Katalog CVE (hal. 271)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 259.784 (Critical 36.003 · High 103.813 · KEV 1.747 · sejak 2020) · Pembaruan terakhir: 20 Okt 2026, 00:28 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 13.501–13.550 dari 259.784 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-62278 LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, authenticated non-administrative users could reach Handl...	8.1 High	—	0,51%	18 Sep 2026
CVE-2026-61552 Icinga 2 is an open source monitoring system. From 2.4 until 2.14.9, 2.15.4, and 2.16.2, the /v1/objects API writes attacker-controlled template names into generated conf...	7.2 High	—	0,90%	18 Sep 2026
CVE-2026-61551 Icinga 2 is an open source monitoring system. Prior to 2.14.9, 2.15.4, and 2.16.2, parsing deeply nested JSON can exhaust the call stack because nesting depth is not boun...	8.6 High	—	0,94%	18 Sep 2026
CVE-2026-61550 Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is...	9.8 Critical	—	0,67%	18 Sep 2026
CVE-2026-59163 Mnemosyne is a memory layer for artificial intelligence agents. Prior to v3.10.1, the auth check in mnemosyne/core/sync_server.py parsed the JWT's header and payload usin...	9.1 Critical	—	0,33%	18 Sep 2026
CVE-2026-33625 LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions 012.1 through 0.12.2 contain a code injection vulnerability in `lmdeploy/pyt...	8.8 High	—	0,44%	18 Sep 2026
CVE-2026-32641 Parseable is a log analytics platform built for high-volume data ingestion and analysis. Prior to 3.0.0, src/handlers/http/middleware.rs uses unwrap() while parsing the x...	7.5 High	—	0,92%	18 Sep 2026
CVE-2025-66455 LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.2 and prior to version 0.16.0, LMDeploy's PyTorch DistServe/P...	9.8 Critical	—	0,69%	18 Sep 2026
CVE-2026-93765 mongodb mongoid Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are passed through from an unauthen...	9.1 Critical	—	0,51%	18 Sep 2026
CVE-2026-93758 mongodb mongoid An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges to referenc...	8.1 High	—	0,36%	18 Sep 2026
CVE-2026-93579 A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into H...	6.5 Medium	—	0,90%	18 Sep 2026
CVE-2026-93559 A vulnerability was identified in Forget-C Jellyfish AI Short Drama Studio 0.1.0-alpha/0.2.0/0.3.0/0.3.1/0.3.2. This affects an unknown function of the file backend/app/d...	7.3 High	—	0,65%	18 Sep 2026
CVE-2026-93534 A vulnerability was identified in spatie Scotty up to 1.4.2. Affected is the function SelfUpdater::update of the file app/Updater/SelfUpdater.php of the component Self Up...	6.3 Medium	—	0,21%	18 Sep 2026
CVE-2026-93533 A vulnerability was determined in spatie Scotty up to 1.4.4. This impacts the function DoctorCommand::checkSshConnectivity/DoctorCommand::checkRemoteTools of the file app...	6.3 Medium	—	1,4%	18 Sep 2026
CVE-2026-93338 Grandstream GWN7660ELR before firmware version 1.0.27.6 contains an information disclosure vulnerability that allows unauthenticated remote attackers to obtain sensitive...	5.3 Medium	—	0,53%	18 Sep 2026
CVE-2026-91149 A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by initiating and sustaining numerous simultaneous connections to the `cock...	7.5 High	—	0,35%	18 Sep 2026
CVE-2026-91147 A flaw was found in `cockpit-ws`. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a specially crafted request....	5.9 Medium	—	0,40%	18 Sep 2026
CVE-2026-91142 A flaw was found in Cockpit. An authenticated local user with a large user identifier (UID) can cause unauthorized modification and disclosure of login records. On 32-bit...	3.6 Low	—	0,12%	18 Sep 2026
CVE-2026-85497 CareCam CM2507 IP cameras store the device's root-account password using a fixed legacy password hash that provides insufficient resistance to offline cracking. An attack...	9.8 Critical	—	0,34%	18 Sep 2026
CVE-2026-85478 A CM2507 IP camera running firmware version HMT.CM2507 v251211.1507 exposes an interactive bootloader through a physical debug interface without requiring authentication....	3.5 Low	—	0,22%	18 Sep 2026
CVE-2026-81505 Convoy is a cloud native webhooks gateway. Prior to 26.6.8, Convoy's GET /api/v1/projects/{projectID}/sources/{sourceID} endpoint authorizes access to the project in the...	7.1 High	—	0,46%	18 Sep 2026
CVE-2026-81321 CM2507 IP cameras store configured wireless network credentials in cleartext within the device filesystem. An attacker who obtains filesystem access through physical acce...	9.8 Critical	—	0,34%	18 Sep 2026
CVE-2026-77616 Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. In versions 7.0.0 through 7.1.0, `Special:A...	6.1 Medium	—	0,33%	18 Sep 2026
