Katalog CVE (hal. 141)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 259.006 (Critical 35.945 · High 103.582 · KEV 1.746 · sejak 2020) · Pembaruan terakhir: 16 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 7.001–7.050 dari 259.006 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-104032 A flaw was found in SSSD. An unprivileged local user can repeatedly request master automount map updates through the autofs responder due to missing authorization checks....	5.5 Medium	—	0,10%	6 Okt 2026
CVE-2026-104031 A flaw was found in SSSD. In configurations where the autofs responder service is enabled, memory allocated during successful request processing is not released until the...	5.5 Medium	—	0,10%	6 Okt 2026
CVE-2026-82989 There is an input injection in vCast exposed network services in ViewSonic ViewBoard that allows a remote, unauthenticated attacker to inject arbitrary input into service...	9.8 Critical	—	0,67%	6 Okt 2026
CVE-2026-82988 There exists an arbitrary file download in vCast APK delivery mechanism in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to trigger unprivileged A...	7.5 High	—	0,46%	6 Okt 2026
CVE-2026-105786 Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, packages/server/src/models/ApplicationModel.ts...	8.5 High	—	0,29%	6 Okt 2026
CVE-2026-105785 Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to Joplin Server 3.7.2, packages/server/src/models/TokenMo...	4.8 Medium	—	0,19%	6 Okt 2026
CVE-2026-105784 Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, selecting a note containing a jsoncanvas fence...	4.6 Medium	—	0,20%	6 Okt 2026
CVE-2026-105783 Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in...	8.0 High	—	0,15%	6 Okt 2026
CVE-2026-105782 Scrapy is a high-level web crawling and scraping framework for Python. From 1.4.0 until 2.14.2, RefererMiddleware in scrapy/spidermiddlewares/referer.py treated a Referre...	7.5 High	—	0,38%	6 Okt 2026
CVE-2026-105764 Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.4, an authenticated non-admin user could upload SVG files that thumbnail-genera...	7.7 High	—	0,27%	6 Okt 2026
CVE-2026-105763 Twenty is an open-source CRM (customer relationship management) platform. From 1.20.10 until 2.7.0, the /metadata GraphQL connectedAccounts query returned connectionParam...	9.6 Critical	—	0,28%	6 Okt 2026
CVE-2026-105762 Dify is an open-source LLM app development platform. Prior to 1.13.0, the /console/api/remote-files/upload endpoint in api/controllers/web/remote_files.py accepted an att...	8.3 High	—	0,35%	6 Okt 2026
CVE-2026-105471 A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Impacted is an unknown function of th...	7.3 High	—	0,26%	6 Okt 2026
CVE-2026-105761 Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps/<app_id>/server endpoint in api/controllers/console/app/mcp_server.p...	7.1 High	—	0,25%	5 Okt 2026
CVE-2026-105760 vLLM is an inference and serving engine for large language models. Prior to 0.30.0, a caller can use the request-level media_io_kwargs field to select the GLMGA video bac...	5.3 Medium	—	0,30%	5 Okt 2026
CVE-2026-105759 vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend's track_http_metrics middleware records the raw HTTP method token as...	5.9 Medium	—	0,33%	5 Okt 2026
CVE-2026-105758 vllm vLLM is an inference and serving engine for large language models. From 0.24.0 until 0.30.0, the Qwen2VLVideoBackend and Qwen3VLVideoBackend classes accept request-level...	5.3 Medium	—	0,30%	5 Okt 2026
CVE-2026-105757 vllm vLLM is an inference and serving engine for large language models. Prior to 0.30.0, structured-output request failures can escape request-scoped validation and reach the...	6.5 Medium	—	0,31%	5 Okt 2026
CVE-2026-105756 vllm vLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible request models accept a non-empty cache_salt value without enforcing...	6.5 Medium	—	0,31%	5 Okt 2026
CVE-2026-105755 vllm vLLM is an inference and serving engine for large language models. Prior to 0.30.0, flash late-interaction scoring at the /score and /rerank endpoints derives each worker...	4.2 Medium	—	0,20%	5 Okt 2026
CVE-2026-105754 vllm vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the /inference/v1/generate endpoint in the disaggregated scale-out path accepts caller...	6.5 Medium	—	0,27%	5 Okt 2026
CVE-2026-105753 vllm vLLM is an inference and serving engine for large language models. Prior to 0.28.0, the default mirrored multimodal LRU cache can commit a media hash in the frontend send...	6.5 Medium	—	0,43%	5 Okt 2026
