Katalog CVE (hal. 214)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 259.509 (Critical 35.989 · High 103.743 · KEV 1.747 · sejak 2020) · Pembaruan terakhir: 19 Okt 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 10.651–10.700 dari 259.509 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-100694 gohugo hugo Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media type are rendered without escaping raw HTML: Org ex...	6.1 Medium	—	0,19%	26 Sep 2026
CVE-2026-100693 gohugo hugo Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restri...	8.4 High	—	0,14%	26 Sep 2026
CVE-2026-100692 gohugo hugo Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme or module...	7.5 High	—	0,42%	26 Sep 2026
CVE-2026-100691 gohugo hugo Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the `lineAnchors` option before passing i...	5.4 Medium	—	0,17%	26 Sep 2026
CVE-2026-100690 gohugo hugo Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model to restrict file system reads t...	7.5 High	—	0,35%	26 Sep 2026
CVE-2026-100689 GitPython before 3.1.62 does not validate the `path` field read from an untrusted .gitmodules file when updating submodules. While a prior fix (GHSA-hmq2-w58f-27jc) added...	5.9 Medium	—	0,40%	26 Sep 2026
CVE-2026-100688 Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint that allows authenticat...	6.5 Medium	—	0,26%	26 Sep 2026
CVE-2026-100687 Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external table updates to the Builder collaboration websocket room. Att...	5.5 Medium	—	0,26%	26 Sep 2026
CVE-2026-100686 Budibase versions before 3.45.0 fail to validate per-app authorization in the POST /api/global/groups/:groupId/apps endpoint, allowing builders to assign application role...	8.1 High	—	0,21%	26 Sep 2026
CVE-2026-100685 Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enumerate chat identity link records across all workspa...	7.7 High	—	0,21%	26 Sep 2026
CVE-2026-100684 Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO login path of @budibase/server. In sso.authenticate, when no existing user matches...	8.1 High	—	0,33%	26 Sep 2026
CVE-2026-100683 Budibase (@budibase/server) before 3.45.0 builds MySQL and MSSQL column-rename DDL in packages/backend-core/src/sql/sqlTable.ts by interpolating identifiers directly into...	8.0 High	—	0,21%	26 Sep 2026
CVE-2026-100682 Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without proper symli...	8.8 High	—	0,57%	26 Sep 2026
CVE-2026-100681 Budibase before 3.45.0 contains an unauthenticated server-side request forgery and credential exfiltration vulnerability in the Microsoft Teams webhook endpoint that acce...	5.4 Medium	—	0,25%	26 Sep 2026
CVE-2026-100680 Budibase versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger import validator, allowing authenticated builders to read arbitr...	8.1 High	—	0,23%	26 Sep 2026
CVE-2026-100679 stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own valid ticket with another...	8.8 High	—	0,32%	26 Sep 2026
CVE-2026-100678 stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attackers who know a password to guess TOTP codes with only IP-bas...	6.5 Medium	—	0,24%	26 Sep 2026
CVE-2026-100677 stoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file locations in error responses. Unauthenticated attacke...	5.3 Medium	—	0,26%	26 Sep 2026
CVE-2026-100676 January, the media proxy/embed service of stoatchat (stoatchat/stoatchat), before version 0.15.5 improperly resolves SVG <image href> values as local filesystem paths whe...	8.2 High	—	0,40%	26 Sep 2026
CVE-2026-100675 stoatchat versions before 0.15.5 contain a denial of service vulnerability in the acknowledgement worker that processes mass mention messages. Authenticated users can sen...	6.5 Medium	—	0,31%	26 Sep 2026
CVE-2026-100674 stoatchat before 0.15.5 fails to revalidate usernames after Unicode sanitization, allowing attackers to create usernames with forbidden characters by submitting Unicode l...	4.3 Medium	—	0,23%	26 Sep 2026
CVE-2026-100673 The Grav Data Manager plugin (getgrav/grav-plugin-datamanager) versions 1.0.1 through 1.4.4 render stored data entries in the item-detail view (admin/templates/partials/i...	8.2 High	—	0,30%	26 Sep 2026
CVE-2026-100672 The Comments plugin (getgrav/grav-plugin-comments) for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any authentica...	7.5 High	—	0,45%	26 Sep 2026
CVE-2026-100671 Grav is a flat-file CMS. In versions 2.0.19 through 2.0.24 — and in 2.0.0 through 2.0.18 and 1.7.x only where content Twig has been explicitly enabled — page content auth...	8.0 High	—	0,29%	26 Sep 2026
