Katalog CVE (hal. 179)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 259.396 (Critical 35.986 · High 103.714 · KEV 1.747 · sejak 2020) · Pembaruan terakhir: 18 Okt 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 8.901–8.950 dari 259.396 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-94171 Unauthenticated Cross Site Scripting (XSS) in CURCY <= 2.2.16 versions.	7.1 High	—	0,15%	30 Sep 2026
CVE-2026-87004 Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.31.3, when the OIDC login flow completes, backend/modules/auth/providers/au...	8.1 High	—	0,34%	30 Sep 2026
CVE-2026-55224 MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers, internal management systems...	8.7 High	—	1,2%	30 Sep 2026
CVE-2026-55107 Kobako is a Ruby gem that embeds a Wasm-isolated mruby interpreter inside applications, allowing execution of untrusted Ruby scripts (LLM-generated code, user formulas, s...	10.0 Critical	—	0,80%	30 Sep 2026
CVE-2026-55094 Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to u...	8.7 High	—	0,42%	30 Sep 2026
CVE-2026-53605 Reachy Mini ISO for Wireless contains the necessary files to build a custom Raspberry Pi OS image for the Reachy Mini Wireless robot, using pi-gen. Prior to version 0.2.4...	7.8 High	—	0,13%	30 Sep 2026
CVE-2026-103500 mozilla thunderbird An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbir...	6.1 Medium	—	0,21%	30 Sep 2026
CVE-2026-103476 yii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowing unauthenticated attackers to download files from...	5.3 Medium	—	0,29%	30 Sep 2026
CVE-2026-103475 yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] in its default development configuration. Unauthen...	9.1 Critical	—	0,40%	30 Sep 2026
CVE-2026-103474 yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with man...	8.8 High	—	0,39%	30 Sep 2026
CVE-2026-103473 Deno versions 2.7.0 through 2.9.7 on Windows contain a command injection vulnerability in node:child_process where shell arguments are escaped for the wrong shell type. A...	8.1 High	—	1,5%	30 Sep 2026
CVE-2026-103472 restbed through 5.0.0 accepts WebSocket frames with declared payload lengths up to 2^63 bytes and buffers the payload without size limits in an unbounded stream buffer. R...	7.5 High	—	0,44%	30 Sep 2026
CVE-2026-103471 restbed through 5.0.0 buffers HTTP request headers without enforcing a maximum size limit, allowing remote unauthenticated attackers to exhaust server memory. Attackers c...	7.5 High	—	0,55%	30 Sep 2026
CVE-2026-103446 Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass. This issue affect...	7.4 High	—	0,33%	30 Sep 2026
CVE-2026-103445 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Page_Forms extension allows Stored XSS....	1.2 Low	—	0,30%	30 Sep 2026
CVE-2026-103440 Exposure of sensitive information through data queries vulnerability in The Wikimedia Foundation MediaWiki PageTriage extension allows Information Elicitation. This issu...	1.2 Low	—	0,27%	30 Sep 2026
CVE-2026-103439 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikbase extension allows Cross-Site Scri...	0.3 Low	—	0,11%	30 Sep 2026
CVE-2026-103438 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikistories extension allows Cross-Site...	0.3 Low	—	0,11%	30 Sep 2026
CVE-2026-103437 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows Reflected...	1.1 Low	—	0,30%	30 Sep 2026
CVE-2026-103399 A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final (non...	5.3 Medium	—	0,25%	30 Sep 2026
CVE-2026-102397 Unauthenticated Broken Access Control in Ultimate Maps by Supsystic <= 1.5.5 versions.	6.5 Medium	—	0,16%	30 Sep 2026
CVE-2026-102392 Shop manager PHP Object Injection in Extra Product Options For WooCommerce \| Custom Product Addons and Fields <= 3.3.8 versions.	7.2 High	—	0,30%	30 Sep 2026
CVE-2026-102391 Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.4 versions.	7.1 High	—	0,15%	30 Sep 2026
CVE-2026-102377 Contributor PHP Object Injection in Photo Gallery by 10Web <= 1.8.46 versions.	8.8 High	—	0,29%	30 Sep 2026
CVE-2026-102376 Subscriber Cross Site Scripting (XSS) in Branda <= 3.4.32 versions.	7.1 High	—	0,19%	30 Sep 2026
