수집 자료 브리핑
2026-09-19 수집 시점의 보안 자료를 정리했습니다. 자동 해설을 생성하지 못해 원문 요약과 출처를 제공하는 복구본입니다. 개별 항목은 아래 원문에서 확인할 수 있습니다.
- NVD 수집: 637건
- 최근 KEV 추가: 3건
실제 악용 확인 — CISA KEV
수집·선별 3건 중 최대 10건을 표시합니다.
CVE-2025-39964 — Linux Kernel Race Condition Vulnerability
EPSS 0.3% · KEV 추가일 2026-09-18 · Kernel
Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket’s internal state.
CVE-2026-53266 — Linux Kernel Out-of-Bounds Write Vulnerability
EPSS 0.1% · KEV 추가일 2026-09-18 · Kernel
Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of
CVE-2025-39682 — Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability
EPSS 0.5% · KEV 추가일 2026-09-18 · Kernel
Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using inc
고위험 취약점 — NVD
수집·선별 25건 중 최대 10건을 표시합니다.
CVE-2026-70200
CVSS 10 · EPSS 0.6%
Improper limitation of a pathname to a restricted directory (‘path traversal’) in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-69843
CVSS 10 · EPSS 0.6%
Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-69399
CVSS 10 · EPSS 0.5%
Azure Arc Elevation of Privilege Vulnerability
CVE-2026-69865
CVSS 10 · EPSS 0.5%
Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-83944
CVSS 10 · EPSS 0.5%
Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-85889
CVSS 10 · EPSS 0.5%
Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-85885
CVSS 9.9 · EPSS 0.5%
Improper neutralization of special elements used in a command (‘command injection’) in M365 Copilot allows an authorized attacker to elevate privileges over a network.
CVE-2026-85878
CVSS 9.9 · EPSS 0.5%
Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network.
CVE-2026-54734
CVSS 10 · EPSS 0.4%
Prebid Server Java is the Java version of Prebid Server. Prior to 3.43.0, certain bidder adapters interpolate user-supplied parameters into outbound request URLs without using HttpUtil to validate the resulting domain or path segment. A malicious actor who can supply bid-request parameters can cause
CVE-2026-62874
CVSS 10 · EPSS 0.3%
Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to elevate privileges over a network.
운영 기술 관련 취약점 — NVD
수집·선별 25건 중 최대 10건을 표시합니다.
CVE-2026-17086
CVSS 8.8 · EPSS 0.9%
The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.5.5 via deserialization of untrusted input . This makes it possible for authenticated attackers, with author-level access and above
CVE-2026-54612
CVSS 8.8 · EPSS 0.5%
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. From 1.0.0 until 1.0.8.5, saveGlobalElements() in admin/controller/editor/global-trait.php concatenates the attacker-controlled file portion of data-v-save-global to the active theme directory bef
CVE-2026-54671
CVSS 8.8 · EPSS 0.4%
WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an empty resource array in web/controle/control.php, and verificarPermissao in web/dao/MiddlewareDAO.php treats that empty array as unconditional access for every authenticated user. The methods in web/
CVE-2026-93435
CVSS 8.7 · EPSS 0.4%
redis-parser through 3.0.0 contains a denial of service vulnerability in the RESP protocol parser that allows malicious Redis endpoints to crash the client process through unbounded recursion on nested arrays. Attackers can send crafted RESP byte streams with repeated array headers that exhaust the
CVE-2026-54354
CVSS 8.2 · EPSS 0.4%
MapServer is a system for developing web-based GIS applications. Prior to 8.6.4, MapServer’s PostGIS runtime filter translation in src/mappostgis.cpp and msPostGISLayerTranslateFilter() treats a filteritem as numeric when CONNECTIONTYPE POSTGIS and metadata such as gml_<item>_type=Integer are config
CVE-2026-93377
CVSS 8.8 · EPSS 0.3%
Type confusion in V8 in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-93381
CVSS 8.8 · EPSS 0.3%
Buffer overflow in PDFium in Google Chrome on on Windows prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)
CVE-2026-93382
CVSS 8.8 · EPSS 0.3%
Use after free in PDFium in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-54507
CVSS 8.4 · EPSS 0.3%
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, the oEmbedProxy() handler in admin/controller/editor/editor.php accepts an attacker-controlled url parameter and passes it to getUrl(), while validateUrl() in system/functions.ph
CVE-2026-54597
CVSS 8.3 · EPSS 0.3%
ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated user with module_support write permission and access to a credential record can perform time-based blind SQL injection through the expires parameter of t
