Katalog CVE (hal. 62) — KUTIM-CSIRT

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 258.286 (Critical 35.887 · High 103.298 · KEV 1.745 · sejak 2020) · Pembaruan terakhir: 15 Okt 2026, 12:38 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 3.051–3.100 dari 258.286 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-109668 Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that handle party records, allowing authenticat...	4.3 Medium	—	0,19%	12 Okt 2026
CVE-2026-109667 Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the req...	8.8 High	—	0,25%	12 Okt 2026
CVE-2026-109666 Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks o...	6.5 Medium	—	0,22%	12 Okt 2026
CVE-2026-109665 Frappe ERPNext before 15.108.0 and 16.x before 16.18.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks....	4.3 Medium	—	0,19%	12 Okt 2026
CVE-2026-109664 Frappe ERPNext before 15.112.0 contains a missing authorization vulnerability that allows authenticated users with a common operational role to modify records beyond thei...	4.3 Medium	—	0,19%	12 Okt 2026
CVE-2026-109663 Frappe ERPNext before 15.113.0 and 16.x before 16.22.0 contains an SQL injection vulnerability caused by missing input validation in some endpoints. Authenticated remote...	6.5 Medium	—	0,34%	12 Okt 2026
CVE-2026-109662 Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability in a public portal form that accepts unauthenticated submissio...	6.1 Medium	—	0,21%	12 Okt 2026
CVE-2026-109661 Frappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization check...	6.5 Medium	—	0,26%	12 Okt 2026
CVE-2026-109660 Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 has certain endpoints that do not enforce proper authorization checks on operations that modify production records....	6.5 Medium	—	0,22%	12 Okt 2026
CVE-2026-109659 Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks....	6.5 Medium	—	0,26%	12 Okt 2026
CVE-2026-109658 Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization chec...	6.5 Medium	—	0,26%	12 Okt 2026
CVE-2026-109657 Frappe ERPNext 16.x before 16.27.0 contains a stored cross-site scripting vulnerability that allows users with edit rights to inject script through a record name rendered...	5.4 Medium	—	0,17%	12 Okt 2026
CVE-2026-109656 Frappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization chec...	6.5 Medium	—	0,26%	12 Okt 2026
CVE-2026-109655 Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role-based authoriz...	6.5 Medium	—	0,22%	12 Okt 2026
CVE-2026-109654 Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in which certain endpoints fail to verify that the caller may read a...	5.4 Medium	—	0,17%	12 Okt 2026
CVE-2026-109653 Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability because record fields are rendered into an HTML attribute cont...	7.3 High	—	0,21%	12 Okt 2026
CVE-2026-109652 Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated be...	8.8 High	—	0,31%	12 Okt 2026
CVE-2026-109651 Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a server-side request forgery vulnerability caused by a configuration field, writable by common operationa...	4.3 Medium	—	0,20%	12 Okt 2026
CVE-2026-109650 Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization check...	6.5 Medium	—	0,26%	12 Okt 2026
CVE-2026-109649 Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of...	6.5 Medium	—	0,28%	12 Okt 2026
CVE-2026-109648 Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers...	6.5 Medium	—	0,28%	12 Okt 2026
CVE-2026-109647 Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in multiple endpoints caused by missing input validation. Authenticated att...	6.5 Medium	—	0,28%	12 Okt 2026
CVE-2026-109646 Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated low-privil...	6.5 Medium	—	0,28%	12 Okt 2026
CVE-2026-109645 Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks....	6.5 Medium	—	0,25%	12 Okt 2026
CVE-2026-109644 Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization check...	6.5 Medium	—	0,26%	12 Okt 2026
CVE-2026-109643 Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in certain project-related endpoints that fail to enforce permission...	6.5 Medium	—	0,26%	12 Okt 2026
CVE-2026-109642 Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization chec...	4.3 Medium	—	0,20%	12 Okt 2026
CVE-2026-109641 Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce authorization checks. Unau...	6.5 Medium	—	0,32%	12 Okt 2026
CVE-2026-109640 Frappe ERPNext before 16.22.0 contains a missing authorization vulnerability that allows authenticated users to modify records by invoking endpoints lacking proper author...	8.1 High	—	0,22%	12 Okt 2026
CVE-2026-109639 Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of...	6.5 Medium	—	0,28%	12 Okt 2026
CVE-2026-109638 Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Authenticated attacker...	6.5 Medium	—	0,28%	12 Okt 2026
CVE-2026-109637 Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability that allows authenticated users to modify master data beyond their permitted role. Attackers...	6.5 Medium	—	0,22%	12 Okt 2026
CVE-2026-109636 Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks....	6.5 Medium	—	0,26%	12 Okt 2026
CVE-2026-109635 Frappe ERPNext before 15.105.0 and 16.x before 16.15.0 contains a missing authorization vulnerability in certain document creation endpoints that fail to verify that the...	4.3 Medium	—	0,19%	12 Okt 2026
CVE-2026-109634 Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers...	4.9 Medium	—	0,30%	12 Okt 2026
CVE-2026-109633 Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-site scripting vulnerability because content submitted through a public-facing booking page...	8.1 High	—	0,25%	12 Okt 2026
CVE-2026-109632 Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization chec...	6.5 Medium	—	0,26%	12 Okt 2026
CVE-2026-109631 Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation, allowing crafted input to alt...	6.5 Medium	—	0,28%	12 Okt 2026
CVE-2026-109630 Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks....	4.3 Medium	—	0,20%	12 Okt 2026
CVE-2026-109629 Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in an endpoint that sends transactional email through the site's con...	4.3 Medium	—	0,19%	12 Okt 2026
CVE-2026-109628 Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role checks when mo...	6.5 Medium	—	0,22%	12 Okt 2026
CVE-2026-109627 Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks....	6.5 Medium	—	0,26%	12 Okt 2026
CVE-2026-109626 Frappe ERPNext before 16.34.2 contains an SQL injection vulnerability caused by missing input validation in multiple endpoints. Authenticated attackers with low privilege...	6.5 Medium	—	0,28%	12 Okt 2026
CVE-2026-109625 Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce role-based authorization c...	6.5 Medium	—	0,26%	12 Okt 2026
CVE-2026-109624 Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks....	6.5 Medium	—	0,26%	12 Okt 2026
CVE-2026-109623 Frappe ERPNext before 15.121.1 and 16.x before 16.34.2 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization check...	5.4 Medium	—	0,17%	12 Okt 2026
CVE-2026-109622 Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization chec...	4.3 Medium	—	0,19%	12 Okt 2026
CVE-2026-109621 Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an authorization bypass in an endpoint that honours a caller-supplied flag disabling its own permission en...	6.5 Medium	—	0,27%	12 Okt 2026
CVE-2026-109617 Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization check...	7.1 High	—	0,22%	12 Okt 2026
CVE-2026-109616 Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization chec...	7.1 High	—	0,24%	12 Okt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.