CVE-2026-102375 Missing Authorization vulnerability in Optimole Optimole optimole-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Optimole:...	6.5 Medium	—	0,26%	30 Sep 2026
CVE-2026-100512 Contributor PHP Object Injection in Nested Pages <= 3.3.2 versions.	9.8 Critical	—	0,33%	30 Sep 2026
CVE-2026-100510 Unauthenticated Cross Site Scripting (XSS) in Post and Page Builder by BoldGrid <= 1.27.14 versions.	7.1 High	—	0,15%	30 Sep 2026
CVE-2026-75969 Missing authentication for critical function vulnerability for all PTZOptics cameras and the Firmware Upgrade Tool - Firmware Update modules. A missing authentication vul...	9.1 Critical	—	0,35%	30 Sep 2026
CVE-2026-62308 Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.6, Tugtainer allows an authenticated user to make the backend server sen...	9.1 Critical	—	0,35%	30 Sep 2026
CVE-2026-55494 Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.4, Tugtainer Agent allows unauthenticated access to Docker management AP...	9.8 Critical	—	0,64%	30 Sep 2026
CVE-2026-55181 Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.3, Tugtainer's OIDC authentication can still be initiated even when OIDC...	9.4 Critical	—	0,60%	30 Sep 2026
CVE-2026-55177 CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to version 13.10.0, every route in the ESRI helper family (...	7.6 High	—	0,38%	30 Sep 2026
CVE-2026-55176 Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, two authentication helpers in /app/server.js — verifyCo...	9.0 Critical	—	0,20%	30 Sep 2026
CVE-2026-46711 Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, the workspace HTTP service that listens on 0.0.0.0:8080...	8.3 High	—	0,27%	30 Sep 2026
CVE-2026-19553 ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check in SSLObje...	7.6 High	—	0,40%	30 Sep 2026
CVE-2026-19445 A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the doc...	9.2 Critical	—	0,43%	30 Sep 2026
CVE-2026-103444 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki WikiForum extension allows Stored XSS....	1.1 Low	—	0,34%	30 Sep 2026
CVE-2026-103443 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Collection (Book) extension allows XSS T...	1.1 Low	—	0,20%	30 Sep 2026
CVE-2026-103241 vllm A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/parser/src/unified/gemma4.rs of the component Gemma4...	7.5 High	—	0,71%	30 Sep 2026
CVE-2026-103233 A security vulnerability has been detected in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This impacts an unknown function...	6.3 Medium	—	0,37%	30 Sep 2026
CVE-2026-103232 A weakness has been identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This affects the function mysqli_query of th...	7.3 High	—	0,33%	30 Sep 2026
CVE-2026-102490 zammad Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service a...	7.8 High	KEV	0,55%	30 Sep 2026
CVE-2026-102489 zammad Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7....	9.8 Critical	KEV	1,3%	30 Sep 2026
CVE-2026-55174 UltrafastSecp256k1 is a high-performance, multi-backend secp256k1 engine with reproducible audit evidence, compatibility shims, and profile-based review scopes. Prior to...	5.9 Medium	—	0,15%	30 Sep 2026
CVE-2026-47604 NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user may access another process's GPU channel state due t...	5.5 Medium	—	0,10%	30 Sep 2026
CVE-2026-47603 NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user may access another process's GPU channel state due t...	5.5 Medium	—	0,10%	30 Sep 2026
CVE-2026-47602 NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user can cause the driver to dereference an untrusted poi...	7.1 High	—	0,11%	30 Sep 2026
CVE-2026-47601 NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the open-source kernel module DMA-BUF import path where an unprivileged local user could cause...	7.8 High	—	0,12%	30 Sep 2026
CVE-2026-47600 NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an error-handling path could operate on an improperly initialized...	7.8 High	—	0,13%	30 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.