CVE-2026-105752 vllm vLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations submitted through "POST /v1/responses" requests rebuild the...	3.1 Low	—	0,22%	5 Okt 2026
CVE-2026-105470 A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This issue affects the function mysqli_que...	7.3 High	—	0,26%	5 Okt 2026
CVE-2026-105469 A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This vulnerability affects unknown code of...	7.3 High	—	0,33%	5 Okt 2026
CVE-2026-104852 GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inher...	8.2 High	—	0,36%	5 Okt 2026
CVE-2026-93321 A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon.	6.9 Medium	—	0,16%	5 Okt 2026
CVE-2026-93315 When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operate outside the build rootfs, or...	5.8 Medium	—	0,10%	5 Okt 2026
CVE-2026-91107 openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staff_id and cause the School Information upd...	9.3 Critical	—	0,24%	5 Okt 2026
CVE-2026-21589 atlassian bitbucket data center, atlassian bitbucket server +7 lainnya This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data C...	7.5 High	KEV	2,8%	5 Okt 2026
CVE-2026-105751 Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until 2.120.3, docling/backend...	6.9 Medium	—	0,37%	5 Okt 2026
CVE-2026-105750 docling Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.82.0 until 2.118.1, HTMLBackendOptio...	7.5 High	—	0,30%	5 Okt 2026
CVE-2026-105749 docling Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.0.0 until 2.131.0, the HTML, JATS, O...	6.5 Medium	—	0,27%	5 Okt 2026
CVE-2026-105748 docling Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.16.0 until 2.131.0, the InputFormat....	4.3 Medium	—	0,22%	5 Okt 2026
CVE-2026-105747 docling Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.45.0 until 2.131.0, METS-GBS format...	4.3 Medium	—	0,23%	5 Okt 2026
CVE-2026-105746 docling Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.83.0 until 2.131.0, the KServeV2OcrM...	5.3 Medium	—	0,22%	5 Okt 2026
CVE-2026-105745 docling Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.27.0 until 2.131.0, Docling plugin f...	7.8 High	—	0,12%	5 Okt 2026
CVE-2026-105744 docling Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, callers that opt...	8.8 High	—	0,34%	5 Okt 2026
CVE-2026-105743 docling Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.91.0 until 2.132.0, validate_url_saf...	5.8 Medium	—	0,19%	5 Okt 2026
CVE-2026-105742 docling Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.95.0 until 2.132.0, the HTML image r...	5.3 Medium	—	0,23%	5 Okt 2026
CVE-2026-105468 A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects the function mysqli_query of the f...	7.3 High	—	0,26%	5 Okt 2026
CVE-2026-103546 In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause...	4.3 Medium	—	0,15%	5 Okt 2026
CVE-2026-103433 Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs. An untrusted Bake definition can expose a readable file through a pathles...	6.9 Medium	—	0,29%	5 Okt 2026
CVE-2026-0482 In AMD Versal™ Adaptive SoC devices, insufficient boundary checks in USB boot mode—when enabled through board modifications—could allow crafted images to trigger a buffer...	5.4 Medium	—	0,13%	5 Okt 2026
CVE-2026-0461 Insufficient boundary validation in the USB boot mode implementation of AMD Zynq™ UltraScale+ MPSoC and RFSoC devices could allow unbounded Device Firmware Upgrade (DFU)...	7.5 High	—	0,13%	5 Okt 2026
CVE-2026-93326 A build step for a Git source, crafted in a specific way, can bypass some policy validation rules. A malicious build definition can make the repository look like it is co...	6.0 Medium	—	0,25%	5 Okt 2026
CVE-2026-84900 Previous versions of HP ThinPro (prior to HP ThinPro 8.1 SP10) could potentially contain security vulnerabilities. HP has released HP ThinPro 8.1 SP10, which includes upd...	6.8 Medium	—	0,14%	5 Okt 2026
CVE-2026-77226 Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly d...	8.1 High	—	0,69%	5 Okt 2026
CVE-2026-105773 Canimaan Software ClamXAV versions 3.3 - 3.11 contains a local privilege escalation vulnerability in the Privileged Helper Tool caused by a race condition and insufficien...	7.0 High	—	0,14%	5 Okt 2026
CVE-2026-105768 apko allows users to build and publish OCI container images built from apk packages. From version 0.2.0 to before version 1.4.5, UserEntry.Parse and GroupEntry.Parse in p...	6.3 Medium	—	0,30%	5 Okt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.