Katalog CVE (hal. 258)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 259.784 (Critical 36.003 · High 103.813 · KEV 1.747 · sejak 2020) · Pembaruan terakhir: 20 Okt 2026, 00:28 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 12.851–12.900 dari 259.784 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-65980 Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, Chartbrew's ClickHouse prot...	7.9 High	—	0,46%	21 Sep 2026
CVE-2026-61852 Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery() impl...	5.8 Medium	—	0,36%	21 Sep 2026
CVE-2026-61851 Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery() impl...	6.5 Medium	—	0,47%	21 Sep 2026
CVE-2026-61743 Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's server/modules/...	6.3 Medium	—	0,40%	21 Sep 2026
CVE-2026-61652 Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service via memory exhaustion. The issue affects all callers who streamed compressed resp...	8.7 High	—	0,44%	21 Sep 2026
CVE-2026-61541 Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or follows a redir...	6.9 Medium	—	0,43%	21 Sep 2026
CVE-2026-59830 Discourse is an open-source discussion platform. Prior to 2026.7.0, the post action component failed to escape user-controlled display names before interpolating them int...	5.4 Medium	—	0,29%	21 Sep 2026
CVE-2026-59815 Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's ItemModel.checkIfAllowed() autho...	4.3 Medium	—	0,23%	21 Sep 2026
CVE-2026-59814 Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's GET /shares/:id?resource_id= rou...	7.6 High	—	0,35%	21 Sep 2026
CVE-2026-55210 Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's UserModel.ssoLogin() returns an...	7.4 High	—	0,48%	21 Sep 2026
CVE-2026-46650 Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, isAcceptedUrl() in packages/renderer/htmlUtils.t...	4.4 Medium	—	0,28%	21 Sep 2026
CVE-2026-17054 The Espressif ESP-hosted Wi-Fi driver (drivers/wifi/esp_hosted/) parses frames received over SPI from the ESP co-processor in esp_hosted_event_task(). For control frames...	5.3 Medium	—	0,17%	21 Sep 2026
CVE-2026-15890 The default AEAD nonce provider for the PSA Internal Trusted Storage transform module, secure_storage_its_transform_aead_get_nonce() in subsys/secure_storage/src/its/tran...	5.3 Medium	—	0,06%	21 Sep 2026
CVE-2026-94588 In Proxmox pmg-api, an argument injection vulnerability exists in the package changelog retrieval functionality. This is caused by improper handling of user-supplied inpu...	4.4 Medium	—	0,25%	21 Sep 2026
CVE-2026-94572 In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field for control characters. The value is written verb...	9.4 Critical	—	0,53%	21 Sep 2026
CVE-2026-94571 In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirect_prefix fields. The RFC 3986 U...	9.4 Critical	—	0,53%	21 Sep 2026
CVE-2026-94424 A vulnerability has been found in Moore Threads MTT S80 Driver Package up to 340.150. Impacted is the function sub_140001000 in the library mtdispkm64.sys of the componen...	8.8 High	—	0,20%	21 Sep 2026
CVE-2026-93433 A flaw was found in libstoragemgmt. An attacker with control over a local or virtual storage device could provide specially crafted SCSI (Small Computer System Interface)...	5.5 Medium	—	0,16%	21 Sep 2026
CVE-2026-88746 idccms V1.70 is vulnerable to Cross Site Scripting (XSS) in /admin/makeDiy_deal.php.	7.1 High	—	0,25%	21 Sep 2026
CVE-2026-88745 EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell.	6.1 Medium	—	0,25%	21 Sep 2026
CVE-2026-88467 CRMEB Knowledge-Paid System crmeb_zzff_class 1.4.4 has a backend verification function that returns the wrong type of value, causing errors and leaking sensitive informat...	6.2 Medium	—	0,12%	21 Sep 2026
CVE-2026-88412 An integer overflow in the _BulkInsert_ReadProperty component (/bulk_insert.c) of FalkorDB (Redis module) v4.20.1 allows attackers to cause a Denial of Service (DoS) via...	5.3 Medium	—	0,40%	21 Sep 2026
CVE-2026-88411 Improper error handling in the GRAPH.EFFECT component (/effects/effects_apply.c) of FalkorDB (Redis module) v4.20.1 leads to a Denial of Service (DoS) within the applicat...	7.5 High	—	0,49%	21 Sep 2026
CVE-2026-88410 The graph.UDF in FalkorDB (Redis module) v4.20.1 to v4.20.4 is not registered as a write command, leading to unexpected behavior within the application.	7.1 High	—	0,32%	21 Sep 2026
CVE-2026-88409 FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a buffer overflow in the _Decode_GrB_Matrix function (/v19/decode_matrix.c). This vulnerability allow...	8.8 High	—	0,48%	21 Sep 2026
