Katalog CVE (hal. 52) — KUTIM-CSIRT

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 258.286 (Critical 35.887 · High 103.298 · KEV 1.745 · sejak 2020) · Pembaruan terakhir: 15 Okt 2026, 12:38 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 2.551–2.600 dari 258.286 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-106170 An Uncaught Exception vulnerability [CWE-248] vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions...	4.9 Medium	—	0,28%	13 Okt 2026
CVE-2026-105445 An Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organization conversion feature allowed an authenticated attacker to reassign a personal access...	9.4 Critical	—	0,41%	13 Okt 2026
CVE-2026-104085 odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary commands by uploading a docume...	8.8 High	—	2,4%	13 Okt 2026
CVE-2025-57739 An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, Fo...	8.8 High	—	0,31%	13 Okt 2026
CVE-2025-46773 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4...	8.8 High	—	0,32%	13 Okt 2026
CVE-2026-94603 Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime....	10.0 Critical	—	0,92%	13 Okt 2026
CVE-2026-88838 A flaw was found in BusyBox's mount utility. A non-root user can bypass mount security restrictions set in /etc/fstab by specifying clearing-mask options on the command l...	5.5 Medium	—	0,11%	13 Okt 2026
CVE-2026-88834 A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An...	3.7 Low	—	0,22%	13 Okt 2026
CVE-2026-88833 A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from...	6.5 Medium	—	0,19%	13 Okt 2026
CVE-2026-85990 Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation and plugin-management surfaces, Leantime's JSON-RPC...	8.8 High	—	0,33%	13 Okt 2026
CVE-2026-85733 FrankenPHP is a modern application server for PHP. Prior to 1.12.5, the official FrankenPHP Debian and Alpine Docker images include a default /app/public/index.php that e...	5.3 Medium	—	0,24%	13 Okt 2026
CVE-2026-82416 FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session extension is loa...	7.7 High	—	0,23%	13 Okt 2026
CVE-2026-77459 Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Argo CD creates PostDelete resource hook...	9.9 Critical	—	0,72%	13 Okt 2026
CVE-2026-69227 A flaw in Portal for ArcGIS allows unauthenticated access to certain Portal Administrator API endpoints under specific conditions. This could enable an attacker to acce...	9.8 Critical	—	0,33%	13 Okt 2026
CVE-2026-69226 A flaw in Portal for ArcGIS allows unauthenticated users to create new accounts through the sharing endpoint even when self-service account registration is disabled (disa...	6.5 Medium	—	0,18%	13 Okt 2026
CVE-2026-66057 Frappe is a full-stack web application framework. Prior to 15.116.0 and 16.29.0, the OAuth login flow uses an unsanitized client-controlled state parameter to select post...	5.1 Medium	—	0,42%	13 Okt 2026
CVE-2026-61642 Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling at...	7.7 High	—	4,7%	13 Okt 2026
CVE-2026-55823 Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview composes a count operation around generated SQL through a raw dat...	8.7 High	—	0,37%	13 Okt 2026
CVE-2026-55562 Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.119, the administrator Activity Log in htdocs/js/pages/admin/Activity.js...	9.0 Critical	—	0,37%	13 Okt 2026
CVE-2026-55183 RClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes efficiently. Prior to 0.2.7, RClone Manager starts the local rclone rcd se...	9.6 Critical	—	0,42%	13 Okt 2026
CVE-2026-54641 OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the get, getUserClientRoles, and getUserRealmRoles methods in manager/src/main/java/org/openrem...	7.7 High	—	0,29%	13 Okt 2026
CVE-2026-54640 OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method in agent/src/main/java/org/openremote/agent/protocol/kn...	7.6 High	—	0,22%	13 Okt 2026
CVE-2026-54454 OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to 0.10.0, the OpenCATS Import module in modules/im...	9.1 Critical	—	0,40%	13 Okt 2026
CVE-2026-53562 Improper link resolution before file access ('link following') vulnerability in Citrix UniconOS. This issue affects UniconOS: before 2607 CR and before 2603 LTSR CU2.	8.5 High	—	0,15%	13 Okt 2026
CVE-2026-19940 The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfp_ag.c keeps its struct bt_hfp_ag objects in a static pool indexe...	6.5 Medium	—	0,19%	13 Okt 2026
