Katalog CVE (hal. 532)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.295 (Critical 36.348 · High 105.272 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 25 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 26.551–26.600 dari 263.295 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-82863 @hulumi/baseline versions before 1.3.2 fail to fully detect CloudTrail selector tampering events, reducing audit logging configuration change coverage. Attackers can modi...	3.3 Low	—	0,24%	31 Agt 2026
CVE-2026-82862 Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing workspace files to shadow the intended helper script. Attackers can pla...	8.4 High	—	0,19%	31 Agt 2026
CVE-2026-82861 @hulumi/policies versions before 1.3.2 contain a parent spoof bypass vulnerability that allows attackers to submit spoofed SecureBucket parent evidence during policy eval...	7.5 High	—	0,43%	31 Agt 2026
CVE-2026-82860 @hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equ...	9.8 Critical	—	0,54%	31 Agt 2026
CVE-2026-82859 hulumi versions before v1.3.2 contain a deployment SCP template that allows tag-on-create bypasses for hulumi:iac-role protections. Attackers can bypass intended IAM boun...	9.8 Critical	—	0,54%	31 Agt 2026
CVE-2026-82858 @hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient provenance validation, allowing untrusted reconciliation input to be treat...	9.8 Critical	—	0,29%	31 Agt 2026
CVE-2026-82857 hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e-* roles wi...	9.8 Critical	—	0,51%	31 Agt 2026
CVE-2026-82856 @hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can use ForAnyValue:St...	9.8 Critical	—	0,51%	31 Agt 2026
CVE-2026-82855 @hulumi/policies versions before 1.3.2 contain an evidence validation bypass vulnerability in Cloudflare and deployment-governance validators that allows attackers to sup...	9.8 Critical	—	0,59%	31 Agt 2026
CVE-2026-82854 Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with...	9.8 Critical	—	2,0%	31 Agt 2026
CVE-2026-82853 Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenat...	4.9 Medium	—	1,0%	31 Agt 2026
CVE-2026-82668 A security vulnerability has been detected in klaussilveira GitList 2.0.0. Affected by this vulnerability is the function getDefaultBranch of the file src/SCM/System/Git/...	7.3 High	—	2,2%	31 Agt 2026
CVE-2026-82667 A vulnerability has been found in yaojingang GEOFlow up to 2.1.0. Impacted is the function DistributionController.isValidHttpEndpoint of the file app/Services/GeoFlow/Gen...	4.7 Medium	—	0,46%	31 Agt 2026
CVE-2026-82666 A flaw has been found in yaojingang GEOFlow up to 2.1.0. This issue affects the function preview of the file app/Http/Controllers/Admin/SiteThemeEditorController.php of t...	4.7 Medium	—	0,51%	31 Agt 2026
CVE-2026-82665 A vulnerability was detected in yaojingang GEOFlow up to 2.1.0. This vulnerability affects the function unlink of the file app/Http/Controllers/Admin/ImageLibraryControll...	3.8 Low	—	0,64%	31 Agt 2026
CVE-2026-82664 A security vulnerability has been detected in yaojingang GEOFlow up to 2.1.0. This affects an unknown part of the file app/Http/Controllers/Site/HomeController.php of the...	4.3 Medium	—	0,59%	31 Agt 2026
CVE-2026-82662 Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token reques...	6.5 Medium	—	0,19%	31 Agt 2026
CVE-2026-82661 Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An atta...	5.4 Medium	—	0,26%	31 Agt 2026
CVE-2026-82660 Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or f...	5.4 Medium	—	0,26%	31 Agt 2026
CVE-2026-82659 nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files...	7.1 High	—	0,35%	31 Agt 2026
CVE-2026-81624 Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certain configur...	7.5 High	—	0,58%	31 Agt 2026
CVE-2026-19410 An Incorrect Authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-06-24 on Google Cloud Platform allows a remote attacker to...	9.4 Critical	—	0,14%	31 Agt 2026
CVE-2024-58379 nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embedded file at...	5.3 Medium	—	0,30%	31 Agt 2026
CVE-2026-82838 The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content...	6.4 Medium	—	0,40%	31 Agt 2026
CVE-2026-82631 A security flaw has been discovered in valkey-io valkey 9.1.0. The affected element is the function handleClientsBlockedOnKey of the file src/blocked.c of the component B...	2.2 Low	—	0,55%	31 Agt 2026
CVE-2026-82630 A vulnerability was identified in PowerJob up to 5.1.2. Impacted is the function MuConnectionManager.getOrCreateConnection of the file powerjob-server/powerjob-server-sta...	7.3 High	—	0,54%	31 Agt 2026
CVE-2026-82629 A vulnerability was determined in jeecgboot jeewx-boot up to 641ab52c3e1845fec39996d7794c33fb40dad1dd. This issue affects the function MyJwWebJwid3Controller.doUpload of...	4.7 Medium	—	0,43%	31 Agt 2026
