Katalog CVE (hal. 376)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 262.314 (Critical 36.225 · High 104.856 · KEV 1.754 · sejak 2020) · Pembaruan terakhir: 22 Okt 2026, 06:31 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 18.751–18.800 dari 262.314 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-81897 concretecms concrete cms In Concrete CMS below CMS 9.5.3, the save_control action in the Express entities forms dashboard controller did not validate the anti-CSRF token. By causing an authentica...	5.4 Medium	—	0,17%	15 Sep 2026
CVE-2026-81896 concretecms concrete cms Concrete CMS before 9.5.3 does not apply HTML entity encoding to user-defined Form block question labels when rendering them as column headers in the Dashboard Form Submi...	5.4 Medium	—	0,24%	15 Sep 2026
CVE-2026-81895 concretecms concrete cms In Concrete CMS before 9.5.3, the Document Library block stored the file-set identifiers submitted through fsID[] without validating them as integers, and when the block...	7.2 High	—	0,51%	15 Sep 2026
CVE-2026-81894 concretecms concrete cms Concrete CMS 9.5.2 and below is vulnerable to stored DOM-based Cross-site Scripting (XSS) via the Gallery block's per-image Caption field because the bundled Magnific Pop...	5.4 Medium	—	0,24%	15 Sep 2026
CVE-2026-79705 A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the t...	4.5 Medium	—	0,41%	15 Sep 2026
CVE-2026-79699 A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination d...	4.4 Medium	—	0,17%	15 Sep 2026
CVE-2026-63443 Coder allows organizations to provision remote development environments via Terraform. Prior to 2.29.19, 2.32.9, 2.33.10, and 2.34.4, agentConn.apiClient() follows redire...	8.3 High	—	0,76%	15 Sep 2026
CVE-2026-59160 Yeger is a monorepo for npm packages maintained under the yeger scope. Prior to 2.8.9, the turbo-graph package starts its embedded Next.js server from packages/turbo-grap...	8.8 High	—	0,49%	15 Sep 2026
CVE-2026-58201 Lokka is a Model Context Protocol server for Microsoft 365, including Microsoft Graph and other services. Prior to 2.1.2, the Lokka-Microsoft tool in src/mcp/src/main.ts...	8.7 High	—	0,48%	15 Sep 2026
CVE-2026-58200 Payload Plugins is a collection of plugins designed to enhance Payload CMS. From 0.3.0 until 0.4.0, @jhb.software/payload-cloudinary-plugin deployments with clientUploads...	7.1 High	—	0,31%	15 Sep 2026
CVE-2026-55863 motionEye (mEye) is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection. Prior to 0.44.0, the ActionH...	5.3 Medium	—	0,50%	15 Sep 2026
CVE-2026-55692 The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing ser...	7.5 High	—	0,49%	15 Sep 2026
CVE-2026-55691 The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing ser...	8.6 High	—	0,48%	15 Sep 2026
CVE-2026-55690 The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing ser...	7.5 High	—	0,49%	15 Sep 2026
CVE-2026-55149 Vouch Proxy is an SSO and OAuth/OIDC login solution for Nginx using the auth_request module. Prior to 0.48.0, Cookie in pkg/cookie/cookie.go parses the total part count f...	7.5 High	—	0,72%	15 Sep 2026
CVE-2026-54561 MCP Memory Keeper is an MCP server for persistent context management in AI coding assistants. Prior to 0.13.0, context_import in src/index.ts passes the caller-controlled...	6.2 Medium	—	0,25%	15 Sep 2026
CVE-2026-54503 plone.app.textfield provides a zope.schema-style field type called RichText for storing a value with a related MIME type. Prior to 2.0.2, 3.0.2, and 4.0.1, depending on t...	4.3 Medium	—	0,40%	15 Sep 2026
CVE-2026-53710 MCP Context Forge is an AI gateway, registry, and proxy for MCP, A2A, REST, and gRPC APIs. Prior to 1.0.2, the python_sandbox_server in mcp-servers/python/python_sandbox_...	10.0 Critical	—	1,1%	15 Sep 2026
CVE-2026-53658 Fabric CA is a Certificate Authority for Hyperledger Fabric. Prior to 1.5.21, when fabric-ca is configured with an LDAP backend, Client.GetUser in lib/server/ldap/client....	6.3 Medium	—	0,45%	15 Sep 2026
CVE-2026-46488 motionEye (mEye) is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection. Prior to 0.44.0, motionEye a...	9.1 Critical	—	0,46%	15 Sep 2026
CVE-2026-44778 Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. From 0.28.0 until 0.53.1, th...	2.9 Low	—	0,63%	15 Sep 2026
CVE-2026-21588 This High severity DoS (Denial of Service) vulnerability was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Conflue...	7.1 High	—	0,29%	15 Sep 2026
CVE-2026-21587 This High severity Improper Authorization vulnerability was introduced in version 11.3.0 of Jira Service Management Data Center. This Improper Authorization vulnerabi...	7.1 High	—	0,32%	15 Sep 2026
CVE-2026-21586 This High severity Improper Authorization vulnerability was introduced in versions 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0,...	7.1 High	—	0,32%	15 Sep 2026
