Katalog CVE (hal. 215)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 259.509 (Critical 35.989 · High 103.743 · KEV 1.747 · sejak 2020) · Pembaruan terakhir: 19 Okt 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 10.701–10.750 dari 259.509 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-100640 SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native clipboard formats by invoking c...	4.7 Medium	—	0,19%	26 Sep 2026
CVE-2026-100639 SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating gutter-button markup (app/src/protyle/gutter/button.ts, assigned via innerHTML in app/src/pr...	8.8 High	—	0,47%	26 Sep 2026
CVE-2026-100638 SiYuan versions before v3.8.4 contain a path traversal vulnerability in the setNotebookIcon endpoint that allows authenticated administrators to create arbitrary director...	7.6 High	—	0,47%	26 Sep 2026
CVE-2026-100637 SiYuan versions before v3.8.4 contain a path traversal vulnerability in the checkoutRepo endpoint that allows authenticated administrators to write JSON files outside the...	7.6 High	—	0,47%	26 Sep 2026
CVE-2026-100636 SiYuan versions before v3.8.4 contain a path traversal vulnerability in the exportBrowserHTML endpoint that allows authenticated administrators to write arbitrary HTML co...	7.6 High	—	0,54%	26 Sep 2026
CVE-2026-100635 SiYuan before v3.8.4 contains an authentication bypass vulnerability in the publish service where session cookies are issued without Secure or SameSite attributes over pl...	5.9 Medium	—	0,26%	26 Sep 2026
CVE-2026-100634 SiYuan before v3.8.4 does not validate the sender or restrict recipients in the 'siyuan-send-windows' IPC handler of the Electron main process (app/electron/main.js). The...	4.7 Medium	—	0,47%	26 Sep 2026
CVE-2026-100633 SiYuan is a self-hosted personal knowledge management system. In versions 3.8.0 through 3.8.3, the MCP file tool's sensitive-path guard (util.IsForbiddenAbsPath(), invoke...	6.5 Medium	—	0,33%	26 Sep 2026
CVE-2026-100632 Parse Server is an open-source backend server. In versions >= 9.0.0 and < 9.10.1-alpha.8, and in versions < 8.6.89, LiveQuery evaluates the protectedFields class-level pe...	6.5 Medium	—	0,29%	26 Sep 2026
CVE-2026-100631 Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1-alpha.9, the device token deduplication logic for in...	7.5 High	—	0,36%	26 Sep 2026
CVE-2026-100630 AVideo before 29.1.0 contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline onclick JavaScript string. Att...	5.4 Medium	—	0,23%	26 Sep 2026
CVE-2026-100629 Capgo (capgo.app backend) before 12.127.5 contains an authorization flaw in the PATCH /private/role_bindings/:binding_id endpoint. The handler verifies that the newly ass...	5.5 Medium	—	0,28%	26 Sep 2026
CVE-2026-100628 capgo.app before 12.128.12 fails to enforce an organization's API key expiration policy when creating app-scoped API keys. In the POST /apikey endpoint, requests that sup...	4.3 Medium	—	0,20%	26 Sep 2026
CVE-2026-100627 Capgo (Cap-go/capgo.app) server backend Supabase functions contain an incorrect authorization flaw in the API-key bundle promotion path. The PUT /bundle endpoint, availab...	8.1 High	—	0,30%	26 Sep 2026
CVE-2026-100626 capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage paths. Aut...	4.3 Medium	—	0,18%	26 Sep 2026
CVE-2026-100625 Capgo (capgo.app) exposes a native build TUS upload proxy (supabase/functions/_backend/public/build/upload.ts) that authorizes a caller against a single build job identif...	7.1 High	—	0,25%	26 Sep 2026
CVE-2026-100624 Capgo.app before 12.264.5 does not enforce upload expiry or build lifecycle state in the /build/upload/:jobId TUS proxy endpoint. When a native build request is created,...	5.4 Medium	—	0,22%	26 Sep 2026
CVE-2026-100623 Capgo (capgo.app) exposes the legacy membership table public.org_users directly through Supabase PostgREST. The table's row-level security policies "Allow org admin to in...	8.8 High	—	0,32%	26 Sep 2026
CVE-2026-100622 capgo.app through 12.129.0 fails to verify deletion status when serving cached bundle artifacts from the public file read endpoint. Unauthenticated attackers can download...	7.5 High	—	0,33%	26 Sep 2026
CVE-2026-100621 Capgo (capgo.app) contains an incomplete access-control/content-lock enforcement issue affecting all versions; no patch is available at the time of publication. The `enfo...	4.3 Medium	—	0,22%	26 Sep 2026
CVE-2026-100620 Capgo CLI (npm package @capgo/cli) through 7.98.2 is affected by an over-permissioned service account in its Android onboarding flow. When onboarding via Google OAuth, th...	3.8 Low	—	0,25%	26 Sep 2026
CVE-2026-100619 Capgo (capgo.app) blocks direct user inserts into the public.manifest table with a RESTRICTIVE row-level security policy, but that restriction can be bypassed indirectly....	8.8 High	—	0,32%	26 Sep 2026
CVE-2026-100618 Capgo (capgo.app) is affected by an authorization flaw in the app icon update path. The PUT /app/:id endpoint accepts a user-controlled `icon` value, normalizes it, and s...	8.5 High	—	0,21%	26 Sep 2026
CVE-2026-100617 Cap-go capgo.app fails to validate that principals in channel_permission_overrides belong to the organization, allowing authenticated app/org admins to grant channel perm...	8.8 High	—	0,30%	26 Sep 2026
