Katalog CVE (hal. 587)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.973 (Critical 36.402 · High 105.447 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 27 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 29.301–29.350 dari 263.973 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-79622 A weakness has been identified in dekdee adobe-xd-mcp 1.0.0. Impacted is an unknown function of the file src/parsers/xd-parser.ts of the component file-access-from-reques...	7.3 High	—	0,62%	25 Agt 2026
CVE-2026-55525 PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the web_crawl function validates only the initial URL before _crawl_with_httpx uses httpx.Client...	7.5 High	—	0,51%	25 Agt 2026
CVE-2026-79406 A security vulnerability has been detected in macrozheng mall up to 1.0.3. Affected is the function OmsCartItemServiceImpl.updateQuantity of the file /cart/update/quantit...	4.3 Medium	—	0,39%	25 Agt 2026
CVE-2026-78887 A weakness has been identified in liketrek TREK up to 3.0.22. This impacts the function validateShareTokenForAsset of the component Journey Photo Proxy. Executing a manip...	3.7 Low	—	0,46%	25 Agt 2026
CVE-2026-78886 A security flaw has been discovered in liketrek TREK up to 3.0.22. This affects an unknown function of the file server/src/nest/journey/journey-public.controller.ts of th...	3.7 Low	—	0,58%	25 Agt 2026
CVE-2026-78885 A vulnerability was identified in liketrek TREK up to 3.0.22. The impacted element is the function findOrCreateUser of the file server/src/services/oidcService.ts of the...	5.6 Medium	—	0,58%	25 Agt 2026
CVE-2026-78581 elastic kibana Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by AC...	4.2 Medium	—	0,20%	25 Agt 2026
CVE-2026-77998 Advisory Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO < 11.0.2, SAML SP Single Sign On – Login with...	10.0 Critical	—	0,60%	25 Agt 2026
CVE-2026-75803 openssl Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation i...	9.1 Critical	—	0,25%	25 Agt 2026
CVE-2026-63076 openssl Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it...	7.5 High	—	1,6%	25 Agt 2026
CVE-2026-63075 openssl Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can...	7.5 High	—	0,57%	25 Agt 2026
CVE-2026-63074 openssl Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them (for instance...	5.9 Medium	—	0,59%	25 Agt 2026
CVE-2026-63073 openssl Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to `ERR_raise_data()`. Impact summar...	9.8 Critical	—	1,2%	25 Agt 2026
CVE-2026-63072 openssl Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cle...	7.5 High	—	0,92%	25 Agt 2026
CVE-2026-57863 Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the...	8.8 High	—	0,90%	25 Agt 2026
CVE-2026-54874 openssl Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires. Impa...	7.5 High	—	0,62%	25 Agt 2026
CVE-2026-18798 openssl Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact summary: Double free leads to heap co...	7.5 High	—	1,7%	25 Agt 2026
CVE-2026-14457 openssl Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the private key (with no associated certificate) configured local...	7.5 High	—	1,2%	25 Agt 2026
CVE-2026-79673 Ech0 before 4.4.3 protects the PUT /user endpoint with the profile:read scope, a read-only scope, but allows write operations including password changes. An attacker with...	6.5 Medium	—	0,43%	25 Agt 2026
CVE-2026-79672 Ech0 before 4.4.3 fails to enforce scope-based authorization on nine comment panel admin endpoints, allowing access tokens with minimal scopes to perform full comment mod...	5.5 Medium	—	0,32%	25 Agt 2026
CVE-2026-79671 Ech0 before 4.4.3 contains a server-side request forgery vulnerability in the validateWebhookURL function (webhook_setting_service.go), which only validates literal IP ad...	5.5 Medium	—	0,31%	25 Agt 2026
CVE-2026-79670 Ech0 before 4.4.3 contains a stored cross-site scripting vulnerability in the file upload endpoint that validates Content-Type using only client-supplied headers without...	4.8 Medium	—	0,25%	25 Agt 2026
CVE-2026-79669 Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access hi...	4.3 Medium	—	0,28%	25 Agt 2026
CVE-2026-79668 Ech0 before 4.7.3 contains an authentication bypass vulnerability in the PUT /api/echo/like/:id endpoint that allows unauthenticated attackers to increment engagement met...	5.3 Medium	—	0,43%	25 Agt 2026
CVE-2026-79667 Ech0 version 4.3.4 and earlier fails to reliably enforce scoped access token (least-privilege) restrictions on several privileged admin routes. Multiple privileged endpoi...	7.6 High	—	0,32%	25 Agt 2026
CVE-2026-79666 Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated user to access system logs. Attackers with valid use...	6.5 Medium	—	0,39%	25 Agt 2026
