Katalog CVE (hal. 508)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.280 (Critical 36.347 · High 105.266 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 25 Okt 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 25.351–25.400 dari 263.280 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-75033 suse rancher A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on its `field.cattle.io/projectId` annotation, without verifying that the...	7.7 High	—	0,34%	3 Sep 2026
CVE-2026-71404 suse rancher A flaw was found in Rancher Manager. The GlobalRole controller derived the target ClusterRole name from the user-settable `authz.management.cattle.io/cr-name` annotation...	8.7 High	—	0,42%	3 Sep 2026
CVE-2026-71403 suse rancher A flaw was found in Rancher Manager. The /v3/users update path did not enforce immutability of a User resource's `username` and `principalIds` fields. A user holding the...	6.1 Medium	—	0,37%	3 Sep 2026
CVE-2026-63694 dell smartfabric os10 Dell SmartFabric OS10 Software, versions prior to 10.5.6.14, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability...	5.0 Medium	—	0,84%	3 Sep 2026
CVE-2026-56128 pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr paramete...	5.4 Medium	—	1,1%	3 Sep 2026
CVE-2026-56127 pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inject arbitrary JavaScript via the descr parameter in...	5.4 Medium	—	1,1%	3 Sep 2026
CVE-2026-56126 pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configuration param...	5.4 Medium	—	1,1%	3 Sep 2026
CVE-2026-35160 dell smartfabric os10 Dell SmartFabric OS10 Software, versions prior to 10.5.6.14, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulner...	5.0 Medium	—	0,84%	3 Sep 2026
CVE-2026-85110 A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formWlanSetup of the file /boaform/formWlanSetup of the component Boa Web Server. The man...	8.8 High	—	0,85%	3 Sep 2026
CVE-2026-85109 A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formLogin of the file /boaform/formLogin of the component Boa Web Server. Executin...	9.8 Critical	—	1,1%	3 Sep 2026
CVE-2026-84815 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold allows Reflected XSS. This issue affects Enfold: from...	5.8 Medium	—	0,20%	3 Sep 2026
CVE-2026-82180 In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the certificate authentication policy, CertificateMqttFilter parses an X.509 certifica...	9.5 Critical	—	0,34%	3 Sep 2026
CVE-2026-80515 In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects every /…/mgmt/… REST endpoint decides whether to apply its check by call...	8.9 High	—	0,47%	3 Sep 2026
CVE-2026-6071 A remote code execution security issue exists in the affected products when parsing DOE files that could allow a remote attacker to write past the end of an allocated obj...	7.5 High	—	0,51%	3 Sep 2026
CVE-2025-12737 wso2 api control plane, wso2 api manager +6 lainnya The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrati...	8.4 High	—	0,22%	3 Sep 2026
CVE-2026-9854 hitachienergy microscada x sys600 A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could elevate their privileges to administrator level on the underlying...	7.8 High	—	0,14%	3 Sep 2026
CVE-2026-9853 hitachienergy microscada x sys600 A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read and modify application objects...	7.8 High	—	0,14%	3 Sep 2026
CVE-2026-9852 hitachienergy microscada x sys600 A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in some cases, d...	7.8 High	—	0,21%	3 Sep 2026
CVE-2026-85175 SiYuan versions <= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go), which only blocks conf/conf.j...	8.8 High	—	0,33%	3 Sep 2026
CVE-2026-85174 SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible log file when full-text search requests exceed timing thresholds. Authenticated a...	8.8 High	—	0,51%	3 Sep 2026
CVE-2026-85173 n8n n8n versions before 2.36.2 contain a missing per-project authorization vulnerability in the Insights API routes that allows authenticated users with insights scopes to ac...	4.3 Medium	—	0,35%	3 Sep 2026
CVE-2026-85172 n8n n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and Function nodes. The validation lo...	6.4 Medium	—	0,26%	3 Sep 2026
CVE-2026-85171 n8n n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nodes send their decrypted creden...	6.5 Medium	—	0,56%	3 Sep 2026
CVE-2026-85170 n8n n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gmail (v1) and Brevo nodes to the mail composer without verifying it is a string. An authenti...	6.5 Medium	—	0,40%	3 Sep 2026
