CVE-2026-43786

🔐 CVE-2026-43786 🚨 macOS 로컬 권한 상승 — 부적절한 엔타이틀먼트 검증 📌 개요 CVE-2026-43786 은 Apple의 macOS에 영향을 미치는 로컬 권한 상승 취약점 입니다. 이 취약점은 부적절한 엔타이틀먼트 검증 과 관련이 있으며, 잠재적으로 낮은 권한으로 실행되는 로컬 애플리케이션이 root 수준 권한 이 필요한 작업을 수행할 수 있게 할 수 있습니다. 🍎 Apple은 추가 엔타이틀먼트 검사 를 구현하여 이 문제를 해결했습니다. 🧾 취약점 정보 🔎 속성| 📋 세부 정보 ---|--- 🆔 CVE|...

CVE-2026-94484

A flaw was found in Next.js. Applications configured with root-level catch-all pages and static routes share a response cache key that does not properly distinguish between different routes. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request t...

CVE-2026-94484

The Next.js React framework is vulnerable to cache poisoning in versions 15.0.0 through 15.5.27 and 16.3.8 . The root cause is an insufficiently scoped shared response cache key used by applications with a root-level catch-all page and statically generated or Incremental Static Regeneration (ISR)...

Linux Distros Unpatched Vulnerability : CVE-2026-94484

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and...

CVE-2025-55182-Terminal

Next.js RSC 취약점 스캐너 CVE-2025-66478 / CVE-2025-55182 Next.js React Server ComponentsRSC 원격 코드 실행 취약점React2Shell을 탐지하고 시연하기 위해 설계된 경량 멀티스레드 PoCProof of Concept 도구입니다. 이 도구는 단일 대상 검증과 고동시성 대량 스캔을 모두 지원합니다. 주요 기능 정밀 탐지 : 엄격한 루트 수준 실행 접근 권한을 확인하여 취약한 인스턴스를 식별합니다. 대량 스캔 : 대규모 대상 목록을 효율적으로 스캔할 수 있는 멀티스레...

CVE-2025-55182-PoC-exploit

CVE-2025-55182-PoC-exploit Next.js RCE（React Server Functions経由） ❯ python3 cve-2025-55182-exploit.py 0:"a":"$@1","f":"","b":"3OmR5Ifk9dmFJ1coB7-Wc" 1:E"digest":"uid=0root gid=0root groups=0root,0root,1bin,2daemon,3sys,4adm,6disk,10wheel,11floppy,20dialout,26tape,27video"...

Rocky Linux 9.6 [TuxCare] Security Update: libipa_hbac / libipa_hbac-devel / libsss_autofs / libsss_certmap / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785345275)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785345275 advisory. - A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches th...

CentOS Linux 7 [TuxCare] Security Update: libipa_hbac / libipa_hbac-devel / libsss_autofs / libsss_certmap / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1785845028)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1785845028 advisory. - A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the enti...

EXOS < 31.7.4 / 32.0.0 < 32.7.4.15 / 33.0.0 < 33.1.100, 33.7.0 < 33.7.1 Privilege Escalation (SA-2026-087)

The version of EXOS installed on the remote host is missing a security update. It is, therefore, affected by an privilege escalation vulnerability. - ExtremeXOS uses a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value can be predicted unde...

Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager - Remote Code Execution

Cisco Prime Infrastructure PI and Cisco Evolved Programmable Network EPN Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because the software improperly validates user-supplied input. An...

CVE-2026-47116

LTSecurity LTK3500SF contains a hard-coded credentials vulnerability where the root and guest account passwords are stored in /etc/shadow as weak hashes recoverable with dictionary-based cracking tools. The recovered credentials authenticate against the device's Telnet and SSH services and grant...

CVE-2026-47116 LTSecurity LTK3500SF Hard-coded Credentials via Telnet/SSH

LTSecurity LTK3500SF contains a hard-coded credentials vulnerability where the root and guest account passwords are stored in /etc/shadow as weak hashes recoverable with dictionary-based cracking tools. The recovered credentials authenticate against the device's Telnet and SSH services and grant...

EUVD-2026-84683

LTSecurity LTK3500SF contains a hard-coded credentials vulnerability where root and guest account passwords are stored as reversible hashes in /etc/shadow, recoverable using dictionary-based cracking tools. Attackers can use the recovered credentials to authenticate via Telnet or SSH and obtain...

PT-2026-96969

Name of the Vulnerable Software and Affected Versions LTSecurity LTK3500SF affected versions not specified Description The device contains hard-coded credentials where the root and guest account passwords are stored in the /etc/shadow file as weak hashes. These hashes can be recovered using...

CVE-2026-47116: Use of Hard-coded Credentials

LTSecurity LTK3500SF contains a hard-coded credentials vulnerability where the root and guest account passwords are stored in /etc/shadow as weak hashes recoverable with dictionary-based cracking tools. The recovered credentials authenticate against the device's Telnet and SSH services and grant...

CVE-2026-84071 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 is vulnerable to OS command injection in the Universal Connector plugin upload functionality. A privileged authenticated attacker can provide a malicious filename that is incorporated into a shell command executed by the application, potentially resulting in...

CVE-2026-84071 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 is vulnerable to OS command injection in the Universal Connector plugin upload functionality. A privileged authenticated attacker can provide a malicious filename that is incorporated into a shell command executed by the application, potentially resulting in...

EUVD-2026-83421

IBM Guardium Data Protection 12.2 is vulnerable to OS command injection in the Universal Connector plugin upload functionality. A privileged authenticated attacker can provide a malicious filename that is incorporated into a shell command executed by the application, potentially resulting in...

EUVD-2026-82989

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain active debug functionality in the embedded software. An attacker with privileged access to the device can enable this debug mode to execute arbitrary code on the underlying...

CVE-2026-84071: Improper Neutralization of Special Elements used in an OS Command

IBM Guardium Data Protection 12.2 is vulnerable to OS command injection in the Universal Connector plugin upload functionality. A privileged authenticated attacker can provide a malicious filename that is incorporated into a shell command executed by the application, potentially resulting in...