Katalog CVE (hal. 526)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.288 (Critical 36.348 · High 105.269 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 25 Okt 2026, 12:26 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 26.251–26.300 dari 263.288 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-82735 Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expression to run on input that a length constraint sh...	5.9 Medium	—	0,18%	1 Sep 2026
CVE-2026-82734 Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to submit a non-finite decimal value that bypasses numeric bounds c...	2.1 Low	—	0,19%	1 Sep 2026
CVE-2026-19032 jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.de...	5.3 Medium	—	0,53%	1 Sep 2026
CVE-2026-82733 Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to read internal application d...	6.3 Medium	—	0,55%	1 Sep 2026
CVE-2026-82732 Improper Input Validation vulnerability in ash-project ash_typescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-co...	6.3 Medium	—	0,68%	1 Sep 2026
CVE-2026-82731 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in ash-project ash_typescript allows an attacker who controls a path-parameter value to redirect a gener...	2.3 Low	—	0,50%	1 Sep 2026
CVE-2026-82730 Incorrect Authorization vulnerability in ash-project ash_typescript allows an unauthorized RPC caller to read attribute values that Ash field policies denied. When a fie...	8.2 High	—	0,50%	1 Sep 2026
CVE-2026-77950 Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to receive unredacted internal...	6.3 Medium	—	0,55%	1 Sep 2026
CVE-2026-77856 Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom table and abo...	8.2 High	—	0,55%	1 Sep 2026
CVE-2026-75865 The WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode plugin for WordPress is vulnerable to arbitrary file upload due to missi...	9.8 Critical	—	0,92%	1 Sep 2026
CVE-2026-74837 Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom table and abo...	8.7 High	—	0,55%	1 Sep 2026
CVE-2026-67395 A path traversal vulnerability exists in Sage Employee Self Service’s custom logo functionality due to improper validation of file path parameters. By leveraging director...	5.9 Medium	—	1,1%	1 Sep 2026
CVE-2026-67394 A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before 18.0.79.9...	9.0 Critical	—	1,3%	1 Sep 2026
CVE-2026-65643 cpanel Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.	8.8 High	—	0,88%	1 Sep 2026
CVE-2026-48932 A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage`...	3.7 Low	—	0,27%	1 Sep 2026
CVE-2026-18743 A flaw was found in popt. This vulnerability allows an attacker to provide specially crafted configuration content to a host, which, when loaded, can lead to a small memo...	2.5 Low	—	0,14%	1 Sep 2026
CVE-2026-19820 A vulnerability in the Backblaze Client allows a local user to make the system not bootable by creating a link from Backblaze's folder to Windows OS system files during a...	7.8 High	—	0,33%	1 Sep 2026
CVE-2026-83524 A security vulnerability has been detected in RedPort Optimizer wXa-203, Optimizer wXa-213 and Optimizer wXa-223 up to 20260704. This impacts the function exec of the fil...	9.9 Critical	—	3,2%	31 Agt 2026
CVE-2026-82971 A vulnerability was determined in QVidium Opera11 3.3.2a26-Ax4x-opera11. This affects an unknown part of the file /cgi-bin/net_tr.cgi of the component CGI Script. This ma...	10.0 Critical	—	3,3%	31 Agt 2026
CVE-2026-82957 A vulnerability was found in hyperledger-firefly firefly up to 1.4.0. The impacted element is the function ValidateOptions of the file internal/events/webhooks/webhooks.g...	7.3 High	—	0,51%	31 Agt 2026
CVE-2026-82954 A vulnerability was detected in Dokploy up to 0.29.7. This issue affects the function writeTraefikConfigInPath of the file packages/server/src/utils/traefik/application.t...	9.9 Critical	—	0,96%	31 Agt 2026
CVE-2026-82922 A security vulnerability has been detected in ShopEx ECShop up to 2.5.1. This vulnerability affects the function flow_update_cart of the file /flow.php?step=update_cart....	7.3 High	—	0,41%	31 Agt 2026
CVE-2026-82921 A weakness has been identified in ShopEx ECShop up to 2.5.1. This affects the function check_img_type of the file admin/pack.php. Executing a manipulation of the argument...	7.3 High	—	0,47%	31 Agt 2026
