Katalog CVE (hal. 257)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 259.612 (Critical 35.994 · High 103.761 · KEV 1.747 · sejak 2020) · Pembaruan terakhir: 19 Okt 2026, 18:29 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 12.801–12.850 dari 259.612 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-48974 HomeBox is a home inventory and organization system. Prior to 0.26.0, POST /v1/groups/members invokes HandleGroupMemberAdd and GroupService.AddMember using a caller-suppl...	5.4 Medium	—	0,29%	21 Sep 2026
CVE-2026-48826 HomeBox is a home inventory and organization system. Prior to 0.26.0, HandleWipeInventory in backend/app/api/handlers/v1/v1_ctrl_actions.go authorizes POST /v1/actions/wi...	8.1 High	—	0,49%	21 Sep 2026
CVE-2026-94449 A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices. The issue oc...	7.5 High	—	0,63%	21 Sep 2026
CVE-2026-84990 ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua and scripts/lu...	8.8 High	—	0,33%	21 Sep 2026
CVE-2026-83621 ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, POST /lua/rest/v2/edit/system/edit_blacklist.lua in scripts/lua/rest/v2/edit/system/edi...	8.1 High	—	0,53%	21 Sep 2026
CVE-2026-79920 Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlug...	9.9 Critical	—	0,62%	21 Sep 2026
CVE-2026-77582 Tinyauth is an authentication and authorization server. Prior to 5.1.0, Tinyauth exposes a remotely observable timing difference between authentication attempts for exist...	6.9 Medium	—	0,48%	21 Sep 2026
CVE-2026-77561 Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login requests with 257 distinct nonexi...	5.3 Medium	—	0,60%	21 Sep 2026
CVE-2026-77560 Tinyauth is an authentication and authorization server. Prior to 5.1.2, Tinyauth compares forwarded hostnames case-sensitively while reverse proxies route equivalent host...	8.1 High	—	0,61%	21 Sep 2026
CVE-2026-76898 draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.3.8, src/main/java/com/mxgraph/online/Utils.java checks IPv6 Unique Local Address...	7.7 High	—	0,35%	21 Sep 2026
CVE-2026-63416 draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, src/main/java/com/mxgraph/online/ExportProxyServlet.java uses request.getPat...	3.7 Low	—	0,33%	21 Sep 2026
CVE-2026-63373 draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, the OAuth callback handler in src/main/java/com/mxgraph/online/AbsAuth.java...	4.2 Medium	—	0,15%	21 Sep 2026
CVE-2026-63334 draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, deployments with ENABLE_DRAWIO_PROXY=1 are vulnerable to server-side request...	6.8 Medium	—	0,32%	21 Sep 2026
CVE-2026-63116 deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valv...	8.8 High	—	0,51%	21 Sep 2026
CVE-2026-62987 Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/http_headers.go uses protectHeade...	5.8 Medium	—	0,20%	21 Sep 2026
CVE-2026-62866 Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advan...	6.2 Medium	—	0,19%	21 Sep 2026
CVE-2026-62371 KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.12.0 until 1.21.2, 1.22.2, and 1.23.1...	8.8 High	—	0,49%	21 Sep 2026
CVE-2026-62370 KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.0.0 until 1.21.2, 1.22.2, and 1.23.1,...	6.5 Medium	—	0,50%	21 Sep 2026
CVE-2026-61674 Fluent Bit is a fast and lightweight logs, metrics, and traces processor for Linux, BSD, macOS, and Windows. From 0.11.0 until 5.0.8, plugins/out_forward/forward.c secure...	9.2 Critical	—	0,72%	21 Sep 2026
CVE-2026-59168 Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.1, parsing/json/json_reader.go decodeValue, deco...	6.2 Medium	—	0,13%	21 Sep 2026
CVE-2026-58504 draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.5, opening or importing a crafted .drawio file can execute attacker-controlled...	6.1 Medium	—	0,25%	21 Sep 2026
CVE-2026-17051 The Intel SEDI IPM (inter-processor mailbox) driver in drivers/ipm/ipm_sedi.c handles an inbound message interrupt in ipm_event_dispose(). It read the peer-written doorbe...	6.0 Medium	—	0,11%	21 Sep 2026
CVE-2026-17050 The experimental USB host stack allocates a per-device configuration-descriptor buffer, udev->cfg_desc, from the dedicated usb_device_heap in usbh_device_set_configuratio...	5.7 Medium	—	0,16%	21 Sep 2026
CVE-2026-88978 Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pkg/repositor...	4.3 Medium	—	0,28%	21 Sep 2026
CVE-2026-85751 Mailu is a mail server distributed as a set of Docker images. From Mailu 2.0 until 2024.06.55 and prior to Mailu helm-charts 2.7.3, deployments with PROXY_AUTH_WHITELIST...	9.8 Critical	—	0,56%	21 Sep 2026