CVE-2026-77610 Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, query debug output...	6.1 Medium	—	0,28%	18 Sep 2026
CVE-2026-77609 Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, `Special:URIResolve...	6.1 Medium	—	0,27%	18 Sep 2026
CVE-2026-77608 Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when the `value` pa...	6.1 Medium	—	0,28%	18 Sep 2026
CVE-2026-77607 Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, `sep` was inserted...	6.1 Medium	—	0,28%	18 Sep 2026
CVE-2026-77606 Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when `headers=plain...	6.1 Medium	—	0,26%	18 Sep 2026
CVE-2026-77339 Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listener in src/mcp/server.go accepts browser-origin req...	5.1 Medium	—	0,26%	18 Sep 2026
CVE-2026-77301 adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData() in zipEntry.js trusts an entry's central-directory uncompre...	7.5 High	—	0,61%	18 Sep 2026
CVE-2026-77240 WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, the profiles_update row-level security policy in supabase/migrations/017_account_sharing...	9.9 Critical	—	0,35%	18 Sep 2026
CVE-2026-77239 WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, WACRM flow and automation write routes authenticate account viewers but do not enforce t...	8.1 High	—	0,53%	18 Sep 2026
CVE-2026-73863 NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's broker-side MQTT v5 nmq_subinfo_decode() function in nng/src/sp/protocol/mqtt/mqtt_parser.c reuses len_of_varint from...	7.0 High	—	0,35%	18 Sep 2026
CVE-2026-63406 AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the telemetry subsystem in telemetry/config.go enables tracki...	5.9 Medium	—	0,30%	18 Sep 2026
CVE-2026-63405 AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the Pusher-compatible REST API in pusher/http.go includes the...	5.9 Medium	—	0,21%	18 Sep 2026
CVE-2026-63349 AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. In 4.14.0, AnyIO accepts the POSIX extra_groups argum...	7.0 High	—	0,11%	18 Sep 2026
CVE-2026-62943 btrbk is a tool for creating snapshots and remote backups of Btrfs subvolumes. From 0.29.0 until 0.32.7, btrbk's ssh_filter_btrbk.sh constructs allow_stream_match with a...	8.7 High	—	0,50%	18 Sep 2026
CVE-2026-61833 zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pk...	8.1 High	—	0,51%	18 Sep 2026
CVE-2026-61795 Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, hostnameRegexHandler.OnUpdate in internal/webhook/tenant/validation/hostna...	6.8 Medium	—	0,59%	18 Sep 2026
CVE-2026-61794 Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, the Tenant update validation in internal/webhook/tenant/validation/forbidd...	6.8 Medium	—	0,59%	18 Sep 2026
CVE-2026-61672 Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.7, ForbiddenListSpec.ExactMatch in pkg/api/forbidden_list.go sorts denied metadata key...	7.1 High	—	0,33%	18 Sep 2026
CVE-2026-61633 NanoMQ is an MQTT broker. Prior to 0.24.14, the NanoMQ client function nni_mqtt_msg_decode_unsubscribe() in nng/src/supplemental/mqtt/mqtt_codec.c does not handle a faile...	2.0 Low	—	0,34%	18 Sep 2026
CVE-2026-61548 Rsyslog is a rocket-fast system for log processing. From 7.5.4 until 8.2606.0, the optional mmpstrucdata plugin's parseSD_PARAM function in plugins/mmpstrucdata/mmpstrucd...	8.1 High	—	0,94%	18 Sep 2026
CVE-2026-58197 ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol servers. Prior to ToolHive CLI 0.30.1 and ToolHive Studio 0.38.0, local...	8.8 High	—	0,37%	18 Sep 2026
CVE-2026-55556 Rsyslog is a rocket-fast system for log processing. From 8.2110.0 until 8.2604.0, the optional imhttp module's parse_auth_header function in contrib/imhttp/imhttp.c alloc...	8.2 High	—	0,85%	18 Sep 2026
CVE-2026-46655 virtio-win provides Windows paravirtualized drivers for QEMU and KVM. From mm210 until mm320, the Viosock driver permits a low-privilege local process to submit an IOCTL_...	7.8 High	—	0,18%	18 Sep 2026
CVE-2026-44639 NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's MQTT v5 property decoder in nng/src/supplemental/mqtt/mqtt_codec.c uses property_append() to walk the entire linked l...	3.7 Low	—	0,44%	18 Sep 2026
CVE-2026-93737 Azkaban through 4.0.0 omits project permission checks in the ScheduleServlet fetchSchedule action, allowing authenticated users to read any project's schedule configurati...	6.5 Medium	—	0,54%	18 Sep 2026
CVE-2026-93736 Mealie before 3.21.0 fails to validate user ownership in the ratings and favorites endpoints, allowing authenticated attackers to read any user's recipe ratings and favor...	4.3 Medium	—	0,39%	18 Sep 2026
CVE-2026-93690 uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or pa...	7.5 High	—	0,68%	18 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.