CVE-2026-85169 n8n n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain an expression sandbox escape in the $fromAI handler. $fromAI resolved a caller-supplied placeholder name without...	8.8 High	—	0,88%	3 Sep 2026
CVE-2026-85168 n8n n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in the Git node. The node reset a fixed list of command-bearing configurati...	8.8 High	—	0,84%	3 Sep 2026
CVE-2026-85167 n8n n8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerability in the Elasticsearch Document Get All and Google Cloud Firestore Document Query operati...	6.5 Medium	—	0,40%	3 Sep 2026
CVE-2026-85166 n8n n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow (e.g., the Wor...	6.5 Medium	—	0,36%	3 Sep 2026
CVE-2026-85165 n8n n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, or class-extension positions re...	9.9 Critical	—	0,57%	3 Sep 2026
CVE-2026-85164 WWBN AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the set_api_userImages API endpoint that fails to validate profileImg and bac...	7.1 High	—	0,33%	3 Sep 2026
CVE-2026-85163 AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the EPG parser that allows authenticated uploaders to fetch arbitrary internal URL...	6.5 Medium	—	0,35%	3 Sep 2026
CVE-2026-85162 AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in plugin/Live/saveLive.php that lacks forbidIfNotPost and forbidIfInvalidToken protec...	6.5 Medium	—	0,17%	3 Sep 2026
CVE-2026-85161 AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in removePoster.php that lacks forbidIfNotPost or forbidIfInvalidToken checks. Attacke...	4.3 Medium	—	0,15%	3 Sep 2026
CVE-2026-85160 AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete directories by expl...	8.1 High	—	0,39%	3 Sep 2026
CVE-2026-85159 AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php where the cancelUri parameter is echoed in an href attribute afte...	5.4 Medium	—	0,29%	3 Sep 2026
CVE-2026-85158 AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbeded.php that echoes the link parameter inside an HTML comment with zer...	5.4 Medium	—	0,26%	3 Sep 2026
CVE-2026-85157 WWBN AVideo contains a broken access control vulnerability in the unauthenticated feed/index.php endpoint that disables per-video visibility checks when a program_id para...	5.3 Medium	—	0,34%	3 Sep 2026
CVE-2026-85156 WWBN AVideo fails to properly validate access controls on the public channel page, allowing unauthenticated visitors to view unlisted and group-restricted videos through...	5.3 Medium	—	0,34%	3 Sep 2026
CVE-2026-85155 WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APIName=channels that allows unauthenticated attackers t...	7.5 High	—	0,46%	3 Sep 2026
CVE-2026-85154 WWBN AVideo contains an authentication failure vulnerability where the video_id_hash credential is a non-expiring, non-revocable bearer token that grants full administrat...	9.8 Critical	—	0,64%	3 Sep 2026
CVE-2026-85150 A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that use...	7.5 High	—	0,53%	3 Sep 2026
CVE-2026-85124 fastify/http-proxy @fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream....	7.5 High	—	0,74%	3 Sep 2026
CVE-2026-85107 A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file apps/desktop/electron/main.ts of...	4.3 Medium	—	0,51%	3 Sep 2026
CVE-2026-85106 A vulnerability has been found in NousResearch hermes-agent 0.18.0. This affects the function fetchLinkTitle of the file apps/desktop/src/app/artifacts/index.tsx of the c...	6.3 Medium	—	0,35%	3 Sep 2026
CVE-2026-85105 A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is the function _sess_nowait of the file s71.py of the component Session Management. Thi...	7.3 High	—	0,50%	3 Sep 2026
CVE-2026-85100 A vulnerability was detected in 2FastLabs agent-squad up to 1.1.4. Affected by this vulnerability is the function AgentSquad.routeRequest of the file agent-squad/typescri...	4.3 Medium	—	0,55%	3 Sep 2026
CVE-2026-85093 Cheshire Cat AI's GET /memory/collections/{collection_id}/points endpoint fails to apply per-user filtering when retrieving episodic memory points. Authenticated attacker...	6.5 Medium	—	0,42%	3 Sep 2026
CVE-2026-85092 LiME through 1.12.0 fails to validate the disk acquisition output path and does not use O_NOFOLLOW when opening the operator-supplied path parameter, allowing unprivilege...	6.6 Medium	—	0,16%	3 Sep 2026
CVE-2026-85091 zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale...	7.4 High	—	0,36%	3 Sep 2026
CVE-2026-85090 freerdp FreeRDP before 3.31.0 contains a heap out-of-bounds read vulnerability in the general_ChromaV1ToYUV444 function during AVC444 chroma plane reconstruction. A malicious RDP...	5.4 Medium	—	0,28%	3 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.