Katalog CVE (hal. 569)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.917 (Critical 36.380 · High 105.432 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 27 Okt 2026, 12:31 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 28.401–28.450 dari 263.917 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-48786 Fleet is an open-source device management platform built on osquery. In versions prior to 4.87.0, the target search endpoint (POST /api/latest/fleet/targets) returned unm...	6.5 Medium	—	0,44%	26 Agt 2026
CVE-2026-41262 Fleet is an open-source device management platform built on osquery. In versions prior to 4.85.0, the global policy read endpoint (GET /api/latest/fleet/policies/{policy_...	4.3 Medium	—	0,31%	26 Agt 2026
CVE-2026-36851 Path traversal vulnerability in UnPoller 2.33.0 password field allows arbitrary file read and network exfiltration.	7.5 High	—	0,52%	26 Agt 2026
CVE-2026-19485 A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce versions prior to 2026-04-27 on Google Cloud Platform a...	9.3 Critical	—	0,38%	26 Agt 2026
CVE-2025-61165 An arbitrary file upload vulnerability in the /v1/my_drive/batch_upload component of cohere North AI v1.1.5 allows attackers to exeute arbitrary code via uploading a craf...	9.8 Critical	—	0,65%	26 Agt 2026
CVE-2025-61164 Cohere North AI v1.1.5 was discovered to contain an information leak via the WebSocket Endpoint.	7.5 High	—	0,43%	26 Agt 2026
CVE-2025-61163 Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. This occurs via the server failing to validate the Ori...	9.8 Critical	—	0,51%	26 Agt 2026
CVE-2025-61162 Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/internal/v1/users/{{USER_ID}} end...	7.5 High	—	0,36%	26 Agt 2026
CVE-2026-76784 Multiple TP-Link Kasa smart home devices contain insufficient cryptographic protections in the local device communication protocol. An adjacent network attacker may inter...	8.7 High	—	0,20%	26 Agt 2026
CVE-2026-58474 whichllm before 0.5.16 contains a code injection vulnerability in the run and snippet commands that allows a remote attacker who controls a HuggingFace repository to achi...	8.8 High	—	0,86%	26 Agt 2026
CVE-2026-54256 Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the backend FileUpload form widget trusted an attack...	5.4 Medium	—	0,24%	26 Agt 2026
CVE-2026-47841 vmware spring security An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store. Spring Security 7.1.0 S...	7.4 High	—	0,36%	26 Agt 2026
CVE-2026-47837 vmware spring cloud config Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not...	9.8 Critical	—	0,55%	26 Agt 2026
CVE-2026-47836 Advisory vmware spring cloud config The base directory (spring.cloud.config.server.svn.basedir) used by the Spring Cloud Config Server to clone SVN repositories to is susceptible to time-of-check-time-of-us...	8.1 High	—	0,22%	26 Agt 2026
CVE-2026-32639 Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the CMS section's Theme Editor AJAX handlers did not...	6.8 Medium	—	0,46%	26 Agt 2026
CVE-2026-32593 Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the backend Filter widget is vulnerable to SQL injec...	5.9 Medium	—	0,27%	26 Agt 2026
CVE-2025-56798 Cross-Site Request Forgery (CSRF) vulnerability in Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier allows remote attackers to escalate privileges via the Un...	8.8 High	—	0,32%	26 Agt 2026
CVE-2025-29419 CTFd v3.7.6 was discovered to be vulnerable to a man-in-the-middle attack.	7.1 High	—	0,29%	26 Agt 2026
CVE-2023-42179 Bird Home Automation GmbH D1101V-F 000140 is vulnerable to Incorrect Access Control via the Key derivation process, password validation process.	9.8 Critical	—	0,51%	26 Agt 2026
CVE-2026-35445 Winter CMS is a content management system built on the Laravel PHP framework. In versions prior to 1.2.13, the backend did not validate the handler name submitted through...	7.1 High	—	0,44%	26 Agt 2026
CVE-2026-32258 Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. From 1.2.10 through 1.2.12, authenticated backend users with the backend...	8.1 High	—	0,38%	26 Agt 2026
CVE-2026-32257 Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Prior to 1.2.13, custom CSS supplied through the Brand Settings Styles f...	8.1 High	—	0,38%	26 Agt 2026
CVE-2020-15878 An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL inje...	8.8 High	—	0,60%	26 Agt 2026
CVE-2020-15876 An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL inje...	8.8 High	—	0,60%	26 Agt 2026
CVE-2020-15874 An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can execute arbitrary shell commands through a command injection in the /...	8.8 High	—	2,3%	26 Agt 2026
CVE-2026-81036 Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validation routine in crates/http/src/...	8.1 High	—	0,39%	26 Agt 2026
