Katalog CVE (hal. 612)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 264.271 (Critical 36.431 · High 105.570 · KEV 1.760 · sejak 2020) · Pembaruan terakhir: 28 Okt 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 30.551–30.600 dari 264.271 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-18409 The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and includin...	7.2 High	—	0,34%	21 Agt 2026
CVE-2026-76158 External Control of File Name or Path in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to write files to a...	9.3 Critical	—	0,52%	21 Agt 2026
CVE-2026-76137 Missing authentication for critical function vulnerability exists in VOCALOID6. Any process running under the same local user account as a running VOCALOID6 Editor instan...	3.3 Low	—	0,16%	21 Agt 2026
CVE-2026-76131 Use of hard-coded credentials issue exists in VOCALOID6 , which may allow an attacker to impersonate a legitimate VOCALOID6 Editor and gain access to Yamaha's activation...	5.3 Medium	—	0,33%	21 Agt 2026
CVE-2026-73267 A flaw was found in the clusterclaims-controller component of multicluster engine (MCE). A tenant with standard permissions to create and delete ClusterClaim resources ca...	7.7 High	—	0,63%	21 Agt 2026
CVE-2026-77392 A weakness has been identified in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This impacts the function saveUser of the file /public/submit...	6.3 Medium	—	0,33%	21 Agt 2026
CVE-2026-77391 A security flaw has been discovered in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This affects an unknown function. The manipulation resul...	4.3 Medium	—	0,23%	21 Agt 2026
CVE-2026-76157 Missing authentication for a critical function in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an unauthenticated remote at...	8.8 High	—	0,73%	21 Agt 2026
CVE-2026-76156 OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenticated administrator to execute arbitrary operating...	9.4 Critical	—	1,1%	21 Agt 2026
CVE-2026-76155 Use of default credentials in Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to gain administrative access to the management platform...	9.3 Critical	—	0,49%	21 Agt 2026
CVE-2026-77651 The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers...	9.8 Critical	—	0,80%	21 Agt 2026
CVE-2026-77650 The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that regi...	9.8 Critical	—	0,80%	21 Agt 2026
CVE-2026-77649 The internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers...	9.8 Critical	—	0,80%	21 Agt 2026
CVE-2026-43679 apple watchos This issue was addressed with improved permissions checking. This issue is fixed in watchOS 26.4. An attacker with physical access to a locked Apple Watch may be able to...	2.4 Low	—	0,17%	21 Agt 2026
CVE-2026-20679 apple macos The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. Processing a maliciously crafted file ma...	4.3 Medium	—	0,36%	21 Agt 2026
CVE-2026-16520 Improper input validation and Exposure of sensitive information through data queries vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, and Genians Genian...	8.7 High	—	0,55%	21 Agt 2026
CVE-2026-77648 In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_filtering_opts, allowing an admin to fetch internal URLs from the Glanc...	2.2 Low	—	0,30%	20 Agt 2026
CVE-2026-77647 SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect identification...	9.8 Critical	—	2,3%	20 Agt 2026
CVE-2026-77113 Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allows an attacker to create or overwrite arbitrary files with the privileg...	6.7 Medium	—	0,20%	20 Agt 2026
CVE-2026-77646 A Server-Side Request Forgery (SSRF) vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the deserializat...	7.7 High	—	0,44%	20 Agt 2026
CVE-2026-77645 A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of...	9.2 Critical	—	0,56%	20 Agt 2026
CVE-2026-77644 A critical bypass access control vulnerability has been reported in PTC Windchill Risk and Reliability (WRR) Enterprise Edition.	9.3 Critical	—	0,43%	20 Agt 2026
CVE-2026-77643 A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping...	4.4 Medium	—	0,25%	20 Agt 2026
CVE-2026-77642 torproject tor tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type. Impact is minor for most To...	9.3 Critical	—	0,35%	20 Agt 2026
CVE-2026-72860 The POST /api/provider-nodes/validate route in 9router takes a caller-supplied baseUrl and issues server-side HTTP requests to it, guarding the destination with assertPub...	8.5 High	—	0,38%	20 Agt 2026