CVE-2026-58301 apache shiro When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an at...	6.5 Medium	—	0,47%	31 Agt 2026
CVE-2026-82628 A vulnerability was found in Colorful iGameCenter 2.0.0.81. This vulnerability affects the function sub_11504 in the library WinRing0x64.sys of the component IOCTL Dispat...	8.8 High	—	0,16%	31 Agt 2026
CVE-2026-82625 A vulnerability has been found in code-projects Simple Inventory System 1.0. This affects an unknown part of the file /register.php of the component User Registration. Su...	4.3 Medium	—	0,47%	31 Agt 2026
CVE-2026-82624 A flaw has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file inventorymanagement.sql of the compon...	5.3 Medium	—	0,53%	31 Agt 2026
CVE-2026-82623 A vulnerability was detected in open62541 up to 1.5.5. Affected by this vulnerability is the function UA_DataValue_backend_copyRange of the file plugins/historydata/ua_hi...	5.3 Medium	—	0,70%	31 Agt 2026
CVE-2026-82622 A security vulnerability has been detected in code-projects Employee Leave Managing System 1.0. Affected is an unknown function of the file /EmpManageSys/editaction.php o...	3.5 Low	—	0,35%	31 Agt 2026
CVE-2026-77013 The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not restrict which of its handler methods a request may invoke, and performs no capability or nonce check on them, al...	5.3 Medium	—	0,30%	31 Agt 2026
CVE-2026-68951 GROWI contains an incorrect authorization vulnerability. If this vulnerability is exploited, an unauthenticated attacker could retrieve the other user's bookmark data.	6.9 Medium	—	0,33%	31 Agt 2026
CVE-2026-58574 dell powerstoreos Dell PowerStore contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with network access to the restricted management interf...	9.8 Critical	—	0,63%	31 Agt 2026
CVE-2026-53620 GROWI contains a vulnerability with an authorization bypass through user-controlled key in the bookmark folder APIs. If this vulnerability is exploited, an authenticated...	5.3 Medium	—	0,29%	31 Agt 2026
CVE-2026-40465 NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL (or redirect) parameter.	5.3 Medium	—	0,28%	31 Agt 2026
CVE-2026-40464 NSP is vulnerable to a stored XSS due to insufficient validation or encoding of user-controlled input in a workflow application. An authenticated attacker with access to...	5.4 Medium	—	0,23%	31 Agt 2026
CVE-2026-40463 WaveSuite is affected by an insufficient role-based access control vulnerability in the CPB Log Files feature. Successful exploitation allows an authenticated low-privile...	7.6 High	—	0,34%	31 Agt 2026
CVE-2026-82621 A weakness has been identified in Soarkey StudentManagement and 学生信息管理系统 up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. This impacts the function AdminDao.doGet of the f...	7.3 High	—	0,52%	31 Agt 2026
CVE-2026-82620 A security flaw has been discovered in Soarkey StudentManagement and 学生信息管理系统 up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. This affects the function CourseDao.course_r...	6.3 Medium	—	0,33%	31 Agt 2026
CVE-2026-82619 A vulnerability was identified in Systerel S2OPC up to 1.7.3. The impacted element is the function monitored_item_event_filter_treatment_bs__init_event_filter_ctx_and_res...	4.3 Medium	—	0,53%	31 Agt 2026
CVE-2026-82618 A vulnerability was determined in Systerel S2OPC up to 1.7.3. The affected element is the function set_range_matrix_on_string_array of the file src/Common/opcua_types/sop...	4.3 Medium	—	0,47%	31 Agt 2026
CVE-2026-82616 A vulnerability was found in TOTOLINK NR1800X 9.1.0u.6681_B20230703. Impacted is the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. The manipulation of the a...	9.9 Critical	—	0,85%	31 Agt 2026
CVE-2026-82615 A vulnerability has been found in itsourcecode Online Medicine Delivery System 1.0. This issue affects the function Customer::find_phone of the file /passwordrecover.php...	7.3 High	—	0,43%	31 Agt 2026
CVE-2026-82614 A flaw has been found in itsourcecode Online Medicine Delivery System 1.0. This vulnerability affects the function loadResultList of the file /index.php?q=product of the...	7.3 High	—	0,43%	31 Agt 2026
CVE-2026-82727 Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_phoenix writes the entire raw submitted param map into an exception message,...	2.3 Low	—	0,47%	31 Agt 2026
CVE-2026-82726 Permissive Regular Expression vulnerability in ash-project ash_phoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending...	6.3 Medium	—	0,52%	31 Agt 2026
CVE-2026-82725 Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_phoenix lets an attacker who controls filter form parameters filter across relationships...	2.3 Low	—	0,45%	31 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.