Katalog CVE (hal. 591)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.973 (Critical 36.402 · High 105.447 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 27 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 29.501–29.550 dari 263.973 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-75554 Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packa...	2.3 Low	—	0,43%	24 Agt 2026
CVE-2026-75542 Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's priv...	8.3 High	—	0,46%	24 Agt 2026
CVE-2026-75464 OneNav 1.2.4 contains an authenticated arbitrary file deletion vulnerability via import_link().	8.1 High	—	0,46%	24 Agt 2026
CVE-2026-5006 A vulnerability was identified in HashiCorp Vault and Vault Enterprise (“Vault”) such that an authenticated attacker may manipulate an identity value referenced by a temp...	6.8 Medium	—	0,28%	24 Agt 2026
CVE-2026-56136 tuxera ntfs-3g In NTFS-3G through 2026.2.25, an out-of-bounds read exists in ntfs_ir_nill() in libntfs-3g/index.c that allows an attacker to read possibly confidential information in an...	4.7 Medium	—	0,12%	24 Agt 2026
CVE-2026-56135 tuxera ntfs-3g In NTFS-3G through 2026.2.25, a heap-based buffer overflow exists in the function build_inherited_id() in libntfs-3g/security.c that allows an attacker to corrupt heap me...	7.4 High	—	0,14%	24 Agt 2026
CVE-2026-55468 Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pag...	4.3 Medium	—	0,34%	24 Agt 2026
CVE-2026-52492 An integer overflow in the libtiff rgb2ycbcr utility's cvtRaster() function when computing strip buffer sizes can result in an undersized heap allocation and subsequent h...	7.8 High	—	0,19%	24 Agt 2026
CVE-2026-52490 An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the process_command_opts() function in tools/tiffcrop.c	9.8 Critical	—	0,73%	24 Agt 2026
CVE-2026-19568 autodesk 3ds max A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to ex...	7.8 High	—	0,19%	24 Agt 2026
CVE-2026-16783 autodesk 3ds max A maliciously crafted ABC file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to...	7.8 High	—	0,19%	24 Agt 2026
CVE-2026-16782 autodesk 3ds max A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to...	7.8 High	—	0,37%	24 Agt 2026
CVE-2026-16781 autodesk 3ds max A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can trigger an Uncontrolled Recursion vulnerability. A malicious actor may leverage this vulnerabili...	5.5 Medium	—	0,16%	24 Agt 2026
CVE-2022-30983 A cross-site scripting (XSS) vulnerability in Support chatbot in Nopaperforms Niaa-Chatbot through 2022-05-17 allows remote attackers to inject arbitrary web script or HT...	6.1 Medium	—	0,40%	24 Agt 2026
CVE-2026-78555 RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened represe...	9.4 Critical	—	0,42%	24 Agt 2026
CVE-2026-78553 RansomLook created its Flask session-signing key without explicitly restricting the file permissions. The secret_key file was created using the process's default permissi...	7.0 High	—	0,20%	24 Agt 2026
CVE-2026-78551 RansomLook contains multiple weaknesses in its authentication endpoint that allow an unauthenticated remote attacker to enumerate valid usernames, perform unrestricted pa...	8.8 High	—	0,65%	24 Agt 2026
CVE-2026-78430 A vulnerability was detected in sworddut mcp-ffmpeg-helper 0.1.0/0.1.1/0.2.1. This affects the function handleToolCall of the file src/tools/handlers.ts of the component...	5.3 Medium	—	1,1%	24 Agt 2026
CVE-2026-77923 dolibarr erp/crm Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnerability caused by an inverted boolean condition in the private-project membership check within the cl...	4.3 Medium	—	0,36%	24 Agt 2026
CVE-2026-77310 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3...	5.3 Medium	—	0,31%	24 Agt 2026
CVE-2026-76816 Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.137.Final and 4.2.17.Final, MqttEncoder does not validate client identifiers,...	3.5 Low	—	0,17%	24 Agt 2026
CVE-2026-76098 Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates de...	7.5 High	—	0,49%	24 Agt 2026
CVE-2026-75509 joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to version 1.7.3, JWTClaimsRegistry appl...	6.5 Medium	—	0,12%	24 Agt 2026
CVE-2026-75369 An out-of-bounds read vulnerability in the CAN::Application::parsePerformFunctionMessage component of SpaceDot AcubeSAT OBC software commit eaf90ec allows attackers to ca...	7.1 High	—	0,28%	24 Agt 2026
CVE-2026-75368 A stack overflow in the loadRawData function of SpaceDot AcubeSAT OBC software commit eaf90ec allows attackers to cause a Denial of Service (DoS) via supplying a crafted...	7.5 High	—	0,46%	24 Agt 2026
