Katalog CVE (hal. 550)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.383 (Critical 36.349 · High 105.290 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 26 Okt 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 27.451–27.500 dari 263.383 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-59292 vmware spring integration PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to ${java.io.tmpdir}/spring-integration/metadata-store.properties wi...	3.2 Low	—	0,15%	27 Agt 2026
CVE-2026-59291 vmware spring cloud function Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Functi...	5.5 Medium	—	0,25%	27 Agt 2026
CVE-2026-59289 vmware spring for graphql Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An atta...	7.5 High	—	0,46%	27 Agt 2026
CVE-2026-59288 vmware spring for graphql The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's b...	7.4 High	—	0,37%	27 Agt 2026
CVE-2026-59287 vmware spring for graphql Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL...	5.9 Medium	—	0,37%	27 Agt 2026
CVE-2026-59286 vmware spring for graphql The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious cod...	8.1 High	—	0,33%	27 Agt 2026
CVE-2026-59285 vmware spring for graphql Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. Spring for GraphQL 2.0.0 - 2.0.4	8.1 High	—	0,44%	27 Agt 2026
CVE-2026-59284 Advisory broadcom spring cloud commons There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled. Spring Cloud Commons 5.0.0 - 5.0.2 Spring Cloud Commons 4.3.0 - 4.3....	7.6 High	—	0,43%	27 Agt 2026
CVE-2026-59283 vmware spring framework Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression...	9.1 Critical	—	0,55%	27 Agt 2026
CVE-2026-59282 vmware spring framework Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Se...	7.5 High	—	0,46%	27 Agt 2026
CVE-2026-59281 vmware spring framework Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFie...	6.1 Medium	—	0,25%	27 Agt 2026
CVE-2026-59277 vmware spring security Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a given IP addr...	5.3 Medium	—	0,29%	27 Agt 2026
CVE-2026-59276 vmware spring security Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because S...	5.9 Medium	—	0,33%	27 Agt 2026
CVE-2026-55758 CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to 1.120.0, the SSRF protection in projects/core/src/main/java/...	6.9 Medium	—	0,47%	27 Agt 2026
CVE-2026-54732 libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileName value i...	6.5 Medium	—	0,42%	27 Agt 2026
CVE-2026-54721 Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in th...	8.8 High	—	0,73%	27 Agt 2026
CVE-2026-54718 Silverstripe Advanced Workflow is a highly configurable step-based workflow module. Prior to 6.4.5, 7.1.3, and 7.2.1, an attacker with permission to author the advanced w...	7.2 High	—	1,0%	27 Agt 2026
CVE-2026-54713 CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId() generates identifiers for jobs with shouldBeUnique enab...	3.7 Low	—	0,46%	27 Agt 2026
CVE-2026-54687 dangerblack n8n-node-sqlite3 n8n-nodes-sqlite3 is a node for operating a local SQLite database from n8n. Prior to 1.0.0, nodes/SqliteNode/v1/SqliteV1.node.ts exposes the db_path database file path as...	9.8 Critical	—	0,79%	27 Agt 2026
CVE-2026-53580 triliumnotes trilium Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the automatic image-download feature accepts file:// URLs in a note's img ta...	8.1 High	—	0,52%	27 Agt 2026
CVE-2026-53579 triliumnotes trilium Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text...	6.1 Medium	—	0,25%	27 Agt 2026
CVE-2026-53578 triliumnotes trilium Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text...	6.1 Medium	—	0,25%	27 Agt 2026
CVE-2026-48996 triliumnotes trilium Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter does not sanitize note titles...	6.1 Medium	—	0,25%	27 Agt 2026
CVE-2026-47727 triliumnotes trilium Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the default-on "Safe import" filter fails to neutralize the shareTemplate re...	8.8 High	—	0,50%	27 Agt 2026
CVE-2026-37198 An integer overflow in the SMF component of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted GTP packet.	7.5 High	—	0,63%	27 Agt 2026
CVE-2026-37073 Incorrect access control in /vfm-admin/ajax/sendfiles.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to send emails from the configured SMPT se...	5.3 Medium	—	0,32%	27 Agt 2026
