Katalog CVE (hal. 507)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.280 (Critical 36.347 · High 105.266 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 25 Okt 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 25.301–25.350 dari 263.280 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-81281 Subscriber Cross Site Scripting (XSS) in Graphene <= 2.9.4 versions.	6.5 Medium	—	0,22%	3 Sep 2026
CVE-2026-75602 OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/add_offline_download with tool: "SimpleHt...	6.5 Medium	—	0,69%	3 Sep 2026
CVE-2026-85239 misp-project misp A vulnerability in MISP's event template handling allowed an authenticated user with permission to create or modify event templates to bypass validation of the template d...	6.5 Medium	—	0,45%	3 Sep 2026
CVE-2026-85238 misp-project misp MISP contains a session fixation vulnerability in the CustomAuth authentication (a custom configuration) flow. When a user was successfully authenticated through CustomAu...	6.8 Medium	—	0,34%	3 Sep 2026
CVE-2026-85237 misp-project misp A vulnerability in MISP's email-based one-time password (OTP) authentication flow allowed an attacker to perform an unrestricted number of OTP verification attempts. Th...	8.1 High	—	0,46%	3 Sep 2026
CVE-2026-85236 misp-project misp A cross-site request forgery (CSRF) vulnerability existed in the cullEmptyEvents action of MISP. The endpoint performed a state-changing and irreversible operation while...	8.8 High	—	0,25%	3 Sep 2026
CVE-2026-85138 A vulnerability was detected in SeaCMS up to 13.6. Affected is the function addslashes of the file weixin/index.php of the component WeChat Module. The manipulation of th...	7.3 High	—	0,41%	3 Sep 2026
CVE-2026-85137 A security vulnerability has been detected in SeaCMS up to 13.6. This impacts the function parseIf of the file seacms_locoy_news.php of the component Locoy Collector. The...	7.3 High	—	0,52%	3 Sep 2026
CVE-2026-84967 mongodb A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line...	4.3 Medium	—	0,27%	3 Sep 2026
CVE-2026-84966 mongodb c++ driver An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly. When an app...	5.5 Medium	—	0,14%	3 Sep 2026
CVE-2026-84965 mongodb c driver An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a following copy operation still w...	5.5 Medium	—	0,13%	3 Sep 2026
CVE-2026-84964 mongodb c driver A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already trusts. Durin...	7.5 High	—	0,26%	3 Sep 2026
CVE-2026-84963 mongodb c driver An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value to be silently shortened, or...	5.3 Medium	—	0,31%	3 Sep 2026
CVE-2026-84962 mongodb libmongocrypt An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's id...	4.2 Medium	—	0,19%	3 Sep 2026
CVE-2026-83961 adobe coldfusion ColdFusion is affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain limite...	7.1 High	—	0,42%	3 Sep 2026
CVE-2026-82525 Exterro FTK Imager before 8.3 contains an XML external entity (XXE) injection vulnerability that allows attackers to read arbitrary files from the host filesystem by embe...	5.5 Medium	—	0,20%	3 Sep 2026
CVE-2026-75036 suse rancher fleet A security vulnerability was discovered in Fleet's Helm template preprocessing where templates evaluated by the Fleet controller could reach network resources outside the...	4.3 Medium	—	0,16%	3 Sep 2026
CVE-2026-75035 suse rancher A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user, the ext.cattle.io/v1 Token store dropped its inte...	6.5 Medium	—	0,34%	3 Sep 2026
CVE-2026-75034 suse rancher A flaw was found in Rancher Manager. The SAML assertion replay protection introduced by the fix for CVE-2026-44946 recorded consumed assertion IDs in a per-process cache,...	7.4 High	—	0,32%	3 Sep 2026
CVE-2026-71963 Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute arbitrary OS commands by supp...	8.8 High	—	0,86%	3 Sep 2026
CVE-2026-57445 Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable parameters and voting mechanisms. I...	8.7 High	—	0,43%	3 Sep 2026
CVE-2026-55658 Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable parameters and voting mechanisms. I...	7.7 High	—	0,30%	3 Sep 2026
CVE-2026-53924 Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable parameters and voting mechanisms. P...	8.7 High	—	0,41%	3 Sep 2026
CVE-2026-53720 pymonocypher uses cython to wrap the Monocypher C library. Prior to version 4.0.2.8, the argon2i_32 implementation does not check the nb_blocks size. If the caller does n...	5.1 Medium	—	0,18%	3 Sep 2026