CVE-2026-72848 SitemapLoader.parse_sitemap in langchain_community/document_loaders/sitemap.py applies the documented restrict_to_same_domain control only to leaf url entries. The loop o...	8.6 High	—	0,60%	20 Agt 2026
CVE-2026-72846 Lightdash stores the webhook URL supplied with a scheduled delivery and later posts to it from sendWebhook in packages/backend/src/clients/GoogleChat/GoogleChatClient.ts...	6.4 Medium	—	0,32%	20 Agt 2026
CVE-2026-72843 The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes the admin...	9.8 Critical	—	0,84%	20 Agt 2026
CVE-2026-72818 The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORD_RE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose...	7.5 High	—	0,74%	20 Agt 2026
CVE-2026-70105 microsoft 365, microsoft office +3 lainnya Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.	7.5 High	—	0,97%	20 Agt 2026
CVE-2026-69855 microsoft azure copilot Server-side request forgery (ssrf) in Microsoft Copilot in Azure allows an authorized attacker to disclose information over a network.	6.5 Medium	—	0,84%	20 Agt 2026
CVE-2026-69851 microsoft entra id Server-side request forgery (ssrf) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.	9.9 Critical	—	0,78%	20 Agt 2026
CVE-2026-69836 Advisory microsoft entra id Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.	10.0 Critical	—	1,5%	20 Agt 2026
CVE-2026-69558 microsoft partner center Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized attacker to disclose information over a network.	8.6 High	—	0,97%	20 Agt 2026
CVE-2026-69555 microsoft azure arc Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network.	10.0 Critical	—	0,80%	20 Agt 2026
CVE-2026-69543 microsoft azure virtual machines Server-side request forgery (ssrf) in Azure Virtual Machines allows an authorized attacker to elevate privileges over a network.	8.5 High	—	0,57%	20 Agt 2026
CVE-2026-69519 microsoft azure stack hci Observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose information over a network.	8.6 High	—	1,0%	20 Agt 2026
CVE-2026-69419 microsoft azure data manager for energy Integer overflow or wraparound in Azure Data Manager for Energy allows an authorized attacker to execute code over a network.	8.8 High	—	0,74%	20 Agt 2026
CVE-2026-69400 microsoft azure logic apps Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.	9.6 Critical	—	0,94%	20 Agt 2026
CVE-2026-68789 microsoft azure sql database Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges over a netw...	9.9 Critical	—	0,99%	20 Agt 2026
CVE-2026-68782 microsoft azure sql database Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges over a netw...	9.9 Critical	—	0,99%	20 Agt 2026
CVE-2026-67448 Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ pr...	6.5 Medium	—	0,22%	20 Agt 2026
CVE-2026-67447 Mailpit is an email testing tool and API for developers. From 1.30.0 until 1.30.5, Mailpit's internal/smtpd/smtpd.go readData() function calls bufio.Reader.ReadBytes befo...	5.3 Medium	—	0,51%	20 Agt 2026
CVE-2026-66800 microsoft azure data factory Server-side request forgery (ssrf) in Azure Data Factory allows an unauthorized attacker to disclose information over a network.	7.5 High	—	0,97%	20 Agt 2026
CVE-2026-66309 microsoft azure sql database Improper access control in Azure SQL Database allows an authorized attacker to elevate privileges over a network.	9.1 Critical	—	0,86%	20 Agt 2026
CVE-2026-65816 microsoft azure web apps Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorized attacker to elevate privileges over a network.	10.0 Critical	—	0,97%	20 Agt 2026
CVE-2026-65801 microsoft exchange online Server-side request forgery (ssrf) in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges over a network.	10.0 Critical	—	0,90%	20 Agt 2026
CVE-2026-65770 microsoft azure managed instance for apache cassandra Improper neutralization of argument delimiters in a command ('argument injection') in Azure Managed Instance for Apache Cassandra allows an unauthorized attacker to execu...	10.0 Critical	—	1,1%	20 Agt 2026
CVE-2026-64773 apple container An attacker that can reach a container's published TCP port may be able to force the host's forwarding process to buffer an unbounded amount of that client's data in memo...	7.5 High	—	0,43%	20 Agt 2026
CVE-2026-63509 microsoft fabric Relative path traversal in Microsoft Fabric allows an authorized attacker to elevate privileges over a network.	8.8 High	—	1,0%	20 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.