Katalog CVE (hal. 108)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 258.834 (Critical 35.935 · High 103.510 · KEV 1.746 · sejak 2020) · Pembaruan terakhir: 16 Okt 2026, 06:27 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 5.351–5.400 dari 258.834 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-107362 Malcolm file-upload component ships the upstream FilePond PHP server (pqina/filepond-server-php) largely unmodified: Dockerfile copies all upstream *.php files and Malcol...	7.1 High	—	0,35%	8 Okt 2026
CVE-2026-107361 The Arkime live capture service (arkime-live) in Malcolm runs with network_mode: host, exposing port 8005 on all network interfaces (viewHost=0.0.0.0). Arkime trusts the...	4.2 Medium	—	0,23%	8 Okt 2026
CVE-2026-107337 The Malcolm kiosk Flask application exposes a POST /script_call/<script> endpoint with zero authentication and wildcard CORS (CORS(app)). An attacker can force the operat...	7.1 High	—	0,13%	8 Okt 2026
CVE-2026-107336 Malcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive regex matcher but a case-sensitive rewrite. A request whose...	6.5 Medium	—	0,24%	8 Okt 2026
CVE-2026-107335 Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives...	6.5 Medium	—	0,46%	8 Okt 2026
CVE-2026-107334 Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restricted path (e.g. /htadmin, /auth, /admin_login, /ar...	5.4 Medium	—	0,21%	8 Okt 2026
CVE-2026-107333 Malcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based role-based access control (RBAC) authorization layer and nginx's...	8.1 High	—	0,98%	8 Okt 2026
CVE-2026-107332 Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local users to obtain CodeCatalyst bearer tokens via rea...	5.5 Medium	—	0,11%	8 Okt 2026
CVE-2026-107303 JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. Prior to generator-jhipster 9.4.0 and...	7.6 High	—	0,26%	8 Okt 2026
CVE-2026-107302 msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the decoder reads the four-byte length of a map32 value before validating that the co...	7.5 High	—	0,43%	8 Okt 2026
CVE-2026-88647 A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name fallback mechanism and eavesdrop on communications via a crafted certifica...	9.1 Critical	—	0,21%	8 Okt 2026
CVE-2026-61801 The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not...	5.5 Medium	—	0,11%	8 Okt 2026
CVE-2026-50055 A policy-enforcement flaw in Zimbra Collaboration Suite allows an authenticated user to bypass disabled mail forwarding by using a Sieve notify action to send copies of e...	6.5 Medium	—	0,27%	8 Okt 2026
CVE-2026-50054 An authorization flaw in Zimbra Collaboration Suite’s GrantRightsRequest allows an attacker with access to an authenticated account to grant another local account the log...	7.1 High	—	0,17%	8 Okt 2026
CVE-2026-107709 A path traversal vulnerability exists in Bower decompress-zip through version 0.3.3. The vulnerability located in `lib/decompress-zip.js` improperly validates archive ent...	7.8 High	—	0,23%	8 Okt 2026
CVE-2026-107301 msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, constructing msgpack5 with an empty or partial options object disables the default pr...	6.5 Medium	—	0,37%	8 Okt 2026
CVE-2026-107300 msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value...	7.5 High	—	0,43%	8 Okt 2026
CVE-2026-10631 An authorization bypass in the EWS FindItem handler of Zimbra Collaboration Suite 10.1.0 through 10.1.19 allows an authenticated user with EWS enabled to read complete ma...	6.5 Medium	—	0,21%	8 Okt 2026
CVE-2026-107299 msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1 as incomplete input i...	5.9 Medium	—	0,39%	8 Okt 2026
CVE-2026-107298 msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the array and map decoding paths have no nesting-depth limit, allowing an attacker wh...	5.3 Medium	—	0,37%	8 Okt 2026
CVE-2026-107297 msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever...	5.9 Medium	—	0,39%	8 Okt 2026
CVE-2026-107296 msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, decoding a negative signed 64-bit integer modifies the corresponding bytes in the cal...	3.7 Low	—	0,28%	8 Okt 2026
CVE-2026-107295 pydantic ai Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 1.107.4 and 2.28.0, the Agent.to_web() and clai web...	7.6 High	—	0,16%	8 Okt 2026
