Katalog CVE (hal. 588)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.973 (Critical 36.402 · High 105.447 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 27 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 29.351–29.400 dari 263.973 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-55976 apache hive Server-Side Request Forgery (SSRF) in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authenticated remote attacker with CREATE TABLE privilege to caus...	9.1 Critical	—	1,0%	25 Agt 2026
CVE-2026-53561 apache hive An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 (and later unreleased branches) on deployments usi...	7.4 High	—	0,34%	25 Agt 2026
CVE-2026-49845 apache hive SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to Hive Metastore...	9.8 Critical	—	0,89%	25 Agt 2026
CVE-2026-21758 HCL Hive is affected by an information disclosure vulnerability, which could lead to an attacker gathering sensitive information about the host environment.	3.7 Low	—	0,27%	25 Agt 2026
CVE-2026-21754 HCL Hive is affected by multiple infrastructure and network configuration vulnerabilities, which could lead to unauthorized lateral movement, container breakout, and sens...	5.4 Medium	—	0,24%	25 Agt 2026
CVE-2026-21753 HCL Hive is affected by weak software supply chain governance, which could lead to the inclusion of vulnerable, unmaintained, or malicious third-party dependencies within...	4.2 Medium	—	0,22%	25 Agt 2026
CVE-2026-12600 Denial-of-service (DoS) vulnerability in the internal JPEG2000 (JPX) decoding implementation of the Poppler fork developed by Innodata Labs. When an application processes...	8.7 High	—	0,52%	25 Agt 2026
CVE-2026-76128 The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.5....	6.4 Medium	—	0,36%	25 Agt 2026
CVE-2026-75038 UNIX symbolic link (symlink) following vulnerability in ilya-zlobintsev/LACT allows for local denial-of-service. This issue affects LACT: through 0.10.0.	6.1 Medium	—	0,16%	25 Agt 2026
CVE-2026-75037 Polkit Authentication Based on UnixProcessSubject / Peer PID in LACT on Linux allows an Authentication Bypass. This issue affects LACT through 0.10.0. Fixed by commit d04...	7.0 High	—	0,16%	25 Agt 2026
CVE-2026-49050 apache dolphinscheduler General user can mint admin access tokens via /access-tokens This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3...	8.8 High	—	0,58%	25 Agt 2026
CVE-2026-16231 hbs project hbs hbs is an Express view engine that wraps Handlebars. Its registerAsyncHelper API bypasses Handlebars' automatic HTML escaping: an async helper returns an opaque placehold...	8.1 High	—	0,40%	25 Agt 2026
CVE-2026-12878 octopus codefresh In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions.	8.8 High	—	0,42%	25 Agt 2026
CVE-2026-77146 The extension's invitation controller fails to stop processing after redirecting on invalid input (missing hash, non-existent, disabled, or deleted users), allowing an un...	8.3 High	—	0,42%	25 Agt 2026
CVE-2026-77145 The permission check for the frontend management update flow verified a different event than the one the request went on to modify. A user with frontend event management...	7.1 High	—	0,35%	25 Agt 2026
CVE-2026-77144 The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own. The acco...	7.1 High	—	0,41%	25 Agt 2026
CVE-2026-77143 The frontend topic editing flow does not verify on the server side that the requesting visitor owns the topic being modified. As a result, a visitor who knows the identif...	8.8 High	—	0,41%	25 Agt 2026
CVE-2026-77142 The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own, but the cor...	8.8 High	—	0,41%	25 Agt 2026
CVE-2026-77141 The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, but performs no ownership check...	8.8 High	—	0,41%	25 Agt 2026
CVE-2026-77140 The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that persists the change. An unauthenti...	8.7 High	—	0,41%	25 Agt 2026
CVE-2026-77139 The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An authenticated b...	6.0 Medium	—	0,44%	25 Agt 2026
CVE-2026-77138 The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize(). A remote, unauthenticated attacker can supp...	9.3 Critical	—	0,72%	25 Agt 2026
CVE-2026-77137 The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL...	7.7 High	—	0,40%	25 Agt 2026
CVE-2026-77136 The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as template source, without any s...	9.5 Critical	—	0,97%	25 Agt 2026
CVE-2026-77135 The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target, allowing any visitor with access to the Detail o...	8.2 High	—	0,41%	25 Agt 2026
