Katalog CVE (hal. 428)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 262.852 (Critical 36.295 · High 105.033 · KEV 1.754 · sejak 2020) · Pembaruan terakhir: 23 Okt 2026, 12:37 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 21.351–21.400 dari 262.852 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-89045 zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read(), allowing attackers to trigger infinite loops....	4.0 Medium	—	0,18%	10 Sep 2026
CVE-2026-89046 zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize that fails to validate negative srcPosition arguments....	8.2 High	—	0,65%	10 Sep 2026
CVE-2026-89042 passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting...	9.1 Critical	—	0,39%	10 Sep 2026
CVE-2026-88051 tesseract-ocr tesseract ocr Tesseract is an open source OCR engine. In version 5.5.3 and earlier, the callback form of GenericVector::read in src/ccutil/genericvector.h reads the independent int32 f...	7.8 High	—	0,17%	10 Sep 2026
CVE-2026-88052 tesseract-ocr tesseract ocr Tesseract is an open source OCR engine. In version 5.5.3 and earlier, UNICHARSET::load_via_fgets in src/ccutil/unicharset.cpp trusts the declared unichar count as a loop...	7.8 High	—	0,18%	10 Sep 2026
CVE-2026-88053 tesseract-ocr tesseract ocr Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadIntTemplates in src/classify/intproto.cpp reads NumClassPruners, NumClasses, and NumPr...	7.8 High	—	0,18%	10 Sep 2026
CVE-2026-88054 tesseract-ocr tesseract ocr Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Plumbing::DeSerialize in src/lstm/plumbing.cpp rejects excessively large network stacks but accepts...	5.5 Medium	—	0,15%	10 Sep 2026
CVE-2026-88055 AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.16.1 and earlier, the manager role can st...	5.5 Medium	—	0,28%	10 Sep 2026
CVE-2026-88027 laravel mongodb Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoDB integration for Laravel can cause a caller-suppl...	8.1 High	—	0,27%	10 Sep 2026
CVE-2026-88028 laravel mongodb Improper neutralization of special elements in data query logic in the polymorphic relation handling of the MongoDB integration for Laravel can cause a caller-supplied re...	6.5 Medium	—	0,42%	10 Sep 2026
CVE-2026-88029 mongodb python driver Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifie...	8.3 High	—	0,27%	10 Sep 2026
CVE-2026-88030 mongodb ruby driver Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Ruby Driver can cause a caller-supplied structured file identifier...	8.3 High	—	0,27%	10 Sep 2026
CVE-2026-88031 mongodb go driver Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied structured file identifier to...	8.1 High	—	0,48%	10 Sep 2026
CVE-2026-88022 laravel mongodb Improper neutralization of special elements in data query logic in the MongoDB integration for Laravel can cause an array supplied to an explicit equality filter to be in...	7.7 High	—	0,43%	10 Sep 2026
CVE-2026-88023 mongodb php library Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier...	8.3 High	—	0,33%	10 Sep 2026
CVE-2026-88024 mongodb rust driver Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Rust Driver can cause a caller-supplied structured file identifier...	8.3 High	—	0,48%	10 Sep 2026
CVE-2026-88025 mongodb c# driver Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C# Driver can cause a caller-supplied structured file identifier to...	8.3 High	—	0,48%	10 Sep 2026
CVE-2026-88026 mongodb c# driver Improper neutralization of regular-expression metacharacters in the LINQ query translation component of the MongoDB C# Driver can cause a caller-supplied character sequen...	6.5 Medium	—	0,38%	10 Sep 2026
CVE-2026-68006 An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/puma_http11/http11_parser.rl file	9.1 Critical	—	0,53%	10 Sep 2026
CVE-2026-15417 In the silabser.sys Windows 8 driver for CP210x devices, a local unprivileged user can use incorrect driver settings to cause a kernel crash.	6.9 Medium	—	0,13%	10 Sep 2026
CVE-2026-15418 In the silabser.sys driver for CP210x devices v11.5.0 and earlier, a local unprivileged user with a malicious device can use malformed packets to leak up to 145 bytes of...	2.4 Low	—	0,15%	10 Sep 2026
CVE-2026-15419 In the silabser.sys driver for CP210x devices v11.5.0 and earlier, a local unprivileged user with a malicious device can use malformed packets to corrupt kernel pool memo...	7.0 High	—	0,17%	10 Sep 2026
CVE-2026-88049 tesseract-ocr tesseract ocr Tesseract is an open source OCR engine. In version 5.5.3 and earlier, prior .traineddata hardening added bounds checks to NetworkIO::CopyTimeStepGeneral and NetworkIO::Ra...	5.5 Medium	—	0,15%	10 Sep 2026