CVE-2026-19939 The AVDTP signalling layer arms a 6-second command timeout (AVDTP_TIMEOUT) in avdtp_send_cmd() whenever the local device issues an AVDTP request. Every response handler i...	6.3 Medium	—	0,18%	13 Okt 2026
CVE-2026-110131 ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/{id} endpoints that allows unauthenticated attackers to...	5.3 Medium	—	0,26%	13 Okt 2026
CVE-2026-110129 fuintCatering through commit 122c9e6 contains an insecure direct object reference vulnerability in the ClientRefundController refund detail endpoint that lets authenticat...	6.5 Medium	—	0,30%	13 Okt 2026
CVE-2026-110128 fuint through commit 4c4bc8a contains a missing authentication vulnerability that allows unauthenticated attackers to retrieve any member's order details via the /clientA...	7.5 High	—	0,44%	13 Okt 2026
CVE-2026-110127 waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in the mobile CartController that allows authenticated members to modify or delete...	4.3 Medium	—	0,25%	13 Okt 2026
CVE-2026-110126 waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in AddressController that allows authenticated members to modify or delete other me...	5.4 Medium	—	0,28%	13 Okt 2026
CVE-2026-110125 Waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability that allows authenticated members to access and modify other members' orders by sup...	6.3 Medium	—	0,25%	13 Okt 2026
CVE-2026-110124 FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify othe...	8.1 High	—	0,30%	13 Okt 2026
CVE-2026-110123 Makunet maku-boot 4.3.0 through 5.0.0 contains a missing authorization vulnerability that allows authenticated users to read mail and SMS configurations by calling /sys/m...	7.1 High	—	0,28%	13 Okt 2026
CVE-2026-110122 PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to change other stores' product freight templat...	4.3 Medium	—	0,25%	13 Okt 2026
CVE-2026-110121 PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to overwrite any store's product by supplying a...	6.5 Medium	—	0,28%	13 Okt 2026
CVE-2026-110120 Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the after-sales API that allows authenticated members to access other members' data...	5.4 Medium	—	0,22%	13 Okt 2026
CVE-2026-110119 Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member address API that allows authenticated members to read, overwrite and dele...	7.1 High	—	0,27%	13 Okt 2026
CVE-2026-110118 WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability that allows authenticated users to complete or reassign other users' workflow tasks via /vue...	6.5 Medium	—	0,28%	13 Okt 2026
CVE-2026-110117 SmartAdmin through 3.30.0 contains a missing authorization vulnerability in AdminProtectController that allows authenticated low-privileged employees to modify system-wid...	6.5 Medium	—	0,28%	13 Okt 2026
CVE-2026-110116 Risesoft-y9 Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager storeFile endpoint that allows unauthenticated attacker...	9.1 Critical	—	0,59%	13 Okt 2026
CVE-2026-110115 Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler that allows un...	7.5 High	—	0,43%	13 Okt 2026
CVE-2026-110114 FJ-OMS oms-erp through PRE contains a missing authentication vulnerability that allows unauthenticated attackers to delete and rebuild product search indexes by calling p...	6.5 Medium	—	0,41%	13 Okt 2026
CVE-2026-110113 PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController tradeAddress/save handler that allows authenticated...	4.3 Medium	—	0,24%	13 Okt 2026
CVE-2026-110110 JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access to enable or disable any alarm configuration. Be...	4.3 Medium	—	0,25%	13 Okt 2026
CVE-2026-110109 JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access on transparent-codec to overwrite product codecs...	6.5 Medium	—	0,28%	13 Okt 2026
CVE-2026-110108 MateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated user to manage object storage by calling the unprotected /api/v1/admi...	8.1 High	—	0,30%	13 Okt 2026
CVE-2026-110107 RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by...	4.2 Medium	—	0,27%	13 Okt 2026
CVE-2026-110106 RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by su...	4.2 Medium	—	0,27%	13 Okt 2026
CVE-2026-110105 B3log Symphony through 3.6.4 contains a missing authorization vulnerability that allows unauthenticated attackers to reach admin routes because PermissionMidware.check pe...	5.3 Medium	—	0,30%	13 Okt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.