Katalog CVE (hal. 567)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.917 (Critical 36.380 · High 105.432 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 27 Okt 2026, 12:31 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 28.301–28.350 dari 263.917 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-75330 The front-end interface /superdiamond/preview/{projectCode}/{module}/{type} of super-diamond-server <= 1.3.3 is vulnerable to SQL injection. The module parameter is direc...	9.8 Critical	—	0,47%	26 Agt 2026
CVE-2026-69129 KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 2.0.0, cluster-scoped APIs do not consistently validate per-cluster access, allowin...	5.8 Medium	—	0,41%	26 Agt 2026
CVE-2026-65956 KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 1.6.15, the SSO configuration API endpoints are exposed on the same public routing...	10.0 Critical	—	0,64%	26 Agt 2026
CVE-2026-47666 Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through custom font...	7.6 High	—	0,35%	26 Agt 2026
CVE-2026-47665 Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through file comment...	8.7 High	—	0,45%	26 Agt 2026
CVE-2026-21808 HCL BigFix Quantum Risk Analyzer generates highly detailed logging information by default which increases the risk of sensitive data leakage and can provide an attacker w...	4.1 Medium	—	0,14%	26 Agt 2026
CVE-2026-21807 HCL BigFix Quantum Risk Analyzer binary lacks several critical, industry-standard hardening protections that could allow an attacker to cause a stack-based buffer overflo...	3.9 Low	—	0,12%	26 Agt 2026
CVE-2025-62341 HCL Connections is vulnerable to server-side request forgery (SSRF) when an internal server is compromised possibly allowing an attacker to send unauthorized requests in...	3.7 Low	—	0,19%	26 Agt 2026
CVE-2026-81202 A flaw has been found in itsourcecode Payroll System 1.0. The impacted element is the function create/read/update/delete of the file ajax.php of the component CRUD Operat...	7.3 High	—	0,69%	26 Agt 2026
CVE-2026-77611 SeaweedFS is a distributed storage system for files and blobs. In versions prior to 4.40, an authenticated S3 principal with permissions scoped to a nested object key can...	7.1 High	—	0,38%	26 Agt 2026
CVE-2026-77368 SeaweedFS is a distributed storage system for files and blobs. In version 4.39, the filer's TUS resumable-upload handler checks JWT allowed_prefixes scoping only when a s...	7.6 High	—	0,38%	26 Agt 2026
CVE-2026-77317 SeaweedFS is a distributed storage system for files and blobs. In versions from 3.88 through 4.39, the SFTP server evaluates configured path permissions with a literal st...	8.1 High	—	0,36%	26 Agt 2026
CVE-2026-77298 SeaweedFS is a distributed storage system for files and blobs. In versions 4.39 and earlier, the S3 API accepts an external OIDC JWT sent directly in the Authorization he...	8.7 High	—	0,40%	26 Agt 2026
CVE-2026-75333 yx-image-recognition v1.0 is vulnerable to Path Traversal. Parameters such as dir, filePath are directly passed to new File() for file system operations without any path...	7.5 High	—	0,50%	26 Agt 2026
CVE-2026-75331 tamguo 1.5.3 is vulnerable to Unrestricted File Upload Leading to Stored XSS. The /uploadFile and /imgUpload endpoints in FileUploadController.java and UEditorController....	4.6 Medium	—	0,23%	26 Agt 2026
CVE-2026-75329 The Netty configuration distribution service (port 8283) of super-diamond-server <= 1.3.3 has no authentication mechanism. Attackers can directly obtain the full configur...	9.8 Critical	—	0,61%	26 Agt 2026
CVE-2026-75328 In DocSys-master V2.02.85, the downloadDocEx interface in src/com/DocSystem/controller/DocController.java has an arbitrary file read vulnerability:	7.5 High	—	0,50%	26 Agt 2026
CVE-2026-65930 LimeSurvey Community Edition 7.0.5 contains an authenticated stored cross-site scripting vulnerability in the replacement-fields dialog used by the administrative questio...	4.8 Medium	—	0,41%	26 Agt 2026
CVE-2026-65647 Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root.	8.7 High	—	0,74%	26 Agt 2026
CVE-2026-65646 Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arbitrary local files and escala...	9.9 Critical	—	0,70%	26 Agt 2026
CVE-2026-65642 Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customers' databa...	8.6 High	—	0,48%	26 Agt 2026
CVE-2026-65641 A vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from the service account.	9.3 Critical	—	0,54%	26 Agt 2026
CVE-2026-64632 A vulnerability allowing a low-privileged user to capture the NTLM credentials of the Reporter service account.	8.5 High	—	0,35%	26 Agt 2026
CVE-2026-63360 LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. The action...	7.4 High	—	0,46%	26 Agt 2026