CVE-2026-82882 Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens...	8.8 High	—	0,57%	31 Agt 2026
CVE-2026-82398 pypdf project pypdf pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long runtimes when the pypdf/_utils.py function read_unt...	5.3 Medium	—	0,52%	31 Agt 2026
CVE-2026-82397 Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.p...	7.5 High	—	0,35%	31 Agt 2026
CVE-2026-82396 Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, src/Sulu/Bundle/MediaBundle/Controller/MediaStrea...	5.4 Medium	—	0,30%	31 Agt 2026
CVE-2026-82395 Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the media move endpoint derives its permission ch...	5.3 Medium	—	0,43%	31 Agt 2026
CVE-2026-82394 Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the preview-link endpoint and src/Sulu/Bundle/Pre...	5.3 Medium	—	0,58%	31 Agt 2026
CVE-2026-82393 pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a tarball dependency's package.json manifest name because pnpm11/resolvin...	7.5 High	—	0,63%	31 Agt 2026
CVE-2026-77353 Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos allows authenticated users to inject arbitrary iCalendar properties...	4.6 Medium	—	0,29%	31 Agt 2026
CVE-2026-77352 Wallos is an open-source, self-hostable personal subscription tracker. From version 2.0.0 to before version 5.0.0, any authenticated Wallos user (no admin rights required...	4.3 Medium	—	0,33%	31 Agt 2026
CVE-2026-77351 Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos lets any authenticated user store an arbitrary SMTP host — including...	3.5 Low	—	0,29%	31 Agt 2026
CVE-2026-77348 Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the fix for CVE-2026-33407 (GHSA-hhjq-82f8-m6rc, "SSRF via HTTP Proxy Envir...	8.2 High	—	0,43%	31 Agt 2026
CVE-2026-83596 A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.	8.8 High	—	0,29%	31 Agt 2026
CVE-2026-82919 A vulnerability was identified in cu silicon up to 0.1.5. Affected by this vulnerability is the function create_app of the file views.py of the component edit Endpoint. S...	7.3 High	—	0,65%	31 Agt 2026
CVE-2026-82914 A security flaw has been discovered in kishan0725 Hospital-Management-System 1.0. This vulnerability affects unknown code of the file /search.php. The manipulation of the...	7.3 High	—	0,41%	31 Agt 2026
CVE-2026-82909 A vulnerability was determined in QuantumNous new-api up to 1.0.0-rc.15. Affected by this issue is some unknown functionality of the file /api/usage/token/ of the compone...	4.3 Medium	—	0,39%	31 Agt 2026
CVE-2026-82908 A vulnerability was found in MSI Dragon Center up to 2.0.155.0. Affected by this vulnerability is the function MmioWritePath in the library NTIOLib_X64.sys of the compone...	8.8 High	—	0,18%	31 Agt 2026
CVE-2026-82906 A flaw has been found in sdcb chats up to 1.12.0. This impacts the function DownloadPublic of the file src/BE/web/Controllers/Chats/Files/FileController.cs of the compone...	3.7 Low	—	0,57%	31 Agt 2026
CVE-2026-82852 Unauthenticated Server Side Request Forgery (SSRF) in MapSVG <= 8.15.0 versions.	5.4 Medium	—	0,22%	31 Agt 2026
CVE-2026-82392 pnpm is a package manager. Prior to 10.34.5 and from 11.0.0 until 11.11.0, pnpm parses the package name from attacker-controlled pnpm-lock.yaml packages keys with dp.pars...	7.1 High	—	0,62%	31 Agt 2026
CVE-2026-82346 A potential security vulnerability has been identified in the HP ImageDiags for versions prior to 5.0.0.36. The vulnerability could potentially allow a local attacker to...	7.0 High	—	0,14%	31 Agt 2026
CVE-2026-82229 Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.2 versions.	7.1 High	—	0,25%	31 Agt 2026
CVE-2026-82228 Unauthenticated Bypass Vulnerability in SiteGround Security <= 1.6.6 versions.	8.1 High	—	0,40%	31 Agt 2026
CVE-2026-82226 Unauthenticated PHP Object Injection in Tickera <= 3.6.0.2 versions.	9.8 Critical	—	0,56%	31 Agt 2026
CVE-2026-82225 Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.9.8 versions.	7.4 High	—	0,39%	31 Agt 2026
CVE-2026-82224 Unauthenticated Cross Site Scripting (XSS) in SliceWP <= 1.2.10 versions.	7.1 High	—	0,25%	31 Agt 2026
CVE-2026-82221 Unauthenticated Cross Site Scripting (XSS) in RegistrationMagic <= 6.0.9.8 versions.	7.1 High	—	0,25%	31 Agt 2026
CVE-2026-81892 EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashbo...	8.1 High	—	0,45%	31 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.