Katalog CVE (hal. 259)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 259.784 (Critical 36.003 · High 103.813 · KEV 1.747 · sejak 2020) · Pembaruan terakhir: 20 Okt 2026, 00:28 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 12.901–12.950 dari 259.784 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-67827 Incorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 allows remote attackers to achieve Remote Code Execution (RCE) via unauthenticated access to...	9.8 Critical	—	0,75%	21 Sep 2026
CVE-2026-61647 NotebookLM MCP is an MCP server and HTTP service for interacting with Google NotebookLM and exporting generated content to local vault directories. Versions 1.6.0 through...	7.1 High	—	0,32%	21 Sep 2026
CVE-2026-59816 Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, the GET /api/transcribe/:id and POST /api/transc...	4.3 Medium	—	0,36%	21 Sep 2026
CVE-2026-58272 Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Versions prior to 2.4.1 contain an observable timing discrepancy in the l...	5.3 Medium	—	0,34%	21 Sep 2026
CVE-2026-58270 Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, the sync diff endpoint compiles a user-supplied s...	6.5 Medium	—	0,35%	21 Sep 2026
CVE-2026-55179 Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /items/:id/content route in...	6.5 Medium	—	0,26%	21 Sep 2026
CVE-2026-55105 Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, packages/renderer/MdToHtml/rules/foun...	7.7 High	—	0,50%	21 Sep 2026
CVE-2026-49453 Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, Joplin accepts synchronized resource...	7.0 High	—	0,41%	21 Sep 2026
CVE-2026-49450 Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Desktop for Windows omits publisherName f...	7.1 High	—	0,18%	21 Sep 2026
CVE-2026-49449 Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. From 1.4.0 until 3.7.2, packages/renderer/MdToHtml/rules/katex.t...	2.5 Low	—	0,20%	21 Sep 2026
CVE-2026-46649 Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /api/login_with_code/:id end...	9.1 Critical	—	0,50%	21 Sep 2026
CVE-2026-85219 Denial-of-Service in Redis module in Thinkst Canary's OpenCanary 0.9.9 allows an unauthenticated remote attacker cause unconstrained memory usage.	3.7 Low	—	0,41%	21 Sep 2026
CVE-2026-81469 Dell Inventory Collector Client, versions prior to 15.0.0, contain an Unquoted Search Path or Element vulnerability. A low privileged attacker with local access could pot...	7.8 High	—	0,19%	21 Sep 2026
CVE-2026-79320 Stencil core 4.43.5 contains a DOM-based cross-site scripting (XSS) vulnerability in the component runtime. When a downstream application enables the experimental slot fi...	6.1 Medium	—	0,16%	21 Sep 2026
CVE-2026-79319 Stencil core 4.43.5 is vulnerable to Incorrect Access Control.	5.3 Medium	—	0,21%	21 Sep 2026
CVE-2026-79318 web2py 3.2.2-stable (commit a7330a2bf21219fa77860b6665de927dd4f98e6d) is vulnerable to Directory Traversal in read_file()/write_file() (applications/admin/controllers/web...	6.5 Medium	—	0,56%	21 Sep 2026
CVE-2026-73552 envoyproxy envoy Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy HTTP RBAC accepts RFC-valid opa...	7.5 High	—	0,47%	21 Sep 2026
CVE-2026-73550 Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy copies every decoded HTTP/2 Hos...	7.5 High	—	0,55%	21 Sep 2026
CVE-2026-73549 Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's Utility::copyInternetAddressA...	5.3 Medium	—	0,62%	21 Sep 2026
CVE-2026-73548 Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy forwards data for a configured...	7.5 High	—	0,46%	21 Sep 2026
CVE-2026-73547 envoyproxy envoy Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ext_authz filter assumes that...	7.5 High	—	0,55%	21 Sep 2026
CVE-2026-73546 Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's /stats?format=html admin endp...	7.4 High	—	0,62%	21 Sep 2026
CVE-2026-73513 Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's optional oghttp2 upstream HTT...	7.5 High	—	0,48%	21 Sep 2026
CVE-2026-73512 Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HttpDatagramHandler caches th...	7.5 High	—	0,87%	21 Sep 2026
CVE-2026-62247 Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension p...	6.5 Medium	—	0,45%	21 Sep 2026
CVE-2026-58271 Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/app/sync/register` accepts credentials...	6.8 Medium	—	0,22%	21 Sep 2026
