Katalog CVE (hal. 165)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 259.396 (Critical 35.986 · High 103.714 · KEV 1.747 · sejak 2020) · Pembaruan terakhir: 18 Okt 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 8.201–8.250 dari 259.396 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-104442 YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by supplyi...	5.8 Medium	—	0,32%	2 Okt 2026
CVE-2026-104441 YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary hosts and ports...	5.3 Medium	—	0,29%	2 Okt 2026
CVE-2026-104440 YesWiki before 4.6.7 contains a blind server-side request forgery vulnerability that allows unauthenticated attackers to make arbitrary server-side requests via the idtyp...	5.3 Medium	—	0,29%	2 Okt 2026
CVE-2026-104439 YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered email addresses throu...	5.3 Medium	—	0,34%	2 Okt 2026
CVE-2026-104438 YesWiki before 4.6.7 contains a missing authorization vulnerability in the listpagestag and includepages actions of the tags tool, which enumerate pages without applying...	5.3 Medium	—	0,30%	2 Okt 2026
CVE-2026-104437 Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for SIGHASH_SINGLE inputs lacking co...	7.4 High	—	0,21%	2 Okt 2026
CVE-2026-104436 Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to exhaust blocking-pool threads by sending oversized block lo...	3.7 Low	—	0,27%	2 Okt 2026
CVE-2026-104435 Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 consensus rule, accepting V5 transparent inputs signed with SIGHASH_SINGLE that lack a corresponding o...	7.4 High	—	0,21%	2 Okt 2026
CVE-2026-104434 ZcashFoundation Zebra zebra-rpc before 8.0.0 and zebrad before 4.5.0 contain a reachable assertion in the z_listunifiedreceivers RPC handler, which calls expect() on Sapl...	6.5 Medium	—	0,31%	2 Okt 2026
CVE-2026-104432 Zebra before 6.3.0 contains an improper exceptional condition check in ChainSync::obtain_tips that discards valid one-hash FindBlocks responses, falsely reporting close-t...	5.3 Medium	—	0,30%	2 Okt 2026
CVE-2026-104431 Zebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers to stall Tokio workers by submitting mempool transactions requiring expens...	7.5 High	—	0,34%	2 Okt 2026
CVE-2026-104430 Zebra zebrad 4.5.0 and zebra-script 7.0.0 count P2SH redeem script signature operations in legacy mode rather than zcashd's accurate P2SH mode, overcounting CHECKMULTISIG...	7.5 High	—	0,41%	2 Okt 2026
CVE-2026-104429 Zebra (zebrad) 5.0.0 before 6.0.0-rc.0 does not apply its per-peer mempool admission cap to transactions received as direct P2P tx messages, because these are queued with...	5.3 Medium	—	0,30%	2 Okt 2026
CVE-2026-104428 The getblock RPC method in zebra-rpc before 11.0.0, used by the Zcash Foundation's Zebra node, panics on verbosity 2 for a side-chain block because the block's -1 confirm...	5.3 Medium	—	0,39%	2 Okt 2026
CVE-2026-104427 Zebra before 6.1.0 contains an incomplete cleanup vulnerability in the state write task that allows remote unauthenticated peers to stall node synchronization by poisonin...	5.9 Medium	—	0,31%	2 Okt 2026
CVE-2026-104426 Zebra before 6.1.0 contains an inefficient algorithmic complexity vulnerability in remaining_transaction_value that clones the entire block-level spent-UTXO map per trans...	5.9 Medium	—	0,31%	2 Okt 2026
CVE-2026-104425 ZcashFoundation Zebra before 6.1.0 contains a resource exhaustion vulnerability that allows unauthenticated peers to degrade block processing by pushing transactions with...	5.3 Medium	—	0,30%	2 Okt 2026
CVE-2026-104424 Zebra before 6.1.0 contains an incorrect calculation vulnerability in its ZIP-317 block template selector that omits header and transaction-count size from the block budg...	3.7 Low	—	0,27%	2 Okt 2026
CVE-2026-104423 Zebra (zebrad) before 6.2.1 contains an asymmetric resource consumption vulnerability that allows unauthenticated peers to stall block verification by pushing V6 mempool...	7.5 High	—	0,34%	2 Okt 2026
CVE-2026-104422 The block sync download path in Zebra (zebrad) before 6.3.0 reads a block's height from its unvalidated coinbase scriptSig and drops blocks that appear too far behind the...	7.5 High	—	0,18%	2 Okt 2026
CVE-2026-104421 Zebra before 6.2.1 contains an incomplete cleanup vulnerability that allows unauthenticated peers to block downloading of valid blocks by leaving rejected hashes in SentH...	5.3 Medium	—	0,30%	2 Okt 2026
CVE-2026-104420 Zebra before 6.3.0 contains a protection mechanism failure that allows unauthenticated peers to evade misbehavior scoring by supplying invalid gossiped blocks. The inboun...	5.3 Medium	—	0,30%	2 Okt 2026
CVE-2026-104419 Zebra (zebrad) 4.5.0 before 6.3.0 discards which peer supplied the block hashes in FindBlocks responses, then assigns 100 misbehavior points, the ban threshold, to whiche...	4.8 Medium	—	0,13%	2 Okt 2026
