Katalog CVE (hal. 538)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.295 (Critical 36.348 · High 105.272 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 25 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 26.851–26.900 dari 263.295 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-82290 Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attackers can delete or modify other users' feedback by...	5.3 Medium	—	0,34%	28 Agt 2026
CVE-2026-82289 Gitingest through 0.3.1 fails to properly validate hostnames in _validate_host, accepting any host with a git., gitlab., or github. prefix regardless of known-hosts list...	7.4 High	—	0,31%	28 Agt 2026
CVE-2026-82288 Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments includ...	7.5 High	—	0,41%	28 Agt 2026
CVE-2026-82287 Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-...	8.1 High	—	0,51%	28 Agt 2026
CVE-2026-82286 gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint, allowing unauthenticated attackers to write arbitrary files to any f...	8.6 High	—	0,52%	28 Agt 2026
CVE-2026-82285 bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applie...	8.2 High	—	0,54%	28 Agt 2026
CVE-2026-82284 Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/{chat_id}/history, DELETE /chat/{chat_id}, and POST /chat/{chat_id}/question/answer endpoi...	8.1 High	—	0,30%	28 Agt 2026
CVE-2026-82283 VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated users to access other users' conversations. Attackers can...	8.1 High	—	0,30%	28 Agt 2026
CVE-2026-82282 Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe o...	8.0 High	—	0,44%	28 Agt 2026
CVE-2026-82281 Kotaemon through 0.12.0 fails to properly validate conversation ownership in select_conv, delete_conv, rename_conv, and on_set_public_conversation functions in control.py...	7.4 High	—	0,33%	28 Agt 2026
CVE-2026-82280 Quivr through 0.0.322 fails to validate ownership in prompt endpoints, allowing authenticated users to modify any prompt by identifier. Attackers with read-only access to...	7.1 High	—	0,25%	28 Agt 2026
CVE-2026-82279 HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. Attackers can...	8.1 High	—	0,33%	28 Agt 2026
CVE-2026-82278 BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow run_once endpoint that allows authenticated users to execute arbitrary Python code. At...	8.8 High	—	0,74%	28 Agt 2026
CVE-2026-82277 Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attacker...	9.8 Critical	—	0,78%	28 Agt 2026
CVE-2026-82276 StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override execute() directly instead of implementing executeWith...	5.3 Medium	—	0,38%	28 Agt 2026
CVE-2026-82275 Qwen-Agent through 0.0.34 contains a path traversal vulnerability in the document parser that fails to restrict file access to intended directories. Attackers can supply...	7.5 High	—	0,46%	28 Agt 2026
CVE-2026-82274 Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a...	4.7 Medium	—	0,28%	28 Agt 2026
CVE-2026-82273 Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId callback is omitted from conf...	6.5 Medium	—	0,38%	28 Agt 2026
CVE-2026-82272 Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible throug...	6.5 Medium	—	0,44%	28 Agt 2026
CVE-2026-82271 R2R through 3.6.5 fails to properly validate user ownership in conversation update and message handlers, allowing authenticated users to modify other users' conversations...	6.5 Medium	—	0,27%	28 Agt 2026
CVE-2026-82270 Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/* route that lacks requestValidator middleware. Attackers can set...	7.5 High	—	0,48%	28 Agt 2026
CVE-2026-82269 Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass th...	8.1 High	—	0,38%	28 Agt 2026
CVE-2026-82268 Qwen-Agent through 0.0.34 contains a server-side request forgery vulnerability in the document parsing path that treats caller-supplied paths as URLs without scheme restr...	7.5 High	—	0,35%	28 Agt 2026
CVE-2026-82267 Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/{variant} handlers....	5.4 Medium	—	0,30%	28 Agt 2026
CVE-2026-82266 Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with admin_api_require_auth defaulting to false, treating unauthenticated requests as superusers. Attackers ca...	9.8 Critical	—	0,62%	28 Agt 2026
CVE-2026-82265 Zipkin through 3.6.1 exposes Spring Boot Actuator endpoints on the tracing API port without authentication, allowing unauthenticated attackers to access sensitive informa...	6.5 Medium	—	0,45%	28 Agt 2026