CVE-2026-58269 Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/auth/token` authenticates with usernam...	8.1 High	—	0,22%	21 Sep 2026
CVE-2026-55897 luci-app-advanced-reboot is a LuCI (web interface) application for OpenWrt that provides a way to reboot your router into an alternative firmware partition or perform r...	8.8 High	—	0,65%	21 Sep 2026
CVE-2026-55159 luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci.adblock-fas...	8.8 High	—	0,49%	21 Sep 2026
CVE-2026-54915 Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the unauthenticated /auth/redirect endpoint in plexpy/webauth.py removes f...	5.4 Medium	—	0,26%	21 Sep 2026
CVE-2026-52835 Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the import_config handler and the database_file branch of import_database...	7.0 High	—	0,59%	21 Sep 2026
CVE-2026-50572 Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HTTP external-authorization c...	5.9 Medium	—	0,68%	21 Sep 2026
CVE-2026-49995 Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the newsletter cron field stored in the newsletters table is inserted by d...	4.8 Medium	—	0,60%	21 Sep 2026
CVE-2026-49811 Dell Command \| Monitor (DCM), versions prior to 10.13.2, contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with lo...	8.4 High	—	0,14%	21 Sep 2026
CVE-2026-48521 Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ProdClusterManagerFactory::al...	5.9 Medium	—	0,74%	21 Sep 2026
CVE-2026-45381 Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the /search endpoint inserts its user-controlled query parameter into a Ja...	5.1 Medium	—	0,57%	21 Sep 2026
CVE-2026-94501 jshERP through 3.6 contains an authorization bypass vulnerability in the userBusiness CRUD endpoints that allows authenticated users to create, modify, or delete authoriz...	8.8 High	—	0,55%	21 Sep 2026
CVE-2026-94497 jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multiple resource types. Authenticated users can read, modify, an...	8.3 High	—	0,46%	21 Sep 2026
CVE-2026-94496 jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete roles. Attack...	8.3 High	—	0,46%	21 Sep 2026
CVE-2026-94495 jshERP through 3.6 fails to properly validate user privileges in SystemConfigService.updateSystemConfig, allowing authenticated users to modify tenant system configuratio...	7.1 High	—	0,44%	21 Sep 2026
CVE-2026-94494 jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows authenticated users to read other tenants' records via the GET /tenant/info endpoint. Atta...	5.0 Medium	—	0,37%	21 Sep 2026
CVE-2026-94414 jshERP through 3.6 is missing an authorization check on the POST /userBusiness/updateBtnStr endpoint that allows authenticated users to modify role button-permission defi...	5.4 Medium	—	0,38%	21 Sep 2026
CVE-2026-94413 jshERP through 3.6 fails to redact password hashes in the /user/info endpoint, allowing authenticated users to retrieve unsalted MD5 password digests for any user. Attack...	6.5 Medium	—	0,55%	21 Sep 2026
CVE-2026-94412 jshERP through 3.6 contains an authorization bypass vulnerability in the POST /user/resetPwd endpoint that allows authenticated users to reset any other user's password....	8.8 High	—	0,55%	21 Sep 2026
CVE-2026-94411 jshERP 3.6 contains a privilege escalation vulnerability in the updateOneValueByKeyIdAndType endpoint that allows authenticated users to grant themselves arbitrary roles....	8.8 High	—	0,52%	21 Sep 2026
CVE-2026-94403 A weakness has been identified in ColorFul iGameCenter 1.0.3.4. This impacts the function sub_140001AF0 in the library ene.sys of the component IOCTL Handler. This manipu...	8.8 High	—	0,18%	21 Sep 2026
CVE-2026-91167 Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.28.4, PUT /@warpgate/admin/api/users/:id/roles/:role_id reaches api_update_user_role in...	6.0 Medium	—	0,41%	21 Sep 2026
CVE-2026-91166 Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent:...	5.7 Medium	—	0,22%	21 Sep 2026
CVE-2026-91165 Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.27.6, the response_mode=form_post SSO return path in warpgate-protocol-http/src/api/sso...	2.4 Low	—	0,40%	21 Sep 2026
CVE-2026-91164 Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.23.0 until 0.27.3, HTTP API token authentication resolves ConfigProvider::validate_api_toke...	4.3 Medium	—	0,42%	21 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.