Katalog CVE (hal. 221)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 259.509 (Critical 35.989 · High 103.743 · KEV 1.747 · sejak 2020) · Pembaruan terakhir: 19 Okt 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 11.001–11.050 dari 259.509 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-18320 Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration f...	6.1 Medium	—	0,16%	25 Sep 2026
CVE-2026-18312 Readwise Reader for Android constructs URLs in its WebView using attacker-controlled metadata without proper encoding or escaping. The application interpolates untrusted...	6.1 Medium	—	0,19%	25 Sep 2026
CVE-2026-18311 Readwise Reader for Android contains a cross-site scripting vulnerability due to missing HTML sanitization in its processing of imported document metadata. Attacker-contr...	6.1 Medium	—	0,16%	25 Sep 2026
CVE-2026-100248 The Rattadan Cosmowarp smart contract before 56c6147 can have a comparison to an unintended value of current_admin.	8.4 High	—	0,40%	25 Sep 2026
CVE-2026-100237 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Thanks Extension allows Stored...	6.1 Medium	—	0,16%	25 Sep 2026
CVE-2026-97869 A flaw has been found in langchain4j up to 1.5.3-beta10/1.11.10-beta18/1.18.1-beta27. This vulnerability affects the function AgenticScopeSerializer.fromJson of the file...	4.1 Medium	—	0,38%	25 Sep 2026
CVE-2026-97868 A security vulnerability has been detected in sheshbabu zen up to 1.5.0. Affected by this issue is the function dangerouslySetInnerHTML of the file features/notes/NotesEd...	3.5 Low	—	0,19%	25 Sep 2026
CVE-2026-97469 PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash() function and collects (seed, hash_output) pairs to...	4.3 Medium	—	0,12%	25 Sep 2026
CVE-2026-96874 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in the Mediawiki - Cargo extension allows Stored XSS. This issue...	2.3 Low	—	0,20%	25 Sep 2026
CVE-2026-92161 FriendsOfFlarum OAuth allows users to log in to Flarum with GitHub, Twitter, Facebook, and other providers. Prior to 1.7.4 and 2.0.0-beta.4, the Discord OAuth provider do...	9.8 Critical	—	0,27%	25 Sep 2026
CVE-2026-85293 InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2-beta-1, InvoicePlane stores client_email values witho...	4.8 Medium	—	0,22%	25 Sep 2026
CVE-2026-85292 InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's User_Controller compares the session us...	4.8 Medium	—	0,25%	25 Sep 2026
CVE-2026-85291 InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Users::change_password() method accepts...	6.5 Medium	—	0,26%	25 Sep 2026
CVE-2026-85290 InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Cron::recur() method writes an invalid...	5.3 Medium	—	0,24%	25 Sep 2026
CVE-2026-85289 InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane omits ensure_valid_post_request() from de...	6.5 Medium	—	0,17%	25 Sep 2026
CVE-2026-85274 InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes Recurring::stop() as a state-chan...	6.5 Medium	—	0,17%	25 Sep 2026
CVE-2026-67236 broadcom rabbitmq server RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused is_authorized/2 to set an auth cookie containing base64-en...	6.5 Medium	—	0,14%	25 Sep 2026
CVE-2026-62262 Piwigo is a full featured open source photo gallery application for the web. In 17.0.0beta1 and earlier, when rating is enabled, an unauthenticated guest can call pwg.ima...	9.1 Critical	—	0,30%	25 Sep 2026
CVE-2026-54790 InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane stores an administrator-controlled custom...	6.0 Medium	—	0,23%	25 Sep 2026
CVE-2026-50547 InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Invoices::generate_xml() method appends...	7.5 High	—	0,46%	25 Sep 2026
CVE-2026-49850 InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes Invoices::delete() and Invoices::...	7.5 High	—	0,33%	25 Sep 2026
CVE-2026-44642 Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, check_upgrade_access_rights() in admin/include/functions_upgrade.php conditi...	8.1 High	—	1,3%	25 Sep 2026
CVE-2026-42324 Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/element_set_ranks.php stores administrator-controlled image_order[] va...	7.2 High	—	0,92%	25 Sep 2026
CVE-2026-42323 Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/batch_manager.php accepts administrator-controlled dimension width, he...	7.2 High	—	0,37%	25 Sep 2026
CVE-2026-42322 Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/themes_standard_pages.php validates uploaded logo content by MIME type...	9.1 Critical	—	0,53%	25 Sep 2026
