Katalog CVE (hal. 217)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 259.509 (Critical 35.989 · High 103.743 · KEV 1.747 · sejak 2020) · Pembaruan terakhir: 19 Okt 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 10.801–10.850 dari 259.509 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-100562 OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in the sessions.create endpoint that allows operator.write callers to modify session confi...	5.4 Medium	—	0,19%	26 Sep 2026
CVE-2026-100561 OpenClaw (npm package 'openclaw') versions >= 2026.3.22 and < 2026.8.1 contain an approval-bypass flaw in the exec approval policy: the policy could trust a command-runni...	8.0 High	—	0,25%	26 Sep 2026
CVE-2026-100560 OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability where Allow Always approvals for exact commands persist as path-only grants on macOS and L...	7.5 High	—	0,58%	26 Sep 2026
CVE-2026-100559 OpenClaw versions before 2026.8.1 contain a command parser vulnerability where escaped newlines confuse exec allowlist parsing, allowing hidden commands to execute. Attac...	8.0 High	—	0,25%	26 Sep 2026
CVE-2026-100558 OpenClaw versions before 2026.8.1 contain a resource exhaustion vulnerability in the Gateway listener that allows unauthenticated clients to retain response sockets by se...	7.5 High	—	0,28%	26 Sep 2026
CVE-2026-100557 OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in skill tool dispatch that fails to carry the sender's owner status. Non-owner senders au...	8.3 High	—	0,24%	26 Sep 2026
CVE-2026-100556 OpenClaw (npm package openclaw) versions >= 2026.5.2 and < 2026.8.1 contain an incorrect authorization vulnerability in WhatsApp group handling. A group sender who is adm...	6.3 Medium	—	0,28%	26 Sep 2026
CVE-2026-100555 OpenClaw is an npm-distributed gateway application. In versions >= 2026.7.1 and < 2026.8.1, Synology Chat attachment delivery could lose DNS pinning: the Gateway validate...	7.1 High	—	0,20%	26 Sep 2026
CVE-2026-100554 OpenClaw (npm package 'openclaw') versions >= 2026.5.12 and < 2026.8.1 do not immediately invalidate Canvas HTTP authorization when a paired node is revoked. Node revocat...	4.2 Medium	—	0,22%	26 Sep 2026
CVE-2026-100553 OpenClaw versions >= 2026.6.9 and < 2026.8.1 do not declare the native chatId parameter as a delivery target in the Feishu unpin feature, so unpin requests can bypass the...	4.3 Medium	—	0,22%	26 Sep 2026
CVE-2026-100552 OpenClaw (npm package 'openclaw') before 2026.8.1 does not correctly enforce per-chat tool policies for Codex app-server runtime tools. A conversation-level tools.allow r...	8.8 High	—	0,26%	26 Sep 2026
CVE-2026-100551 OpenClaw for iOS versions >= 2026.7.1 and < 2026.8.11 do not enforce saved Gateway TLS pins in the Control UI. While native connections enforced the saved Gateway fingerp...	8.3 High	—	0,17%	26 Sep 2026
CVE-2026-100550 OpenClaw (npm package 'openclaw') before 2026.8.1 contains an access-control bypass in the Microsoft Teams integration. When groupPolicy is set to allowlist, a missing or...	5.4 Medium	—	0,19%	26 Sep 2026
CVE-2026-100549 OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in QQBot voice attachment handling where filenames are decoded twice, allowing encoded traversal...	5.4 Medium	—	0,28%	26 Sep 2026
CVE-2026-100548 OpenClaw (npm package 'openclaw') versions >= 2026.3.28 and < 2026.8.1 contain a credential exposure issue in memory embedding failover. When remote embedding fallback is...	5.3 Medium	—	0,25%	26 Sep 2026
CVE-2026-100547 OpenClaw is a coding agent distributed as the npm package `openclaw`. In affected versions (2026.7.1 through 2026.7.2), alternate but valid `file:` URL spellings supplied...	5.5 Medium	—	0,13%	26 Sep 2026
CVE-2026-100546 OpenClaw (npm package `openclaw`) versions >= 2026.7.2 and < 2026.9.2 contain a race condition in the Discord realtime voice transcript path. Concurrent control-classifie...	6.4 Medium	—	0,18%	26 Sep 2026
CVE-2026-100545 OpenClaw (npm package `openclaw`) before 2026.8.1 incorrectly enforces sender tool policies during session-memory filename generation. In affected versions, filename gene...	5.3 Medium	—	0,21%	26 Sep 2026
CVE-2026-100544 openclaw's @openclaw/voice-call package before 2026.8.1 launches the configured agent for classic inbound voice calls without propagating the caller's identity or non-own...	8.8 High	—	0,25%	26 Sep 2026
CVE-2026-100543 OpenClaw (npm package openclaw) before 2026.8.1 could include deterministic hashes computed over the original, unredacted configuration in redacted configuration response...	7.5 High	—	0,35%	26 Sep 2026
CVE-2026-100542 OpenClaw (npm package 'openclaw') versions >= 2026.5.28 and < 2026.8.1 mishandle archive listings in the tar.bz2 skill installer: bounded command-output suffixes were tre...	3.1 Low	—	0,26%	26 Sep 2026
CVE-2026-100541 OpenClaw's Matrix integration (npm package @openclaw/matrix) versions >= 2026.2.2 and < 2026.8.1 lowercase complete Matrix user IDs — including historical localparts and...	7.5 High	—	0,30%	26 Sep 2026
CVE-2026-100540 OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations. Attackers can exploit mu...	6.8 Medium	—	0,23%	26 Sep 2026
CVE-2026-100539 OpenClaw (npm package 'openclaw') before 2026.8.1 fails to revoke memory tool access when an operator hot-disables memory configuration. Existing memory_search and memory...	2.6 Low	—	0,20%	26 Sep 2026
