CVE 検索
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ（NVD、OSV、GitHub）を、CVSS、EPSS、実際に悪用されているか（CISA KEV）とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ（NVD、OSV、GitHub）を、CVSS、EPSS、実際に悪用されているか（CISA KEV）とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
| 28/10/2026 |
| CVE-2026-110182 | 中4.3 | PostgreSQL Anonymizer contains a vulnerability related to the anon.partial() and anon.partial_email() functions. These function can reveal the while data if the data is small enough. The issue is fixed in PostgreSQL Anonymizer 3.3.0 and later versions. | 28/10/2026 |
| CVE-2026-110181 | 中6.5 | PostgreSQL Anonymizer contains a vulnerability related to anonymization functions defined using SQL-standard function bodies. PostgreSQL analyses such functions at declaration time, while Anonymizer only attempts to check them at execution time. This problem can be exploited by any user with the TEMPORARY privilege. Th | 28/10/2026 |
| CVE-2026-105620 | 中6.5 | PostgreSQL Anonymizer doesn't mask data returned by a sub-query in a rule. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions. | 28/10/2026 |
| CVE-2026-105619 | 中4.8 | PostgreSQL Anonymizer doesn't mask data accessed thru a security_invoker view. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions. | 28/10/2026 |
| CVE-2026-105618 | 中5.7 | PostgreSQL Anonymizer's documentation recommends applying rules on partitions and inheritance tables. Direct access to the paritions / inheritance tables is masked but not thru the parent table. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions. | 28/10/2026 |
| CVE-2026-105617 | 中6.5 | PostgreSQL Anonymizer doesn't invalidate plans prepared after a rule was added or a role changed. Users using such plans can still see the unmasked data until the end of the session. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions. | 28/10/2026 |
| CVE-2026-105616 | 中5.7 | PostgreSQL restricts acces to the salt and shift via the `SHOW` command for users not member of `pg_read_all_settings`. But they are visible in `pg_db_role_setting` or `pg_roles` if they were set on the database, user or both. PostgreSQL Anonymizer's documentation recommends to use ALTER DATABASE / ALTER ROLE for the s | 28/10/2026 |
| CVE-2026-105615 | 低3.5 | PostgreSQL's optimized statistics on a table are visible as long as you have SELECT privilege on said table. A masked role can therefore read a limited subset of the data through the statistics view's histograms and mcvs. The vulnerability is resolved in PostgreSQL Anonymizer 3.3.0 and later versions. | 28/10/2026 |
| CVE-2026-105614 | 中4.7 | PostgreSQL Anonymizer's `anon.image_blur()` function doesn't check the declared dimension of the provided image, allowing an attacker to provide a small image with enormous declared dimensions. This vulnerability can be exploited to exhaust the memory of a backend and OOM-kill it (when ovecommit is on), which results i | 28/10/2026 |
| CVE-2026-105613 | 中4.7 | PostgreSQL Anonymizer's range-based dummy functions dont constraint the range size. This vulnerability can be exploited to exhaust the memory of a backend and OOM-kill it (when ovecommit is on), which results in a cluster-wide crash recovery. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions. | 28/10/2026 |
| CVE-2026-105612 | 低3.5 | PostgreSQL Anonymizer contains a vulnerability that data-modifying CTEs to bypass the read-only restriction of masked roles. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions | 28/10/2026 |
| CVE-2026-93536 | 中5.3 | A use after free caused by missing lifecycle management of gesture sprites in GestureBuildSprite() in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash the X server or potentially execute code. | 28/10/2026 |
| CVE-2026-93524 | 中6.9 | A buffer overread in CheckKeySyms() in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to leak small amounts of information from X server memory or potentially crash the X server. | 28/10/2026 |
| CVE-2026-93523 | 高7.8 | A heap buffer overflow caused by a XIPassiveUngrabDevice request with an out-of-range modifier value in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context. | 28/10/2026 |
| CVE-2026-88967 | 高7.7 | A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data source's Azure access token (server-side request forgery). | 28/10/2026 |
| CVE-2026-88858 | 中6.5 | A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts. | 28/10/2026 |
| CVE-2026-83525 | 中6.5 | Incorrect operator (CWE-480) in the FetchSnapshot RPC handler
in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2
on all platforms allows an authenticated attacker with
CLUSTER_ACTION privilege to cause a denial of service
(controller process termination) via a crafted
FetchSnapshotRequest with an empt | 28/10/2026 |