CVE-2026-107294 pydantic ai Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.2 and 2.24.0, web_fetch_tool, the WebFetch loc...	6.5 Medium	—	0,44%	8 Okt 2026
CVE-2026-107293 pydantic ai Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.4 and 2.27.1, OpenTelemetry instrumentation con...	5.3 Medium	—	0,30%	8 Okt 2026
CVE-2026-107292 pydantic ai Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 2.30.0, the Agent.to_web() and clai web development...	6.4 Medium	—	0,13%	8 Okt 2026
CVE-2026-107291 pydantic ai Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.6 and 2.44.0, OpenTelemetry instrumentation con...	4.3 Medium	—	0,52%	8 Okt 2026
CVE-2026-107290 pydantic ai Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local web_fetch_tool and the...	6.5 Medium	—	0,44%	8 Okt 2026
CVE-2026-105436 Deserialization of Untrusted Data vulnerability in MainWP MainWP Child mainwp-child allows Object Injection.This issue affects MainWP Child: from n/a through 6.2.1.	8.8 High	—	0,25%	8 Okt 2026
CVE-2026-104078 Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bundled MathJax 3.2.2 Safe component that allows attackers to execute arbitrary code by embed...	7.8 High	—	0,17%	8 Okt 2026
CVE-2026-104077 Obsidian Desktop before 1.14.0 contains a remote code execution vulnerability that allows attackers to craft malicious Markdown notes exploiting insufficient sanitization...	7.8 High	—	0,26%	8 Okt 2026
CVE-2026-95208 An issue in the ConfirmNameConstraints() function (wolfcrypt/src/asn.c) of wolfSSL v5.9.1 and v5.9.2 allows attackers to cause a Denial of Service (DoS) via providing cra...	7.5 High	—	0,17%	8 Okt 2026
CVE-2026-19585 HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow...	5.3 Medium	—	0,21%	8 Okt 2026
CVE-2026-107678 ffmpeg FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitI...	4.7 Medium	—	0,09%	8 Okt 2026
CVE-2026-107677 ffmpeg FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplat...	4.7 Medium	—	0,14%	8 Okt 2026
CVE-2026-107676 ffmpeg FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when to...	3.3 Low	—	0,14%	8 Okt 2026
CVE-2026-107675 ffmpeg FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP se...	5.9 Medium	—	0,19%	8 Okt 2026
CVE-2026-107660 ffmpeg FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tls_open() of libavformat/tls_mbedtls.c, which skips hostname checks...	4.8 Medium	—	0,14%	8 Okt 2026
CVE-2026-107289 pydantic ai Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.56.0 until 1.107.6 and 2.44.0, applications that opt attacker-i...	6.8 Medium	—	0,32%	8 Okt 2026
CVE-2026-107288 pydantic ai Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local web_fetch_tool and the...	3.7 Low	—	0,37%	8 Okt 2026
CVE-2026-107287 pydantic ai Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.7 and 2.52.0, the local web_fetch_tool and the...	6.5 Medium	—	0,28%	8 Okt 2026
CVE-2026-106177 A kernel buffer overflow vulnerability in HP Sure Click versions prior to 4.4.33 may allow local privilege escalation or arbitrary code execution. HP has released version...	6.4 Medium	—	0,10%	8 Okt 2026
CVE-2026-93034 SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditionally deserializing PickleWrapper payloads via pickle.loads() in _ma...	9.8 Critical	—	0,46%	8 Okt 2026
CVE-2026-9209 mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQueryButton postback and exp...	9.8 Critical	—	0,69%	8 Okt 2026
CVE-2026-93017 The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restricti...	7.7 High	—	0,21%	8 Okt 2026
CVE-2026-14999 ibm datapower gateway IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to bypass...	7.5 High	—	0,19%	8 Okt 2026
CVE-2026-14992 ibm datapower gateway IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 vulnerable to buffer overflow.	9.8 Critical	—	0,31%	8 Okt 2026
CVE-2026-14988 ibm datapower gateway IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to buffer overflow.	9.8 Critical	—	0,26%	8 Okt 2026
CVE-2026-14905 ibm datapower gateway IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to an XML external entity...	8.2 High	—	0,34%	8 Okt 2026
CVE-2026-14888 ibm datapower gateway IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execut...	9.8 Critical	—	0,38%	8 Okt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.