Katalog CVE (hal. 534)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.295 (Critical 36.348 · High 105.272 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 25 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 26.651–26.700 dari 263.295 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-81322 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ash_cloak allows anyone with access to logs, error trackers, or crash reports, or...	2.1 Low	—	0,12%	30 Agt 2026
CVE-2026-81319 Deserialization of Untrusted Data vulnerability in ash-project ash_cloak allows an attacker who can influence the bytes of an encrypted column to crash the BEAM node, by...	5.9 Medium	—	0,37%	30 Agt 2026
CVE-2026-82553 A vulnerability was detected in sambitraj Student Management System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. Affected by this issue is the function mysqli_query of...	6.3 Medium	—	0,35%	30 Agt 2026
CVE-2026-82552 A security vulnerability has been detected in Linux Foundation Magma 1.9.0. Affected by this vulnerability is an unknown functionality of the file tasks/ngap/ngap_amf.c o...	4.3 Medium	—	0,52%	30 Agt 2026
CVE-2026-82551 A weakness has been identified in Linux Foundation Magma 1.9.0. Affected is an unknown function of the file ngap_amf_handlers.c of the component NGSetup Handler. Executin...	5.3 Medium	—	0,51%	30 Agt 2026
CVE-2026-82550 A security flaw has been discovered in Linux Foundation Magma 1.9.0. This impacts an unknown function of the component NGSetupRequest Handler. Performing a manipulation o...	5.3 Medium	—	0,70%	30 Agt 2026
CVE-2026-82549 A vulnerability was identified in Linux Foundation Magma 1.9.0. This affects an unknown function of the component SecurityModeComplete Handler. Such manipulation leads to...	8.3 High	—	0,26%	30 Agt 2026
CVE-2026-78699 Unchecked Return Value vulnerability in ash-project ash_postgres allows a user who can drive a tenant rename to a name that collides with an existing tenant's schema to h...	7.2 High	—	0,16%	30 Agt 2026
CVE-2026-82658 Admidio versions before 5.0.12 contain a broken access control vulnerability in profile_function.php that allows authenticated low-privilege users to read another user's...	4.3 Medium	—	0,31%	30 Agt 2026
CVE-2026-82657 Admidio before 5.0.12 fails to enforce login-only module restrictions in RSS feed endpoints for forum and announcements modules. Unauthenticated attackers can retrieve fo...	7.5 High	—	0,45%	30 Agt 2026
CVE-2026-82656 Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated users with album-creation rights to include path trave...	2.6 Low	—	0,44%	30 Agt 2026
CVE-2026-82655 Admidio before 5.0.12 contains a blind SQL injection vulnerability in the relation_type_list parameter of lists_show.php that allows unauthenticated attackers to execute...	7.5 High	—	0,56%	30 Agt 2026
CVE-2026-82654 SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink, and breadcrumb rendering functions. Attackers can set a block's name t...	8.9 High	—	0,37%	30 Agt 2026
CVE-2026-82653 SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog() where unescaped package names and notebook names are interpolated directly in...	8.9 High	—	0,37%	30 Agt 2026
CVE-2026-82652 SiYuan before v3.8.1 fails to filter invisible-tier content from SQL embed blocks, attribute-view keys, and attribute-view backlinks in publish mode. Anonymous readers ca...	5.3 Medium	—	0,34%	30 Agt 2026
CVE-2026-82651 SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard (introduced in GHSA-c8r8-95hg-mp34) to the /history/path and /repo/diff/path endpoints in kernel/server...	4.9 Medium	—	0,48%	30 Agt 2026
CVE-2026-82650 SiYuan 3.8.0 contains a path traversal / sensitive file exposure vulnerability in the RenderTemplate function (kernel/model/template.go), reachable via the POST /api/temp...	4.4 Medium	—	0,35%	30 Agt 2026
CVE-2026-82649 SiYuan Windows installer before version 3.8.1 (affected versions >= 2.0.14) contains an uncontrolled search path element vulnerability in its NSIS installer, which invoke...	7.0 High	—	0,17%	30 Agt 2026
CVE-2026-82648 WWBN AVideo contains a server-side request forgery filter bypass vulnerability in the isSSRFSafeURL function that fails to normalize NAT64 addresses written in hexadecima...	7.1 High	—	0,32%	30 Agt 2026
CVE-2026-82647 WWBN AVideo contains a cross-site request forgery vulnerability in sendEmail.json.php that allows authenticated administrators to send mail from the site's contact addres...	6.1 Medium	—	0,15%	30 Agt 2026
CVE-2026-82646 WWBN AVideo contains an unauthenticated reflected cross-site scripting vulnerability in the url2Embed.json.php endpoint that allows attackers to inject malicious scripts...	6.1 Medium	—	0,26%	30 Agt 2026
CVE-2026-82645 AVideo (current commit e01e41ecc and earlier) exposes stream credentials through the plugin/Live/view/Live_restreams/getLiveKey.json.php endpoint. Supplying a 'token' req...	8.6 High	—	0,20%	30 Agt 2026
CVE-2026-82644 WWBN AVideo (current e01e41ecc and earlier) contains a brute-force rate limiting bypass in enforceRateLimit(), which protects login.json.php and 13 other endpoints. The f...	7.5 High	—	0,45%	30 Agt 2026