CVE-2026-104418 Ghost from 6.10.3 before 6.64.0 contains a remote code execution vulnerability that allows authenticated administrators to run code by abusing theme translation file load...	7.2 High	—	0,65%	2 Okt 2026
CVE-2026-104417 Ghost from 1.20.0 before 6.64.0 contains a path traversal vulnerability in theme translation file loading that allows authenticated administrators to read JSON files outs...	4.9 Medium	—	0,37%	2 Okt 2026
CVE-2026-104416 Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff users to view secret tokens of pending staff invites....	7.5 High	—	0,31%	2 Okt 2026
CVE-2026-104415 Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level users to determine the relative ordering of other...	3.1 Low	—	0,21%	2 Okt 2026
CVE-2026-104414 Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untrusted scripts into post content via oEmbed photo r...	8.1 High	—	0,28%	2 Okt 2026
CVE-2026-104413 Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host arbitrary HTML by abusing bo...	7.3 High	—	0,26%	2 Okt 2026
CVE-2026-104412 Ghost 0.5.0 before 6.64.0 does not correctly restrict staff role assignment, allowing users with the Editor or Super Editor role to assign their own role to other staff d...	4.3 Medium	—	0,19%	2 Okt 2026
CVE-2026-104411 Ghost from 6.22.1 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users to host scripts by uploading files served with extension-deri...	7.3 High	—	0,26%	2 Okt 2026
CVE-2026-104410 SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to read password-protected and publish-disabled database rows via the /ap...	7.5 High	—	0,38%	2 Okt 2026
CVE-2026-103763 SiYuan before v3.8.5 contains an information disclosure vulnerability that allows read-only publish readers to learn metadata of publish-excluded documents through the ge...	5.8 Medium	—	0,31%	2 Okt 2026
CVE-2026-103762 SiYuan before v3.8.5 contains a missing authorization vulnerability in the getRefCreateSavePath, getShorthandSavePath, and getDocCreateSavePath endpoints that allows read...	5.3 Medium	—	0,24%	2 Okt 2026
CVE-2026-97876 A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB contin...	6.4 Medium	—	0,11%	2 Okt 2026
CVE-2026-96990 Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Erlang bindings. This issue affects Apache Thrift: before 0.25.0. Users are reco...	8.2 High	—	0,43%	2 Okt 2026
CVE-2026-94651 improper handling of exceptional conditions, Missing release of resource after effective lifetime vulnerability in Apache Thrift java bindings. This issue affects Apac...	7.5 High	—	0,47%	2 Okt 2026
CVE-2026-94650 Uncontrolled Recursion vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version...	8.2 High	—	0,43%	2 Okt 2026
CVE-2026-94645 Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings. This issue aff...	8.2 High	—	0,43%	2 Okt 2026
CVE-2026-94644 Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recomme...	8.2 High	—	0,43%	2 Okt 2026
CVE-2026-94642 Uncaught exception vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0,...	8.7 High	—	0,43%	2 Okt 2026
CVE-2026-94633 Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Dart bindings. This issue affects Apach...	8.7 High	—	0,43%	2 Okt 2026
CVE-2026-93926 Missing release of memory after effective lifetime, Missing release of resource after effective lifetime vulnerability in Apache Thrift THeaderTransport. This issue af...	8.7 High	—	0,43%	2 Okt 2026
CVE-2026-93925 Stack-based buffer overflow, Incorrect bitwise shift of integer vulnerability in Apache Thrift C++ THeaderProtocol. This issue affects Apache Thrift: before 0.25.0....	8.7 High	—	0,46%	2 Okt 2026
CVE-2026-91137 Improper validation of specified quantity in input, Allocation of resources without limits or throttling, Excessive Iteration vulnerability in Apache Thrift PHP bindings....	8.7 High	—	0,43%	2 Okt 2026
CVE-2026-91135 Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport. When an application enables the ZLIB transform for the frames it sends, THeaderTranspor...	9.2 Critical	—	0,46%	2 Okt 2026
CVE-2026-86326 An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify the cryptographic authenticity o...	8.6 High	—	0,19%	2 Okt 2026
CVE-2026-86325 A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface. The vulnerability is caused by insufficient length validation of th...	9.4 Critical	—	0,34%	2 Okt 2026
CVE-2026-85494 Improper handling of length parameter inconsistency, Uncaught exception, Inefficient Algorithmic Complexity, Memory allocation with excessive size value, Initialization o...	7.5 High	—	0,47%	2 Okt 2026
CVE-2026-85493 Uncontrolled Recursion vulnerability in Apache Thrift Dart and Java ME bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade t...	8.7 High	—	0,43%	2 Okt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.