CVE-2026-82264 Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry paths deserialized from snapshot files. Attackers can...	6.8 Medium	—	0,71%	28 Agt 2026
CVE-2026-82263 Logto through 1.42.0 contains a server-side request forgery vulnerability in the OIDC SSO connector creation endpoint that fails to validate the issuer URL parameter. Ten...	6.8 Medium	—	0,46%	28 Agt 2026
CVE-2026-82262 Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Te...	6.8 Medium	—	0,46%	28 Agt 2026
CVE-2026-82021 Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled MCP catalog that allows a remote attacker to execute arbitrary code by compromisi...	8.3 High	—	0,34%	28 Agt 2026
CVE-2026-82020 Hermes Agent 0.16.0 prior to 0.17.0 contains an improper path restriction vulnerability that allows attackers who can influence ingested message content to overwrite the...	6.8 Medium	—	0,44%	28 Agt 2026
CVE-2026-81849 Improper limitation of a pathname to a restricted directory in the aws:downloadContent plugin in amazon-ssm-agent before 3.3.4515.0 might allow an authenticated remote us...	8.8 High	—	0,90%	28 Agt 2026
CVE-2026-77939 Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files...	6.5 Medium	—	0,61%	28 Agt 2026
CVE-2026-77586 mongodb bi connector In MongoDB Connector for BI, MongoDB object names such as collection, field, and index names are placed into the quoted identifiers of the DDL text returned by SHOW CREAT...	8.0 High	—	0,42%	28 Agt 2026
CVE-2026-77218 PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains authenticated stack buffer overflow vulnerabilities in /cgi-bin/dispatcher.cgi. The web_login_first_post han...	4.9 Medium	—	0,57%	28 Agt 2026
CVE-2026-77217 PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains authenticated stack buffer overflow and null pointer dereference vulnerabilities in /cgi-bin/dispatcher.cgi....	4.9 Medium	—	0,60%	28 Agt 2026
CVE-2026-77184 mongodb bi connector In MongoDB Connector for BI, the description text of a collection's JSON schema validator is incorporated into the comment text of the DDL returned by SHOW CREATE stateme...	5.2 Medium	—	0,31%	28 Agt 2026
CVE-2026-76798 mongodb mongosql transition readiness tool The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report without encoding them for that out...	6.3 Medium	—	0,29%	28 Agt 2026
CVE-2026-76797 mongodb mongosql transition readiness tool The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading characters that spreadsheet applic...	6.3 Medium	—	0,35%	28 Agt 2026
CVE-2026-76794 mongodb mongosql transition readiness tool MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML. A MongoDB user with write access can introduce cr...	4.6 Medium	—	0,23%	28 Agt 2026
CVE-2026-75486 Synk Sweater Comb before 3.8.8 contains a command injection vulnerability that allows an attacker who controls the .vervet.yaml configuration file to execute arbitrary OS...	8.0 High	—	2,3%	28 Agt 2026
CVE-2026-75126 PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains multiple authenticated stack buffer overflow vulnerabilities in /cgi-bin/dispatcher.cgi. The following handl...	4.9 Medium	—	0,60%	28 Agt 2026
CVE-2026-75125 PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated null pointer dereference vulnerability in /cgi-bin/dispatcher.cgi. The web_poe_alive_rmtip_...	4.9 Medium	—	0,56%	28 Agt 2026
CVE-2026-75124 PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains a pre-authentication memory corruption vulnerability in the web management interface where the _readHttpPara...	7.5 High	—	0,71%	28 Agt 2026
CVE-2026-75123 PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The web_smtp_test_post handl...	7.2 High	—	1,5%	28 Agt 2026
CVE-2026-75122 PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/httpuploadcert.cgi. The certificate password...	7.2 High	—	0,94%	28 Agt 2026
CVE-2026-75121 PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The web_vlan_membership_edit...	7.2 High	—	1,5%	28 Agt 2026
CVE-2026-72984 microsoft edge chromium Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.	8.8 High	—	0,82%	28 Agt 2026
CVE-2026-70331 microsoft edge, microsoft edge chromium Improper neutralization of input used for llm prompting in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network.	5.4 Medium	—	0,41%	28 Agt 2026
CVE-2026-70309 microsoft edge chromium Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.	5.4 Medium	—	0,21%	28 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.