CVE-2026-100538 OpenClaw (npm package 'openclaw') before 2026.8.1 does not apply the originating sender's global or per-agent toolsBySender policy when handling outbound attachments. A s...	6.5 Medium	—	0,26%	26 Sep 2026
CVE-2026-100537 OpenClaw (npm package 'openclaw') before 2026.8.1 fails to apply the originating requester's effective tool policy during Active Memory automatic recall. In deployments t...	3.1 Low	—	0,19%	26 Sep 2026
CVE-2026-100536 OpenClaw versions before 2026.8.1 fail to validate all source fields in structured message attachments, allowing attackers to hide unvalidated host paths behind allowed a...	6.5 Medium	—	0,43%	26 Sep 2026
CVE-2026-100535 OpenClaw (npm package 'openclaw') versions >= 2026.4.5 and < 2026.8.1 can lose the originating requester's restrictions and untrusted provenance when session-derived text...	7.5 High	—	0,26%	26 Sep 2026
CVE-2026-100534 OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in webhook TaskFlow cancellation that allows attackers to cancel unrelated sessions. An at...	3.1 Low	—	0,27%	26 Sep 2026
CVE-2026-100533 OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in the tools.fs.workspaceOnly feature where Unicode filename fallback can normalize validated par...	5.3 Medium	—	0,29%	26 Sep 2026
CVE-2026-100532 @openclaw/whatsapp (npm) before 2026.8.1 exposes the WhatsApp login tool through the generic channel-tool path without preserving the originating sender's owner status, s...	8.1 High	—	0,27%	26 Sep 2026
CVE-2026-100531 The @openclaw/slack npm package before 2026.8.1 contains an authorization flaw in its Slack download-file handler: when a file lacks the share metadata used to prove it b...	6.5 Medium	—	0,33%	26 Sep 2026
CVE-2026-100530 OpenClaw versions before 2026.8.1 fail to bind working directory context to reusable exec approvals, allowing approved commands to execute in different directories. Attac...	7.3 High	—	0,19%	26 Sep 2026
CVE-2026-100529 OpenClaw versions before 2026.8.1 contain an authorization scope widening vulnerability in file-transfer allow-always approvals that allows attackers to reuse standing gr...	6.4 Medium	—	0,21%	26 Sep 2026
CVE-2026-100528 OpenClaw (npm package 'openclaw') before 2026.8.1 could send third-party provider credentials to the wrong endpoint. In affected versions, when a third-party provider use...	5.4 Medium	—	0,24%	26 Sep 2026
CVE-2026-100527 OpenClaw before 2026.8.2 contains a denial of service vulnerability in the Browser extension relay that allows unauthenticated network sources to exhaust pending-authenti...	5.3 Medium	—	0,35%	26 Sep 2026
CVE-2026-100526 OpenClaw's Discord integration (npm package @openclaw/discord) before version 2026.9.3 could lose the sender-scoped media policy in the emoji and sticker upload actions b...	5.3 Medium	—	0,28%	26 Sep 2026
CVE-2026-100525 The OpenClaw Prometheus diagnostics plugin (@openclaw/diagnostics-prometheus) before version 2026.9.3 does not enforce the operator.read scope on its authenticated metric...	4.3 Medium	—	0,25%	26 Sep 2026
CVE-2026-100524 Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in the extensions manager that allows attackers to perform state-changing actions without anti-C...	5.4 Medium	—	0,12%	26 Sep 2026
CVE-2026-100523 Cotonti through 1.0.0 contains an open redirect vulnerability in message.php that base64-decodes the redirect parameter without domain validation. Unauthenticated attacke...	6.1 Medium	—	0,19%	26 Sep 2026
CVE-2026-100522 Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in message.php where the lng parameter is not properly escaped before output in the confirma...	6.1 Medium	—	0,21%	26 Sep 2026
CVE-2026-100521 Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in the search plugin highlight parameter that performs no HTML or JavaScript escaping. Attac...	6.1 Medium	—	0,20%	26 Sep 2026
CVE-2026-100520 Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary fil...	8.8 High	—	0,94%	26 Sep 2026
CVE-2026-100505 nsa ghidra Ghidra versions 9.2 through 12.1.4 contain a heap out-of-bounds read vulnerability in StringManager::getCodepoint when decoding multi-byte UTF-8, UTF-16, or UTF-32 charac...	4.4 Medium	—	0,14%	26 Sep 2026
CVE-2026-100504 nsa ghidra Ghidra versions through 12.1.4 contain a stack-based out-of-bounds write vulnerability in the decompiler's leftshift128 function when processing negative shift amounts fr...	7.0 High	—	0,16%	26 Sep 2026
CVE-2026-100503 nsa ghidra Ghidra versions through 12.1.4 contain a heap use-after-free vulnerability in the decompiler's Funcdata::opInsertAfter function caused by stale INDIRECT effect-op referen...	5.5 Medium	—	0,12%	26 Sep 2026
CVE-2026-96795 Horilla is an HR and CRM software. Prior to 2.0.0, HorillaListView.export_data in horilla_views/generic/cbv/views.py accepts an authenticated user's columns POST paramete...	8.8 High	—	0,31%	25 Sep 2026
CVE-2026-86066 Horilla is an HR and CRM software. Prior to 2.0.0, approve_validate_attendance_request at /attendance/approve-validate-attendance-request/ changes attendance_validated, i...	5.9 Medium	—	0,20%	25 Sep 2026
CVE-2026-57449 Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositor...	7.1 High	—	0,21%	25 Sep 2026
CVE-2026-92842 The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked sep...	5.9 Medium	—	0,36%	25 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.