Katalog CVE (hal. 210)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 259.509 (Critical 35.989 · High 103.743 · KEV 1.747 · sejak 2020) · Pembaruan terakhir: 19 Okt 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 10.451–10.500 dari 259.509 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-100890 A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_spf_ipv6_explode in the library libopendma...	5.3 Medium	—	0,37%	28 Sep 2026
CVE-2026-100889 A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. Affected is the function dkim_qp_decode of the file util.c of the component Decoder. The man...	7.3 High	—	0,30%	28 Sep 2026
CVE-2026-100888 A weakness has been identified in Trusted Domain Project OpenDKIM up to 2.11.0. This affects the function dkim_canon_selecthdrs of the file libopendkim/dkim-canon.c of th...	7.3 High	—	0,29%	28 Sep 2026
CVE-2026-100887 A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. The impacted element is the fu...	6.3 Medium	—	0,19%	28 Sep 2026
CVE-2026-96284 A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system help...	2.5 Low	—	0,14%	27 Sep 2026
CVE-2026-100886 A vulnerability was identified in Seetong T8108, T8108P, T8116 and T8232 4.6.1.4-build202604241011. The affected element is an unknown function of the component Debug Ser...	10.0 Critical	—	0,77%	27 Sep 2026
CVE-2026-100885 A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the file packages/Webkul/Installer/src/Http/Middleware/CanInstall.php of...	7.3 High	—	1,00%	27 Sep 2026
CVE-2026-100884 A vulnerability has been found in Krayin laravel-crm up to 2.2.5. The impacted element is the function Storage::download of the file packages/Webkul/Admin/src/Config/acl....	4.3 Medium	—	0,48%	27 Sep 2026
CVE-2026-100883 A flaw has been found in Krayin laravel-crm up to 2.2.5. The affected element is an unknown function of the file packages/Webkul/Admin/src/Config/acl.php. Executing a man...	6.3 Medium	—	0,46%	27 Sep 2026
CVE-2026-96283 By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it imposs...	3.3 Low	—	0,15%	27 Sep 2026
CVE-2026-96282 A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed...	3.1 Low	—	0,33%	27 Sep 2026
CVE-2026-100882 A vulnerability was detected in Krayin laravel-crm up to 2.2.5. Impacted is an unknown function of the file packages/Webkul/Admin/src/Resources/views/components/layouts/i...	2.4 Low	—	0,26%	27 Sep 2026
CVE-2026-100881 A security vulnerability has been detected in zhistaredu StarTraining up to 3.8.1. This issue affects some unknown processing of the file application.yml. Such manipulati...	2.6 Low	—	0,18%	27 Sep 2026
CVE-2026-96281 On a multi-user system, a user with an active local login session could downgrade a system-wide Flatpak app to an older version by removing the app's remote ref via the u...	6.2 Medium	—	0,17%	27 Sep 2026
CVE-2026-96280 The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized all...	7.5 High	—	0,66%	27 Sep 2026
CVE-2026-101090 Nezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect endpoint. When the new optional dashboard_host setting is empty, /api/v1/oauth2/{provider}...	9.8 Critical	—	0,36%	27 Sep 2026
CVE-2026-101089 Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed password field of authenticated use...	3.1 Low	—	0,15%	27 Sep 2026
CVE-2026-101088 Nezha is a server and website monitoring tool. In versions >= 2.2.11 and < 2.3.1, the service sentinel worker (service/singleton/servicesentinel.go) contains an incomplet...	5.3 Medium	—	0,18%	27 Sep 2026
CVE-2026-101087 Nezha versions 2.0.10 through 2.3.2 use a restricted HTTP client to validate user-configurable notification and DDNS webhook URLs, but the denylist did not cover IPv6 tra...	4.3 Medium	—	0,26%	27 Sep 2026
CVE-2026-101086 Nezha Dashboard versions before 2.3.5 fail to restrict service monitor task types to supported probe types, allowing authenticated users with nezha:service:write scope to...	6.5 Medium	—	0,32%	27 Sep 2026
CVE-2026-101085 Nezha before 2.3.8 fails to validate alert rule type and duration bounds, allowing authenticated non-administrator users to create malformed rules that trigger unrecovere...	6.5 Medium	—	0,25%	27 Sep 2026
CVE-2026-101084 obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP servers if th...	9.6 Critical	—	0,28%	27 Sep 2026
CVE-2026-101065 Obot is an open-source AI agent/MCP platform. In all versions up to and including commit d7e6970, the Docker quickstart command documented in the README starts the contai...	9.8 Critical	—	0,44%	27 Sep 2026
CVE-2026-101064 Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server registration that allows privileged users to specify arbitrary URLs without...	7.6 High	—	0,24%	27 Sep 2026
