脆弱性とエクスプロイト

エクスプロイトカタログ

自前の研究から得たゼロデイと、侵入事案から回収した n-day です。各解説記事では、脆弱性の種別、影響、検知方法、公開されている概念実証へのリンクを示しています。

エクスプロイト

21 件の対象

CVE あり

割り当て済み

CISA KEV 掲載

悪用確認済み

完全なレポートあり

詳細解析へリンク

djangorestframework 1

djangorestframework remote code execution (CVE-2026-114137) CVSS 7.4 HighEPSS 0.35% (p27) CVE-2026-114137 n-day Arbitrary code execution against the vulnerable build October 21, 2026

org.http4s:http4s-scala-xml_2.12 1

org.http4s:http4s-scala-xml_2.12 remote code execution (CVE-2026-61741) CVSS 9.3 CriticalEPSS 0.29% (p20) CVE-2026-61741 n-day Arbitrary code execution against the vulnerable build September 24, 2026

io.moquette:moquette-broker 1

io.moquette:moquette-broker remote code execution (CVE-2026-85724) CVSS 9.6 CriticalEPSS 0.27% (p17) CVE-2026-85724 n-day Arbitrary code execution against the vulnerable build September 23, 2026

lightrag-hku 1

lightrag-hku remote code execution (CVE-2026-85734) CVSS 9.1 CriticalEPSS 0.36% (p27) CVE-2026-85734 n-day Arbitrary code execution against the vulnerable build September 22, 2026

mcp-atlassian 1

mcp-atlassian remote code execution (CVE-2026-77244) CVSS 10.0 CriticalEPSS 0.50% (p42) CVE-2026-77244 n-day Arbitrary code execution against the vulnerable build September 22, 2026

lmdeploy 2

lmdeploy remote code execution (CVE-2025-66455) CVSS 9.8 CriticalEPSS 0.70% (p52) CVE-2025-66455 n-day Arbitrary code execution from loading untrusted input September 18, 2026
lmdeploy remote code execution (CVE-2026-33625) CVSS 8.8 HighEPSS 0.24% (p16) CVE-2026-33625 n-day Arbitrary code execution against the vulnerable build September 18, 2026

org.opencastproject:opencast-engage-paella-player-7 1

org.opencastproject:opencast-engage-paella-player-7 remote code execution (CVE-2026-77615) CVSS 8.7 HighEPSS 0.39% (p33) CVE-2026-77615 n-day Arbitrary code execution against the vulnerable build September 17, 2026

@vendure/core 1

@vendure/core remote code execution (CVE-2026-63472) CVSS 9.1 Critical CVE-2026-63472 n-day Arbitrary code execution against the vulnerable build September 17, 2026

djust 1

djust remote code execution (CVE-2026-61594) CVSS 9.1 CriticalEPSS 0.43% (p36) CVE-2026-61594 n-day Arbitrary code execution against the vulnerable build September 16, 2026

org.http4s:http4s-ember-core_2.12 1

org.http4s:http4s-ember-core_2.12 remote code execution (CVE-2026-69204) CVSS 9.2 CriticalEPSS 0.33% (p26) CVE-2026-69204 n-day Arbitrary code execution against the vulnerable build September 15, 2026

@zereight/mcp-gitlab 1

@zereight/mcp-gitlab remote code execution (CVE-2026-61568) CVSS 9.6 CriticalEPSS 0.32% (p25) CVE-2026-61568 n-day Arbitrary code execution against the vulnerable build September 15, 2026

yayson 1

yayson remote code execution (CVE-2026-61534) CVSS 9.1 Critical CVE-2026-61534 n-day Arbitrary code execution against the vulnerable build September 14, 2026

morgan 1

morgan remote code execution (CVE-2026-87859) CVSS 5.3 MediumEPSS 0.41% (p33) CVE-2026-87859 n-day Arbitrary code execution against the vulnerable build September 11, 2026

open-webui 1

open-webui remote code execution (CVE-2026-88006) CVSS 6.5 Medium CVE-2026-88006 n-day Arbitrary code execution against the vulnerable build September 10, 2026

httpx2 3

httpx2 remote code execution (CVE-2026-84378) CVSS 5.9 Medium CVE-2026-84378 n-day Arbitrary code execution against the vulnerable build September 2, 2026
httpx2 remote code execution (CVE-2026-84380) CVSS 5.6 Medium CVE-2026-84380 n-day Arbitrary code execution against the vulnerable build September 2, 2026
httpx2 remote code execution (CVE-2026-84382) CVSS 7.5 High CVE-2026-84382 n-day Arbitrary code execution against the vulnerable build September 2, 2026

gitpython 1

gitpython remote code execution (CVE-2026-78676) CVSS 9.8 Critical CVE-2026-78676 n-day Arbitrary code execution against the vulnerable build August 25, 2026

nltk 2

nltk remote code execution (CVE-2026-78683) CVSS 9.6 Critical CVE-2026-78683 n-day Arbitrary code execution from loading untrusted input August 25, 2026
nltk remote code execution (CVE-2026-79657) CVSS 9.8 Critical CVE-2026-79657 n-day Arbitrary code execution from loading untrusted input August 25, 2026

vllm 4

vllm remote code execution (CVE-2026-71486) CVSS 4.3 Medium CVE-2026-71486 n-day Arbitrary code execution from loading untrusted input August 17, 2026
vllm remote code execution (CVE-2026-73560) CVSS 6.5 Medium CVE-2026-73560 n-day Arbitrary code execution against the vulnerable build August 17, 2026
vllm remote code execution (CVE-2026-73557) CVSS 6.3 Medium CVE-2026-73557 n-day Arbitrary code execution from loading untrusted input August 13, 2026
vllm remote code execution (CVE-2026-73558) CVSS 5.3 Medium CVE-2026-73558 n-day Arbitrary code execution against the vulnerable build August 13, 2026

@mockoon/commons-server 1

@mockoon/commons-server remote code execution (CVE-2026-59148) CVSS 8.8 High CVE-2026-59148 n-day Arbitrary code execution against the vulnerable build July 9, 2026

Linux kernel 1

getroot — AF_ALG page-cache LPE and container escape CVSS 8.8 High CVE-2026-31431 n-day Local privilege escalation to root, with escape from a container to the host June 15, 2026

PyYAML 1

PyYAML FullLoader deserialization RCE (CVE-2020-14343) CVSS 9.8 Critical CVE-2020-14343 n-day Arbitrary code execution from loading untrusted input February 9, 2021

概念実証と取り扱い

概念実証がすでに公開されている場合は、解説記事から直接リンクしています。ここに登録されているものはすべて本物であり、一部は実際に動作するエクスプロイトコードなので、実行する際は、普段使うネットワークへの経路を持たない使い捨ての VM で行ってください。公開リンクのないものについては、[email protected] までメールで、所属と用途をお知らせください。