Katalog CVE (hal. 539)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.295 (Critical 36.348 · High 105.272 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 25 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 26.901–26.950 dari 263.295 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-66798 microsoft edge chromium Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.	4.3 Medium	—	0,79%	28 Agt 2026
CVE-2026-66324 microsoft edge chromium External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.	6.5 Medium	—	0,92%	28 Agt 2026
CVE-2026-66323 microsoft edge chromium Improper neutralization of parameter/argument delimiters in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.	5.4 Medium	—	0,41%	28 Agt 2026
CVE-2026-62904 microsoft edge chromium Incorrect authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.	5.4 Medium	—	0,39%	28 Agt 2026
CVE-2026-58616 microsoft edge chromium Concurrent execution using shared resource with improper synchronization ('race condition') in Copilot Chat (Microsoft Edge) allows an authorized attacker to disclose inf...	3.0 Low	—	0,30%	28 Agt 2026
CVE-2026-56100 SpringBlade versions from 2.7.3 up to but not including 5.0.0 contain a privilege escalation vulnerability that allows authenticated attackers to create system administra...	8.1 High	—	0,53%	28 Agt 2026
CVE-2026-55834 Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.6.0 until 2.9.0, frontend/src/routes/authorize/+page.ts reads the...	4.3 Medium	—	0,37%	28 Agt 2026
CVE-2026-55673 PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior to 7.2.2, UnixLocalCommandExecutor and WindowsLocalCommandExecutor concatenate...	7.1 High	—	0,60%	28 Agt 2026
CVE-2026-55634 Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, the class-definition import endpoint /pimcore-studio/api/class/d...	9.9 Critical	—	0,65%	28 Agt 2026
CVE-2026-55584 phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSI_ALLOWED access-control check in read_config.php trusts attacker-controll...	7.5 High	—	1,9%	28 Agt 2026
CVE-2026-55569 aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archiv...	6.6 Medium	—	0,18%	28 Agt 2026
CVE-2026-55566 Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp/projects/w...	4.3 Medium	—	0,38%	28 Agt 2026
CVE-2026-55565 Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs LikeExpression.fillCode_getValueReturn in yamcs-core/src/main/java/org/yamcs/yarch/streamsql/LikeE...	9.9 Critical	—	0,65%	28 Agt 2026
CVE-2026-55559 Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs inserts templateArgs from POST /api/instances and PATCH /api/instances/{instance} into YAML throug...	9.8 Critical	—	0,78%	28 Agt 2026
CVE-2026-55552 Yamcs is a mission control framework. Prior to 5.11.13, Yamcs StaticFileHandler.locateFile resolves an unauthenticated request path without using Path.normalize and Path....	7.5 High	—	1,7%	28 Agt 2026
CVE-2026-55549 Yamcs is a mission control framework. Prior to 5.9.4, Yamcs reflects an attacker-controlled redirect_uri parameter from GET /auth/authorize into yamcs-core/src/main/resou...	6.5 Medium	—	1,3%	28 Agt 2026
CVE-2026-55547 Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits SystemPrivilege.ControlAccess checks from IamApi.listRoles, IamApi.getRole, and IamApi.listP...	4.3 Medium	—	0,34%	28 Agt 2026
CVE-2026-55545 Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs WebSocket subscription handlers fail to enforce the privileges required by equivalent REST endpoin...	6.5 Medium	—	0,45%	28 Agt 2026
CVE-2026-55521 Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits authorization checks in IndexesApi.listPacketIndex, IndexesApi.listEventIndex, Cop1Api.disab...	8.8 High	—	0,52%	28 Agt 2026
CVE-2026-55520 Protego is a pure-Python robots.txt parser with support for modern conventions. Prior to 0.6.2, protego._urlpattern._URLPattern._prepare_pattern_for_regex translates ever...	7.1 High	—	0,51%	28 Agt 2026
CVE-2026-55511 Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL column nam...	9.1 Critical	—	0,68%	28 Agt 2026
CVE-2026-55509 WsgiDAV is a generic and extendable WebDAV server based on WSGI. Prior to 4.3.5, the sample MySQLBrowserProvider in wsgidav/samples/mysql_dav_provider.py concatenates the...	8.8 High	—	0,51%	28 Agt 2026
CVE-2026-55485 Piccolo Admin is an admin interface and content management system for Python, built on top of Piccolo. Prior to 1.14.0, piccolo_admin/endpoints.py uses superuser_validato...	8.8 High	—	0,56%	28 Agt 2026
CVE-2026-55484 ALOS HTTP is a Linux-first Go web framework and application server built around a custom networking stack. Prior to 0.0.0-20260617230736-314b6783e196, core/utils.go::sani...	7.5 High	—	0,49%	28 Agt 2026
