Katalog CVE (hal. 609)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 264.271 (Critical 36.431 · High 105.570 · KEV 1.760 · sejak 2020) · Pembaruan terakhir: 28 Okt 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 30.401–30.450 dari 264.271 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-63004 Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the operator-controlled parameters.url...	5.5 Medium	—	0,39%	21 Agt 2026
CVE-2026-55850 Element Web is a Matrix web client built using the Matrix React SDK. Prior to 1.12.22, EmbeddedPage in apps/web/src/components/structures/EmbeddedPage.tsx renders homeser...	5.3 Medium	—	0,55%	21 Agt 2026
CVE-2026-54682 DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, HTML exports generated with markdown formatting disabled pass attacker-controlled content through...	8.2 High	—	0,20%	21 Agt 2026
CVE-2026-54681 DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, the VisitEmojiAsync method in DiscordChatExporter.Core/Exporting/HtmlMarkdownVisitor.cs interpolat...	4.1 Medium	—	0,16%	21 Agt 2026
CVE-2026-54134 OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, OctoPrint's custom Tornado upload handler and Flask with Werkzeug p...	7.0 High	—	0,32%	21 Agt 2026
CVE-2026-54073 VeraCrypt provides disk encryption with strong security based on TrueCrypt. From 1.26.6 until 1.26.29, file-hosted hidden volume creation forces quick format and the Form...	4.6 Medium	—	0,14%	21 Agt 2026
CVE-2026-54071 BabelDOC is a document translation tool. Prior to 0.6.3, BabelDOC's vendored PDF parser in babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when CMapDB._loa...	7.8 High	—	0,38%	21 Agt 2026
CVE-2026-53762 VeraCrypt provides disk encryption with strong security based on TrueCrypt. Prior to 1.26.29, non-default builds created with WOLFCRYPT=1 and WOLFCRYPT_BACKEND route SHA-...	6.2 Medium	—	0,08%	21 Agt 2026
CVE-2026-35163 OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, Suppressed Command notification popups use PNotify rendering for pr...	4.6 Medium	—	0,20%	21 Agt 2026
CVE-2026-77237 amazon freertos Missing queue-set type validation in xQueueAddToSet() in the FreeRTOS-Kernel before 11.3.1 might allow an unprivileged task on MPU-enabled ports with configUSE_QUEUE_SETS...	8.4 High	—	0,18%	21 Agt 2026
CVE-2026-77236 amazon freertos Missing minimum size validation in secure context allocation in FreeRTOS-Kernel before 11.3.1 might allow local users to corrupt secure-world heap metadata via an out-of-...	7.3 High	—	0,16%	21 Agt 2026
CVE-2026-77235 amazon freertos Missing privilege verification in the secure context cleanup handler in FreeRTOS-Kernel before 11.3.1 might allow local users to cause a use-after-free condition in secur...	7.3 High	—	0,16%	21 Agt 2026
CVE-2026-77234 amazon freertos Improper input validation in FreeRTOS-Kernel before 11.3.1 might allow an unprivileged task on MPU-enabled ports to execute code in privileged kernel context. To remediat...	8.8 High	—	0,17%	21 Agt 2026
CVE-2026-71862 Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizati...	7.5 High	—	0,48%	21 Agt 2026
CVE-2026-71494 Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remote_variables_loader.go and related Terraform Clo...	5.9 Medium	—	0,50%	21 Agt 2026
CVE-2026-71493 Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, the readFile, pathExists, isDir, and matchPaths template function...	5.9 Medium	—	0,54%	21 Agt 2026
CVE-2026-70656 Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizati...	4.9 Medium	—	0,59%	21 Agt 2026
CVE-2026-62677 Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, an authenticated user can upload a session-scoped agent bu...	8.8 High	—	0,61%	21 Agt 2026
CVE-2026-62676 Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, the shared shell-command parser in omnigent/policies/built...	7.1 High	—	0,40%	21 Agt 2026
CVE-2026-62675 Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, multipart POST /v1/sessions accepts an authenticated user'...	8.8 High	—	0,65%	21 Agt 2026
CVE-2026-62674 Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, PUT /sessions/{session_id}/agent checks LEVEL_EDIT permiss...	9.0 Critical	—	0,51%	21 Agt 2026
CVE-2026-55241 Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizati...	7.5 High	—	0,62%	21 Agt 2026
CVE-2026-41451 UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the user substitution logic within parse_artifact.sh where userna...	7.8 High	—	1,2%	21 Agt 2026
CVE-2026-41450 UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the _command_collector function where foreach command output line...	7.8 High	—	1,1%	21 Agt 2026
CVE-2026-41449 UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the _run_command function that allows attackers to execute arbitr...	7.8 High	—	1,0%	21 Agt 2026
