Katalog CVE (hal. 557)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.391 (Critical 36.349 · High 105.294 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 26 Okt 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 27.801–27.850 dari 263.391 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-63360 LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. The action...	7.4 High	—	0,46%	26 Agt 2026
CVE-2026-61617 Wings is the server control plane for the Pterodactyl game-server management panel. In versions up to and including 1.13.2, the SFTP write path does not enforce a server'...	7.7 High	—	0,44%	26 Agt 2026
CVE-2026-58070 A vulnerability that records guest OS processing credentials in cleartext in a support log on the guest, allowing a user with read access to that log to recover privilege...	6.8 Medium	—	0,15%	26 Agt 2026
CVE-2026-55182 LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection because the signal-cli path a...	8.6 High	—	1,6%	26 Agt 2026
CVE-2026-45694 LibreNMS is a network monitoring system. In versions up to and including 26.4.0, the Proxmox application view is vulnerable to reflected cross-site scripting through the...	5.4 Medium	—	0,24%	26 Agt 2026
CVE-2026-43621 Simple Machines Forum (SMF) through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerability in the profile loader that allows authenticate...	8.1 High	—	0,36%	26 Agt 2026
CVE-2026-21810 HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and a lack of binary integrity which could allow an attacker to obtain sensitive i...	4.4 Medium	—	0,11%	26 Agt 2026
CVE-2026-21809 HCL BigFix Quantum Risk Analyzer has a certain validation process that provides overly descriptive error messages when it encounters malformed input which can allow an at...	3.9 Low	—	0,12%	26 Agt 2026
CVE-2026-16809 LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the survey quota creation workflow. An authenticated low-privileged user who ca...	7.2 High	—	0,41%	26 Agt 2026
CVE-2026-79921 amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content bod...	8.9 High	—	0,55%	26 Agt 2026
CVE-2026-77573 Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, a user permitted to manage component repository...	3.5 Low	—	0,20%	26 Agt 2026
CVE-2026-77507 Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, Weblate's object-scoped RSS feeds do not apply...	5.3 Medium	—	0,43%	26 Agt 2026
CVE-2026-75415 AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java retrieves the userid from the request header as the core of the identity...	7.5 High	—	0,39%	26 Agt 2026
CVE-2026-75414 In AntFlow V2.0.0, ActivitiTest.java enables users to execute JUEL expressions without filtering the user input, which leads to a command execution vulnerability.	9.8 Critical	—	0,88%	26 Agt 2026
CVE-2026-75413 DocSys V2.02.80 is vulnerable to Any File Download. An attacker does not need to go through authentication to utilize the downloadDocEx.do interface and download any file...	7.5 High	—	0,48%	26 Agt 2026
CVE-2026-75411 JeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow module supports Groovy script execution. While the `SecurityCheck` class...	9.8 Critical	—	1,1%	26 Agt 2026
CVE-2026-75364 Comfast CF-N1-S firmware 2.6.0.1 and CF-WR630AX (2024-01-30 build), the update_interface_png SET handler in /usr/bin/webmgnt fails to sanitize the display_name parameter....	6.8 Medium	—	0,41%	26 Agt 2026
CVE-2026-75363 An issue in Comfast CF-WR630AX v.2.7.0.2 allows a remote attacker to execute arbitrary code via the /usr/bin/webmgnt, /cgi-bin/mbox-config, and the parameters timestr, di...	6.8 Medium	—	0,46%	26 Agt 2026
CVE-2026-62326 Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a user with the built-in "Edit source" role can...	6.5 Medium	—	0,50%	26 Agt 2026
CVE-2026-62249 Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, an authenticated user with access to a project...	4.3 Medium	—	0,32%	26 Agt 2026
CVE-2026-61792 Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a project administrator can read files outside...	7.7 High	—	0,59%	26 Agt 2026
CVE-2026-61790 Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a team can require its members to configure two...	4.4 Medium	—	0,40%	26 Agt 2026
CVE-2026-55228 Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, the REST API did not properly enforce the scope...	8.1 High	—	0,45%	26 Agt 2026
CVE-2026-55227 Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally scoped manner rather than restricting the lookup to...	4.3 Medium	—	0,32%	26 Agt 2026
CVE-2026-52473 An issue in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the content parameter is directly concatenated to the ProcessBuilder.	4.3 Medium	—	0,30%	26 Agt 2026
