Katalog CVE (hal. 599)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 264.125 (Critical 36.415 · High 105.508 · KEV 1.758 · sejak 2020) · Pembaruan terakhir: 28 Okt 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 29.901–29.950 dari 264.125 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-78213 Heptabase developed by Hepta Platforms, Inc. has a Stored Cross-Site Scripting vulnerability. Authenticated remote attackers can inject persistent malicious content into...	8.7 High	—	0,44%	24 Agt 2026
CVE-2026-78212 4MOSAn developed by 4MOSAn Security Technology Co., Ltd. has an Arbitrary File Read vulnerability. Unauthenticated remote attackers can exploit a Relative Path Traversal...	7.5 High	—	0,68%	24 Agt 2026
CVE-2026-78211 4MOSAn GCB Doctor developed by 4MOSAn Security Technology has a OS Command Injection vulnerability. Unauthenticated remote attackers can inject malicious commands through...	9.8 Critical	—	2,0%	24 Agt 2026
CVE-2026-78185 A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. The impacted element is an unknown function of the file /pages/cust_edit.php. The manipulatio...	6.3 Medium	—	0,33%	24 Agt 2026
CVE-2026-78182 A security vulnerability has been detected in Shenzhen Gongji Technology XBROTHER Dynamic Environment Monitoring System up to 300R004C00B300. The affected element is the...	7.3 High	—	0,41%	24 Agt 2026
CVE-2026-78181 A weakness has been identified in ractivejs ractive up to 1.4.4. Impacted is the function Ractive#set of the component Keypath Handler. Executing a manipulation can lead...	7.3 High	—	0,59%	24 Agt 2026
CVE-2026-78180 A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the function ConfigProvider.getContextProps of the file components/dialog/ind...	7.3 High	—	0,54%	24 Agt 2026
CVE-2026-78179 A vulnerability was identified in rexrainbow phaser3-rex-notes up to 1.80.17. This vulnerability affects the function SetValue of the file plugins/utils/object/SetValue.j...	6.3 Medium	—	0,45%	24 Agt 2026
CVE-2026-19853 NewSiteServer (NSS) developed by CyberTutor has a Missing Authentication vulnerability. Unauthenticated remote attackers can exploit a specific functionality to send emai...	5.3 Medium	—	0,47%	24 Agt 2026
CVE-2026-19852 NewSiteServer (NSS) developed by CyberTutor has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload arbitrary files, including malicious H...	6.1 Medium	—	0,33%	24 Agt 2026
CVE-2026-19200 The Velociraptor verify() VQL function allows a user to verify an artifact for syntatic and other issues. Due to an implementation fault in this VQL function, the global...	8.9 High	—	0,33%	24 Agt 2026
CVE-2026-78178 A vulnerability was determined in jQWidgets up to 24.0.1. This affects the function JQXLite.extend/jqxBaseFramework.extend of the file jqwidgets/jqx-all.js. This manipula...	7.3 High	—	0,59%	24 Agt 2026
CVE-2026-78177 A vulnerability was found in TanStack devtools-vite 0.7.0. Affected by this issue is the function installPackage of the file packages/devtools-bundler-core/src/package-ma...	4.5 Medium	—	0,90%	24 Agt 2026
CVE-2026-78171 A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/processlogin....	7.3 High	—	0,43%	24 Agt 2026
CVE-2026-78170 A flaw has been found in UTT HiPER 1200GW up to 2.5.3-170306. Affected is the function strcpy of the file /goform/formConfigFastDirectionW. Executing a manipulation of th...	8.8 High	—	0,79%	24 Agt 2026
CVE-2026-78169 A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. This impacts the function strcpy of the file /goform/aspRemoteApConfTempSend of the component...	9.9 Critical	—	0,79%	24 Agt 2026
CVE-2026-78168 A security vulnerability has been detected in EFM ipTIME T24000M up to 14.20.0. This affects the function httpcon_check_session_url of the component Session Validation Ha...	9.8 Critical	—	1,3%	24 Agt 2026
CVE-2026-78167 A weakness has been identified in EFM ipTIME T16000M 14.20.2. The impacted element is the function httpcon_check_session_url of the component Session Validation Handler....	10.0 Critical	—	1,5%	24 Agt 2026
CVE-2026-78166 A security flaw has been discovered in provectus kafka-ui up to 0.7.2. The affected element is the function executeSmartFilterTest of the file kafka-ui-api/src/main/java/...	6.3 Medium	—	0,41%	24 Agt 2026
CVE-2026-78209 exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values...	8.2 High	—	0,41%	24 Agt 2026
CVE-2026-78208 exceljs through 4.4.0 contains a path traversal vulnerability in the Workbook.addImage() function that fails to validate file paths. Attackers can supply arbitrary file p...	7.5 High	—	0,51%	24 Agt 2026
CVE-2026-78207 exceljs through 4.4.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject __proto__, constructor, or prototype keys when merging not...	9.4 Critical	—	0,60%	24 Agt 2026
CVE-2026-78206 exceljs through 4.4.0 decompresses all entries from supplied xlsx archives into memory without limits on entry size, total size, or compression ratio. Attackers can uploa...	7.5 High	—	0,63%	24 Agt 2026
CVE-2026-78205 BentoML's outbound connection safeguard (make_safe_connect in _internal/utils/uri.py) blocks private, loopback, and link-local IP addresses but fails to reject the RFC 65...	5.8 Medium	—	0,41%	24 Agt 2026