CVE-2026-82643 WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php that accepts credentials over GET without rate limiti...	6.5 Medium	—	0,35%	30 Agt 2026
CVE-2026-82548 A vulnerability was determined in Linux Foundation Magma 1.9.0. The impacted element is an unknown function of the component InitialUEMessage Handler. This manipulation c...	5.3 Medium	—	0,53%	30 Agt 2026
CVE-2026-82547 A vulnerability was found in Linux Foundation Magma 1.9.0. The affected element is an unknown function of the file tasks/amf/amf_fsm.cpp of the component Registration Com...	6.5 Medium	—	0,76%	30 Agt 2026
CVE-2026-82545 A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/sup_searchfrm.php. The manipulation of t...	6.3 Medium	—	0,33%	30 Agt 2026
CVE-2026-82642 Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade onl...	8.8 High	—	0,67%	30 Agt 2026
CVE-2026-82641 Keploy versions 3.1.0 through 3.6.25, fixed in 3.6.26, bind the agent control-plane HTTP server to all interfaces without authentication, exposing endpoints that stream T...	8.6 High	—	0,60%	30 Agt 2026
CVE-2026-82640 browser-use web-ui versions 2.0.0 through 3.0.0 write configured LLM API keys to disk in cleartext without encryption or access restrictions. Attackers with read access t...	5.5 Medium	—	0,07%	30 Agt 2026
CVE-2026-82639 NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint that allows attackers to obtain the server's OpenAI AP...	7.5 High	—	0,51%	30 Agt 2026
CVE-2026-82638 jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthenticated attackers to perform server-side request forgery. Attackers c...	7.5 High	—	0,50%	30 Agt 2026
CVE-2026-82637 browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in run_agent_task, allowing attackers to create directories at arbitrary locations...	5.3 Medium	—	0,41%	30 Agt 2026
CVE-2026-82636 Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qube, because the "system" libra...	7.9 High	—	1,9%	30 Agt 2026
CVE-2026-82544 A flaw has been found in wger-project wger up to 2.6.0-alpha2. This issue affects the function reset_user_password of the file wger/gym/views/gym.py of the component Pass...	4.3 Medium	—	0,24%	30 Agt 2026
CVE-2026-82635 faberon pake Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri command onto the user's Downloads directory with no sanitization. A filename contain...	8.8 High	—	0,63%	30 Agt 2026
CVE-2026-82634 Frappe Framework development builds contain an authorization flaw in the render_jinja_template endpoint that allows low-privileged users to render arbitrary Jinja templat...	6.5 Medium	—	0,42%	30 Agt 2026
CVE-2026-82633 Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API endpoint, allowing authenticated users to retrieve...	4.3 Medium	—	0,34%	30 Agt 2026
CVE-2026-82543 A vulnerability was detected in vastsa FileCodeBox up to 2.3. This vulnerability affects the function update_file_usage of the file apps/base/views.py of the component Pi...	7.3 High	—	0,50%	30 Agt 2026
CVE-2026-82542 A weakness has been identified in Tenda HG10 300001138. Affected by this issue is the function formIPv6Routing of the file /boaform/admin/formIPv6Routing of the component...	10.0 Critical	—	1,1%	30 Agt 2026
CVE-2026-82541 A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/sup_edit...	6.3 Medium	—	0,33%	30 Agt 2026
CVE-2026-82540 A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/cust_searchfrm.php. The manipulation of...	6.3 Medium	—	0,33%	30 Agt 2026
CVE-2026-81318 Incorrect Authorization vulnerability in ash-project ash_sql allows a caller in a schema-based multitenant application to receive aggregate values computed from another t...	2.1 Low	—	0,17%	30 Agt 2026
CVE-2026-81316 Incorrect Authorization vulnerability in ash-project ash_sql allows a caller to receive an aggregate value computed over rows a more restrictive filter should have exclud...	2.1 Low	—	0,17%	30 Agt 2026
CVE-2026-80227 Incorrect Comparison vulnerability in ash-project ash_sql allows a user to pad a string field with tab, newline, carriage-return, or form-feed characters and pass a trimm...	2.1 Low	—	0,37%	30 Agt 2026
CVE-2026-78691 Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash_sql allows a user who supplies a search term to contains/2, string_starts...	2.1 Low	—	0,20%	30 Agt 2026
CVE-2026-78228 Uncontrolled Recursion vulnerability in ash-project ash_oban allows a user who can drive a trigger's on_error action to fail on the final attempt to exhaust worker CPU an...	5.9 Medium	—	0,18%	30 Agt 2026
CVE-2026-78038 Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash_oban allows a user whose input reaches the :args option of...	5.9 Medium	—	0,38%	30 Agt 2026
CVE-2026-77454 Incorrect Authorization vulnerability in ash-project ash_sql allows a caller to bypass a scoping or authorization filter expressed as exists/2 over a relationship that de...	5.9 Medium	—	0,18%	30 Agt 2026
CVE-2026-82539 A vulnerability was determined in TOTOLINK A720R 4.1.5cu.630_B20250509. This impacts the function setMacFilterRules of the file cstecgi.cgi of the component MAC Filtering...	9.1 Critical	—	0,83%	30 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.