CVE-2026-39372 InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane stores and serves uploaded image attachme...	4.9 Medium	—	0,28%	25 Sep 2026
CVE-2026-39353 InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-rc-1, InvoicePlane builds its permitted template list b...	9.1 Critical	—	0,45%	25 Sep 2026
CVE-2026-33639 InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane interpolates the administrator-controlled...	7.2 High	—	0,40%	25 Sep 2026
CVE-2026-100230 Input Leap (aka input-leap) through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / versus \ distinction and allows di...	5.3 Medium	—	0,65%	25 Sep 2026
CVE-2026-97866 A weakness has been identified in Zhonglun CloudPOS 3.0. Affected by this vulnerability is an unknown functionality of the file Program.cs of the component Automatic Upda...	5.6 Medium	—	0,26%	25 Sep 2026
CVE-2026-96812 Improper Exposure of Resource to Wrong Sphere in the host file helper (gofer) in Google gVisor prior to commit 573a9e73cf844f on Linux platforms with CUSE enabled allows...	8.8 High	—	0,10%	25 Sep 2026
CVE-2026-93306 ibm power system e1080 (9080-hex) firmware, ibm power system e1180 (9080-heu) firmware +7 lainnya IBM Server Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in...	7.1 High	—	0,18%	25 Sep 2026
CVE-2026-93030 FTM 4.x ALL could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity injection flaw.	6.5 Medium	—	0,28%	25 Sep 2026
CVE-2026-88389 Espruino 2v29 (commit bffc6d0) contains a NULL pointer dereference vulnerability in jslGetRawString() in src/jslex.c. Crafted raw/binary string input can cause the lexer...	6.2 Medium	—	0,11%	25 Sep 2026
CVE-2026-84882 IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the Universal Connector Oracle Wallet upload component. An authenticated remote attacker could exploi...	7.5 High	—	0,33%	25 Sep 2026
CVE-2026-84862 IBM Guardium Data Protection 12.2 is vulnerable to insecure deserialization in the Quartz JDBC job store. An authenticated attacker could exploit this vulnerability to ex...	7.2 High	—	0,37%	25 Sep 2026
CVE-2026-98162 linux kernel In the Linux kernel, the following vulnerability has been resolved: smb/server: fix tree connection leak in smb2_tree_connect() See the procedure below: smb2_tree_co...	5.5 Medium	—	0,11%	25 Sep 2026
CVE-2026-98161 linux kernel In the Linux kernel, the following vulnerability has been resolved: nvdimm: pmem: keep PREFLUSH before data writes pmem_submit_bio() records a REQ_PREFLUSH error, but c...	5.5 Medium	—	0,11%	25 Sep 2026
CVE-2026-98160 linux kernel In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() padapter->HalData is alloc...	5.5 Medium	—	0,11%	25 Sep 2026
CVE-2026-97865 A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of the file queue.php of the component Remote Event Q...	7.3 High	—	0,40%	25 Sep 2026
CVE-2026-97864 A vulnerability has been found in GibbonEdu Gibbon up to 30.0.01. The affected element is the function makeBlock of the file modules/Planner/units_add_blockAjax.php of th...	5.3 Medium	—	0,74%	25 Sep 2026
CVE-2026-97222 A heap use-after-free flaw was found in Gnumeric. When a user opens a crafted Gnumeric workbook containing a malformed SheetObjectComponent element, the XML parser can de...	5.5 Medium	—	0,12%	25 Sep 2026
CVE-2026-93834 A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Tw...	8.8 High	—	0,38%	25 Sep 2026
CVE-2026-93647 Advisory An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing...	9.3 Critical	—	0,23%	25 Sep 2026
CVE-2026-93643 When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save f...	9.8 Critical	—	0,96%	25 Sep 2026
CVE-2026-93642 Advisory An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing the attacker to a...	9.3 Critical	—	0,23%	25 Sep 2026
CVE-2026-93641 Advisory An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share, allowing the attacker to...	9.3 Critical	—	0,27%	25 Sep 2026
CVE-2026-85750 Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validatio...	7.2 High	—	1,2%	25 Sep 2026
CVE-2026-85542 IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the GIM bundle import functionality. An authenticated attacker can provide a crafted...	8.8 High	—	2,4%	25 Sep 2026
CVE-2026-85029 IBM Guardium Data Protection 12.2 could allow a remote attacker to obtain sensitive information, delete arbitrary files, or execute arbitrary code due to improper limitat...	7.5 High	—	0,54%	25 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.