CVE-2026-27875 Cleartext Storage of Sensitive Information in Memory vulnerability in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator may allow an attcker to Retr...	6.9 Medium	—	0,08%	21 Agt 2026
CVE-2026-17252 A stack-based out-of-bounds write vulnerability exists in the login request handling functionality of the administrative web interface of TP-Link TL-MR6400 v7 routers. An...	7.1 High	—	0,27%	21 Agt 2026
CVE-2026-17251 A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of TL-MR6400 v7. An unauthenticated remote attacker can trigger the vulnerabili...	7.1 High	—	0,47%	21 Agt 2026
CVE-2026-17250 A stack-based buffer overflow vulnerability exists in the firmware update functionality of TL-MR6400 v7 due to unsafe processing of attacker-controlled metadata within a...	8.5 High	—	0,30%	21 Agt 2026
CVE-2026-74583 In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_route: fix fastmap use-after-free on filter The route4 classifier maintains a 16-slot...	7.8 High	—	0,12%	21 Agt 2026
CVE-2026-74582 In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hard_header_len in non-ring send paths packet_snd() reads dev->hard_header_le...	7.8 High	—	0,12%	21 Agt 2026
CVE-2026-74581 Advisory In the Linux kernel, the following vulnerability has been resolved: net: ipv6: clear suppressed fib6 rule result fib6_rule_suppress() drops a suppressed route with ip6_...	9.8 Critical	—	0,42%	21 Agt 2026
CVE-2026-74580 In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration vq->meta_iotlb[] caches the vhost_iot...	8.8 High	—	0,24%	21 Agt 2026
CVE-2026-75933 Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and styles option. Injected script is executed in the context of any visiti...	7.3 High	—	0,42%	21 Agt 2026
CVE-2026-75932 Jet Admin allows an attacker to create a malicious app and connect it to a target user's custom domain, edit the authentication configuration, and reroute traffic to the...	8.6 High	—	0,57%	21 Agt 2026
CVE-2026-75928 The Brushfire platform's video content streaming application (https://online.brushfire.com) exposes database path in requests to users, allowing a remote, unauthenticated...	5.3 Medium	—	0,53%	21 Agt 2026
CVE-2026-69502 microsoft azure sql database Server-side request forgery (ssrf) in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network.	10.0 Critical	—	0,80%	21 Agt 2026
CVE-2026-54789 mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functional...	7.5 High	—	0,49%	21 Agt 2026
CVE-2026-49114 linuxfoundation onnx In ONNX before 1.21.0, the 'save_external_data' function builds the external-data file path from the model's external_data location field and opens it for writing without...	7.1 High	—	0,16%	21 Agt 2026
CVE-2026-22681 OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege attackers to access internal network services by subm...	8.5 High	—	0,34%	21 Agt 2026
CVE-2026-77815 to_abs_path in scripts/iib/tool.py normalised the requested path with os.path.normpath, which collapses dot segments but does not resolve symbolic links. A symlink placed...	7.5 High	—	0,51%	21 Agt 2026
CVE-2026-77814 is_path_trusted in scripts/iib/api.py compares the requested path against each allowed parent directory with path.startswith(parent_path), without appending a path separa...	7.5 High	—	0,50%	21 Agt 2026
CVE-2026-77812 DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption. When a client attempts to connect to the dr...	9.4 Critical	—	0,09%	21 Agt 2026
CVE-2026-77087 Paperclip before 0.3.1 in default local_trusted mode fails to validate Host headers, allowing attackers to execute arbitrary commands via DNS rebinding. An attacker can c...	9.6 Critical	—	0,49%	21 Agt 2026
CVE-2026-63343 Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image containing a `metadata.yaml` symlink pointing to an arbitrary host path...	9.9 Critical	—	0,48%	21 Agt 2026
CVE-2026-63125 Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, project-confined Incus user (a non-admin TLS/RBAC identity with `can_cre...	9.9 Critical	—	0,66%	21 Agt 2026
CVE-2026-62941 Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check (`AllowInstanceCr...	9.9 Critical	—	0,44%	21 Agt 2026
CVE-2026-62940 Incus is a system container and virtual machine manager. Prior to version 7.3.0, when migrating an instance to another cluster member, user-supplied configuration overrid...	9.9 Critical	—	0,42%	21 Agt 2026
CVE-2026-62867 Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation of user-provided `block.create_options` in storage volume configurati...	9.9 Critical	—	0,52%	21 Agt 2026
CVE-2026-62313 Incus is a system container and virtual machine manager. Prior to version 7.3.0, project-level enforcement of `restricted.containers.privilege=isolated` can be trivially...	4.3 Medium	—	0,36%	21 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.