Katalog CVE (hal. 119)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 258.897 (Critical 35.936 · High 103.540 · KEV 1.746 · sejak 2020) · Pembaruan terakhir: 16 Okt 2026, 12:28 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 5.901–5.950 dari 258.897 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-42617 tuxera ntfs-3g In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ir_to_ib() in index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by...	7.1 High	—	0,15%	7 Okt 2026
CVE-2026-43976 wger is a free, open-source workout and fitness manager. Prior to version 2.6, five gym management views in wger apply a flawed gym-scope guard (`gym_a != gym_b`) that si...	7.1 High	—	0,22%	7 Okt 2026
CVE-2026-42618 tuxera ntfs-3g In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_decompress() in compress.c that allows an attacker to corrupt one byte of heap memory in the SUID-root n...	7.1 High	—	0,15%	7 Okt 2026
CVE-2026-107194 Sungrow iSolarCloud before 2026 allows authentication bypass and account takeover via "login_type":"5" in a login request, potentially leading to "local blackouts on the...	9.2 Critical	—	0,34%	7 Okt 2026
CVE-2026-107183 llama.cpp before b11393 contains a use-after-free and double free vulnerability in common_chat_peg_mapper::map that allows unauthenticated remote attackers to corrupt hea...	8.1 High	—	0,42%	7 Okt 2026
CVE-2026-107181 Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted t...	8.1 High	—	0,35%	7 Okt 2026
CVE-2026-102258 Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions cou...	6.1 Medium	—	0,39%	7 Okt 2026
CVE-2026-102257 A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extract files outside the intended destination directory...	7.2 High	—	0,65%	7 Okt 2026
CVE-2026-42532 A path traversal vulnerability exists in the EmailSheet extract_parts functionality of VisiData (version(s): dev (commit 38b21f78)). A specially crafted .eml file can lea...	5.5 Medium	—	0,13%	7 Okt 2026
CVE-2026-41958 A path traversal vulnerability exists in the unzip_http RemoteZipFile extract functionality of VisiData (version(s): dev (commit 38b21f78)). A specially crafted .zip file...	6.5 Medium	—	0,25%	7 Okt 2026
CVE-2026-107180 On MISP instances configured to require TOTP enrolment (Security.otp_required), the enforcement of the mandatory two-factor authentication setup applied only to standard...	7.1 High	—	0,32%	7 Okt 2026
CVE-2026-107177 Express Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerability that allows attackers with datastore access to decrypt stored OAuth 2.0 token secrets...	5.9 Medium	—	0,32%	7 Okt 2026
CVE-2026-107175 MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distribution level or sharing group...	5.3 Medium	—	0,21%	7 Okt 2026
CVE-2026-107170 A flaw was found in m17n-lib. A partial failure during library initialization can leave an internal driver pointer uninitialized. Under specific error conditions, such as...	2.9 Low	—	0,10%	7 Okt 2026
CVE-2026-107168 A flaw was found in m17n-lib. By providing crafted input containing an invalid UTF-8 character sequence, an attacker can cause the text parsing function to enter an infin...	6.2 Medium	—	0,11%	7 Okt 2026
CVE-2026-107162 Express Gateway through 1.16.11 contains an authentication bypass vulnerability in the OAuth 2.0 refresh_token grant that fails to validate the token secret or issuing cl...	6.8 Medium	—	0,29%	7 Okt 2026
CVE-2026-107151 Missing authentication has been found in remote-execution task updates in the smart_proxy_dynflow package. The progress and completion callbacks accept a report when the...	5.9 Medium	—	0,38%	7 Okt 2026
CVE-2026-105140 Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 contains a race condition in auth provider group refreshes that can restore group memberships just revoked in the ident...	4.2 Medium	—	0,18%	7 Okt 2026
CVE-2026-105139 Obot 0.26.0 before 0.26.2 contains an authorization bypass vulnerability that allows authenticated users matching any vMCP profile to reach prompts and resources of ungra...	4.3 Medium	—	0,23%	7 Okt 2026
CVE-2026-105138 Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries...	6.5 Medium	—	0,26%	7 Okt 2026
CVE-2026-103435 Claude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at write time without repeat...	7.7 High	—	0,25%	7 Okt 2026
CVE-2026-102256 Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 appliance...	7.8 High	—	0,49%	7 Okt 2026
CVE-2026-102255 A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote un...	10.0 Critical	—	0,48%	7 Okt 2026
CVE-2026-42710 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 10Web Slider by 10Web slider-wd allows Blind SQL Injection.This issu...	7.6 High	—	0,23%	7 Okt 2026