CVE-2026-55425 Graylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the System Catalog entity titles endpoint in graylog2-server/src/main/java/o...	5.0 Medium	—	0,41%	28 Agt 2026
CVE-2026-55378 JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/pr_checker.yml places github...	9.3 Critical	—	0,85%	28 Agt 2026
CVE-2026-55248 plone.app.portlets provides portlets and a Plone-specific user interface for plone.portlets. Prior to 5.0.8, 6.0.4, and 7.0.2, a member who can add an RSS portlet can set...	9.1 Critical	—	0,44%	28 Agt 2026
CVE-2026-55247 plone.app.event provides the event content type for Plone. Prior to versions 5.2.4 and 6.0.1, the iCalendar import in src/plone/app/event/ical/importer.py accepts insuffi...	9.1 Critical	—	0,44%	28 Agt 2026
CVE-2026-55245 Bifrost is an enterprise AI gateway for routing requests to model providers. Prior to 1.5.17, the isPublicIP function in core/providers/utils/fetch.go, reached through Fe...	8.7 High	—	0,61%	28 Agt 2026
CVE-2026-55220 Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, Pimcore\Model\DataObject\ClassDefinition\Data\Hotspotimage::getD...	9.3 Critical	—	0,68%	28 Agt 2026
CVE-2026-55215 MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to versions 3.3.3, 3.4.6, and 3.5.3, when ssl is enab...	7.5 High	—	0,57%	28 Agt 2026
CVE-2026-55108 KubeVela is an open source application delivery platform. Prior to 1.9.14, from 1.10.0-alpha.1 until 1.10.9, and from 1.11.0-alpha.1 until 1.11.0-alpha.4, the Terraform r...	8.5 High	—	0,75%	28 Agt 2026
CVE-2026-55068 free5GC is an open-source implementation of the 5G core network. In 4.2.2 and earlier, the NRF RegisterNFInstance handler at PUT /nnrf-nfm/v1/nf-instances/{nfInstanceID}...	9.3 Critical	—	0,59%	28 Agt 2026
CVE-2026-55067 Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/{project}/views/{view}/buckets/{bucket} allows the request body proj...	5.0 Medium	—	0,34%	28 Agt 2026
CVE-2026-55066 Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}/tasks accepts a body supplie...	7.1 High	—	0,37%	28 Agt 2026
CVE-2026-55065 Vikunja is an open-source self-hosted task management platform. From 0.24.6 until 2.4.0, DELETE /api/v1/projects/:project/views/:view permits an authenticated user to sup...	8.1 High	—	0,50%	28 Agt 2026
CVE-2026-55064 Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shared child project can detach it...	4.3 Medium	—	0,37%	28 Agt 2026
CVE-2026-54788 dd-trace-rs provides Datadog application performance monitoring for Rust. From 0.1.0 until 0.3.3, datadog-opentelemetry/src/propagation/tracecontext.rs parses the W3C tra...	7.5 High	—	0,79%	28 Agt 2026
CVE-2026-54766 Vikunja is an open-source self-hosted task management platform. From 0.21.0 until 2.4.0, the project duplication operation in pkg/models/project_duplicate.go allows an au...	5.3 Medium	—	0,43%	28 Agt 2026
CVE-2026-54755 Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, split-royalty fields decoded in core/kapp/builtInFunctions/utils.go can contain val...	9.6 Critical	—	0,56%	28 Agt 2026
CVE-2026-54754 Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, marketplace settlement in core/kapp/market/market.go reads MarketOrderData.Referral...	9.6 Critical	—	0,43%	28 Agt 2026
CVE-2026-54746 Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. From 0.40.0 until 0.91.1, the Dispatcher gRPC service does not verify...	6.4 Medium	—	0,37%	28 Agt 2026
CVE-2026-54745 Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the Kubeflow Pipelines frontend exposes an unauthenti...	10.0 Critical	—	0,62%	28 Agt 2026
CVE-2026-51660 Incorrect access control in the getIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain IP and port filtering rules...	9.1 Critical	—	0,51%	28 Agt 2026
CVE-2026-51659 Incorrect access control in the getUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain DMZ configuration information v...	7.5 High	—	0,50%	28 Agt 2026
CVE-2026-51658 Incorrect access control in the getDmzCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain DMZ configuration information via sendi...	7.5 High	—	0,50%	28 Agt 2026
CVE-2026-51657 Incorrect access control in the getSyslogCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain syslog-related configuration via sen...	9.1 Critical	—	0,51%	28 Agt 2026
CVE-2026-51656 Incorrect access control in the getVpnPassCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain VPN pass-through and WAN ping filte...	4.3 Medium	—	0,29%	28 Agt 2026
CVE-2026-51655 Incorrect access control in the getMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain MAC filter rules via sending a...	4.3 Medium	—	0,29%	28 Agt 2026
CVE-2026-51654 Incorrect access control in the getScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain schedule or scheduled-reboot confi...	4.3 Medium	—	0,29%	28 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.