CVE-2026-19780 Koha Eval Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Koha. Auth...	8.8 High	—	0,58%	15 Sep 2026
CVE-2026-18111 concretecms concrete cms Concrete CMS 9 before 9.5.3 was vulnerable to stored cross-site scripting (XSS) in the Feature, Feature Link, Hero Image, and Image blocks and before Concrete 8.5.21 in t...	6.1 Medium	—	0,19%	15 Sep 2026
CVE-2026-18110 concretecms concrete cms Concrete CMS 9 (9.0.0 through 9.5.2) does not perform an authorization check on the user selector autocomplete endpoint (/ccm/system/user/autocomplete), which backs the "...	7.5 High	—	0,27%	15 Sep 2026
CVE-2024-58385 Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fillbacksettingedit.php configuration endpoint where the DontCheckLogin=1 parameter bypasses...	9.8 Critical	—	0,38%	15 Sep 2026
CVE-2023-54398 Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component that allows remote unauthenticate...	9.8 Critical	—	0,64%	15 Sep 2026
CVE-2026-91992 Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attack...	5.9 Medium	—	0,26%	15 Sep 2026
CVE-2026-91991 Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legac...	5.4 Medium	—	0,25%	15 Sep 2026
CVE-2026-91990 Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attacker...	7.5 High	—	0,42%	15 Sep 2026
CVE-2026-91989 atomic-agents-stack before 1.1.0 contains a path traversal vulnerability in the dashboard HTTP server that allows remote attackers to read arbitrary files by supplying di...	7.5 High	—	1,3%	15 Sep 2026
CVE-2026-91988 atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP server-registry backend factory, allowing network man-in-the-middle attackers to rewrite c...	8.1 High	—	0,32%	15 Sep 2026
CVE-2026-91987 atomic-agents-stack before 1.1.0 contains a cost-guardrail bypass in the _estimate_batch_cost function that returns zero cost for unknown models not in the pricing table....	6.5 Medium	—	0,48%	15 Sep 2026
CVE-2026-91986 gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafted git URLs....	5.4 Medium	—	0,23%	15 Sep 2026
CVE-2026-91985 Vikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share read endpoints, allowing read-only members to obtain the share's secre...	7.5 High	—	0,43%	15 Sep 2026
CVE-2026-91984 Vikunja before 2.6.0 fails to validate that user-supplied project_view_id in task-position requests belongs to the task's project. Authenticated attackers can insert task...	4.3 Medium	—	0,26%	15 Sep 2026
CVE-2026-91983 Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fails to inspect query string parameters. Attackers with...	4.3 Medium	—	0,31%	15 Sep 2026
CVE-2026-91982 Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after enrollment through the GET /api/v1/user/settings/totp and /api/v1/user/settings/totp/qrcode endp...	4.3 Medium	—	0,35%	15 Sep 2026
CVE-2026-91981 Vikunja versions before 2.6.0 fail to properly validate link-share tokens in the v2 API user search endpoints. Attackers with a read-only share link can enumerate project...	4.3 Medium	—	0,31%	15 Sep 2026
CVE-2026-91980 vikunja before 2.6.0 fails to validate team access when attaching teams to projects, allowing authenticated users to enumerate all teams and members. Attackers can attach...	4.3 Medium	—	0,31%	15 Sep 2026
CVE-2026-91979 Vikunja before 2.6.0 fails to limit archive expansion during data import, allowing authenticated users to cause denial of service. Attackers can upload highly compressed...	6.5 Medium	—	0,44%	15 Sep 2026
CVE-2026-91973 Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers ca...	7.5 High	—	0,67%	15 Sep 2026
CVE-2026-91972 Vikunja versions before 2.6.0 fail to apply rate limiting to /api/v2 public authentication endpoints including login, register, password-reset, and OAuth token routes. Re...	7.5 High	—	0,63%	15 Sep 2026
CVE-2026-91971 Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and project-background upload endpoints, allowing authenticated users to upload crafted images that deco...	6.5 Medium	—	0,44%	15 Sep 2026
CVE-2026-91970 Vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the Planka migrator that fails to enforce aggregate memory budgets during migration jobs. Aut...	6.5 Medium	—	0,38%	15 Sep 2026
CVE-2026-91969 vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endpoint that fails to limit parsed row cardinality. A...	6.5 Medium	—	0,35%	15 Sep 2026
CVE-2026-91968 vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions without recursion dept...	6.5 Medium	—	0,44%	15 Sep 2026
CVE-2026-91967 AVideo through 29.0 contains a blind server-side request forgery vulnerability in the getHeaderContentTypeFromURL function that issues get_headers() calls guarded only by...	5.0 Medium	—	0,34%	15 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.