脆弱性一覧
CVE / GHSA / KEV / OSV を統合監視。タグ・カテゴリで絞り込み可能。
| ID | タイトル | |
|---|---|---|
| CVE-2026-62960 |
|
Git for Windows is the Windows port of Git. Prior to 2.55.0.windows.4, a malicious remote Git server can advertise a bundle URI that reaches transport_get_remote_bundle_uri(), fetch_bundle_uri_interna...
Git for Windows is the Windows port of Git. Prior to 2.55.0.windows.4, a malicious remote Git server can advertise a bundle URI that reaches transport_get_remote_bundle_uri(), fetch_bundle_uri_internal(), and copy_uri_to_file() in bundle-uri.c during clone or fetch when transfer.bundleuri=true. Non-...
|
| CVE-2026-18691 |
|
An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable...
An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable...
|
| CVE-2026-67425 |
|
Flyto2 Core: LLM/API keys leak to an attacker-controlled base_url
Flyto2 Core: LLM/API keys leak to an attacker-controlled base_url
|
| CVE-2026-46622 |
|
SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, API tokens used to authenticate all REST API requests are stored as plaintext strings in the api_tokens database table. Any...
SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, API tokens used to authenticate all REST API requests are stored as plaintext strings in the api_tokens database table. Any attacker who obtains read access to the database — through SQL injection, a leaked backup, a misconf...
|
| CVE-2026-46407 |
|
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, the backend admin/auth-token endpoint allows an authenticated administrator to...
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, the backend admin/auth-token endpoint allows an authenticated administrator to load another administrator's REST API token list by supplying that user's admin_id. This can disclo...
|
| CVE-2026-44313 |
|
ssrf に SSRF (サーバー側リクエスト偽造) (CVE-2026-44313)
ssrf に SSRF (CVE-2026-44313) が存在。機密情報が外部に流出する可能性があります。`GET /api/v1/archives/{linkId}` 経由で攻撃可能。
|
| CVE-2013-10075 |
|
apache の脆弱性 (CVE-2013-10075)
apache に 脆弱性 (CVE-2013-10075) が存在。機密情報が外部に流出する可能性があります。
|
| CVE-2026-33823 |
|
microsoft の脆弱性 (CVE-2026-33823)
microsoft に 脆弱性 (CVE-2026-33823) が存在。機密情報が外部に流出する可能性があります。
|
| CVE-2026-35428 |
|
microsoft に コマンドインジェクション (CVE-2026-35428)
microsoft に コマンドインジェクション (CVE-2026-35428) が存在。悪用されるとシステム全体を乗っ取られる可能性があります。
|
| CVE-2026-20133 KEV |
|
【KEV】Cisco catalyst-sd-wan-manager に 情報漏洩 (CVE-2026-20133)
Cisco catalyst-sd-wan-manager に 脆弱性 (CVE-2026-20133) が存在。不正な操作・情報露出のリスクがあります。CISA KEV登録済 — 実環境で悪用が確認されている。
|
| CVE-2025-2749 KEV |
|
【KEV】Kentico path-traversal に パストラバーサル (CVE-2025-2749)
Kentico path-traversal に パストラバーサル (CVE-2025-2749) が存在。不正な操作・情報露出のリスクがあります。CISA KEV登録済 — 実環境で悪用が確認されている。
|
| CVE-2026-34197 KEV |
|
【KEV】Apache activemq の脆弱性 (CVE-2026-34197)
Apache activemq に 脆弱性 (CVE-2026-34197) が存在。不正な操作・情報露出のリスクがあります。CISA KEV登録済 — 実環境で悪用が確認されている。
|
| CVE-2026-1233 |
|
The Text to Speech for WP (AI Voices by Mementor) plugin for WordPress is vulnerable to sensitive information exposure in all versions up to, and including, 1.9.8. This is due to the plugin containing...
The Text to Speech for WP (AI Voices by Mementor) plugin for WordPress is vulnerable to sensitive information exposure in all versions up to, and including, 1.9.8. This is due to the plugin containing hardcoded MySQL database credentials for the vendor's external telemetry server in the `Mementor_TT...
|
| CVE-2024-1139 |
|
A credentials leak vulnerability was found in the cluster monitoring operator in OCP. This issue may allow a remote attacker who has basic login credentials to check the pod manifest to discover a re...
A credentials leak vulnerability was found in the cluster monitoring operator in OCP. This issue may allow a remote attacker who has basic login credentials to check the pod manifest to discover a repository pull secret.
|