CVE-2026-78204 Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.test_func returns only request.user.i...	5.4 Medium	—	0,27%	24 Agt 2026
CVE-2026-78203 Ghostwriter before 7.1.2 fails to validate template ownership in the report template swap endpoint, allowing attackers to attach client-scoped templates from other client...	7.1 High	—	0,37%	24 Agt 2026
CVE-2026-78161 A vulnerability was found in warmcat libwebsockets 4.5.0. Impacted is the function report_raw_cbor of the file lib/misc/lecp.c of the component LECP CBOR Recording. The m...	7.3 High	—	0,41%	24 Agt 2026
CVE-2026-78160 A vulnerability has been found in Dolibarr ERP up to 18.0.10/22.0.5/23.0.3. This issue affects some unknown processing of the file /user/note.php of the component User No...	6.3 Medium	—	0,39%	24 Agt 2026
CVE-2026-78158 A flaw has been found in Open5GS 2.8.0. This vulnerability affects unknown code of the component AMF UEContextReleaseRequest Path Handler. Executing a manipulation can le...	6.3 Medium	—	0,37%	24 Agt 2026
CVE-2026-78157 A vulnerability was detected in Open5GS 2.8.0. This affects the function pcrf_rx_aar_cb of the file src/pcrf/pcrf-rx-path.c of the component Rx AA-Request Handler. Perfor...	7.4 High	—	0,28%	24 Agt 2026
CVE-2026-78156 A security vulnerability has been detected in Open5GS 2.8.0. Affected by this issue is the function hss_ogs_diam_s6a_air_cb of the file src/hss/hss-s6a-path.c of the comp...	7.4 High	—	0,56%	24 Agt 2026
CVE-2026-78148 A vulnerability was determined in ggml-org llama.cpp bec4772f6. This affects the function rpc_server::graph_compute of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the comp...	5.3 Medium	—	0,72%	24 Agt 2026
CVE-2026-78147 A vulnerability was found in ggml-org llama.cpp bec4772f6. The impacted element is the function deserialize_tensor of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the compo...	7.3 High	—	0,56%	23 Agt 2026
CVE-2026-78145 A vulnerability has been found in CTFd up to 3.8.4. The affected element is the function _is_safe_url of the file CTFd/utils/validators/__init__.py. Such manipulation of...	4.3 Medium	—	0,56%	23 Agt 2026
CVE-2026-78144 A vulnerability was identified in code-projects Barangay Resident Profiling Management System 1.0. Affected by this vulnerability is an unknown functionality of the file...	6.3 Medium	—	0,38%	23 Agt 2026
CVE-2026-78143 A vulnerability was determined in code-projects Barangay Resident Profiling Management System 1.0. Affected is an unknown function of the file residents.php of the compon...	7.3 High	—	0,43%	23 Agt 2026
CVE-2026-78142 A vulnerability was found in code-projects Barangay Resident Profiling Management System 1.0. This impacts an unknown function of the file /archived_records.php of the co...	6.3 Medium	—	0,38%	23 Agt 2026
CVE-2026-78141 A vulnerability has been found in Tenda CH22 1.0.0.1. This affects the function formexeCommand of the file /goform/exeCommand. The manipulation of the argument cmdinput l...	7.4 High	—	2,7%	23 Agt 2026
CVE-2026-78183 DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quote_float. quote_float() allocates the length of the string + 1, which is the size of the bare numeri...	9.8 Critical	—	0,67%	23 Agt 2026
CVE-2026-78140 A flaw has been found in Dromara UJCMS up to 10.1.3. The impacted element is the function update of the file src/main/java/com/ujcms/cms/ext/web/backendapi/WebFileTemplat...	4.7 Medium	—	0,41%	23 Agt 2026
CVE-2026-19565 Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKey. CreateSes...	3.7 Low	—	0,44%	23 Agt 2026
CVE-2026-75922 Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream request line. PSGI hands PATH...	5.3 Medium	—	0,42%	23 Agt 2026
CVE-2026-9769 justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.finish() uncond...	7.5 High	—	0,34%	23 Agt 2026
CVE-2026-8630 justhtml before 1.12.0 (versions <= 1.11.0) contains a mutation cross-site scripting (mXSS) vulnerability in the serialization of raw-text elements such as <style> and <s...	6.1 Medium	—	0,26%	23 Agt 2026
CVE-2026-8445 justhtml versions <= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant characters (angle brackets) in text nodes when converting a parsed document to M...	9.8 Critical	—	0,64%	23 Agt 2026
CVE-2026-7808 justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content (e.g., script or style) to survive sanitization, potentia...	9.8 Critical	—	0,59%	23 Agt 2026
CVE-2026-77088 justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in to_markdown() where inline code spans fail to account for blank lines as block boun...	6.1 Medium	—	0,26%	23 Agt 2026
CVE-2026-74793 justhtml before 3.11.0 contains a cross-site scripting vulnerability where the default sanitizer bypasses event handler removal in selectedcontent projections. Attackers...	6.1 Medium	—	0,25%	23 Agt 2026
CVE-2026-6827 justhtml before 1.17.0 contains multiple security issues in sanitization, serialization, and programmatic DOM handling. When custom policies preserve foreign namespaces (...	6.1 Medium	—	0,26%	23 Agt 2026
CVE-2026-5751 justhtml versions 1.13.0 and earlier contain a parser-differential / mutation cross-site scripting (mXSS) vulnerability when using a custom SanitizationPolicy that preser...	6.1 Medium	—	0,26%	23 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.