CVE-2026-42708 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AF themes WP Post Author wp-post-author allows Blind SQL Injection.T...	7.6 High	—	0,23%	7 Okt 2026
CVE-2026-107159 MiniUPnPd through 2.3.11 built with --strict contains a divide-by-zero vulnerability in ProcessSSDPData() that allows unauthenticated local network attackers to crash the...	6.5 Medium	—	0,24%	7 Okt 2026
CVE-2026-106059 GitAhead through 2.7.1 on macOS contains a command injection vulnerability that allows attackers to execute shell commands by crafting repository filenames interpolated u...	8.8 High	—	1,3%	7 Okt 2026
CVE-2026-106058 GitAhead through 2.7.1 contains an OS command injection vulnerability in src/git/Filter.cpp that allows malicious repositories to execute commands by substituting crafted...	7.5 High	—	1,2%	7 Okt 2026
CVE-2026-106057 patool before 4.0.6 contains an OS command injection vulnerability on Windows because shell_quote_nt fails to escape cmd.exe metacharacters or embedded double quotes in a...	7.8 High	—	0,76%	7 Okt 2026
CVE-2026-106056 Rundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permission to execute commands on Windows nodes by supply...	7.5 High	—	1,2%	7 Okt 2026
CVE-2026-96408 A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL que...	9.3 Critical	—	0,64%	7 Okt 2026
CVE-2026-92533 Path traversal vulnerability in the BugTracker.NET file download component. The parameter used to specify the file name does not properly validate user-supplied paths. An...	7.1 High	—	0,36%	7 Okt 2026
CVE-2026-92532 Unrestricted file upload vulnerability in the BugTracker.NET attachment functionality. An authenticated user with administrator privileges could modify the application co...	7.5 High	—	0,30%	7 Okt 2026
CVE-2026-92531 Operating system command injection vulnerability in the SVN integration component of BugTracker.NET. The application incorporates the value of the field corresponding to...	7.5 High	—	0,93%	7 Okt 2026
CVE-2026-42714 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Piggly Dev Pix por Piggly (para Woocommerce) pix-por-piggly allows B...	7.6 High	—	0,23%	7 Okt 2026
CVE-2026-42713 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Gopiplus Post title marquee scroll post-title-marquee-scroll allows...	7.6 High	—	0,23%	7 Okt 2026
CVE-2026-103668 An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary SQL query on the af...	8.8 High	—	0,43%	7 Okt 2026
CVE-2026-97294 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows...	6.5 Medium	—	0,13%	7 Okt 2026
CVE-2026-97146 Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a secondary label on the pod. If the pod has the label 'app=yunikorn' the...	4.8 Medium	—	0,35%	7 Okt 2026
CVE-2026-92393 Apache YuniKorn 1.9.0 and earlier does not implement label and user annotation checks for workload UPDATE action bypassing all checks. Workloads in YuniKorn are defined a...	2.0 Low	—	0,31%	7 Okt 2026
CVE-2026-78243 Apache YuniKorn 1.8.0 and later, if configured with the LDAP group resolver, crashes due to an out of bounds read processing group membership entries.If the LDAP server r...	2.1 Low	—	0,29%	7 Okt 2026
CVE-2026-42721 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SERVIT Software Solutions affiliate-toolkit affiliate-toolkit-starte...	7.6 High	—	0,23%	7 Okt 2026
CVE-2026-42720 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sarah Giles Dynamic User Directory dynamic-user-directory allows Bli...	7.6 High	—	0,23%	7 Okt 2026
CVE-2026-27434 Missing Authorization vulnerability in sc Internet Vivoo WP Rentals wprentals allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects W...	5.3 Medium	—	0,18%	7 Okt 2026
CVE-2026-105884 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Media Rocket Lazy Load rocket-lazy-load allows Stored XSS.This is...	6.5 Medium	—	0,13%	7 Okt 2026
CVE-2026-105876 Missing Authorization vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Retrieve Embedded Sensitive Data.This issue affects Modula Image Gall...	5.3 Medium	—	0,25%	7 Okt 2026
CVE-2026-105875 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Prime Slider – Addons For Elementor bdthemes-prime-slider-l...	6.5 Medium	—	0,21%	7 Okt 2026
CVE-2026-105873 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite al...	6.5 Medium	—	0,21%	7 Okt 2026
CVE-2026-105871 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite al...	6.5 Medium	—	0,21%	7 Okt 2026
CVE-2026-105192 LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks. Messages on th...	9.8 Critical	—	0,48%	7 Okt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.