CVE-2026-84298 Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.95.3, the V1 DurableTask stream handler stores worker-supp...	3.1 Low	—	0,24%	21 Sep 2026
CVE-2026-82412 ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, the vulnerability-scan endpoints scripts/lua/rest/v2/add/host/to_scan.lua and scripts/l...	8.8 High	—	0,65%	21 Sep 2026
CVE-2026-77166 The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can...	2.4 Low	—	0,28%	21 Sep 2026
CVE-2026-77165 File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database.	6.5 Medium	—	0,42%	21 Sep 2026
CVE-2026-63342 Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-runs/workflo...	6.3 Medium	—	0,31%	21 Sep 2026
CVE-2026-61687 Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauth_state_ session v...	7.1 High	—	0,17%	21 Sep 2026
CVE-2026-61681 Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/...	4.1 Medium	—	0,31%	21 Sep 2026
CVE-2026-55563 Feast is the open source feature store for AI and machine learning. Prior to 0.65.0, .github/workflows/pr_integration_tests.yml uses pull_request_target with the synchron...	8.9 High	—	0,50%	21 Sep 2026
CVE-2026-53940 Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parse_entry_point_def in conda/common/...	8.8 High	—	0,55%	21 Sep 2026
CVE-2026-36472 CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS). Improper neutralization of the __referer value 2.0.1 allows a remote attacker to execute arbitrary JavaScrip...	5.2 Medium	—	0,23%	21 Sep 2026
CVE-2026-36471 Deserialization of Untrusted Data of the __post_data parameter in cn_parse_url() in CuteNews v.2.1.2 allows a remote attacker to inject arbitrary values into internal req...	5.8 Medium	—	0,21%	21 Sep 2026
CVE-2026-36470 CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS) in index.php. The value of the "Referer" header is copied into the response HTML unmodified/unescaped during...	5.8 Medium	—	0,22%	21 Sep 2026
CVE-2026-36469 CuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery (SSRF) in core/modules/media.php -- upload_from_inet (Media Manager's "Upload by URL" functionality).	9.1 Critical	—	0,27%	21 Sep 2026
CVE-2026-36468 Cross-site Scripting (XSS) in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers to supply an arbitrarily named URL parameter key, with part of its nam...	6.1 Medium	—	0,34%	21 Sep 2026
CVE-2026-36467 Unrestricted Upload of File with Dangerous Type in core/modules/media.php in CuteNews v.2.1.2 allows remote authenticated users with access to the Media Manager panel to...	7.2 High	—	0,53%	21 Sep 2026
CVE-2026-94301 The fix for CVE-2026-47065/ZDRES-232 ("resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy"), released on 2026-06-02 and announced...	9.8 Critical	—	0,39%	21 Sep 2026
CVE-2026-94184 A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a...	5.3 Medium	—	0,82%	21 Sep 2026
CVE-2026-93339 Metaphor Creations Ditty (ditty-news-ticker) before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated users with Author-level privileg...	5.4 Medium	—	0,31%	21 Sep 2026
CVE-2026-86473 apache airflow Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie. When a client logs out presenting its credential as an Authoriza...	9.1 Critical	—	0,75%	21 Sep 2026
CVE-2026-82355 apache airflow When a request to the Airflow core API carries both a session cookie and an explicit `Authorization: Bearer` token, Airflow resolves the caller from the cookie and ignore...	4.2 Medium	—	0,74%	21 Sep 2026
CVE-2026-80110 A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison r...	8.1 High	—	0,16%	21 Sep 2026
CVE-2026-75939 A flaw was found in openshift/oc-mirror. The tool incorrectly verifies PGP (Pretty Good Privacy) release image signatures by checking for signature errors before the enti...	7.4 High	—	0,38%	21 Sep 2026
CVE-2026-75158 apache airflow Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is authorized to read....	4.3 Medium	—	0,64%	21 Sep 2026
CVE-2026-71543 OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, templated ACL, PKI, and SSH policies could substitute attacker-controlled identity dat...	7.5 High	—	0,42%	21 Sep 2026
CVE-2026-68919 GoCD is a continuous deliver server. From 13.3.0 until 26.1.0, GoCD does not correctly encode and escape malicious material modification comments that mimic the special t...	7.0 High	—	0,48%	21 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.