CVE-2026-77134 The extension fails to require the dedicated admin confirmation token when processing an admin-approval request, so a regular user confirmation hash, obtainable by any vi...	8.3 High	—	0,41%	25 Agt 2026
CVE-2026-77133 The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configurati...	6.0 Medium	—	0,35%	25 Agt 2026
CVE-2026-77131 When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it. Exploitation requires the attacker to a...	5.3 Medium	—	0,24%	25 Agt 2026
CVE-2026-77130 The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control of a valid API key to authenticate with an expired...	5.3 Medium	—	0,35%	25 Agt 2026
CVE-2026-77129 The extension passes an editor-configurable email subject string directly into a Fluid template source without restriction. A backend user with edit access to the event p...	7.7 High	—	0,40%	25 Agt 2026
CVE-2026-77128 The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidd...	6.3 Medium	—	0,51%	25 Agt 2026
CVE-2026-77127 The extension fails to restrict a backend AJAX endpoint for inline editing to fields the current user is permitted to see or edit. An authenticated, low-privileged backen...	6.0 Medium	—	0,35%	25 Agt 2026
CVE-2026-63587 The SMS control function of IE-SR-2TX-WL-4G devices can require a password for SMS commands via the 'Enable Password Authorization' setting. The device increments a retry...	8.6 High	—	0,41%	25 Agt 2026
CVE-2026-63586 The web-based management interface uses a modified uhttpd server with CGI shell scripts. The HTTP Basic Authentication username, taken directly from the Authorization hea...	9.8 Critical	—	0,93%	25 Agt 2026
CVE-2026-56096 The extension passes the user-supplied search query parameter to Apache Solr without restricting advanced Solr query syntax such as wildcards, field selectors and range q...	6.3 Medium	—	0,43%	25 Agt 2026
CVE-2026-56095 The extension's indexer passed every field value returned by content object rendering through PHP's unserialize() function when transferring multi-value data for the SOLR...	7.7 High	—	0,32%	25 Agt 2026
CVE-2026-56094 The extension allows a request-provided additionalFilters parameter to register a named siteHash filter before the system's own siteHash filter is applied, and the query...	6.3 Medium	—	0,33%	25 Agt 2026
CVE-2026-56093 The extension's frontend detail-view document lookup does not apply the current site's siteHash filter or frontend user access filter, unlike the regular search path. A v...	6.3 Medium	—	0,31%	25 Agt 2026
CVE-2026-56092 The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the...	7.6 High	—	0,29%	25 Agt 2026
CVE-2026-17548 Missing authorization in Checkmk <2.5.0p12, <2.4.0p36, <2.3.0p50 and all 2.2.0 versions allows an authenticated user who knows the ID of a background job to view that job...	5.3 Medium	—	0,35%	25 Agt 2026
CVE-2026-78701 A flaw was found in 389-ds-base. A remote, authenticated attacker could exploit a vulnerability in the Simple Authentication and Security Layer (SASL) UNBIND process. By...	6.5 Medium	—	0,78%	25 Agt 2026
CVE-2026-78322 A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive containing a file entry with an excessively long path, file-roller's progress-li...	6.5 Medium	—	0,51%	25 Agt 2026
CVE-2026-67578 FA-50 all versions miss authentication for some configuration. An attacker with access to the vessel's internal network can manipulate the product's settings screen to a...	7.5 High	—	0,54%	25 Agt 2026
CVE-2026-66882 Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in team-alembic AshAuthentication allows reflected cross-site scripting via the confirmati...	2.1 Low	—	0,75%	25 Agt 2026
CVE-2026-65633 Improper Authentication vulnerability in team-alembic AshAuthentication allows purpose-limited JWTs to be replayed as full bearer API credentials when a resource uses sta...	7.6 High	—	0,58%	25 Agt 2026
CVE-2026-59769 FA-50 all versions contain hard-coded credentials. An attacker, who knows the credentials and has access to the vessel's internal network, can operate the settings scree...	9.1 Critical	—	0,58%	25 Agt 2026
CVE-2026-19851 A Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to gain access to user accounts created during...	7.7 High	—	0,33%	25 Agt 2026
CVE-2026-18512 The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Approved Comment Body Rendered...	6.4 Medium	—	0,41%	25 Agt 2026
CVE-2026-18328 The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the 'error_desc...	7.2 High	—	0,42%	25 Agt 2026
CVE-2026-18323 The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field (Save and Contin...	7.2 High	—	0,54%	25 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.