CVE-2026-88408 FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _GetGroup() function (/ops/op_aggregate.c). This vulnerability allows attacke...	6.5 Medium	—	0,41%	21 Sep 2026
CVE-2026-88407 An out-of-bounds read in the node_token_count/relation_token_count component of FalkorDB (Redis module) v4.20.1 to v4.20.4 allows attackers to cause a Denial of Service (...	7.5 High	—	0,46%	21 Sep 2026
CVE-2026-88406 FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _ValidateUnion_Clauses function (/ast/ast_validations.c). This vulnerability...	7.5 High	—	0,46%	21 Sep 2026
CVE-2026-88405 A remote code execution (RCE) vulnerability in the RemoteRegisterFunctionService function (/remote/remote-register-function.service.ts) of Univer v1.0.0-alpha.2 allows at...	9.8 Critical	—	0,75%	21 Sep 2026
CVE-2026-88404 A remote code execution (RCE) vulnerability in the UniscriptExecutionService.execute() function (/services/script-execution.service.ts) of Univer v1.0.0-alpha.2 allows at...	9.8 Critical	—	0,75%	21 Sep 2026
CVE-2026-88403 A Server-Side Request Forgery (SSRF) in the serverRequest function of nocobase v2.1.21 allows authenticated attackers to scan internal resources via a crafted HTTP reques...	6.5 Medium	—	0,40%	21 Sep 2026
CVE-2026-88402 A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via injecting crafted SQL statements.	9.8 Critical	—	0,47%	21 Sep 2026
CVE-2026-79919 MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.6-lts, function-library code running under the LD_PRELOAD sandbox can invoke ctypes.CDLL from a...	6.3 Medium	—	0,39%	21 Sep 2026
CVE-2026-79918 MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.6-lts, the ToolExecutor LD_PRELOAD sandbox hooks execve, execvpe, and execveat to prevent subpr...	6.3 Medium	—	0,36%	21 Sep 2026
CVE-2026-79917 MaxKB is an open-source AI assistant for enterprise. In 2.7.0 through 2.10.4-lts, POST /chat/api/{application_id}/chat/{chat_id}/share_chat verifies that a conversation e...	6.5 Medium	—	0,27%	21 Sep 2026
CVE-2026-79916 MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace members can inject control characters into AWS Bedrock access_key_id and...	9.1 Critical	—	0,45%	21 Sep 2026
CVE-2026-79317 A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only checks that a user object can be...	4.8 Medium	—	0,29%	21 Sep 2026
CVE-2026-79316 An improper access control vulnerability exists in x-ui 0.3.2. Any authenticated panel user can modify the xray configuration template through the settings interface and...	7.6 High	—	0,32%	21 Sep 2026
CVE-2026-77525 MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, management chat-record routes authorize the path application_id but load records using glo...	4.2 Medium	—	0,19%	21 Sep 2026
CVE-2026-77523 MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the model parameter form route authorizes the path workspace but ModelSerializer.M...	7.4 High	—	0,26%	21 Sep 2026
CVE-2026-77522 MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the knowledge web-document import and synchronization crawler passes an authentica...	4.3 Medium	—	0,30%	21 Sep 2026
CVE-2026-77521 MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a tool, MCP tool, skill, or sub-application use SandboxShellBackend, whi...	10.0 Critical	—	1,0%	21 Sep 2026
CVE-2026-77520 MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal user in the same workspace can obtain another user's application_id from the home...	5.4 Medium	—	0,23%	21 Sep 2026
CVE-2026-77519 MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, the /chat/api/mcp authentication path looks up an ApplicationApiKey using only its secret...	5.4 Medium	—	0,24%	21 Sep 2026
CVE-2026-77518 MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal workspace user who knows another user's active MCP tool_id in the same workspace...	5.0 Medium	—	0,27%	21 Sep 2026
CVE-2026-77517 MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.10.2-lts, document and paragraph operate routes authorize only knowledge_id in the reque...	5.4 Medium	—	0,23%	21 Sep 2026
CVE-2026-77516 MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.9.2, a lowest-role workspace member denied access to a tool by WorkspaceUserResourcePerm...	5.4 Medium	—	0,24%	21 Sep 2026
CVE-2026-73553 Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, When ignore_path_parameters_in_path_m...	7.5 High	—	0,51%	21 Sep 2026
CVE-2026-73551 Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not re...	5.3 Medium	—	0,53%	21 Sep 2026
CVE-2026-73511 envoyproxy envoy Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw reques...	5.3 Medium	—	0,38%	21 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.