비동기 신호 안전하지 않은 함수가 호출되었기 때문에 이 취약점은 root 권한으로 원격 코드 실행을 허용합니다. 취약점 요약 이 취약점은 SIGALRM 처리기에서 OpenSSH sshd의 경쟁 조건을 대상으로 합니다. 영향을 받는 버전: OpenSSH 8.5p1 9.8p1。 취약점: 취약한 SIGALRM 처리기가 비동기 신호 안전하지 않은 함수를...

CVE-2025-2620-poc

CVE-2025-2620 개념 증명 익스플로잇 개요 이 저장소는 D-Link DAP-1620 라우터의 펌웨어 버전 1.03 에서 발견된 치명적인 스택 기반 버퍼 오버플로 취약점인 CVE-2025-2620 에 대한 고급 개념 증명PoC 익스플로잇을 포함하고 있습니다. 이 취약점은 인증되지 않은 원격 공격자 가 라우터의 웹 서버를 충돌시키거나서비스 거부, DoS 잠재적으로 임의 코드를 실행할 수 있게 합니다원격 코드 실행, RCE. 이 프로젝트의 목적은 익스플로잇 개발 기술을 시연 하는 것입니다. 취약점 세부 정보 CVE 설명...