CVE-2026-72714 Rocq Prover does not restore the universe graph's copy of the universe checking flag when a module that locally disabled the check is closed. Local Unset Universe Checkin...	6.3 Medium	—	0,18%	24 Agt 2026
CVE-2026-72711 The Lean 4 kernel does not check that the body of an opaque declaration is closed. environment::add_opaque omits the check_no_metavar_no_fvar call that the definition and...	6.3 Medium	—	0,18%	24 Agt 2026
CVE-2026-72705 The guard checker in Rocq Prover does not follow recursive calls made through a fixpoint's own arguments. A fixpoint may pass itself as a higher-order argument to a secon...	6.3 Medium	—	0,18%	24 Agt 2026
CVE-2026-72704 The guard checker in Rocq Prover does not recheck the recursive tree representation of an inductive type parameter after that parameter has been changed by transport. A f...	6.3 Medium	—	0,18%	24 Agt 2026
CVE-2026-72703 The guard checker in Rocq Prover treats a parameter of a nested mutual fixpoint as uniform without examining calls between the different bodies of that fixpoint. find_uni...	6.3 Medium	—	0,18%	24 Agt 2026
CVE-2026-71511 Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with member-read rights to retrieve bc...	6.5 Medium	—	0,42%	24 Agt 2026
CVE-2026-71510 Dolibarr before 24.0.0 contains a SQL injection vulnerability in the users REST API that allows authenticated attackers with user-read rights to extract sensitive data by...	6.5 Medium	—	0,38%	24 Agt 2026
CVE-2026-63693 Dell Client BIOS contains an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially e...	6.6 Medium	—	0,14%	24 Agt 2026
CVE-2026-61419 dell thinos Dell ThinOS 10, versions prior to 2605_10.2518, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit th...	7.8 High	—	0,14%	24 Agt 2026
CVE-2020-37268 Print Assumptions does not report that a definition was produced while universe checking was disabled when that definition reaches the caller through Parameter Inline in...	6.3 Medium	—	0,18%	24 Agt 2026
CVE-2026-78541 A stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1. An authenticated adjacent attacker with administrative access...	8.5 High	—	2,3%	24 Agt 2026
CVE-2026-78417 Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and earlier, allows an on-...	4.3 Medium	—	0,15%	24 Agt 2026
CVE-2026-75371 An integer handling flaw in the cobs_decode function of SpaceDot AcubeSAT OBC software commit eaf90ec allows physically-proximate attackers with UART access to cause a De...	7.5 High	—	0,46%	24 Agt 2026
CVE-2026-75370 An out-of-bounds read/write vulnerability in the MessageParser::parseECSSTCHeader component of SpaceDot AcubeSAT OBC software commit eaf90ec allows attackers to cause a D...	6.5 Medium	—	0,36%	24 Agt 2026
CVE-2026-71832 Aria2 version 1.37.0 and below is affected by a Divide By Zero issue in src/bittorrent_helper.cc, which allows a remote malicious user to cause a Denial of Service	6.2 Medium	—	0,16%	24 Agt 2026
CVE-2026-71509 Dolibarr before 24.0.0 contains an improper authorization vulnerability in the expense report REST API update endpoint that allows authenticated attackers with expense-cr...	6.5 Medium	—	0,42%	24 Agt 2026
CVE-2026-71508 Dolibarr before 24.0.0 contains an improper authorization vulnerability in the user REST API update endpoint that allows attackers with user-write rights to modify payrol...	6.5 Medium	—	0,39%	24 Agt 2026
CVE-2026-71507 Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated attackers wi...	6.5 Medium	—	0,39%	24 Agt 2026
CVE-2026-71506 Dolibarr before 24.0.0 contains an improper authorization vulnerability in the payments REST API delete endpoint that allows authenticated attackers with invoice-deletion...	8.1 High	—	0,54%	24 Agt 2026
CVE-2026-71505 Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attacker...	7.1 High	—	0,41%	24 Agt 2026
CVE-2026-71504 Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers with only member-creation rights to reset the passwo...	8.1 High	—	0,46%	24 Agt 2026
CVE-2026-71503 Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed with...	6.1 Medium	—	0,37%	24 Agt 2026
CVE-2026-40877 Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to PHP object injection in the user preference functionality, which can lead to...	8.7 High	—	0,53%	24 Agt 2026
CVE-2026-39975 Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, unauthenticated users could delete the .readonly file on iTop instances, leading to code execution...	9.4 Critical	—	0,59%	24 Agt 2026
CVE-2026-30864 Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to Reflected Cross-Site Scripting (XSS) in the dashboard revert functionality....	8.9 High	—	0,35%	24 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.