Katalog CVE (hal. 430)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 262.852 (Critical 36.295 · High 105.033 · KEV 1.754 · sejak 2020) · Pembaruan terakhir: 23 Okt 2026, 12:37 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 21.451–21.500 dari 262.852 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-66632 Unauthenticated Content Injection in Simple Cloudflare Turnstile <= 1.42.1 versions.	6.5 Medium	—	0,28%	10 Sep 2026
CVE-2026-66674 Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile <= 1.42.1 versions.	5.6 Medium	—	0,25%	10 Sep 2026
CVE-2026-46387 oisf suricata Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's HTTP/...	7.5 High	—	0,86%	10 Sep 2026
CVE-2026-45747 oisf suricata Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.16, the Lua TLS certificate inf...	7.5 High	—	0,42%	10 Sep 2026
CVE-2026-15461 The Sierra Wireless HL78xx modem GNSS driver (drivers/modem/hl78xx/, later drivers/modem/vendor_standalone/hl78xx/) embeds a generic struct gnss_nmea0183_match_data match...	5.3 Medium	—	0,16%	10 Sep 2026
CVE-2026-88896 EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInternal(), which validates outbound URLs to block requests to internal/priva...	5.3 Medium	—	0,37%	10 Sep 2026
CVE-2026-88915 Affected versions of MISP do not consistently enforce the acting user's authorization when instantiating event templates. For templates using distribution = 4, the temp...	7.1 High	—	0,35%	10 Sep 2026
CVE-2026-88921 MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which is responsible for rendering MISP element references (attributes, objec...	5.1 Medium	—	0,49%	10 Sep 2026
CVE-2026-88889 Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to execute arbitrary commands by specifying a malici...	7.8 High	—	1,0%	10 Sep 2026
CVE-2026-88890 OpenPanel through 2.3.0 contains an SQL injection vulnerability in the analytics filter builder that fails to validate profile.* filter column identifiers before interpol...	8.5 High	—	0,39%	10 Sep 2026
CVE-2026-88891 OpenPanel through 2.3.0 fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and publish projec...	8.3 High	—	0,44%	10 Sep 2026
CVE-2026-88892 In OpenPanel through 2.3.0, the data importer fetches a caller-supplied URL with plain fetch instead of the project's existing SSRF guard (apps/api/src/utils/safe-fetch.t...	5.0 Medium	—	0,33%	10 Sep 2026
CVE-2026-88893 OpenPanel through 2.3.0 share lookup procedures fail to validate access controls and return password hashes and protected report definitions to unauthenticated callers. A...	7.5 High	—	0,49%	10 Sep 2026
CVE-2026-88894 snipeitapp snipe-it Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support (FMCS) tenant isolation on the checkout target. Unlike the single, bulk, API, acces...	5.4 Medium	—	0,26%	10 Sep 2026
CVE-2026-88895 CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attacke...	7.2 High	—	0,65%	10 Sep 2026
CVE-2026-88884 Renovate is a dependency update automation tool. In versions before 44.3.1 (and Mend Renovate CE/EE images before 15.4.0, mend-renovate-ce Helm chart before 15.4.0, mend-...	5.8 Medium	—	0,31%	10 Sep 2026
CVE-2026-88885 Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when processing unescaped depName parameters in import-path update commands with b...	7.0 High	—	0,89%	10 Sep 2026
CVE-2026-88886 Renovate is a dependency update automation tool. In versions before 44.14.7 (and in Mend Renovate CE/EE distributions before 15.4.0, and the mend-renovate-enterprise-edit...	7.8 High	—	0,23%	10 Sep 2026
CVE-2026-88887 Renovate is a dependency update automation tool. When listing tags/digests for a container image, Renovate follows pagination links supplied by the remote registry in the...	8.6 High	—	0,41%	10 Sep 2026
CVE-2026-88888 Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependencies with unescaped organization parameters. Attacke...	7.0 High	—	0,89%	10 Sep 2026
CVE-2026-88877 traefik Traefik is a HTTP reverse proxy and load balancer. In versions >= v3.7.0 and <= v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry both an aut...	9.8 Critical	—	0,65%	10 Sep 2026
CVE-2026-88878 traefik Traefik is an HTTP reverse proxy and load balancer. In versions >= v2.8.2 through <= v2.11.55 and >= v3.0.0 through <= v3.7.11, the entryPoints.<name>.transport.respondin...	5.3 Medium	—	0,42%	10 Sep 2026
CVE-2026-88879 traefik Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11, header names are canonicalized only on dashes, so...	8.2 High	—	0,30%	10 Sep 2026
CVE-2026-88880 Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagination, allowing malicious servers to redirect credential-bearing requ...	8.6 High	—	0,50%	10 Sep 2026