CVE-2026-81035 Midday allows any member of a team to delete it. The delete procedure in apps/api/src/trpc/routers/team.ts authorises the caller with the team-access helper, which return...	8.1 High	—	0,34%	26 Agt 2026
CVE-2026-81034 Netmaker disables certificate verification on the connection to the configured mail server. The sender in pro/email/smtp.go assigns a TLS configuration whose skip-verify...	6.5 Medium	—	0,26%	26 Agt 2026
CVE-2026-81033 Automatisch reveals whether an address is registered through the response to its forgot-password request. The controller at packages/backend/src/controllers/internal/api/...	5.3 Medium	—	0,48%	26 Agt 2026
CVE-2026-81032 NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service. Each daemon starts the web service defined in src/webservice/WebService.cpp, whose bin...	9.8 Critical	—	0,36%	26 Agt 2026
CVE-2026-81031 IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlew...	7.2 High	—	0,41%	26 Agt 2026
CVE-2026-81030 Mage AI does not confine the paths accepted by its browser-items API to the project directory. BrowserItemResource in mage_ai/api/resources/BrowserItemResource.py passes...	6.5 Medium	—	0,48%	26 Agt 2026
CVE-2026-81029 OpenMetadata accepts a caller-supplied post-authentication redirect target and appends the issued token to it. SamlLoginServlet reads the callback request parameter and s...	8.1 High	—	0,55%	26 Agt 2026
CVE-2026-81028 ZLMediaKit confines the downloadFile API to a configured set of root directories with a prefix comparison that does not account for directory boundaries. The configuratio...	4.9 Medium	—	0,52%	26 Agt 2026
CVE-2026-81027 one-api gates one of its two channel-pinning paths and not the other. middleware/auth.go permits a request to name a specific channel either through a suffix on the API k...	8.5 High	—	0,35%	26 Agt 2026
CVE-2026-80428 ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code...	9.8 Critical	—	4,7%	26 Agt 2026
CVE-2026-80427 bestzip builds the argument list for the system zip utility without separating options from operands. The destination archive path and the caller-supplied source paths ar...	8.4 High	—	0,21%	26 Agt 2026
CVE-2026-80426 FiftyOne renders a dataset field's description as markup. The sidebar field-information component at app/packages/core/src/components/FieldLabelAndInfo/index.tsx passes t...	7.1 High	—	0,41%	26 Agt 2026
CVE-2026-54614 DebugKit provides a debugging toolbar for CakePHP applications. Prior to 4.10.3 and 5.2.4, the DebugKit MailPreview feature in src/Controller/MailPreviewController.php ac...	4.3 Medium	—	0,54%	26 Agt 2026
CVE-2026-54606 SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.j...	8.5 High	—	0,58%	26 Agt 2026
CVE-2026-54569 SENAITE.CORE is the core framework for the SENAITE laboratory information management system. From 2.0.0 to 2.6.0, the SENAITE.CORE JSON API permits unauthenticated remote...	9.8 Critical	—	1,2%	26 Agt 2026
CVE-2026-48549 Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 contains a CSRF vulnerability in cmd.cgi. When no Cookie header is present, the double-submit cookie protection ca...	6.5 Medium	—	0,26%	26 Agt 2026
CVE-2026-48548 Nagios Core before 4.5.12 contains a cross-site request forgery vulnerability in cmd.cgi where the CSRF protection mechanism passes validation when the NagFormId cookie i...	6.5 Medium	—	0,21%	26 Agt 2026
CVE-2026-80589 In the Linux kernel, the following vulnerability has been resolved: block: stop the timeout timer when releasing a never added disk disk_release() undoes blk_mq_init_al...	9.8 Critical	—	0,37%	26 Agt 2026
CVE-2026-80588 In the Linux kernel, the following vulnerability has been resolved: mptcp: reclaim forward-allocated memory on RX path errors After commit 9db5b3cec4ec ("mptcp: borrow...	7.5 High	—	0,61%	26 Agt 2026
CVE-2026-80587 In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid combining some incoming suboptions Some MPTCP suboptions are mutually exclusive accordi...	9.8 Critical	—	0,40%	26 Agt 2026
CVE-2026-80586 In the Linux kernel, the following vulnerability has been resolved: mptcp: options: reset DSS fields in case of unexpected size A remote peer could send a malformed DSS...	9.8 Critical	—	0,40%	26 Agt 2026
CVE-2026-80585 In the Linux kernel, the following vulnerability has been resolved: mptcp: fastopen: only mark MPTFO subflows with SYN data Passive TCP Fast Open accepts a valid-cookie...	9.4 Critical	—	0,31%	26 Agt 2026
CVE-2026-80584 In the Linux kernel, the following vulnerability has been resolved: s390/qeth: validate user buffer length in SNMP and ARP query ioctls qeth_snmp_command() and qeth_l3_...	8.4 High	—	0,20%	26 Agt 2026
CVE-2026-80583 In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses The "DEC0 MODE" to "DEC7 MODE" controls are...	7.8 High	—	0,18%	26 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.