Katalog CVE (hal. 617)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 264.331 (Critical 36.436 · High 105.591 · KEV 1.760 · sejak 2020) · Pembaruan terakhir: 28 Okt 2026, 12:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 30.801–30.850 dari 264.331 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-61663 django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, render_object_structure fails to authorize non...	4.3 Medium	—	0,34%	20 Agt 2026
CVE-2026-54624 django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, render_object_structure in cms/views.py render...	6.5 Medium	—	0,42%	20 Agt 2026
CVE-2026-54622 django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the copy_plugins endpoint in cms/admin/placeho...	6.5 Medium	—	0,42%	20 Agt 2026
CVE-2026-53587 libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application....	7.5 High	—	0,47%	20 Agt 2026
CVE-2026-53586 libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application....	6.5 Medium	—	0,28%	20 Agt 2026
CVE-2026-53585 libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application....	5.3 Medium	—	0,40%	20 Agt 2026
CVE-2026-53584 libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application....	4.3 Medium	—	0,33%	20 Agt 2026
CVE-2026-53583 libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application....	6.5 Medium	—	0,24%	20 Agt 2026
CVE-2026-53569 Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted toggle_like and mark_as_seen endpoints in frappe/desk/like.py and frappe...	5.3 Medium	—	0,47%	20 Agt 2026
CVE-2026-50190 Shaarli is a personal bookmarking service. Versions prior to 0.16.3 are vulnerable to stored XSS in `application/front/controller/visitor/BookmarkListController.php`. The...	8.6 High	—	0,44%	20 Agt 2026
CVE-2026-49996 SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. Prior to version 1.3.1, a ma...	3.7 Low	—	0,31%	20 Agt 2026
CVE-2026-43678 apple swiftnio An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed WebSocket hand...	5.3 Medium	—	0,37%	20 Agt 2026
CVE-2026-19683 tp-link er7212pc firmware, tp-link er605 firmware +16 lainnya A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During communication with a third-party DDNS service, authentication credentials...	7.4 High	—	0,35%	20 Agt 2026
CVE-2026-19586 tp-link er7212pc firmware, tp-link er605 firmware +16 lainnya A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of...	9.8 Critical	—	5,7%	20 Agt 2026
CVE-2026-15743 Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The _serve_static method always sets the Cache-Control header to "p...	5.7 Medium	—	0,41%	20 Agt 2026
CVE-2026-77036 A vulnerability was found in elunez eladmin up to 2.7. The impacted element is the function EmailController/AliPayController/GeneratorController/GenConfigController. The...	6.3 Medium	—	0,37%	20 Agt 2026
CVE-2026-77031 A vulnerability has been found in Tenda CH22 1.0.0.1. The affected element is the function formcreateFileName of the file /goform/formcreateFileName. The manipulation of...	7.4 High	—	2,7%	20 Agt 2026
CVE-2026-76641 Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created...	7.5 High	—	0,35%	20 Agt 2026
CVE-2026-73259 cesanta mongoose Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using MG_ENABLE_D...	5.4 Medium	—	0,41%	20 Agt 2026
CVE-2026-73258 cesanta mongoose Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mg_...	6.5 Medium	—	0,46%	20 Agt 2026
CVE-2026-73257 cesanta mongoose Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length a...	9.1 Critical	—	0,67%	20 Agt 2026
CVE-2026-73256 cesanta mongoose Mongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proxy deployment by sending a req...	9.1 Critical	—	0,44%	20 Agt 2026
CVE-2026-73255 cesanta mongoose Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an #incl...	6.5 Medium	—	0,66%	20 Agt 2026
CVE-2026-73254 cesanta mongoose Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cross-site sc...	5.4 Medium	—	0,34%	20 Agt 2026
CVE-2026-73253 cesanta mongoose Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a parent domain can impersonate...	9.1 Critical	—	0,34%	20 Agt 2026
