Katalog CVE (hal. 324)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 261.514 (Critical 36.161 · High 104.405 · KEV 1.754 · sejak 2020) · Pembaruan terakhir: 21 Okt 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 16.151–16.200 dari 261.514 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-25278 qualcomm lemans au lgit firmware, qualcomm lemansau firmware +27 lainnya Memory Corruption when processing I2C transfer requests due to a race condition between memory allocation and data copying.	7.0 High	—	0,05%	17 Sep 2026
CVE-2026-25275 qualcomm q-7790 firmware, qualcomm qam8255p firmware +58 lainnya Transient DOS when processing authentication frames with invalid FILS information element header lengths.	7.5 High	—	0,19%	17 Sep 2026
CVE-2026-25261 qualcomm cologne firmware, qualcomm fastconnect 6700 firmware +22 lainnya Memory corruption while processing rear sensor IOCTL calls.	7.8 High	—	0,07%	17 Sep 2026
CVE-2026-24081 qualcomm ar8035 firmware, qualcomm c110100 firmware +58 lainnya Transient DOS when processing a channel map with insufficient used channels and adaptive frequency hopping is fully enabled.	7.4 High	—	0,10%	17 Sep 2026
CVE-2026-24075 qualcomm wsa8845h firmware, qualcomm aqt1000 firmware +41 lainnya Memory Corruption when multiple threads issue concurrent IOCTL requests to the device control handler due to improper synchronization and race conditions.	7.0 High	—	0,06%	17 Sep 2026
CVE-2026-24074 qualcomm iqx5121 firmware, qualcomm iqx7181 firmware +23 lainnya Memory Corruption when processing data with large offset and length values exceeds buffer limits during data copy operations.	7.8 High	—	0,07%	17 Sep 2026
CVE-2026-24073 qualcomm cologne firmware, qualcomm fastconnect 6900 firmware +12 lainnya Memory corruption when processing decode statistics due to insufficient validation of offset against structure size.	7.8 High	—	0,07%	17 Sep 2026
CVE-2025-59607 qualcomm cologne firmware, qualcomm fastconnect 6900 firmware +12 lainnya Memory Corruption when copying large input data exceeds normal allocation limits.	7.8 High	—	0,07%	17 Sep 2026
CVE-2026-92839 Canva Desktop before v1.125.0 performed double decoding in the deeplink handler. A threat actor could cause the application to load arbitrary same-origin content under th...	4.3 Medium	—	0,28%	17 Sep 2026
CVE-2026-86311 The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Shortcode Attributes in all versions...	6.4 Medium	—	0,26%	17 Sep 2026
CVE-2026-50603 A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The vulnerability is caused by the use of a hard-coded...	4.9 Medium	—	0,10%	17 Sep 2026
CVE-2026-89064 The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to th...	5.3 Medium	—	0,50%	17 Sep 2026
CVE-2026-92838 A DLL hijacking vulnerability exists in the GeoVision GV-Remote E-Map desktop application. The application loads one or more dynamic-link libraries (DLLs) from an unsafe...	7.8 High	—	0,20%	17 Sep 2026
CVE-2026-81546 The Affinity by Canva application before 3.3.0 (September 2026 release) did not perform adequate bounds checking when parsing Affinity document files leading to a stack-b...	7.7 High	—	0,15%	17 Sep 2026
CVE-2026-65388 A remote attacker who controls a container registry may be able to direct a client's token request to a host of the attacker's choice, and disclose the victim's registry...	7.5 High	—	0,43%	16 Sep 2026
CVE-2026-61599 djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the djust live transport resolves t...	8.8 High	—	0,60%	16 Sep 2026
CVE-2026-61596 djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's per-object authorization (`...	7.1 High	—	0,33%	16 Sep 2026
CVE-2026-61589 djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the WebSocket `handle_mount` and `V...	6.3 Medium	—	0,18%	16 Sep 2026
CVE-2026-61588 djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, when a Django `Model` instance is a...	6.5 Medium	—	0,39%	16 Sep 2026
CVE-2026-92599 joi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnerable to regular expression denial of service in the `Joi.string().isoDate()` va...	7.5 High	—	0,58%	16 Sep 2026
CVE-2026-92598 Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label...	6.5 Medium	—	0,40%	16 Sep 2026
CVE-2026-92597 Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a comment closed immediately before a non-break character...	6.5 Medium	—	0,38%	16 Sep 2026
CVE-2026-92596 Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of service by suppl...	7.5 High	—	0,82%	16 Sep 2026
CVE-2026-92595 Nodemailer (npm package `nodemailer`) versions 9.1.0 and earlier do not honor the `disableFileAccess` and `disableUrlAccess` sandbox options when message content is resol...	5.9 Medium	—	0,30%	16 Sep 2026
CVE-2026-92594 Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fields: instead of requiring the user-data scope enf...	7.5 High	—	0,43%	16 Sep 2026
