Katalog CVE (hal. 608)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 264.271 (Critical 36.431 · High 105.570 · KEV 1.760 · sejak 2020) · Pembaruan terakhir: 28 Okt 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 30.351–30.400 dari 264.271 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-69233 esri portal for arcgis There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, administratively privileged attacker to inject mal...	5.5 Medium	—	0,27%	21 Agt 2026
CVE-2026-69232 esri portal for arcgis There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that...	5.5 Medium	—	0,33%	21 Agt 2026
CVE-2026-69231 esri portal for arcgis There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that...	5.5 Medium	—	0,33%	21 Agt 2026
CVE-2026-69230 esri portal for arcgis There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, administratively privileged attacker to inject mal...	4.8 Medium	—	0,24%	21 Agt 2026
CVE-2026-69229 esri portal for arcgis There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that allows a remote, authenticated attacker to insert arbitrary HTML into the...	5.4 Medium	—	0,28%	21 Agt 2026
CVE-2026-69228 esri portal for arcgis There is a missing authentication vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that may allow a remote, unauthenticated attacker to access a specific r...	5.3 Medium	—	0,48%	21 Agt 2026
CVE-2026-69225 esri portal for arcgis There is an information disclosure vulnerability in Esri Portal for ArcGIS versions 11.5 through 12.0 and earlier that may allow a remote, unauthenticated attacker to ref...	7.5 High	—	0,46%	21 Agt 2026
CVE-2026-69224 esri portal for arcgis There is an information disclosure vulnerability in Esri Portal for ArcGIS versions 12.0 and earlier that may under difficult to reproduce circumstances allow a remote, u...	7.5 High	—	0,46%	21 Agt 2026
CVE-2026-68508 Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.4, hydra.utils.instantiate() resolves and calls Python objects selected by configuration...	7.8 High	—	0,46%	21 Agt 2026
CVE-2026-64679 Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From 0.19.8 until 0.45.0, Atlantis does not consistently validat...	8.1 High	—	0,80%	21 Agt 2026
CVE-2026-63421 Keystone is a content management system for Node.js. Prior to 6.5.3, the findMany resolver in packages/core/src/lib/core/queries/resolvers.ts compares the signed take arg...	7.5 High	—	0,67%	21 Agt 2026
CVE-2026-63135 YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourls_get_referrer(), yourls_s...	8.2 High	—	0,43%	21 Agt 2026
CVE-2026-62316 Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, ufo/client/mcp/http_servers/linux_mcp_server.py binds a FastM...	8.8 High	—	0,51%	21 Agt 2026
CVE-2026-62283 Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Nezha versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9 do not bind...	9.9 Critical	—	0,55%	21 Agt 2026
CVE-2026-61824 Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt and src values, og:image values, and video descriptions into HTML strin...	8.2 High	—	0,41%	21 Agt 2026
CVE-2026-61539 Xinference is an inference API for running open-source, speech, and multimodal models. In 2.5.0 and earlier, Xinference passes attacker-influenced Llama3 tool-call output...	10.0 Critical	—	1,2%	21 Agt 2026
CVE-2026-59989 Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inser...	9.2 Critical	—	0,54%	21 Agt 2026
CVE-2026-55185 Miniflux 2 is an open source feed reader. Prior to 2.3.1, IsRelativePath in internal/urllib/url.go accepts redirect targets containing backslashes because Go URL parsing...	5.1 Medium	—	0,56%	21 Agt 2026
CVE-2026-55168 Runtipi is a personal homeserver orchestrator. In 4.10.0 and earlier, Runtipi accepts symbolic links from an attacker-controlled backup archive and copies them into live...	6.5 Medium	—	0,61%	21 Agt 2026
CVE-2026-54457 TensorZero is an open-source LLMOps platform that unifies an LLM gateway, observability, evaluation, optimization, and experimentation. Prior to 2026.6.0, the TensorZero...	7.7 High	—	0,40%	21 Agt 2026
CVE-2026-53656 FiftyOne is an open-source platform for refining high-quality datasets and visual AI models. Prior to 1.17.0, the FiftyOne App/API server in fiftyone/server/app.py and th...	6.3 Medium	—	0,12%	21 Agt 2026
CVE-2026-53572 KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresql_scaler.go constructs libpq-style connection strings from tenant-con...	5.9 Medium	—	0,39%	21 Agt 2026
CVE-2026-50538 LibVNCClient is a library for easy implementation of a VNC client. In versions 0.9.12 through 0.9.15, a malicious (or man-in-the-middle) VNC server can force a connecting...	8.8 High	—	0,40%	21 Agt 2026
