Katalog CVE (hal. 551)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.383 (Critical 36.349 · High 105.290 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 26 Okt 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 27.501–27.550 dari 263.383 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-18885 ServiceNow has remediated a code injection vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in ce...	10.0 Critical	—	7,2%	27 Agt 2026
CVE-2026-18374 Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result i...	4.9 Medium	—	0,14%	27 Agt 2026
CVE-2026-10036 SpeechBrain before 1.1.1 contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary code by supplying a crafted CKPT.yaml checkpoint me...	8.8 High	—	0,68%	27 Agt 2026
CVE-2026-81827 Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Email(email). That does not perform WTForms field validation; it merely...	6.9 Medium	—	0,43%	27 Agt 2026
CVE-2026-81826 Affected versions of Flowintel do not revoke existing authenticated sessions when a user’s password is changed. This means that if an attacker already possesses a valid...	9.1 Critical	—	0,41%	27 Agt 2026
CVE-2026-81820 Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as: * object UUID; * object name; * attribut...	5.1 Medium	—	0,39%	27 Agt 2026
CVE-2026-81819 Affected versions of Flowintel expose the /my_assignment/user API endpoint to any authenticated API user. The endpoint accepts a user_id parameter identifying the user wh...	5.3 Medium	—	0,47%	27 Agt 2026
CVE-2026-81818 Affected versions of Flowintel contain an authorization flaw in the administrative user-edit API. The existing authorization check correctly prevented an organization a...	8.6 High	—	0,39%	27 Agt 2026
CVE-2026-81817 Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints. The routes generall...	7.2 High	—	0,35%	27 Agt 2026
CVE-2026-81735 startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was given, so startSseAndStreamableHttpMcpServer bound...	10.0 Critical	—	0,78%	27 Agt 2026
CVE-2026-81727 nltk NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incr_download methods that allows attackers to...	7.1 High	—	0,19%	27 Agt 2026
CVE-2026-81726 nltk NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths...	7.0 High	—	0,34%	27 Agt 2026
CVE-2026-81725 nltk NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplyi...	3.7 Low	—	0,37%	27 Agt 2026
CVE-2026-81724 nltk NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial of service...	5.3 Medium	—	0,46%	27 Agt 2026
CVE-2026-81723 NLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView._read_xml_fragment() that rescans accumulated XML fragments on every 1 KiB b...	3.7 Low	—	0,28%	27 Agt 2026
CVE-2026-81722 nltk nltk PorterStemmer in versions <= 3.10.2 (fixed in 3.10.3) contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem(). The _is_consonant() h...	7.5 High	—	0,52%	27 Agt 2026
CVE-2026-81721 Advisory jahlives openssl encrypt openssl_encrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allowing attackers to trigger unbounded memory allocat...	7.5 High	—	0,58%	27 Agt 2026
CVE-2026-81720 Advisory jahlives openssl encrypt openssl_encrypt before 1.4.9 fails to validate the memory_cost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory conditions duri...	6.2 Medium	—	0,19%	27 Agt 2026
CVE-2026-81719 Advisory jahlives openssl encrypt openssl_encrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an unsigned/unverifiable...	7.8 High	—	0,44%	27 Agt 2026
CVE-2026-81718 Advisory openssl_encrypt versions before 1.4.9 use under-parameterized PBKDF2-HMAC-SHA256 with only 100,000 iterations to protect PQC keyfile private keys and 10,000 iterations fo...	7.5 High	—	0,17%	27 Agt 2026
CVE-2026-81717 Advisory jahlives openssl encrypt openssl_encrypt (pip package openssl-encrypt) before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable drive as unt...	3.5 Low	—	0,12%	27 Agt 2026
CVE-2026-81716 Advisory jahlives openssl encrypt openssl_encrypt (pip: openssl-encrypt) versions before 1.4.9 contain a path traversal flaw in PluginSandbox._is_safe_path, which authorized file access using a bare strin...	5.2 Medium	—	0,26%	27 Agt 2026
CVE-2026-81715 Advisory jahlives openssl encrypt openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the...	3.3 Low	—	0,26%	27 Agt 2026
CVE-2026-81714 Advisory jahlives openssl encrypt openssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use suffix-tolerant fingerprint matching in enroll_trust_key when binding a plugin-signing trust anchor. An opera...	7.0 High	—	0,20%	27 Agt 2026
CVE-2026-81707 Advisory openssl_encrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inject ANSI escape sequences that forge the fingerpri...	9.8 Critical	—	0,59%	27 Agt 2026
