Katalog CVE (hal. 500)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.273 (Critical 36.346 · High 105.264 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 25 Okt 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 24.951–25.000 dari 263.273 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-85660 cli-mcp-server 0.2.5 contains a command allowlist bypass vulnerability in the _validate_command_with_operators function when ALLOW_SHELL_OPERATORS is enabled. Attackers c...	8.1 High	—	0,62%	4 Sep 2026
CVE-2026-85651 Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to inject task runs into arbitrar...	8.5 High	—	0,49%	4 Sep 2026
CVE-2026-85650 Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protectio...	5.4 Medium	—	0,35%	4 Sep 2026
CVE-2026-85626 git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref and object parameters of git_log, git_diff, and git_show tools that lack leading-dash valida...	7.5 High	—	0,48%	4 Sep 2026
CVE-2026-85625 sift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where op...	8.1 High	—	0,74%	4 Sep 2026
CVE-2026-85624 Blinko 1.8.7 contains a cross-user private note disclosure vulnerability in the noteReferenceList procedure that performs no ownership verification on supplied note ident...	6.5 Medium	—	0,42%	4 Sep 2026
CVE-2026-85623 goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute malicious recipes that execut...	8.8 High	—	0,59%	4 Sep 2026
CVE-2026-85622 AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket connections in the establish_ws_connection_v2 handler, allowing authentic...	5.3 Medium	—	0,40%	4 Sep 2026
CVE-2026-85621 LobeChat (LobeHub) 2.2.1 does not properly verify inbound chat-platform webhook signatures in the QQ and Feishu adapters. The webhook route (/api/agent/webhooks/:platform...	6.5 Medium	—	0,20%	4 Sep 2026
CVE-2026-85620 Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to RangeFunction nodes in FROM clauses. Attackers can...	8.6 High	—	0,51%	4 Sep 2026
CVE-2026-85619 AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and database r...	7.5 High	—	0,57%	4 Sep 2026
CVE-2026-85618 ConvertX 0.17.0 contains an arbitrary file read vulnerability in the xelatex converter that allows authenticated users to read files by uploading LaTeX files with input d...	6.5 Medium	—	0,48%	4 Sep 2026
CVE-2026-85608 Douyin_TikTok_Download_API through 4.1.2 contains a server-side request forgery vulnerability in the /api/download and /api/hybrid/video_data endpoints that allows unauth...	7.5 High	—	0,50%	4 Sep 2026
CVE-2026-85607 Blinko 1.8.7 contains an authorization bypass (IDOR) vulnerability in multiple tRPC procedures (message.list, message.update, message.delete, message.clearAfter in server...	8.8 High	—	0,69%	4 Sep 2026
CVE-2026-85606 firecrawl-mcp-server 3.20.2 contains an arbitrary local file read vulnerability in the firecrawl_parse tool that accepts unconstrained filePath arguments without director...	7.5 High	—	0,90%	4 Sep 2026
CVE-2026-85605 Slink before 1.12.3 fails to properly authorize access to image comment endpoints, allowing unauthenticated attackers to read comment threads via GET /api/image/{imageId}...	5.3 Medium	—	0,55%	4 Sep 2026
CVE-2026-82729 Inefficient Algorithmic Complexity vulnerability in elixir-mint mint allows a remote HTTP server to exhaust CPU on the client host and cause a denial of service. parse_h...	6.3 Medium	—	0,52%	4 Sep 2026
CVE-2026-82728 Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory on the client host and cause a denial...	8.2 High	—	0,52%	4 Sep 2026
CVE-2026-81859 CP4BA - IBM Enterprise Records could allow a local attacker to obtain sensitive information due to the use of a broken or risky cryptographic algorithm.	6.2 Medium	—	0,11%	4 Sep 2026
CVE-2026-81832 ibm app connect enterprise, ibm integration bus for z/os IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 SAP Adapter is vulnerable...	7.7 High	—	0,38%	4 Sep 2026
CVE-2026-6958 Acunetix 25.11.251107123 for Windows contains a local privilege escalation vulnerability in the Web Vulnerability Scanning Engine (wvsc.exe) that allows low-privileged lo...	7.8 High	—	0,18%	4 Sep 2026
CVE-2026-19727 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Yordam Information Technology Consulting, Training and Electronic Sy...	6.1 Medium	—	0,15%	4 Sep 2026
CVE-2026-19205 Observable response discrepancy vulnerability in GastroMenum GastroMenum Web Panel allows Account Footprinting. This issue affects GastroMenum Web Panel: before 31.08.20...	7.5 High	—	0,25%	4 Sep 2026
CVE-2026-14466 It’s possible to run a stored XSS in Stormshield’s web administration panel. To exploit this vulnerability, a SNS administrator with appropriate permissions must injec...	4.3 Medium	—	0,16%	4 Sep 2026
CVE-2026-85522 A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function createSlotImportJob of the file src/cluster_migrateslot...	5.3 Medium	—	0,86%	4 Sep 2026
