Katalog CVE (hal. 533)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.295 (Critical 36.348 · High 105.272 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 25 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 26.601–26.650 dari 263.295 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-82724 Incorrect Authorization vulnerability in ash-project ash_phoenix invokes the SubdomainHook authorization callback with a nil tenant, so tenant-scoped access checks never...	7.6 High	—	0,43%	31 Agt 2026
CVE-2026-82613 A vulnerability was detected in itsourcecode Online Medicine Delivery System 1.0. This affects the function loadResultList of the file /index.php?q=product of the compone...	7.3 High	—	0,43%	31 Agt 2026
CVE-2026-82612 A security vulnerability has been detected in itsourcecode Online Medicine Delivery System 1.0. Affected by this issue is the function loadResultList of the file /index.p...	7.3 High	—	0,43%	31 Agt 2026
CVE-2026-82611 A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is the function Customer::cusAuthentication of the file...	7.3 High	—	0,56%	31 Agt 2026
CVE-2026-82610 A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. Affected is the function Employee::employeeAuthentication of the file /rider/logi...	7.3 High	—	0,56%	31 Agt 2026
CVE-2026-82609 A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the file /pages/inv_edit.php. The manipulation of the a...	6.3 Medium	—	0,33%	31 Agt 2026
CVE-2026-82722 Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_admin lets any client that can reach the admin LiveView exhaust the BEAM atom table...	8.3 High	—	0,47%	31 Agt 2026
CVE-2026-82681 Improper Encoding or Escaping of Output vulnerability in ash-project ash_admin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin'...	2.0 Low	—	0,47%	31 Agt 2026
CVE-2026-82673 Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in ash-project ash_admin allows writing attacker-controlled bytes to arbitrary...	8.3 High	—	0,79%	31 Agt 2026
CVE-2026-82608 A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. This affects the function get_4bytes of the file src/modules/ims_registrar_scscf/cxdx_avp.c of the component...	7.4 High	—	0,41%	31 Agt 2026
CVE-2026-82607 A vulnerability was found in Cozmoslabs Profile Builder Plugin up to 3.16.1 on WordPress. The impacted element is the function wppb_ajax_simple_avatar of the file /wp-adm...	7.3 High	—	0,50%	31 Agt 2026
CVE-2026-82605 A vulnerability has been found in BareBones BBEdit up to 15.5.5. The affected element is an unknown function of the component Lasso Language Tokenizer. Such manipulation...	4.3 Medium	—	0,58%	31 Agt 2026
CVE-2026-81853 Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_admin turns a record-lookup URL into an equality oracle over sensitive attributes. AshA...	2.3 Low	—	0,45%	31 Agt 2026
CVE-2026-81852 Use of Insufficiently Random Values vulnerability in ash-project ash_admin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy prot...	2.1 Low	—	0,53%	31 Agt 2026
CVE-2026-77850 Stored Cross-site Scripting vulnerability in ash-project ash_admin executes attacker-supplied record content as script in an administrator's browser. The relationship ty...	8.4 High	—	0,48%	31 Agt 2026
CVE-2026-75757 Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ash_admin lets an attacker who controls a sibling subdomain rebind an admin's s...	8.3 High	—	0,52%	31 Agt 2026
CVE-2026-82604 A flaw has been found in BareBones BBEdit up to 15.5.5. Impacted is an unknown function of the component Java Language Module. This manipulation causes uncontrolled recur...	4.3 Medium	—	0,58%	31 Agt 2026
CVE-2026-82603 A vulnerability was detected in SeaCMS up to 13.6. This issue affects some unknown processing of the file /member.php?action=del_pl of the component Comment Cache. The ma...	5.4 Medium	—	0,44%	31 Agt 2026
CVE-2026-82602 A security vulnerability has been detected in SeaCMS up to 13.6. This vulnerability affects unknown code of the file /ass.php. The manipulation leads to authorization byp...	5.3 Medium	—	0,52%	31 Agt 2026
CVE-2026-82601 A weakness has been identified in SeaCMS up to 13.6. This affects an unknown part of the file /err.php. Executing a manipulation of the argument errtxt can lead to cross...	4.3 Medium	—	0,45%	31 Agt 2026
CVE-2026-82600 A security flaw has been discovered in SeaCMS up to 13.6. Affected by this issue is some unknown functionality of the file /zyapi.php?ac=videolist. Performing a manipulat...	7.3 High	—	0,41%	31 Agt 2026
CVE-2026-82580 Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai discloses internal error text to chat users. In AshAi.ToolLoop and AshAi...	5.3 Medium	—	0,47%	31 Agt 2026
CVE-2026-82579 Loop with Unreachable Exit Condition (Infinite Loop) vulnerability in ash-project ash_ai allows an attacker who can influence a model's output to hang the tool loop and d...	6.0 Medium	—	0,47%	31 Agt 2026
CVE-2026-82564 Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_ai allows a caller of an identity-configured tool to update or destroy records it never...	7.1 High	—	0,54%	31 Agt 2026
CVE-2026-75760 Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai discloses provider request state and credentials in a user-facing validat...	7.1 High	—	0,47%	31 Agt 2026