CVE-2026-92593 Craft CMS versions 5.10.0 through 5.10.12 contain an incomplete fix for CVE-2026-55794: the Controller::getPostedRedirectUrl() -> View::renderObjectTemplate() sink remain...	8.8 High	—	0,55%	16 Sep 2026
CVE-2026-92592 Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun cookie with the same key and format used to validat...	8.8 High	—	0,65%	16 Sep 2026
CVE-2026-92591 Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not installed, which makes anonymous installer actions — including install/v...	5.9 Medium	—	0,41%	16 Sep 2026
CVE-2026-92590 Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields feature that disables Twig autoescaping and fails...	5.4 Medium	—	0,24%	16 Sep 2026
CVE-2026-92589 Craft CMS 5.0.0 through 5.10.12 (fixed in 5.10.13) contains a broken access control flaw in the nested-elements reorder endpoint. When an authenticated control panel user...	4.3 Medium	—	0,26%	16 Sep 2026
CVE-2026-92588 n8n is a workflow automation platform. In n8n versions before 1.123.76, 2.37.7, and 2.38.2, the source control push endpoint derived the set of files to push from the fil...	4.4 Medium	—	0,32%	16 Sep 2026
CVE-2026-92587 n8n is a workflow automation platform. In versions before 1.123.76, 2.37.7, and 2.38.2, the Git node validated a relative remote URL against the configured repositoryPath...	5.0 Medium	—	0,31%	16 Sep 2026
CVE-2026-92586 AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to verify video access permissions in the set_api_comment function, allowing authenticated use...	4.3 Medium	—	0,26%	16 Sep 2026
CVE-2026-92585 AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to validate video access permissions in the API like endpoint, allowing logged-in users to vot...	4.3 Medium	—	0,26%	16 Sep 2026
CVE-2026-92584 AVideo through 29.0 (current revision e01e41ecc) contains a stored cross-site scripting vulnerability. The unauthenticated view-counter endpoint objects/videoAddViewCount...	6.1 Medium	—	0,26%	16 Sep 2026
CVE-2026-92583 AVideo through 29.0 contains a race condition in the enforceRateLimit() function that fails to atomically increment rate limit counters, allowing attackers to bypass all...	6.5 Medium	—	0,30%	16 Sep 2026
CVE-2026-92582 AVideo (WWBN/AVideo) through 29.0 (commit e01e41ecc) is vulnerable to cross-site request forgery. objects/videoAddNew.json.php disables AVideo's automatic CSRF guard ($gl...	7.1 High	—	0,18%	16 Sep 2026
CVE-2026-92581 In AVideo through 29.0, Like::__construct() performs counter arithmetic on raw request values before validation, allowing array-typed parameters to desynchronize stored v...	4.3 Medium	—	0,29%	16 Sep 2026
CVE-2026-92580 In AVideo through 29.0, the CloneSite plugin is vulnerable to stored OS command injection. In plugin/CloneSite/cloneClient.json.php (line ~270) the stored SSH password is...	8.8 High	—	1,4%	16 Sep 2026
CVE-2026-92579 In AVideo through 29.0, the autoCSRFGuard() function maintains a hardcoded allowlist of exempt basenames tested without directory context, allowing plugin files matching...	5.4 Medium	—	0,27%	16 Sep 2026
CVE-2026-92578 WWBN AVideo through 29.0 contains an authentication bypass vulnerability where the stored password hash is accepted as a valid login credential through two independent co...	8.1 High	—	0,62%	16 Sep 2026
CVE-2026-92577 In AVideo through 29.0, the API get_api_video endpoint contains a broken access control vulnerability in the clean_title branch that returns user-group-restricted videos...	7.5 High	—	0,43%	16 Sep 2026
CVE-2026-92576 HKUDS nanobot before 0.3.0 contains a server-side request forgery vulnerability in the WebFetchTool component where the _validate_url() function fails to block internal I...	8.6 High	—	0,45%	16 Sep 2026
CVE-2026-89034 TCH QRing smart ring model R20_B006 running firmware RT09R20_1.00.00_250318 contains an unauthenticated Bluetooth Low Energy access vulnerability that allows any nearby a...	6.5 Medium	—	0,33%	16 Sep 2026
CVE-2026-85469 A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream `Noelware/docker-manifest-action` used in the release workflow, w...	8.0 High	—	0,52%	16 Sep 2026
CVE-2026-64684 RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.1.0, the rmcp crate's StreamableHttpClientTransport in crates/rmcp/src/transport/common/reqwest/st...	6.8 Medium	—	0,50%	16 Sep 2026
CVE-2026-61597 djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, many djust built-in component templ...	5.1 Medium	—	0,41%	16 Sep 2026
CVE-2026-61594 djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the live (WebSocket) transport auth...	9.1 Critical	—	0,49%	16 Sep 2026
CVE-2026-61592 djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, SSE sessions were keyed solely by a...	7.4 High	—	0,39%	16 Sep 2026
CVE-2026-61591 djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, for views that opt into state snaps...	8.1 High	—	0,22%	16 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.