Katalog CVE (hal. 261)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 259.784 (Critical 36.003 · High 103.813 · KEV 1.747 · sejak 2020) · Pembaruan terakhir: 20 Okt 2026, 00:28 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 13.001–13.050 dari 259.784 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-77166 The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can...	2.4 Low	—	0,28%	21 Sep 2026
CVE-2026-77165 File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database.	6.5 Medium	—	0,42%	21 Sep 2026
CVE-2026-63342 Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-runs/workflo...	6.3 Medium	—	0,31%	21 Sep 2026
CVE-2026-61687 Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauth_state_ session v...	7.1 High	—	0,17%	21 Sep 2026
CVE-2026-61681 Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/...	4.1 Medium	—	0,31%	21 Sep 2026
CVE-2026-55563 Feast is the open source feature store for AI and machine learning. Prior to 0.65.0, .github/workflows/pr_integration_tests.yml uses pull_request_target with the synchron...	8.9 High	—	0,50%	21 Sep 2026
CVE-2026-53940 Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parse_entry_point_def in conda/common/...	8.8 High	—	0,55%	21 Sep 2026
CVE-2026-36472 CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS). Improper neutralization of the __referer value 2.0.1 allows a remote attacker to execute arbitrary JavaScrip...	5.2 Medium	—	0,23%	21 Sep 2026
CVE-2026-36471 Deserialization of Untrusted Data of the __post_data parameter in cn_parse_url() in CuteNews v.2.1.2 allows a remote attacker to inject arbitrary values into internal req...	5.8 Medium	—	0,21%	21 Sep 2026
CVE-2026-36470 CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS) in index.php. The value of the "Referer" header is copied into the response HTML unmodified/unescaped during...	5.8 Medium	—	0,22%	21 Sep 2026
CVE-2026-36469 CuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery (SSRF) in core/modules/media.php -- upload_from_inet (Media Manager's "Upload by URL" functionality).	9.1 Critical	—	0,27%	21 Sep 2026
CVE-2026-36468 Cross-site Scripting (XSS) in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers to supply an arbitrarily named URL parameter key, with part of its nam...	6.1 Medium	—	0,34%	21 Sep 2026
CVE-2026-36467 Unrestricted Upload of File with Dangerous Type in core/modules/media.php in CuteNews v.2.1.2 allows remote authenticated users with access to the Media Manager panel to...	7.2 High	—	0,53%	21 Sep 2026
CVE-2026-94301 The fix for CVE-2026-47065/ZDRES-232 ("resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy"), released on 2026-06-02 and announced...	9.8 Critical	—	0,39%	21 Sep 2026
CVE-2026-94184 A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a...	5.3 Medium	—	0,82%	21 Sep 2026
CVE-2026-93339 Metaphor Creations Ditty (ditty-news-ticker) before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated users with Author-level privileg...	5.4 Medium	—	0,31%	21 Sep 2026
CVE-2026-86473 apache airflow Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie. When a client logs out presenting its credential as an Authoriza...	9.1 Critical	—	0,75%	21 Sep 2026
CVE-2026-82355 apache airflow When a request to the Airflow core API carries both a session cookie and an explicit `Authorization: Bearer` token, Airflow resolves the caller from the cookie and ignore...	4.2 Medium	—	0,74%	21 Sep 2026
CVE-2026-80110 A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison r...	8.1 High	—	0,16%	21 Sep 2026
CVE-2026-75939 A flaw was found in openshift/oc-mirror. The tool incorrectly verifies PGP (Pretty Good Privacy) release image signatures by checking for signature errors before the enti...	7.4 High	—	0,38%	21 Sep 2026
CVE-2026-75158 apache airflow Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is authorized to read....	4.3 Medium	—	0,64%	21 Sep 2026
CVE-2026-71543 OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, templated ACL, PKI, and SSH policies could substitute attacker-controlled identity dat...	7.5 High	—	0,42%	21 Sep 2026
CVE-2026-68919 GoCD is a continuous deliver server. From 13.3.0 until 26.1.0, GoCD does not correctly encode and escape malicious material modification comments that mimic the special t...	7.0 High	—	0,48%	21 Sep 2026
CVE-2026-61630 nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reused during th...	4.2 Medium	—	0,38%	21 Sep 2026
CVE-2026-61629 nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in front of ev...	7.5 High	—	0,42%	21 Sep 2026