CVE-2026-82599 A vulnerability was identified in SeaCMS up to 13.6. Affected by this vulnerability is the function unlink of the file /member.php?action=chgpwdsubmit of the component Av...	5.4 Medium	—	0,44%	31 Agt 2026
CVE-2026-82598 A vulnerability was determined in SeaCMS up to 13.6. Affected is the function parseIf of the file search.php of the component Template Engine. This manipulation of the ar...	7.3 High	—	0,52%	31 Agt 2026
CVE-2026-82597 A vulnerability was identified in TOTOLINK NR1800X 9.1.0u.6681_B20230703. This affects the function setUssd of the file /cgi-bin/cstecgi.cgi. The manipulation of the argu...	7.4 High	—	1,8%	31 Agt 2026
CVE-2026-81315 Origin Validation Error vulnerability in ash-project ash_ai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests...	7.4 High	—	0,28%	31 Agt 2026
CVE-2026-77956 Improper Control of Generation of Code (Code Injection) vulnerability in ash-project ash_ai allows a remote, unauthenticated client to execute arbitrary Elixir code. Ash...	8.9 High	—	0,28%	31 Agt 2026
CVE-2026-82596 A vulnerability was determined in LatencyUtils up to 2.0.3. Affected by this issue is the function LatencyStats.recordDetectedPause of the file src/main/java/org/LatencyU...	3.3 Low	—	0,16%	31 Agt 2026
CVE-2026-82595 A vulnerability was found in D-Link DIR-825M 1.1.8. Affected by this vulnerability is the function sub_456CF4 of the file /boafrm/formSysCmd of the component System Comma...	7.4 High	—	4,4%	31 Agt 2026
CVE-2026-82594 A vulnerability has been found in LogNet grpc-spring-boot-starter up to 5.2.0. Affected is an unknown function of the component Annotation Processing. Such manipulation l...	5.0 Medium	—	0,31%	31 Agt 2026
CVE-2026-82593 A flaw has been found in D-Link DIR-825M 1.1.8. This impacts the function sub_41802C of the file /boafrm/formLtefotaUpgradeFibocom of the component LTE Module Firmware Up...	9.9 Critical	—	0,91%	31 Agt 2026
CVE-2026-82592 A vulnerability was detected in D-Link DIR-825M 1.1.8. This affects the function sub_46725C of the file /boafrm/formDiskFormat of the component Disk Formatting Handler En...	9.9 Critical	—	0,91%	30 Agt 2026
CVE-2026-82591 A security vulnerability has been detected in Open Asset Import Library Assimp up to 6.0.2. The impacted element is the function MD5Importer::MakeDataUnique of the file c...	5.3 Medium	—	0,17%	30 Agt 2026
CVE-2026-82590 A weakness has been identified in Open5GS up to 2.7.7. The affected element is the function smf_nudm_sdm_handle_get of the file src/smf/nudm-handler.c of the component SM...	4.3 Medium	—	0,55%	30 Agt 2026
CVE-2026-82589 A security flaw has been discovered in Open5GS up to 2.7.7. Impacted is the function amf_namf_comm_handle_n1_n2_message_transfer of the file src/amf/namf-handler.c of the...	4.3 Medium	—	0,55%	30 Agt 2026
CVE-2026-82588 A vulnerability was identified in Open5GS up to 2.7.7. This issue affects some unknown processing of the file src/amf/namf-handler.c of the component Transfer Endpoint. S...	4.3 Medium	—	0,55%	30 Agt 2026
CVE-2026-56718 AJCloud AJY IPC firmware prior to version 01.10715.11.37 contains a path traversal vulnerability in the jdbhttpd web service that allows unauthenticated remote attackers...	7.5 High	—	0,94%	30 Agt 2026
CVE-2026-82587 A vulnerability was determined in Open5GS up to 2.7.7. This vulnerability affects the function amf_namf_comm_decode_ue_mm_context_list of the file src/amf/namf-handler.c...	4.3 Medium	—	0,55%	30 Agt 2026
CVE-2026-82367 Exposure of Data Element to Wrong Session vulnerability in ash-project ash_graphql can deliver one subscription's resolved records to a different subscriber's topic. Ash...	2.3 Low	—	0,39%	30 Agt 2026
CVE-2026-81643 Incorrect Authorization vulnerability in ash-project ash_graphql delivers GraphQL subscription payloads for records a subscriber is not authorized to see. In AshGraphql....	2.3 Low	—	0,43%	30 Agt 2026
CVE-2026-81636 Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_graphql allows an unauthenticated client to bypass the configured GraphQL query-comp...	8.7 High	—	0,55%	30 Agt 2026
CVE-2026-81633 Improper Input Validation vulnerability in ash-project ash_graphql allows an unauthenticated client to crash a relay node(id: ...) query with an unhandled KeyError. AshG...	6.9 Medium	—	0,52%	30 Agt 2026
CVE-2026-80223 Incorrect Authorization vulnerability in ash-project ash_graphql allows an authenticated subscriber in one tenant to receive another tenant's records over GraphQL subscri...	7.1 High	—	0,43%	30 Agt 2026
CVE-2026-78693 Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_graphql allows a remote client to read internal field names that an applicat...	6.9 Medium	—	0,52%	30 Agt 2026
CVE-2026-82556 A vulnerability was found in Forgejo up to 15.0.4. This issue affects the function net.LookupIP of the file services/migrations/allowlist/is_migrate_allowed.go of the com...	6.3 Medium	—	0,37%	30 Agt 2026
CVE-2026-82555 A vulnerability has been found in TOTOLINK N600R 4.3.0cu.7866_B20220506. This vulnerability affects the function loginAuth of the file /web_cste/cgi-bin/cstecgi.cgi of th...	3.7 Low	—	0,66%	30 Agt 2026
CVE-2026-82554 A flaw has been found in SourceCodester Queue Management System 1.0. This affects an unknown part of the file /api/add_customer.php. This manipulation of the argument Nam...	4.3 Medium	—	0,47%	30 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.