CVE-2026-79665 Ech0 before 4.5.1 contains an authorization bypass vulnerability where session tokens skip scope validation in RequireScopes middleware, allowing logged-in non-admin user...	8.8 High	—	0,51%	25 Agt 2026
CVE-2026-79664 Ech0 before 4.7.3 fails to properly revoke access tokens created with never-expire option, allowing attackers to maintain perpetual authenticated access after token theft...	7.4 High	—	0,36%	25 Agt 2026
CVE-2026-79663 Ech0 before 4.7.3 contains a stored cross-site scripting vulnerability in the public RSS feed where tag names and markdown content are rendered without HTML escaping. Att...	4.8 Medium	—	0,25%	25 Agt 2026
CVE-2026-79662 Ech0 through 4.5.6 contains an OAuth redirect URI validation vulnerability in parseAndValidateClientRedirect (internal/service/auth/auth.go) that compares only the scheme...	8.0 High	—	0,32%	25 Agt 2026
CVE-2026-79661 Ech0 through 4.5.6 registers the PUT /api/echo/like/:id endpoint on the public router group without authentication or rate limiting. Unauthenticated attackers can increme...	6.5 Medium	—	0,43%	25 Agt 2026
CVE-2026-79660 Ech0 versions before 4.7.3 expose guest commenter email addresses through public API endpoints due to improper JSON serialization tags on the Comment model. Unauthenticat...	5.3 Medium	—	0,41%	25 Agt 2026
CVE-2026-79659 Ech0 before 4.7.3 contains a server-side request forgery vulnerability in the fetchPeerConnectInfo function that uses unvalidated HTTP requests instead of safe request me...	7.7 High	—	0,35%	25 Agt 2026
CVE-2026-79658 Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n middleware, which runs on every HTTP request. The header is...	7.5 High	—	0,51%	25 Agt 2026
CVE-2026-79657 nltk NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead of specific safe calla...	9.8 Critical	—	1,3%	25 Agt 2026
CVE-2026-78864 A vulnerability was determined in liketrek TREK up to 3.0.22. The affected element is the function journeyService.updateEntry of the file server/src/nest/journey/journey....	6.3 Medium	—	0,33%	25 Agt 2026
CVE-2026-78684 vllm vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. Unauthenticated attackers can activate Dee...	5.3 Medium	—	0,61%	25 Agt 2026
CVE-2026-77997 Joomla Extension - yootheme.com - Authenticated, privileged information disclosure in YOOtheme Pro 1.0.0-5.0.41 - A missing access check allowed users with com_template e...	5.1 Medium	—	0,39%	25 Agt 2026
CVE-2026-77996 Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41 - Lack of escaping in the location custom field lead to a XSS vector.	7.5 High	—	0,42%	25 Agt 2026
CVE-2026-77824 The Media Sweep – WordPress Media Cleaner plugin for WordPress is vulnerable to generic SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1...	4.9 Medium	—	0,51%	25 Agt 2026
CVE-2026-75971 The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and...	7.2 High	—	0,58%	25 Agt 2026
CVE-2026-75908 The Newsletters plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.17. This is due to the plugin not properly verifying th...	4.3 Medium	—	0,39%	25 Agt 2026
CVE-2026-57910 Improper authentication in the WatchGuard Agent allows an unauthenticated attacker with network access to cause the agent to execute arbitrary code with elevated privileg...	9.3 Critical	—	0,25%	25 Agt 2026
CVE-2026-57909 A path traversal vulnerability in WatchGuard Agent allows a remote, unauthenticated attacker on an adjacent network to execute arbitrary code on an affected system.	9.4 Critical	—	0,41%	25 Agt 2026
CVE-2026-19949 The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 d...	8.8 High	—	0,96%	25 Agt 2026
CVE-2026-18547 The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site...	6.4 Medium	—	0,36%	25 Agt 2026
CVE-2026-17587 The My Agile Privacy® – CMP, Cookie Consent & Privacy Tools plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.3.6. This i...	5.3 Medium	—	0,45%	25 Agt 2026
CVE-2026-79652 A flaw was found in the JWT Bearer authorization grant implementation within the keycloak-services component of Red Hat Build of Keycloak. This component handles various...	5.9 Medium	—	0,34%	25 Agt 2026
CVE-2026-78863 A vulnerability was found in liketrek TREK up to 3.0.22. Impacted is the function loginUser of the file server/src/services/authService.ts of the component Pre-2FA mfa_to...	6.3 Medium	—	0,51%	25 Agt 2026
CVE-2026-59335 Improper handling of case sensitivity (CWE-178) in the identity zone authorization check in the Identity Zone Endpoint in Cloud Foundry UAA allows a remote authenticated...	8.7 High	—	0,53%	25 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.