Katalog CVE (hal. 282)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 259.945 (Critical 36.018 · High 103.876 · KEV 1.748 · sejak 2020) · Pembaruan terakhir: 20 Okt 2026, 06:26 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 14.051–14.100 dari 259.945 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-54507 Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, the oEmbedProxy() handler in admin/controller/ed...	8.4 High	—	0,45%	17 Sep 2026
CVE-2026-54506 Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, app/controller/user/profile.php accepts the user...	7.6 High	—	0,31%	17 Sep 2026
CVE-2026-54343 Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.1, a remote attacker can request a traversal...	8.7 High	—	0,68%	17 Sep 2026
CVE-2026-53557 SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a crafted sheet["tableName"] value in...	7.7 High	—	0,34%	17 Sep 2026
CVE-2026-53556 SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/previewData endpoint in backend/apps/datas...	6.0 Medium	—	0,48%	17 Sep 2026
CVE-2026-53555 SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated uploader can submit an image/svg+xml assistant UI log...	5.1 Medium	—	0,48%	17 Sep 2026
CVE-2026-53554 SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/parseExcel endpoint in backend/apps/dataso...	7.3 High	—	0,42%	17 Sep 2026
CVE-2026-53534 JabRef is a desktop application for managing BibTeX and BibLaTeX libraries. Prior to 6.0-alpha.6, when jabsrv or JabRef's built-in HTTP server is enabled, the GET /better...	7.5 High	—	0,45%	17 Sep 2026
CVE-2026-50291 openimageio OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to versions 3.0.16.0 and 3.1.11.0,...	5.5 Medium	—	0,20%	17 Sep 2026
CVE-2026-50158 yutu is an AI-powered toolkit for managing and growing YouTube channels. Prior to 0.10.9, the caption-download MCP tool accepts a caller-controlled file parameter through...	7.7 High	—	0,23%	17 Sep 2026
CVE-2026-16750 The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized access of data due to missing authorization checks in mvl_ajax...	5.3 Medium	—	0,24%	17 Sep 2026
CVE-2026-16582 The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 2....	5.3 Medium	—	0,23%	17 Sep 2026
CVE-2026-14311 The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing ownership ve...	5.4 Medium	—	0,17%	17 Sep 2026
CVE-2026-93395 mongodb c driver A missing lower-bound validation in the bson_new_from_buffer() function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The fu...	5.3 Medium	—	0,40%	17 Sep 2026
CVE-2026-93394 mongodb c driver A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce misma...	3.7 Low	—	0,32%	17 Sep 2026
CVE-2026-93393 mongodb c driver A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built with the Windows platform TLS backend. A remote endpoint that the client...	8.1 High	—	0,47%	17 Sep 2026
CVE-2026-93387 google chrome Improper state validation in Skia in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium securit...	4.3 Medium	—	0,25%	17 Sep 2026
CVE-2026-93386 google chrome UI misrepresentation in WebAppInstalls in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted...	5.4 Medium	—	0,25%	17 Sep 2026
CVE-2026-93385 google chrome Information leak in Paint in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security se...	6.5 Medium	—	0,31%	17 Sep 2026
CVE-2026-93384 google chrome Server-side request forgery in Omnibox in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to bypass system acce...	3.7 Low	—	0,25%	17 Sep 2026
CVE-2026-93383 google chrome Information leak in Permissions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security se...	4.3 Medium	—	0,25%	17 Sep 2026
CVE-2026-93382 google chrome Use after free in PDFium in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium...	8.8 High	—	0,37%	17 Sep 2026
CVE-2026-93381 google chrome Buffer overflow in PDFium in Google Chrome on on Windows prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to potentially execute arbitrary c...	8.8 High	—	0,39%	17 Sep 2026
CVE-2026-93380 google chrome Race condition in FileSystem in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process and leveraged social engineering t...	3.1 Low	—	0,20%	17 Sep 2026
CVE-2026-93379 google chrome Incorrect authorization in ORB in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security seve...	4.3 Medium	—	0,25%	17 Sep 2026