CVE-2026-88050 tesseract-ocr tesseract ocr Tesseract is an open source OCR engine. In version 5.5.3 and earlier, RecodedCharID::DeSerialize in src/ccutil/unicharcompress.h validates length_ but accepts negative co...	5.5 Medium	—	0,15%	10 Sep 2026
CVE-2026-88044 rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.70.0 until 1.75.1, the serve/start RC interface accep...	9.1 Critical	—	0,49%	10 Sep 2026
CVE-2026-88045 rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed multipart pa...	7.5 High	—	0,63%	10 Sep 2026
CVE-2026-88046 rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone core does not reject parent-director...	5.3 Medium	—	0,29%	10 Sep 2026
CVE-2026-88047 tesseract-ocr tesseract ocr Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadNormProtos in src/classify/normmatch.cpp parses the NORMPROTO component of a .trainedd...	7.8 High	—	0,11%	10 Sep 2026
CVE-2026-88048 tesseract-ocr tesseract ocr Tesseract is an open source OCR engine. In version 5.5.3 and earlier, FullyConnected::DeSerialize in src/lstm/fullyconnected.cpp does not validate the deserialized layer...	7.1 High	—	0,17%	10 Sep 2026
CVE-2026-85228 An integer overflow in the tensor buffer validation component in Amazon Deep Java Library (DJL) from 0.13.0 through 0.36.0 on all platforms might allow a remote unauthent...	9.1 Critical	—	0,54%	10 Sep 2026
CVE-2026-73699 FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary code by exploiting incorrect options passed...	7.2 High	—	0,78%	10 Sep 2026
CVE-2026-73693 FileRun before 2026.3.0 contains an OS command injection vulnerability in the PhotoProofSheet handler that allows authenticated users with upload permission to execute ar...	8.8 High	—	2,7%	10 Sep 2026
CVE-2026-73694 FileRun before 2026.3.0 contains an OS command injection vulnerability caused by a no-op redefinition of escapeshellcmd() in CLI.php that strips shell-metacharacter escap...	7.2 High	—	2,2%	10 Sep 2026
CVE-2026-73698 FileRun before 2026.3.0 contains a SQL injection vulnerability that allows delegated or simple administrators to execute arbitrary SQL by submitting the description param...	7.2 High	—	0,62%	10 Sep 2026
CVE-2026-68487 Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer.	9.9 Critical	—	0,65%	10 Sep 2026
CVE-2026-68488 A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory...	9.9 Critical	—	0,40%	10 Sep 2026
CVE-2026-65638 Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account...	9.2 Critical	—	2,3%	10 Sep 2026
CVE-2026-65639 OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitra...	9.5 Critical	—	1,4%	10 Sep 2026
CVE-2026-52097 An issue in AppFlowy 0.11.8 allows a remote attacker to execute arbitrary code via the afLaunchUri, _afLaunchLocalUri (url_launcher.dart), OpenFilex.open, localPathRegex...	6.8 Medium	—	0,55%	10 Sep 2026
CVE-2026-52098 flowiseai flowise An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/prediction/<flowId> endpoint	9.8 Critical	—	1,1%	10 Sep 2026
CVE-2026-88899 knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can supply arbitrary...	9.8 Critical	—	0,81%	10 Sep 2026
CVE-2026-88937 knowns through 0.33.0 fails to properly validate template destination paths in the code generation template engine, allowing attackers to read and write arbitrary files o...	8.8 High	—	0,65%	10 Sep 2026
CVE-2026-88938 knowns through 0.33.0 fails to confine the path argument of the code.find MCP tool to the project root, allowing AI agent sessions to read source files anywhere on the ho...	6.5 Medium	—	0,48%	10 Sep 2026
CVE-2026-88939 knowns through 0.33.0 exempts the project.set action from permission guard checks unconditionally, allowing read-only agent sessions to bypass restrictions. Attackers can...	8.3 High	—	0,48%	10 Sep 2026
CVE-2026-88940 knowns through 0.33.0 fails to validate the path query parameter in the workspace browse endpoint, allowing remote attackers to enumerate arbitrary directories on the hos...	5.3 Medium	—	0,56%	10 Sep 2026
CVE-2026-88959 Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any authenticated low-privilege user to create administr...	8.8 High	—	0,52%	10 Sep 2026
CVE-2026-88012 traefik Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints do not apply entryPoints..transport.respondingTime...	5.3 Medium	—	0,52%	10 Sep 2026
CVE-2026-88013 rclone rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.49.0 until 1.75.1, the HTTP backend attaches headers...	5.3 Medium	—	0,19%	10 Sep 2026
CVE-2026-88014 rclone rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method (*F...	6.3 Medium	—	0,15%	10 Sep 2026
CVE-2026-88015 rclone rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true ex...	5.3 Medium	—	0,36%	10 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.