CVE-2026-73251 cesanta mongoose Mongoose is an embedded web server and network library. Prior to 7.23, a network attacker can impersonate a TLS server to a Mongoose client configured with a multi-certif...	9.1 Critical	—	0,19%	20 Agt 2026
CVE-2026-72847 broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain to_string_lossy() call in sr...	4.6 Medium	—	0,15%	20 Agt 2026
CVE-2026-72844 The Lean 4 kernel does not verify that the structure named in a projection expression matches the type of the value being projected, and environment::add_inductive in src...	6.3 Medium	—	0,19%	20 Agt 2026
CVE-2026-63495 Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alpha, the libevent WebSocket server in ws.c accumulates fragmented frames in evws->incomplete...	7.5 High	—	0,61%	20 Agt 2026
CVE-2026-63388 Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_socket_set_conn...	8.4 High	—	0,14%	20 Agt 2026
CVE-2026-63387 Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels formats a n...	7.0 High	—	0,42%	20 Agt 2026
CVE-2026-63385 Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttp_decode_uri_internal decodes percent...	9.2 Critical	—	0,55%	20 Agt 2026
CVE-2026-63384 Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in event_tagging.c when evtag_unmarshal_header us...	8.7 High	—	0,52%	20 Agt 2026
CVE-2026-63383 Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in event_tagging.c when decode_tag_inter...	8.7 High	—	0,49%	20 Agt 2026
CVE-2026-63382 Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding header...	9.2 Critical	—	0,78%	20 Agt 2026
CVE-2026-63381 Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbuffer_add_buffer_reference processes an outp...	5.8 Medium	—	0,16%	20 Agt 2026
CVE-2026-63380 Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evws_new_session enters its error path after...	5.7 Medium	—	0,14%	20 Agt 2026
CVE-2026-63379 Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttp_read_trailer and merges them...	6.3 Medium	—	0,71%	20 Agt 2026
CVE-2026-54625 django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declare...	4.8 Medium	—	0,18%	20 Agt 2026
CVE-2026-54623 django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the move_plugin endpoint in cms/admin/placehol...	7.1 High	—	0,49%	20 Agt 2026
CVE-2026-53425 Insufficient Verification of Data Authenticity vulnerability in dropbox samly allows an attacker to establish an authenticated session using a SAML response the service p...	7.6 High	—	0,22%	20 Agt 2026
CVE-2026-53424 Authentication Bypass by Capture-replay vulnerability in dropbox samly allows an attacker to authenticate as the subject of a captured SAML assertion by resubmitting it....	9.1 Critical	—	0,60%	20 Agt 2026
CVE-2026-2334 An issue was discovered in vsDesk v14.0101. An authenticated attacker with administrative privileges can bypass client-side file validation in the "Import via CSV" compon...	9.4 Critical	—	0,72%	20 Agt 2026
CVE-2026-77176 A flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containers guest protection, a malicious host operator can exploit insufficien...	8.1 High	—	0,48%	20 Agt 2026
CVE-2026-77025 A weakness has been identified in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /viewappointmentpending.php. This manipulation of...	6.3 Medium	—	0,33%	20 Agt 2026
CVE-2026-77022 A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function sub_44B438 of the file /cgi-bin/mbox-config?method=SET&section=ptes...	9.9 Critical	—	0,79%	20 Agt 2026
CVE-2026-77020 A vulnerability was identified in CodeAstro Apartment Visitor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file password-recov...	7.3 High	—	0,43%	20 Agt 2026
CVE-2026-77019 A vulnerability was determined in CodeAstro Apartment Visitor Management System 1.0. Affected is an unknown function of the file /apartment-visitor/forgotpw.php. Executin...	7.3 High	—	0,43%	20 Agt 2026
CVE-2026-71492 Banks generates meaningful LLM prompts using a simple template language. Prior to version 2.4.5, DirectoryPromptRegistry.set() in src/banks/registries/directory.py interp...	6.0 Medium	—	0,47%	20 Agt 2026
CVE-2026-71428 The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. From 0....	9.3 Critical	—	0,44%	20 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.