CVE-2026-101063 Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/* when registry authentication is enabled. Unauthenticated attackers can...	5.3 Medium	—	0,24%	27 Sep 2026
CVE-2026-101062 Obot before v0.23.0 (affected versions <= v0.22.1) running with OBOT_SERVER_ENABLE_AUTHENTICATION=true exposes OAuth dynamic client registration without authentication an...	8.8 High	—	0,34%	27 Sep 2026
CVE-2026-100880 A weakness has been identified in zhistaredu StarTraining up to 3.8.1. This vulnerability affects unknown code of the file du-common/src/main/java/com/edu/common/utils/fi...	3.5 Low	—	0,19%	27 Sep 2026
CVE-2026-100879 A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. This affects the function checkRoleAllowed of the file SysRoleServiceImpl.java of the componen...	4.3 Medium	—	0,20%	27 Sep 2026
CVE-2026-100878 A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. Affected by this issue is the function SysUser.isAdmin of the file edu-common/src/main/java/com/edu...	6.3 Medium	—	0,21%	27 Sep 2026
CVE-2026-100877 A vulnerability was determined in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected by this vulnerability is an unknown fun...	4.3 Medium	—	0,26%	27 Sep 2026
CVE-2026-96279 A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowin...	6.5 Medium	—	0,63%	27 Sep 2026
CVE-2026-100876 A vulnerability was found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file loginlink...	6.3 Medium	—	0,28%	27 Sep 2026
CVE-2026-100875 A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file upd...	7.3 High	—	0,25%	27 Sep 2026
CVE-2026-100874 A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This affects an unknown function of the file addnewstuden...	7.3 High	—	0,25%	27 Sep 2026
CVE-2026-100873 A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function. The m...	4.3 Medium	—	0,21%	27 Sep 2026
CVE-2026-101061 utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incomplete application of CVE-2026-44661 fixes. The Graph...	4.7 Medium	—	0,20%	27 Sep 2026
CVE-2026-101060 python-utcp versions before 1.1.4 contain a server-side request forgery vulnerability in HttpCommunicationProtocol.call_tool that validates the initial tool URL but follo...	8.2 High	—	0,18%	27 Sep 2026
CVE-2026-101059 utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attackers to redirect credential submission to arbitrary e...	7.1 High	—	0,18%	27 Sep 2026
CVE-2026-101058 python-utcp (pip package utcp-http) before 1.1.12 does not verify whether tool URLs declared in a hand-written UTCP manual point at the agent's own loopback interface whe...	6.9 Medium	—	0,17%	27 Sep 2026
CVE-2026-101057 utcp-mcp (the MCP plugin of python-utcp) through 1.1.2 connects to the HTTP and WebSocket MCP server URLs given in a call template's mcpServers configuration without the...	3.1 Low	—	0,11%	27 Sep 2026
CVE-2026-101056 Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a context_hint UUID. Attackers who previously had valid share access c...	5.3 Medium	—	0,19%	27 Sep 2026
CVE-2026-101051 Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected destinatio...	3.1 Low	—	0,22%	27 Sep 2026
CVE-2026-101048 Cloudreve before 4.17.0 registers the administrative node test endpoints (POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader) without requiring the...	5.4 Medium	—	0,19%	27 Sep 2026
CVE-2026-101047 fleetdm fleet Fleet before 4.87.0 does not protect the two endpoints that serve in-house iOS application packages and manifests (enterprise tier only) with the intended random, time-li...	5.3 Medium	—	0,24%	27 Sep 2026
CVE-2026-101046 fleetdm fleet Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints (GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/{id}/activities). The...	4.3 Medium	—	0,17%	27 Sep 2026
CVE-2026-101045 Fleet-maintained app install and uninstall scripts for macOS are generated from Homebrew cask metadata. In manifests generated before 2026-08-19, the script generator esc...	8.0 High	—	0,75%	27 Sep 2026
CVE-2026-101044 pacquet, the Rust package-manager component shipped in the pnpm npm package versions >=12.0.0-alpha.0 and <12.0.0-alpha.5, does not validate dependency alias/name paths t...	7.1 High	—	0,26%	27 Sep 2026
CVE-2026-101043 pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from...	7.4 High	—	0,22%	27 Sep 2026
CVE-2026-88778 Advisory citrix netscaler application delivery controller, citrix netscaler gateway Predictable exact value from previous values vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-6...	7.5 High	—	0,38%	27 Sep 2026
CVE-2026-88777 citrix netscaler application delivery controller, citrix netscaler gateway Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14...	9.8 Critical	—	0,38%	27 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.