CVE-2026-52103 A zero-click remote code execution (RCE) vulnerability in the /Terminal/Notification.hs component of SimpleX Chat before v6.5 allows attackers to execute arbitrary comman...	9.8 Critical	—	1,1%	26 Agt 2026
CVE-2026-39275 Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and tags.js com...	6.1 Medium	—	0,39%	26 Agt 2026
CVE-2026-15973 LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the Survey Menu Entries administration page. An authenticated user with the glo...	8.4 High	—	0,44%	26 Agt 2026
CVE-2025-61480 An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via spoofed TCP FIN p...	7.5 High	—	0,18%	26 Agt 2026
CVE-2025-61479 An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via the SPC Connect P...	7.5 High	—	0,43%	26 Agt 2026
CVE-2025-61478 An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via Spoofed SYN packe...	7.5 High	—	0,46%	26 Agt 2026
CVE-2025-51679 An issue was discovered in openRISC OR1200 commit 83ac6b. A mismatch between the RTL and netlist can lead to unexpected behavior.	9.1 Critical	—	0,63%	26 Agt 2026
CVE-2025-51675 An issue was discovered in openRISC OR1200 commit 83ac6b. An inaccurate update of program counter (PC) values when SPR changes can lead to a Denial of Service (DoS).	7.5 High	—	0,46%	26 Agt 2026
CVE-2026-79939 dell powerprotect cyber recovery Dell PowerProtect Cyber Recovery, versions Prior to 20.3, contain an UNIX Symbolic Link (Symlink) Following vulnerability. A low privileged attacker with local access cou...	7.8 High	—	0,17%	26 Agt 2026
CVE-2026-79938 dell powerprotect cyber recovery Dell PowerProtect Cyber Recovery, versions prior to 20.3, contain an Improper Authentication vulnerability. A low privileged attacker with remote access could potentially...	8.8 High	—	0,46%	26 Agt 2026
CVE-2026-77652 A heap-based buffer overflow vulnerability exists in the Dia diagram editor WPG file format importer. In plug-ins/wpg/wpg-import.c, the WPG import renderer allocates a f...	7.8 High	—	0,21%	26 Agt 2026
CVE-2026-77508 Weblate is a web based localization tool. Prior to 2026.8, an authenticated user can change the account's primary email through PUT or PATCH requests to /api/users/{usern...	3.5 Low	—	0,26%	26 Agt 2026
CVE-2026-75601 Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics features enab...	4.3 Medium	—	0,39%	26 Agt 2026
CVE-2026-75334 The report module in the backend of smart-web2 v1.3.1 is vulnerable to arbitrary SQL execution. The sqlResource.sql parameter is stored in the t_report_sql_resource table...	9.8 Critical	—	0,70%	26 Agt 2026
CVE-2026-75327 In DocSys-master V2.02.85, the uploadMarkdownPic interface in src/com/DocSystem/controller/DocController.java has an arbitrary file upload vulnerability:	9.8 Critical	—	0,52%	26 Agt 2026
CVE-2026-74774 dell powerprotect one Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potenti...	7.5 High	—	0,22%	26 Agt 2026
CVE-2026-74771 dell powerprotect one Dell PowerProtect One, versions 20.1.0.0 and below, contain an Authorization Bypass Through User-Controlled Key vulnerability. A low privileged attacker with remote acces...	6.5 Medium	—	0,31%	26 Agt 2026
CVE-2026-74770 dell powerprotect one Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A...	8.8 High	—	2,0%	26 Agt 2026
CVE-2026-71172 dell cloud disaster recovery Dell Cloud Disaster Recovery, versions 20.2 and prior, contain a Server-Side Request Forgery (SSRF) vulnerability. A low privileged attacker with remote access could pote...	4.3 Medium	—	0,27%	26 Agt 2026
CVE-2026-71054 Vulnerability in Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u511. Easily exploitable vulnerability allows unauthenticated...	6.5 Medium	—	0,37%	26 Agt 2026
CVE-2026-68863 dell powerprotect one Dell PowerProtect One, versions 20.1.0.0 and below, contain a Stack-based Buffer Overflow vulnerability. An unauthenticated attacker with remote access could potentially...	7.5 High	—	0,48%	26 Agt 2026
CVE-2026-68861 dell powerprotect one Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A...	8.8 High	—	1,7%	26 Agt 2026
CVE-2026-68000 The front-end interface /cms/category/list of MCMS <=6.2.0 is vulnerable to SQL injection. The size parameter is directly concatenated into the LIMIT clause of SQL throug...	9.8 Critical	—	0,50%	26 Agt 2026
CVE-2026-67275 dell powerprotect one Dell PowerProtect One, versions 20.1.0.0 and below, contain a Reliance on Insufficiently Trustworthy Component vulnerability. An unauthenticated attacker with remote acce...	6.5 Medium	—	0,30%	26 Agt 2026
CVE-2026-66003 Frappe is a full-stack web application framework written in Python and JavaScript. Prior to version 15.115.0, an access control bypass in the REST API allows a user to re...	7.1 High	—	0,42%	26 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.