CVE-2026-45271 Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. Picotls implements its own ASN.1 validation helper, which is...	5.5 Medium	—	0,15%	21 Agt 2026
CVE-2026-45099 Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.0.4, Terragrunt trusts paths decoded...	6.9 Medium	—	0,54%	21 Agt 2026
CVE-2026-44517 Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDirForURL in define/types.go does not securely confine Git repository sub...	6.3 Medium	—	0,18%	21 Agt 2026
CVE-2026-31880 Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the universal search. This issue...	8.0 High	—	0,43%	21 Agt 2026
CVE-2026-31803 Combodo iTop is a web based IT service management tool. Prior to 3.2.3, 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in pages/tagadmin.php. This i...	8.0 High	—	0,43%	21 Agt 2026
CVE-2026-30890 Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the synchro import script. This i...	8.0 High	—	0,43%	21 Agt 2026
CVE-2026-30865 Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the dashboard save functionality....	7.1 High	—	0,26%	21 Agt 2026
CVE-2026-30826 Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the testing OQL query functionali...	8.0 High	—	0,43%	21 Agt 2026
CVE-2026-77810 In the Neptune connector, a user with access to Neptune through Athena Federated Query could gain access to properties in the Lambda supplying the compute for the connect...	9.9 Critical	—	0,63%	21 Agt 2026
CVE-2026-76876 Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sensitive credentials by exploiting an unconditional a...	5.9 Medium	—	0,45%	21 Agt 2026
CVE-2026-74252 Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - J2Commerce 4.1.5 is vulnerable to Stored Cross-Site...	8.6 High	—	0,52%	21 Agt 2026
CVE-2026-67362 Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - Four task handlers accepted a base64-encoded URL...	5.1 Medium	—	0,54%	21 Agt 2026
CVE-2026-67361 Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - The file upload end...	6.9 Medium	—	0,21%	21 Agt 2026
CVE-2026-67360 Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user could supply another custo...	6.3 Medium	—	0,41%	21 Agt 2026
CVE-2026-67359 Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An unauthenticated visitor could supply any order_id as a q...	8.7 High	—	0,41%	21 Agt 2026
CVE-2026-67358 Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user with a valid order token could...	5.3 Medium	—	0,19%	21 Agt 2026
CVE-2026-62960 Git for Windows is the Windows port of Git. Prior to 2.55.0.windows.4, a malicious remote Git server can advertise a bundle URI that reaches transport_get_remote_bundle_u...	7.4 High	—	0,46%	21 Agt 2026
CVE-2026-50290 SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, CSS value sanitization stripped `expression(` and `url(javascript:` using simple...	5.3 Medium	—	0,49%	21 Agt 2026
CVE-2026-50288 SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, when `new URL()` throws a parse error, the `assertSecureUrl` function returned w...	8.7 High	—	0,48%	21 Agt 2026
CVE-2026-30866 Combodo iTop is a web based IT service management tool. Prior to 3.2.3, unauthenticated users can access uploaded sensitive via sniffed url. This issue has been fixed in...	7.5 High	—	0,46%	21 Agt 2026
CVE-2026-30819 Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop has a reflected Cross-Site Scripting (XSS) vulnerability in its dashboard revert functionalit...	7.3 High	—	0,37%	21 Agt 2026
CVE-2026-27490 Combodo iTop is a web based IT service management tool. Prior to 3.2.3, inline images that are accessible without being authenticated are protected by a weak 24-bit pseud...	7.5 High	—	0,43%	21 Agt 2026
CVE-2026-27463 Combodo iTop is a web based IT service management tool. Prior to 3.2.3, the HTML title attribute of the logo in the login page contains the complete iTop version. This is...	5.3 Medium	—	0,34%	21 Agt 2026
CVE-2026-27462 Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop returns different responses for valid/invalid usernames depending on multiple factors in the...	7.5 High	—	0,43%	21 Agt 2026
CVE-2026-77795 A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.6.2. This issue affects the function FlwInstanceController/FlwDefinitionController/FlwCategoryController/...	6.3 Medium	—	0,35%	21 Agt 2026
CVE-2026-63466 Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts assigns Mustache.esc...	4.1 Medium	—	0,32%	21 Agt 2026
CVE-2026-63462 Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passe...	7.5 High	—	0,70%	21 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.