CVE-2026-88881 Renovate, a dependency update tool, follows pagination links supplied by the GitHub server in the HTTP `Link` header when interacting with GitHub.com, GitHub Enterprise C...	8.6 High	—	0,41%	10 Sep 2026
CVE-2026-88882 Renovate is a dependency update automation tool. In versions before 44.11.2 (and Mend Renovate CE/EE images and charts before 15.4.0, and mend-renovate-enterprise-edition...	8.6 High	—	0,41%	10 Sep 2026
CVE-2026-88883 Renovate is an automated dependency update tool. In versions before 44.14.4 (and Mend Renovate CE/EE images before 15.4.0 and the mend-renovate-enterprise-edition Helm ch...	7.7 High	—	0,39%	10 Sep 2026
CVE-2026-88871 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) contains a cross-site request forgery vulnerability in the CustomizeUser plugin's...	4.3 Medium	—	0,18%	10 Sep 2026
CVE-2026-88872 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the setPassword.json.php endpoint that allows unauth...	7.1 High	—	0,19%	10 Sep 2026
CVE-2026-88873 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in view/logArchive.json.php that allows unauthenti...	7.1 High	—	0,18%	10 Sep 2026
CVE-2026-88874 AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) does not enforce the Live stream password check on the stats endpoint or on the HLS...	7.5 High	—	0,55%	10 Sep 2026
CVE-2026-88875 AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) incompletely sanitizes sensitive user fields in the APIName=video response. Video ro...	4.3 Medium	—	0,31%	10 Sep 2026
CVE-2026-88876 AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/PlayerSkins/seo.php that allows unauthenticated...	7.5 High	—	0,44%	10 Sep 2026
CVE-2026-88869 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the AD_Server plugin's log.php endpoint that fails...	9.3 Critical	—	0,53%	10 Sep 2026
CVE-2026-88870 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the LoginControl plugin PGP key endpoints that...	7.1 High	—	0,17%	10 Sep 2026
CVE-2026-88868 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LiveLinks plugin where title and description fi...	8.7 High	—	0,37%	10 Sep 2026
CVE-2026-88864 Capgo (capgo.app) fails to restrict direct write access to the public.sso_providers table exposed through Supabase PostgREST. A holder of an ordinary Capgo full API key c...	9.1 Critical	—	0,37%	10 Sep 2026
CVE-2026-88865 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate restream ownership in getRestream.json.php, allowing authenticated users with canStream p...	8.1 High	—	0,36%	10 Sep 2026
CVE-2026-88866 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to encode t...	8.7 High	—	0,45%	10 Sep 2026
CVE-2026-88867 WWBN AVideo, in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, contains a stored cross-site scripting vulnerability. objects/categoryAddNew...	8.7 High	—	0,37%	10 Sep 2026
CVE-2026-88790 A security vulnerability has been detected in proma-ai Proma up to 0.19.37. Affected is the function resolveTargetPath of the file apps/electron/src/main/lib/file-preview...	4.8 Medium	—	0,17%	10 Sep 2026
CVE-2026-88860 Capgo fails to clean up channel permission overrides when a user's last organization role binding is deleted, leaving stale overrides active. Attackers can retain channel...	6.3 Medium	—	0,27%	10 Sep 2026
CVE-2026-88861 Capgo (Cap-go/capgo.app) contains an authentication bypass affecting all versions (no patched version available at time of publication). The Edge authorization path allow...	8.3 High	—	0,52%	10 Sep 2026
CVE-2026-88862 Capgo (capgo.app) backend through 12.242.4 does not validate parent-child delegation when processing the x-limited-key-id header. checkKeyByIdPg() in supabase/functions/_...	8.8 High	—	0,44%	10 Sep 2026
CVE-2026-88863 capgo.app (npm package `capgo`) through version 12.207.1 does not compare the caller's role rank against the requested role in the validateInvite() function of supabase/f...	8.1 High	—	0,39%	10 Sep 2026
CVE-2026-85217 A maliciously crafted add-in, when installed and executed in Autodesk Fusion Desktop, can modify persistent network proxy settings without user notification or consent. A...	8.6 High	—	0,19%	10 Sep 2026
CVE-2026-75584 ION-DTN before 4.2.1-a.1 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash the ION process by sending a BPv7 bundle with a...	7.5 High	—	0,61%	10 Sep 2026
CVE-2026-6285 Weak Password Recovery Mechanism for Forgotten Password vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Password Recovery Exploitation. This...	7.5 High	—	0,39%	10 Sep 2026
CVE-2026-64836 ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check. The File::c...	8.8 High	—	0,61%	10 Sep 2026
CVE-2026-64837 ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php, allowing authenticated users to inject OS commands through directory...	8.8 High	—	0,81%	10 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.