CVE-2026-61617 Wings is the server control plane for the Pterodactyl game-server management panel. In versions up to and including 1.13.2, the SFTP write path does not enforce a server'...	7.7 High	—	0,44%	26 Agt 2026
CVE-2026-58070 A vulnerability that records guest OS processing credentials in cleartext in a support log on the guest, allowing a user with read access to that log to recover privilege...	6.8 Medium	—	0,15%	26 Agt 2026
CVE-2026-55182 LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection because the signal-cli path a...	8.6 High	—	1,6%	26 Agt 2026
CVE-2026-45694 LibreNMS is a network monitoring system. In versions up to and including 26.4.0, the Proxmox application view is vulnerable to reflected cross-site scripting through the...	5.4 Medium	—	0,24%	26 Agt 2026
CVE-2026-43621 Simple Machines Forum (SMF) through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerability in the profile loader that allows authenticate...	8.1 High	—	0,36%	26 Agt 2026
CVE-2026-21810 HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and a lack of binary integrity which could allow an attacker to obtain sensitive i...	4.4 Medium	—	0,11%	26 Agt 2026
CVE-2026-21809 HCL BigFix Quantum Risk Analyzer has a certain validation process that provides overly descriptive error messages when it encounters malformed input which can allow an at...	3.9 Low	—	0,12%	26 Agt 2026
CVE-2026-16809 LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the survey quota creation workflow. An authenticated low-privileged user who ca...	7.2 High	—	0,41%	26 Agt 2026
CVE-2026-79921 amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content bod...	8.9 High	—	0,55%	26 Agt 2026
CVE-2026-77573 Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, a user permitted to manage component repository...	3.5 Low	—	0,20%	26 Agt 2026
CVE-2026-77507 Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, Weblate's object-scoped RSS feeds do not apply...	5.3 Medium	—	0,43%	26 Agt 2026
CVE-2026-75415 AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java retrieves the userid from the request header as the core of the identity...	7.5 High	—	0,39%	26 Agt 2026
CVE-2026-75414 In AntFlow V2.0.0, ActivitiTest.java enables users to execute JUEL expressions without filtering the user input, which leads to a command execution vulnerability.	9.8 Critical	—	0,88%	26 Agt 2026
CVE-2026-75413 DocSys V2.02.80 is vulnerable to Any File Download. An attacker does not need to go through authentication to utilize the downloadDocEx.do interface and download any file...	7.5 High	—	0,48%	26 Agt 2026
CVE-2026-75411 JeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow module supports Groovy script execution. While the `SecurityCheck` class...	9.8 Critical	—	1,1%	26 Agt 2026
CVE-2026-75364 Comfast CF-N1-S firmware 2.6.0.1 and CF-WR630AX (2024-01-30 build), the update_interface_png SET handler in /usr/bin/webmgnt fails to sanitize the display_name parameter....	6.8 Medium	—	0,41%	26 Agt 2026
CVE-2026-75363 An issue in Comfast CF-WR630AX v.2.7.0.2 allows a remote attacker to execute arbitrary code via the /usr/bin/webmgnt, /cgi-bin/mbox-config, and the parameters timestr, di...	6.8 Medium	—	0,46%	26 Agt 2026
CVE-2026-62326 Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a user with the built-in "Edit source" role can...	6.5 Medium	—	0,50%	26 Agt 2026
CVE-2026-62249 Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, an authenticated user with access to a project...	4.3 Medium	—	0,32%	26 Agt 2026
CVE-2026-61792 Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a project administrator can read files outside...	7.7 High	—	0,59%	26 Agt 2026
CVE-2026-61790 Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a team can require its members to configure two...	4.4 Medium	—	0,40%	26 Agt 2026
CVE-2026-55228 Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, the REST API did not properly enforce the scope...	8.1 High	—	0,45%	26 Agt 2026
CVE-2026-55227 Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally scoped manner rather than restricting the lookup to...	4.3 Medium	—	0,32%	26 Agt 2026
CVE-2026-52473 An issue in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the content parameter is directly concatenated to the ProcessBuilder.	4.3 Medium	—	0,30%	26 Agt 2026
CVE-2026-52103 A zero-click remote code execution (RCE) vulnerability in the /Terminal/Notification.hs component of SimpleX Chat before v6.5 allows attackers to execute arbitrary comman...	9.8 Critical	—	1,1%	26 Agt 2026
CVE-2026-39275 Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and tags.js com...	6.1 Medium	—	0,39%	26 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.