CVE-2026-85517 A flaw has been found in code-projects Vehicle Management System 1.0. The impacted element is an unknown function of the file /vehicle_management.sql of the component SQL...	5.3 Medium	—	0,53%	4 Sep 2026
CVE-2026-77818 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Yordam Information Technology Consulting, Training and Electronic Sy...	6.1 Medium	—	0,25%	4 Sep 2026
CVE-2026-52691 UNSUPPORTED WHEN ASSIGNED Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Griffin Hive Metastore Module...	8.8 High	—	0,46%	4 Sep 2026
CVE-2026-19081 Missing Authorization vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows Accessing Functionality Not Properly Constrained by ACLs. This issue affe...	4.3 Medium	—	0,16%	4 Sep 2026
CVE-2026-19057 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows Stored XSS....	5.4 Medium	—	0,13%	4 Sep 2026
CVE-2026-12483 The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type Upload in versions up to and including 5.1.5. This is due to insufficient input validation...	7.5 High	—	0,38%	4 Sep 2026
CVE-2026-85649 (Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the Alpha user and root user password loops of Shell/de...	7.9 High	—	0,20%	4 Sep 2026
CVE-2026-85516 A vulnerability was detected in code-projects Vehicle Management System 1.0. The affected element is an unknown function of the file /busprofile.php. Performing a manipul...	7.3 High	—	0,43%	4 Sep 2026
CVE-2026-85514 A security vulnerability has been detected in StackStorm st2 up to 3.9.0. Impacted is an unknown function of the file st2api/st2api/controllers/v1/auth.py of the componen...	6.3 Medium	—	0,37%	4 Sep 2026
CVE-2026-85513 A weakness has been identified in StackStorm st2 up to 3.9.0. This issue affects the function assert_user_is_admin_if_user_query_param_is_provided of the file st2api/st2a...	6.3 Medium	—	0,43%	4 Sep 2026
CVE-2026-82309 Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS queries per validation via a forward-confirmation loop that does not bound the na...	4.3 Medium	—	0,37%	4 Sep 2026
CVE-2026-74237 GFI Exinda AI and ClearView before 7.6.5 contains an argument injection vulnerability in the Tools Iperf Client functionality. The web_tools_cmd() function constructs an...	6.5 Medium	—	0,39%	4 Sep 2026
CVE-2026-74236 GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the diagnostic file deletion handler. The unlink_or_email_file() function accepts para...	6.5 Medium	—	0,93%	4 Sep 2026
CVE-2026-74235 GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the system maintenance configuration download handler. The wcf_handle_download() funct...	4.9 Medium	—	0,84%	4 Sep 2026
CVE-2026-18198 Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in TAC Information Services Internal and External Trade Inc. GOLDENHORN...	8.8 High	—	0,24%	4 Sep 2026
CVE-2026-85617 snipeitapp snipe-it snipe-it versions before 8.6.3 contain an authorization bypass vulnerability in the bulk delete functionality that allows restricted users to soft-delete users outside th...	8.8 High	—	0,48%	4 Sep 2026
CVE-2026-85616 snipeitapp snipe-it Snipe-IT versions before 8.6.2 contain an authorization bypass vulnerability in checkout-acceptance report actions when Full Multiple Company Support is enabled. Authenti...	8.5 High	—	0,38%	4 Sep 2026
CVE-2026-85615 Openpanel before 2.3.0 contains an insecure direct object reference vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to bind dashbo...	6.4 Medium	—	0,24%	4 Sep 2026
CVE-2026-85614 OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the GET /tools/site-checker endpoint that accepts a fully client-controlle...	8.6 High	—	0,26%	4 Sep 2026
CVE-2026-85613 OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unauthenticated favicon proxy endpoint GET /misc/favicon that allows remote attackers to execu...	8.2 High	—	0,40%	4 Sep 2026
CVE-2026-85612 OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the /misc/favicon and /misc/og endpoints that accept an attacker-supplied...	7.5 High	—	0,41%	4 Sep 2026
CVE-2026-85611 OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail t...	6.4 Medium	—	0,24%	4 Sep 2026
CVE-2026-85610 OpenPanel before 2.3.0 fails to properly validate chart formula expressions, allowing authenticated project members with read access to execute arbitrary code by recoveri...	8.8 High	—	0,71%	4 Sep 2026
CVE-2026-85609 Openpanel before 2.3.0 contains an unauthenticated full-read server-side request forgery (SSRF) vulnerability in the GET /tools/site-checker endpoint (apps/api/src/contro...	7.5 High	—	0,50%	4 Sep 2026
CVE-2026-85604 Grav before 2.0.18 (affected versions <= 2.0.17) contains a remote code execution vulnerability in the Twig sort filter. The sortFunc wrapper in GravExtension.php hardcod...	8.8 High	—	0,86%	4 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.