CVE-2026-93378 google chrome Missing authorization in Storage in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a...	3.1 Low	—	0,22%	17 Sep 2026
CVE-2026-93377 google chrome Type confusion in V8 in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a cr...	8.8 High	—	0,44%	17 Sep 2026
CVE-2026-93376 google chrome Out of bounds read in DataTransfer in Google Chrome prior to 153.0.8010.52 allowed a local attacker leveraging social engineering to read memory outside the sandbox via a...	6.3 Medium	—	0,11%	17 Sep 2026
CVE-2026-93375 google chrome Incorrect reference resolution in Tracing in Google Chrome on on Windows prior to 153.0.8010.52 allowed a local attacker to potentially execute arbitrary code outside the...	8.1 High	—	0,10%	17 Sep 2026
CVE-2026-93374 google chrome Use after free in Dawn in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a cra...	9.6 Critical	—	0,41%	17 Sep 2026
CVE-2026-93373 google chrome Use after free in Extensions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted Chrome extensio...	9.6 Critical	—	0,34%	17 Sep 2026
CVE-2026-93372 google chrome Buffer overflow in WebGL in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML...	9.6 Critical	—	0,45%	17 Sep 2026
CVE-2026-86049 Jupyter Server is the backend for Jupyter web applications. Prior to version 2.21.0, the 5xx request logging path in jupyter_server/log.py copies the Referer header into...	7.1 High	—	0,42%	17 Sep 2026
CVE-2026-77615 Paella Player is a set of libraries to create a multi stream video player. Prior to Paella Player 2.12.11 (as used in Opencast prior to 19.7 and 20.2), there is a potenti...	8.7 High	—	0,56%	17 Sep 2026
CVE-2026-77281 Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, three configuration-dependent weaknesses affect the handler and placeholde...	6.5 Medium	—	0,49%	17 Sep 2026
CVE-2026-76154 A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's...	7.3 High	—	0,35%	17 Sep 2026
CVE-2026-68537 `fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose...	7.5 High	—	0,61%	17 Sep 2026
CVE-2026-68523 `fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose...	7.5 High	—	0,61%	17 Sep 2026
CVE-2026-67071 HCL DevOps Deploy / HCL Launch is susceptible to an information disclosure vulnerability when processing redacted property values. If a deployment is configured with a se...	6.5 Medium	—	0,38%	17 Sep 2026
CVE-2026-54918 NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. In the affected repository revisions, NETBOX_DT_LIBRARY_UR...	5.3 Medium	—	0,42%	17 Sep 2026
CVE-2026-54916 NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The absence of tests/init.py and the lack of --import-mode...	8.8 High	—	0,61%	17 Sep 2026
CVE-2026-54907 Caddy Proxy Manager is a web interface for managing Caddy Server reverse proxies and certificates. Prior to 1.5.1, Caddy Proxy Manager enables email and password self-reg...	5.3 Medium	—	0,29%	17 Sep 2026
CVE-2026-54604 OpenSlide is a C library for reading whole slide image files. Prior to 4.0.1, a behavior change in libtiff 4.7.1 causes the indirect TIFF tile path in src/openslide-decod...	5.3 Medium	—	0,53%	17 Sep 2026
CVE-2026-54597 ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated user with module_suppor...	8.3 High	—	0,43%	17 Sep 2026
CVE-2026-54596 ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated Technician or higher wi...	8.1 High	—	0,48%	17 Sep 2026
CVE-2026-54565 rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. Prior to rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4, the browser extensions use an all-...	4.7 Medium	—	0,19%	17 Sep 2026
CVE-2026-54521 FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2319, the ActivityAMP AMP message renderer in app/src/main/java/eu/faircode...	6.1 Medium	—	0,33%	17 Sep 2026
CVE-2026-54510 Speakr is a personal, self-hosted web application designed for transcribing audio recordings. Prior to 0.8.21-alpha, the csrf_exempt_for_api_tokens() before_request hook...	7.1 High	—	0,22%	17 Sep 2026
CVE-2026-54501 Browsertrix is a high-fidelity, browser-based crawling service for web archiving that can be self-hosted or used through Webrecorder's hosted instance. From 1.15.0 until...	9.4 Critical	—	1,2%	17 Sep 2026
CVE-2026-54460 OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to 1.1.1, POST /api/auth/passkeys accepts a request-body...	9.8 Critical	—	0,70%	17 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.