Security News

주요 제품 취약점 (43건)

PostgreSQL finance
28건
KEV 2 · 최근 2026-09-02
 MySQL/MariaDB finance
10건
KEV 2 · 최근 2024-11-07
 wolfSSL finance
3건
KEV 0
 Apache Spark finance
1건
KEV 1 · 최근 2023-03-07
 Spring Framework finance
1건
KEV 1 · 최근 2022-04-04
기술CVE심각도유형KEV등재일
MySQL/MariaDB CyberPersons CyberPanel
upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute …
 CVE-2024-51567 10.0 CWE-306 KEV 2024-11-07
PostgreSQL Splunk Enterprise
In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files throug…
 CVE-2026-20253 9.8 CWE-306 KEV 2026-06-18
MySQL/MariaDB Progress MOVEit Transfer
In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection…
 CVE-2023-34362 9.8 CWE-89 KEV 2023-06-02
Spring Framework VMware Spring Framework
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit …
 CVE-2022-22965 9.8 CWE-94 KEV 2022-04-04
Apache Spark
The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks …
 CVE-2022-33891 8.8 CWE-78 KEV 2023-03-07
PostgreSQL Sangoma Switchvox
An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning…
 CVE-2026-9586 — CWE-89 KEV 2026-09-02
PostgreSQL
Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network.
 CVE-2026-85878 9.9 CWE-285 —
PostgreSQL
Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API routes are …
 CVE-2026-77936 9.8 CWE-1188 —
MySQL/MariaDB
DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL_ROOT_PASSWORD and publ…
 CVE-2026-77933 9.8 CWE-1392 —
MySQL/MariaDB
Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code node…
 CVE-2026-77934 8.8 CWE-1188 —
PostgreSQL
Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system user runni…
 CVE-2026-6637 8.8 CWE-89 —
PostgreSQL
Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functi…
 CVE-2026-6477 8.8 CWE-242 —
PostgreSQL
Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgr…
 CVE-2026-6475 8.8 CWE-61 —
PostgreSQL
Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an allocation and wri…
 CVE-2026-6473 8.8 CWE-190 —
PostgreSQL
Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating syste…
 CVE-2026-19385 8.8 CWE-122 —
PostgreSQL
Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time executi…
 CVE-2026-18408 8.8 CWE-829 —
PostgreSQL
Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via…
 CVE-2026-16239 8.8 CWE-843 —
PostgreSQL
Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the…
 CVE-2026-16238 8.8 CWE-843 —
PostgreSQL
Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating…
 CVE-2026-15742 8.8 CWE-190 —
PostgreSQL
SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attack…
 CVE-2026-15741 8.8 CWE-89 —
PostgreSQL
Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the data…
 CVE-2026-14680 8.8 CWE-843 —
PostgreSQL
Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write …
 CVE-2026-14677 8.8 CWE-190 —
PostgreSQL
Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operating system user running the data…
 CVE-2026-14676 8.8 CWE-122 —
PostgreSQL
Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. T…
 CVE-2026-14671 8.8 CWE-843 —
PostgreSQL
Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user runn…
 CVE-2026-14670 8.8 CWE-122 —
PostgreSQL
Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user…
 CVE-2026-14669 8.8 CWE-122 —
PostgreSQL
Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via te…
 CVE-2026-14664 8.8 CWE-122 —
PostgreSQL
Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an al…
 CVE-2026-14662 8.8 CWE-190 —
MySQL/MariaDB
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT e…
 CVE-2026-107815 8.5 CWE-787 —
MySQL/MariaDB
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM p…
 CVE-2026-107814 8.4 CWE-732 —
wolfSSL
MatchTrustedPeer ignores the public key used, leading to forged CA clones passing verification. Affected builds are any that enable the macro WOLFSSL…
 CVE-2026-93302 8.2 CWE-295 —
PostgreSQL
Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT parameter count. The attack c…
 CVE-2026-14679 8.2 CWE-121 —
PostgreSQL
Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injec…
 CVE-2026-6464 8.1 CWE-829 —
PostgreSQL
Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the val…
 CVE-2026-14668 8.1 CWE-843 —
MySQL/MariaDB
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insuf…
 CVE-2026-107821 8.0 CWE-1285 —
PostgreSQL
Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained d…
 CVE-2026-6479 7.5 CWE-674 —
PostgreSQL
SQL injection in PostgreSQL pg_createsubscriber allows an attacker with pg_create_subscription rights to execute arbitrary SQL as a superuser. The a…
 CVE-2026-6476 7.2 CWE-89 —
PostgreSQL
Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating…
 CVE-2026-6471 7.2 CWE-862 —
wolfSSL
In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, multiple OCSP response stapling, which can lead to ce…
 CVE-2026-89102 6.5 CWE-295 —
MySQL/MariaDB
MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Co…
 CVE-2026-107819 5.9 CWE-297 —
wolfSSL
src/internal.c in wolfSSL wolfSSH through 1.5.0 admits the server-to-client Diffie-Hellman group exchange messages SSH_MSG_KEX_DH_GEX_GROUP (31) and …
 CVE-2026-84897 5.3 CWE-372 —
MySQL/MariaDB
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise record manager and agent memory node…
 CVE-2026-69251 — CWE-94 —
MySQL/MariaDB
Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a cra…
 CVE-2026-114509 — CWE-287 —