CVE-2026-61628 nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, `POST /api/users/onboarding/finish` is registered as anonymous (unauthenticated) and...	8.1 High	—	0,43%	21 Sep 2026
CVE-2026-55870 GoCD is a continuous deliver server. Prior to 26.1.0, GoCD can return unmasked credentials that administrators stored in the userinfo portion of source control material U...	2.3 Low	—	0,58%	21 Sep 2026
CVE-2026-55625 GoCD is a continuous deliver server. From 16.1.0 until 26.1.0, the internal material connection test APIs at /go/api/admin/internal/material_test and /go/api/internal/con...	4.9 Medium	—	0,59%	21 Sep 2026
CVE-2026-55567 BleachBit cleans files to free disk space and to maintain privacy. Prior to 6.0.1, privileged Windows cleaning does not lock and validate a target's parent directory befo...	7.8 High	—	0,14%	21 Sep 2026
CVE-2026-55074 Ansible FreeBSD Jail Connection Plugin is an Ansible connection plugin for FreeBSD Jails via jexec. Through version 1.3.0, the jailexec connection plugin's put_file resol...	8.2 High	—	0,44%	21 Sep 2026
CVE-2026-55071 MCP-for-Stata is a MCP server for integrating Stata into agent loops with a safety-first design. Prior to version 1.19.0, the ado_package_install MCP tool in stata-mcp co...	8.4 High	—	0,25%	21 Sep 2026
CVE-2026-55060 GoCD is a continuous deliver server. From 13.1.0 until 26.1.0, the /go/api/support/process_list endpoint does not enforce its intended administrator-only authorization. A...	3.7 Low	—	0,41%	21 Sep 2026
CVE-2026-54584 mport is the MidnightBSD Package Manager. mport before 2.7.8 used TMPDIR while extracting package metafiles, including when running as root or in setuid/setgid contexts....	5.3 Medium	—	0,47%	21 Sep 2026
CVE-2026-52743 GoCD is a continuous deliver server. Prior to 26.1.0, the internal GoCD UI /jobStatus.json API does not validate that a requested server-assigned job ID belongs to the pi...	4.3 Medium	—	0,40%	21 Sep 2026
CVE-2026-52742 GoCD is a continuous deliver server. From 12.3.1 until 26.1.0, legacy routes under /go/admin/restful/* expose historical full server configuration to pipeline group admin...	5.1 Medium	—	0,71%	21 Sep 2026
CVE-2026-52741 GoCD is a continuous deliver server. From 18.3.0 until 26.1.0, GoCD can generate unescaped tracking-tool links from commit comments when a project uses a lenient Tracking...	7.5 High	—	0,54%	21 Sep 2026
CVE-2026-52740 GoCD is a continuous deliver server. From 18.7.0 until 26.1.0, the Get Template Config API compares HTTP method names case-sensitively when selecting authorization filter...	5.3 Medium	—	0,58%	21 Sep 2026
CVE-2026-94404 MISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user’s browser without that user knowingly approving the change....	7.1 High	—	0,21%	21 Sep 2026
CVE-2026-94401 MISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services. When importing an XML f...	8.3 High	—	0,38%	21 Sep 2026
CVE-2026-94394 When a regular user adds a reference between objects or attributes, MISP checks whether the user can access the overall event, but it does not always check whether the in...	6.3 Medium	—	0,35%	21 Sep 2026
CVE-2026-94393 When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs...	6.4 Medium	—	0,37%	21 Sep 2026
CVE-2026-94387 Aureus ERP before 1.6.0 contains a stored cross-site scripting vulnerability in the Chatter field-change log where old_value and new_value entries are rendered without pr...	5.4 Medium	—	0,32%	21 Sep 2026
CVE-2026-94382 Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that allows any authenticated user...	4.2 Medium	—	0,31%	21 Sep 2026
CVE-2026-88807 A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients.	8.9 High	—	0,26%	21 Sep 2026
CVE-2026-88806 A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map.	7.5 High	—	0,20%	21 Sep 2026
CVE-2026-85220 A vulnerability in the Thinkst Canary honeypot Redis service allows an unauthenticated remote attacker to execute a Denial-of-Service attack against the honeypot. The vu...	3.7 Low	—	0,41%	21 Sep 2026
CVE-2025-71421 UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to...	7.2 High	—	0,44%	21 Sep 2026
CVE-2025-71420 UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replies restricte...	4.3 Medium	—	0,30%	21 Sep 2026
CVE-2025-71419 UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier parameter of the createMailerConfigura...	5.4 Medium	—	0,18%	21 Sep 2026
CVE-2026-94383 The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only sanitization applied was basename...	8.6 High	—	0,51%	21 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.