CVE-2026-100616 capgo.app is an over-the-air update platform for Capacitor apps. In all versions prior to a fix, the row-level security UPDATE policy on the public.orgs table permits an...	5.5 Medium	—	0,27%	26 Sep 2026
CVE-2026-100615 Cap-go capgo.app before 12.267.1 fails to validate target API key privilege during rotation, allowing an apikey_manager to rotate a higher-privileged org_super_admin sibl...	8.8 High	—	0,31%	26 Sep 2026
CVE-2026-100614 Capgo before 12.244.1 contains a cross-tenant integrity vulnerability in the metadata-cleaning worker that trusts image object keys from mutable database rows without val...	8.8 High	—	0,32%	26 Sep 2026
CVE-2026-100613 capgo.app is an over-the-air (OTA) update platform for Capacitor apps. In all versions up to and including the current release (no patch available at time of publication)...	5.3 Medium	—	0,21%	26 Sep 2026
CVE-2026-100612 Capgo (capgo.app) through version 12.261.0 contains an incomplete access-control fix for the public.sso_providers table. Migration 20260826100000_sso_providers_block_dire...	7.2 High	—	0,34%	26 Sep 2026
CVE-2026-100611 Capgo (capgo.app backend, versions ≤ 12.261.0) improperly restricts which roles the apikey_manager organization role may bind to newly created API keys. When an authentic...	6.5 Medium	—	0,22%	26 Sep 2026
CVE-2026-100610 Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the backing service performs no w...	7.5 High	—	0,27%	26 Sep 2026
CVE-2026-100609 Flowise (npm packages `flowise` and `flowise-components`) through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace (findOneBy({ id: c...	6.8 Medium	—	0,23%	26 Sep 2026
CVE-2026-100608 Flowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboard. When the server runs in queue mode with the dashboard enabled and not in cloud mode (M...	8.3 High	—	0,27%	26 Sep 2026
CVE-2026-100607 Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifier bindings, allowing attackers to authenticate as...	7.7 High	—	0,29%	26 Sep 2026
CVE-2026-100606 Flowise through 3.1.4 (Enterprise/platform mode with SSO enabled) contains an authentication bypass in the SSO login path. When an SSO callback arrives with an email matc...	7.7 High	—	0,37%	26 Sep 2026
CVE-2026-100605 Flowise through 3.1.4 contains missing route-level RBAC checks on chat message endpoints that allow low-privileged API keys to read and delete chat history. Attackers wit...	7.1 High	—	0,22%	26 Sep 2026
CVE-2026-100604 ClawHub (openclaw/clawhub) contains an incorrect authorization vulnerability in the ClawHub application/backend: an organization-owned skill retains the ownerUserId of it...	5.4 Medium	—	0,27%	26 Sep 2026
CVE-2026-100603 ClawHub (openclaw/clawhub) application/backend contains a flaw in the skill report moderation flow: four distinct ordinary authenticated accounts can report a visible ski...	5.4 Medium	—	0,29%	26 Sep 2026
CVE-2026-100602 ClawHub (openclaw/clawhub application/backend) contains a missing authorization check in the changelog preview feature. A signed-in caller can invoke the public skills:ge...	6.5 Medium	—	0,29%	26 Sep 2026
CVE-2026-100601 ClawHub (openclaw/clawhub) application/backend contains a server-side request forgery vulnerability in the public profile preview's image fetching. The preview accepts a...	5.3 Medium	—	0,32%	26 Sep 2026
CVE-2026-100600 ClawHub (the openclaw/clawhub application/backend) does not bind anonymous HTTP API requests to a trusted caller identity, so all direct anonymous API requests share a si...	5.3 Medium	—	0,37%	26 Sep 2026
CVE-2026-100315 A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file mydeta...	7.3 High	—	0,39%	26 Sep 2026
CVE-2026-100314 A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of...	7.3 High	—	0,39%	26 Sep 2026
CVE-2026-100313 A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This affects an unknown function of the file upd...	4.3 Medium	—	0,42%	26 Sep 2026
CVE-2026-98163 linux kernel In the Linux kernel, the following vulnerability has been resolved: cgroup: Avoid iteration of dying tasks with zero refcount The commit 260fbcb92bbea ("cgroup: Move dy...	7.0 High	—	0,11%	26 Sep 2026
CVE-2026-100312 A security flaw has been discovered in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function...	6.3 Medium	—	0,19%	26 Sep 2026
CVE-2026-100311 A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The affected element is an unknown function of t...	3.5 Low	—	0,19%	26 Sep 2026
CVE-2026-96533 The Testimonials Widget WordPress plugin through 4.0.4 does not validate a user-supplied URL before fetching it server-side and storing the response as a public file, all...	5.8 Medium	—	0,19%	26 Sep 2026
CVE-2026-96532 The Testimonials Widget WordPress plugin through 4.0.4 does not perform a capability or ownership check when handling its front-end testimonial submission form, allowing...	7.5 High	—	0,21%	26 Sep 2026
CVE-2026-96531 The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before rendering them onto the block's wrapper element, all...	6.8 Medium	—	0,24%	26 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.