CVE-2026-81706 Advisory jahlives openssl encrypt openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed contact ent...	6.8 Medium	—	0,18%	27 Agt 2026
CVE-2026-81705 Advisory jahlives openssl encrypt openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings (e.g. -apHunter2)...	7.5 High	—	0,44%	27 Agt 2026
CVE-2026-81704 Advisory jahlives openssl encrypt openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of...	7.5 High	—	0,27%	27 Agt 2026
CVE-2026-81703 Advisory jahlives openssl encrypt openssl_encrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with unencrypte...	5.5 Medium	—	0,22%	27 Agt 2026
CVE-2026-81702 Advisory jahlives openssl encrypt openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in iden...	9.8 Critical	—	0,19%	27 Agt 2026
CVE-2026-81701 Advisory jahlives openssl encrypt openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdire...	9.8 Critical	—	0,43%	27 Agt 2026
CVE-2026-81700 Advisory jahlives openssl encrypt openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by only checking...	9.8 Critical	—	0,35%	27 Agt 2026
CVE-2026-81699 Advisory jahlives openssl encrypt openssl_encrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory and CPU exh...	7.5 High	—	0,51%	27 Agt 2026
CVE-2026-81698 Advisory jahlives openssl encrypt openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields wi...	8.8 High	—	0,43%	27 Agt 2026
CVE-2026-81697 Advisory openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 contain a CWD-relative configuration file resolution flaw in crypt_settings.py, where CONFIG_FILE (origina...	5.5 Medium	—	0,21%	27 Agt 2026
CVE-2026-81696 Advisory jahlives openssl encrypt openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files conta...	3.3 Low	—	0,25%	27 Agt 2026
CVE-2026-81695 Advisory jahlives openssl encrypt openssl_encrypt versions before 1.4.9 fail to escape attacker-controlled key_id values printed to stderr during decrypt auto-detection. Attackers can craft encrypted file...	3.3 Low	—	0,25%	27 Agt 2026
CVE-2026-81694 Advisory jahlives openssl encrypt openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize filenames read from untrusted drive data (outside the AES-GCM authenticated manifest) before printing t...	3.3 Low	—	0,25%	27 Agt 2026
CVE-2026-81693 Advisory jahlives openssl encrypt openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely la...	7.5 High	—	0,49%	27 Agt 2026
CVE-2026-81692 Advisory openssl_encrypt (pip: openssl-encrypt) versions 1.4.8 and earlier fail to validate the 36-bit STREAMINFO total_samples field of FLAC files before using it to size an allo...	7.5 High	—	0,49%	27 Agt 2026
CVE-2026-81691 Advisory jahlives openssl encrypt openssl_encrypt versions before 1.4.9 fail to validate server URLs in login and register_with_email functions, accepting unencrypted http:// URLs and unconfigured hosts....	7.5 High	—	0,27%	27 Agt 2026
CVE-2026-81690 Advisory jahlives openssl encrypt openssl-encrypt (pip package) before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. The scan enumerated the drive with rglob(), w...	7.3 High	—	0,71%	27 Agt 2026
CVE-2026-81689 Advisory jahlives openssl encrypt openssl_encrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of the password, allowing identical keys across all use...	7.5 High	—	0,27%	27 Agt 2026
CVE-2026-81688 Advisory jahlives openssl encrypt openssl_encrypt versions before 1.4.9 store an unkeyed SHA-256 hash of the plaintext in the cleartext file header metadata. Attackers can read this hash without the passw...	7.5 High	—	0,27%	27 Agt 2026
CVE-2026-81687 Advisory openssl_encrypt versions before 1.4.9 fail to enforce a time ceiling on key derivation function iteration counts specified in file metadata. Attackers can craft files wit...	5.5 Medium	—	0,29%	27 Agt 2026
CVE-2026-81686 Advisory jahlives openssl encrypt openssl_encrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization chec...	5.5 Medium	—	0,14%	27 Agt 2026
CVE-2026-81685 Advisory jahlives openssl encrypt openssl_encrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI, allowing attackers to inject control characters and line separators into...	3.3 Low	—	0,25%	27 Agt 2026
CVE-2026-81684 Advisory jahlives openssl encrypt In openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8, the desktop GUI passes the steganography password to the CLI child process on the command line via the...	6.2 Medium	—	0,17%	27 Agt 2026
CVE-2026-81683 Advisory jahlives openssl encrypt openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable (0644) SharedPreferences fi...	5.5 Medium	—	0,07%	27 Agt 2026
CVE-2026-81682 Advisory openssl_encrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI that writes decrypted plaintext with world-readable default pe...	6.2 Medium	—	0,16%	27 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.