CVE 検索
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ（NVD、OSV、GitHub）を、CVSS、EPSS、実際に悪用されているか（CISA KEV）とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ（NVD、OSV、GitHub）を、CVSS、EPSS、実際に悪用されているか（CISA KEV）とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
| 17/09/2025 |
| CVE-2025-35434 | 緊急9.8 | CISA Thorium does not validate TLS certificates when connecting to Elasticsearch. An unauthenticated attacker with access to a Thorium cluster could impersonate the Elasticsearch service. Fixed in 1.1.2. | 17/09/2025 |
| CVE-2025-35433 | 高8.8 | CISA Thorium does not properly invalidate previously used tokens when resetting passwords. An attacker that possesses a previously used token could still log in after a password reset. Fixed in 1.1.1. | 17/09/2025 |
| CVE-2025-35432 | 高7.5 | CISA Thorium does not rate limit requests to send account verification email messages. A remote unauthenticated attacker can send unlimited messages to a user who is pending verification. Fixed in 1.1.1 by adding a rate limit set by default to 10 minutes. | 17/09/2025 |
| CVE-2025-35431 | 中5.4 | CISA Thorium does not escape user controlled strings used in LDAP queries. An authenticated remote attacker can modify LDAP authorization data such as group memberships. Fixed in 1.1.1. | 17/09/2025 |
| CVE-2025-35430 | 中6.5 | CISA Thorium does not adequately validate the paths of downloaded files via 'download_ephemeral' and 'download_children'. A remote, authenticated attacker could access arbitrary files subject to file system permissions. Fixed in 1.1.2. | 17/09/2025 |
| CVE-2023-7244 | 緊急9.8 | Industrial Control Systems Network Protocol Parsers (ICSNPP) - Ethercat
Zeek Plugin versions d78dda6 and prior are vulnerable to out-of-bounds
write in their primary analyses function for Ethercat communication
packets. This could allow an attacker to cause arbitrary code execution.
| 01/03/2024 |
| CVE-2023-7243 | 緊急9.8 |
Industrial Control Systems Network Protocol Parsers (ICSNPP) - Ethercat
Zeek Plugin versions d78dda6 and prior are vulnerable to out-of-bounds
write while analyzing specific Ethercat datagrams. This could allow an
attacker to cause arbitrary code execution.
| 01/03/2024 |
| CVE-2023-7242 | 高8.2 |
Industrial Control Systems Network Protocol Parsers (ICSNPP) - Ethercat
Zeek Plugin versions d78dda6 and prior are vulnerable to out-of-bounds
read during the process of analyzing a specific Ethercat packet. This
could allow an attacker to crash the Zeek process and leak some
information in memory.
| 01/03/2024 |