KrCERT 보안공지
Cisco 제품 보안 업데이트 권고
□ 개요 o Cisco社는 자사 제품에서 발생하는 취약점을 해결한 보안 업데이트 발표 \[1\]\[2\] o 영향을 받는 버전을 사용 중인 사용자는 해결 방안에 따라 최신 버전으로 업데이트 권고 □ 설명 o Cisco Identity Services Engine(ISE), Cisco ISE Passive Identity Connector(ISE-PIC)에서 발생하는 Incorrect Use of Privileged APIs 취약점(CVE-2026-76460) \[1\]\[3\] o Cisco AsyncOS So
Check Point 제품 보안 업데이트 권고
□ 개요 o Check Point社는 자사 제품에서 발생하는 취약점을 해결한 보안 업데이트 발표 \[1\]\~\[6\] o 영향을 받는 버전을 사용 중인 사용자는 해결 방안에 따라 최신 버전으로 업데이트 권고 □ 설명 o Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server에서 발생하는 Stack-based Buffer Overflow 취약점(CVE-2026-91843) \[1\]\
美 CISA 발표 주요 Exploit 정보공유(Update. 2026-09-18)
□ 개요 o 美 CISA에서 현재 자주 악용되고 있는 취약점 목록 발표 [1] o 영향을 받는 버전을 사용 중인 사용자는 해결 방안에 따라 최신 버전으로 업데이트 권고 □ 영향을 받는 제품 | CVE | 제조사 | 취약점 | 내용 | 조치사항 | | :—: | :—: | :—: | — | — | | CVE-2025-39682 | Linux | Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability | L
KrCERT 취약점
해당 수집 결과에 항목이 없습니다.
CISA 권고
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2025-39964 Linux Kernel Race Condition Vulnerability CVE-2026-53266 Linux Kernel Out-of-Bounds Write Vulnerability These types of vulnerabilities are a frequent
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2025-39682 Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability This type of vulnerability is a frequent attack vector for malicious cyb
ABB Ability Edgenius
View CSAF Summary ABB is aware of public reports of a vulnerability CVE‑2026‑31431 (Copy Fail) in the product versions listed as affected in the advisory. An update is available that resolves a publicly reported vulnerability. CVE‑2026‑31431 (Copy Fail) is a Linux kernel vulnerability that may allow
Mitsubishi Electric CC-Link IE TSN Communication Protocol (Update A)
View CSAF Summary Successful exploitation of this vulnerability could allow an attacker with access to the same network segment to tamper with communication data in the affected product by sending specially crafted packets under specific timing conditions. This could allow the attacker to cause a de
Schneider Electric PowerChute Serial Shutdown
View CSAF Summary Schneider Electric is aware of vulnerabilities in its PowerChute Serial Shutdown product. The PowerChute Serial Shutdown product is a UPS management software enabling graceful system shutdown and energy management capabilities for desktops, servers and workstations. Failure to appl
Mitsubishi Electric GX Works3 and Motion Control Settings
View CSAF Summary Successful exploitation of this vulnerability could allow a local attacker to successfully authenticate even with an invalid block password by executing the affected product and modify part of the executable module in memory, and thereby allows the attacker to view, tamper with, de
Hitachi Energy FACTS Control Platform (FCP)
View CSAF Summary Hitachi Energy is aware of vulnerabilities that affect the FACTS Control systems with GWS component listed in this document. An attacker exploiting these vulnerabilities can cause impact on confidentiality, integrity and availability of the product. Following FACTS Control systems
Schneider Electric NetBotz 5 750/755
View CSAF Summary Schneider Electric is aware of multiple vulnerabilities in its NetBotz 5 – 750/755 products.The NetBotz 5 – 750/755 products are security and environmental monitors providing temperature, humidity, leak, smoke, vibration, door contact, and video monitoring capabilities. Failure to
SANS ISC 동향
HTTP QUERY Method: The Grey Zone Between GET And POST., (Fri, Sep 18th)
In June 2026 the IETF published RFC 10008[1], defining a new HTTP method: “QUERY”. The HTTP protocol faced already by changes (HTTP/2, HTTP/2) but it’s the first new standard HTTP verb since “PATCH” in 2010!
ISC Stormcast For Friday, September 18th, 2026 https://isc.sans.edu/podcastdetail/10100, (Fri, Sep 18th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
LausivLoader analysis, or how to pass data between malware stages, (Thu, Sep 17th)
At the end of August, a malspam message was caught in the quarantine of a mail gateway operated by one of my customers. The message was not especially remarkable â;€;“; it asked the recipient to review some attached requirements and provide a price quotation for a fiber optic system and appeared to
ISC Stormcast For Thursday, September 17th, 2026 https://isc.sans.edu/podcastdetail/10098, (Thu, Sep 17th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
패키지 보안 권고 — GHSA
해당 수집 결과에 항목이 없습니다.