CVE-2026-50554 Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/{bookID}/notes is an unauthenticated endpoint that accepts a "deleted" query...	5.3 Medium	—	0,42%	3 Sep 2026
CVE-2026-48486 Signum Node is a HDD-mined cryptocurrency using an energy efficient and fair Proof-of-Commitment (PoC+) consensus algorithm. Prior to version 3.9.9, an integer overflow i...	7.5 High	—	0,33%	3 Sep 2026
CVE-2026-85230 misp-project misp A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only when the widget was ren...	5.4 Medium	—	0,29%	3 Sep 2026
CVE-2026-85227 misp-project misp MISP contains a reflected Cross-Site Scripting (XSS) vulnerability in the event attribute filtering query builder. The taggedAttributes and galaxyAttachedAttributes URL p...	6.1 Medium	—	0,25%	3 Sep 2026
CVE-2026-85226 misp-project misp MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated solely from matching attribute values without applying the distr...	4.3 Medium	—	0,25%	3 Sep 2026
CVE-2026-85221 misp-project misp MISP contains an improper TLS certificate validation vulnerability in CurlClient. The CurlClient::$verifyPeer property was not explicitly initialized and therefore defaul...	9.1 Critical	—	0,27%	3 Sep 2026
CVE-2026-85216 misp-project misp MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to insufficient validation of user-supplied credentials. The cu...	9.8 Critical	—	0,87%	3 Sep 2026
CVE-2026-85214 vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID in the req...	8.1 High	—	0,50%	3 Sep 2026
CVE-2026-85213 Kill Bill through 0.24.21 fails to enforce permission annotations on several AdminResource endpoints including getQueueEntries, invalidatesCache, and putOutOfRotation. Au...	7.6 High	—	0,39%	3 Sep 2026
CVE-2026-85212 CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServices.php that returns true from both conditional branches. Sub-administr...	8.3 High	—	0,60%	3 Sep 2026
CVE-2026-85211 Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxy_api.py endpoints. Attackers can access other tenants' cloud s...	7.7 High	—	0,42%	3 Sep 2026
CVE-2026-85210 Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with open_access, allowing any registered user to enumerate privileged accounts and roles....	4.3 Medium	—	0,34%	3 Sep 2026
CVE-2026-85199 Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API. User-controlled identifiers used to create, update, or de...	8.8 High	—	0,91%	3 Sep 2026
CVE-2026-85183 Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connections to vict...	9.3 Critical	—	0,23%	3 Sep 2026
CVE-2026-85182 vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change arbitrary...	7.5 High	—	0,44%	3 Sep 2026
CVE-2026-85181 CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers c...	9.8 Critical	—	0,71%	3 Sep 2026
CVE-2026-85180 Ollama fails to validate redirect destinations when pulling tensor-layer models, allowing unauthenticated attackers to redirect blob downloads to arbitrary hosts. An atta...	7.5 High	—	0,50%	3 Sep 2026
CVE-2026-85179 Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud...	8.5 High	—	0,40%	3 Sep 2026
CVE-2026-85178 Helicone's VaultManager.getDecryptedProviderKeyById() function in the GET /v1/vault/key/{providerKeyId} endpoint fails to validate the requester's organization against th...	7.7 High	—	0,42%	3 Sep 2026
CVE-2026-85177 CRMEB through 6.0.0 fails to validate message ownership in the edit_message handler of MessageSystemController.php, allowing authenticated users to modify arbitrary syste...	5.4 Medium	—	0,27%	3 Sep 2026
CVE-2026-85176 DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resolution. Attacke...	8.8 High	—	0,63%	3 Sep 2026
CVE-2026-85135 A security flaw has been discovered in ILIAS up to 9.21/10.9/11.2. This affects the function ilObjMediaObjectGUI::uploadMultipleSubtitleFileObject of the file Services/Re...	6.3 Medium	—	0,37%	3 Sep 2026
CVE-2026-84989 ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, two REST v2 endpoints that manage ntopng's tag/badge feature — `POST /...	7.1 High	—	0,38%	3 Sep 2026
CVE-2026-84971 mongodb libmongocrypt Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the process usi...	6.5 Medium	—	0,26%	3 Sep 2026
CVE-2026-84970 mongodb c++ driver A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library. An actor who controls the text that an embedding application...	5.8 Medium	—	0,12%	3 Sep 2026
CVE-2026-84969 mongodb c driver A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a binary field...	3.7 Low	—	0,27%	3 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.