CVE-2026-37072 Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php.	9.8 Critical	—	0,51%	27 Agt 2026
CVE-2026-37071 Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile() function in Veno File Manager Project 4.4.9 allows an authenticated attacker with 'reanme'...	9.8 Critical	—	0,51%	27 Agt 2026
CVE-2026-37070 Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any uploaded files by other users...	6.5 Medium	—	0,35%	27 Agt 2026
CVE-2026-37069 Absolute Path Disclosure in /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacke...	5.3 Medium	—	0,36%	27 Agt 2026
CVE-2026-37068 Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super adm...	8.1 High	—	0,53%	27 Agt 2026
CVE-2026-37067 Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all application logs...	5.3 Medium	—	0,34%	27 Agt 2026
CVE-2026-37066 Path traversal leading to Arbitrary File Read in /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php in Veno File Manager Project 4.4.9 allows and authenticated attack...	6.5 Medium	—	0,54%	27 Agt 2026
CVE-2026-37065 Veno File Manager Project 4.4.9 is vulnerable to Arbitrary File Deletion in /vfm-admin/index.php?section=translations&action=update&remove=.	9.1 Critical	—	0,50%	27 Agt 2026
CVE-2026-37064 User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via sending a s...	5.3 Medium	—	0,36%	27 Agt 2026
CVE-2026-37012 A vulnerability in pentestgpt/core/langfuse.py in PentestGPT 1.0.0 allows remote attackers to disclose sensitive user telemetry data via hardcoded API credentials.	7.5 High	—	0,50%	27 Agt 2026
CVE-2026-37009 A SQL injection vulnerability in NL2SQLTool in crewai-tools v1.10.2rc1 allows a remote attacker to execute arbitrary SQL commands via an unsanitized sql_query argument.	6.5 Medium	—	0,35%	27 Agt 2026
CVE-2026-37007 A vulnerability in FileWriterTool in crewai-tools <= 1.10.2rc1 allows a remote attacker to achieve code execution via malicious path traversal sequences in the filename a...	9.8 Critical	—	0,99%	27 Agt 2026
CVE-2026-37006 A vulnerability in the WebSocket endpoint of gpt-researcher v0.14.7 and before allows an unauthenticated remote attacker to achieve code execution via malicious Model Con...	9.8 Critical	—	0,89%	27 Agt 2026
CVE-2026-37004 BerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands via a craf...	9.8 Critical	—	0,80%	27 Agt 2026
CVE-2026-37003 Agno up to and including 2.5.8 is vulnerable to Remote Code Execution (RCE) via prompt injection. The PythonTools and ShellTools components pass unsanitized, LLM-generate...	9.8 Critical	—	1,3%	27 Agt 2026
CVE-2026-36102 An issue in the inviteController.js component in Bluewave Labs Checkmate <=3.3.0 allows remote authenticated administrators to escalate privileges to superadmin via the r...	7.2 High	—	0,58%	27 Agt 2026
CVE-2026-35869 A Command Injection vulnerability exists in the bs_SetLimitCli_info function within the libshare.so library of LB-link Router AC450M V4.0.0. This flaw occurs due to insuf...	9.8 Critical	—	2,3%	27 Agt 2026
CVE-2026-35868 A Command Injection vulnerability exists in the bs_SetLimitCli_info function within the libshare.so library of LB-link Router AC2100_AZ3 V1.0.4. This flaw occurs due to i...	9.8 Critical	—	2,3%	27 Agt 2026
CVE-2026-34620 adobe dng software development kit DNG SDK versions 1.7.1 2502 and earlier are affected by an out-of-bounds write vulnerability that could lead to application denial-of-service. An attacker could leverage...	5.5 Medium	—	0,22%	27 Agt 2026
CVE-2026-34616 adobe dng software development kit DNG SDK versions 1.7.1 2502 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerabil...	5.5 Medium	—	0,26%	27 Agt 2026
CVE-2026-30612 An issue in Time4 Popcorn for Windows <= 6.2.1.18 and Time4Popcorn for MacOS <= 6.2.1.17 and Time4Popcorn for Android <= 3.5.0.173 allows a remote attacker to execute arb...	9.8 Critical	—	0,42%	27 Agt 2026
CVE-2026-25250 EAZ EazyFix 12.9 allows a Security Feature Bypass related to a "Missing Cryptographic Step" associated with "Secure Boot disable."	6.0 Medium	—	0,12%	27 Agt 2026
CVE-2026-19092 The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to...	9.8 Critical	—	2,6%	27 Agt 2026
CVE-2026-18886 ServiceNow has remediated an improper access control vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated u...	10.0 Critical	—	5,0%	27 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.