CVE-2026-100670 Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints. The access map is gated by a `security@: admin.super` gu...	8.8 High	—	0,30%	26 Sep 2026
CVE-2026-100669 Grav before 2.0.25 ships web server configuration samples whose access-control deny rules are matched case-sensitively. In webserver-configs/web.config (IIS), every deny...	7.5 High	—	0,44%	26 Sep 2026
CVE-2026-100668 Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape. The `array` filter (and its identical function form) is on the sandbox allowlist but is registered withou...	6.5 Medium	—	0,28%	26 Sep 2026
CVE-2026-100667 grav-plugin-login (the Grav CMS Login plugin) versions >= 3.8.7 and < 3.9.7 allow the two-factor authentication challenge to be bypassed for content gated by the authenti...	5.3 Medium	—	0,31%	26 Sep 2026
CVE-2026-100666 Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound res...	7.3 High	—	0,24%	26 Sep 2026
CVE-2026-100665 Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC certificate verification path when using a plain X509Trus...	7.5 High	—	0,29%	26 Sep 2026
CVE-2026-100664 Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host header before...	7.5 High	—	0,33%	26 Sep 2026
CVE-2026-100663 Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets when convertin...	7.5 High	—	0,30%	26 Sep 2026
CVE-2026-100662 Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption vulnerability in the QPACK encode...	7.5 High	—	0,34%	26 Sep 2026
CVE-2026-100661 Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-integer decode...	7.5 High	—	0,34%	26 Sep 2026
CVE-2026-100660 Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state. QpackEncoder stores a queue and...	7.5 High	—	0,38%	26 Sep 2026
CVE-2026-100659 Netty's HTTP/3 codec (io.netty:netty-codec-http3) in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC 9114 requirement that the :authority pseudo-header...	6.5 Medium	—	0,24%	26 Sep 2026
CVE-2026-100654 vllm vLLM before 0.29.0 accepts user-controlled stop_token_ids on the OpenAI-compatible POST /v1/completions and POST /v1/chat/completions endpoints but validates only that th...	6.5 Medium	—	0,31%	26 Sep 2026
CVE-2026-100653 vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-supplied model revision pin (--revision / --code-r...	6.5 Medium	—	0,28%	26 Sep 2026
CVE-2026-100652 vllm vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token IDs to rea...	7.5 High	—	0,36%	26 Sep 2026
CVE-2026-100651 vllm vLLM before 0.29.0 fails to enforce decoder prompt-length validation on the disaggregated serving endpoint /inference/v1/generate. When the request contains a 'features'...	6.5 Medium	—	0,33%	26 Sep 2026
CVE-2026-100650 vllm vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB compressed-a...	6.5 Medium	—	0,65%	26 Sep 2026
CVE-2026-100649 vllm vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increme...	5.3 Medium	—	0,34%	26 Sep 2026
CVE-2026-100648 vllm vllm before 0.29.0 fails to enforce VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit in multimodal chat audio decoding, allowing unauthenticated clients to bypass file size restrict...	5.3 Medium	—	0,35%	26 Sep 2026
CVE-2026-100647 vllm vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cache_salt parameter accepted on OpenAI-compatible and Anthropic API endpoints, which lacks m...	7.5 High	—	0,35%	26 Sep 2026
CVE-2026-100646 SiYuan is a self-hosted personal knowledge management system. In versions up to and including 3.8.3, the kernel's authentication guards (CheckAuth in kernel/model/session...	8.1 High	—	0,19%	26 Sep 2026
CVE-2026-100645 SiYuan versions 3.7.0 before 3.8.4 contain a stored cross-site scripting vulnerability in gallery and kanban database renderers where field descriptions are not escaped i...	8.0 High	—	0,35%	26 Sep 2026
CVE-2026-100644 SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into SQL without escaping. U...	7.5 High	—	0,34%	26 Sep 2026
CVE-2026-100643 SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values in textarea elements, allowing authenticated attackers to inject JavaScript by mod...	8.0 High	—	0,42%	26 Sep 2026
CVE-2026-100642 SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branch that grants administrator ac...	7.6 High	—	0,11%	26 Sep 2026
CVE-2026-100641 SiYuan before v3.8.4 does not HTML-escape stored flashcard block content before interpolating it into the card-manager list markup. Block content returned by /api/riff/ge...	8.0 High	—	0,53%	26 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.