Katalog CVE (hal. 620)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 264.331 (Critical 36.436 · High 105.591 · KEV 1.760 · sejak 2020) · Pembaruan terakhir: 28 Okt 2026, 12:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 30.951–31.000 dari 264.331 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-70383 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Estonian Information System Authority (RIA) DigiDoc4 client. This issue a...	8.4 High	—	0,19%	20 Agt 2026
CVE-2026-64972 ATutor is vulnerable to Reflected XSS via popup parameter in preview.php. An authenticated attacker can inject a double quote into the popup parameter, break out of the a...	4.8 Medium	—	0,41%	20 Agt 2026
CVE-2026-64971 ATutor is vulnerable to Reflected XSS in restore functionality. An attacker can provide a specially crafted URL that, when opened, results in arbitrary JavaScript executi...	4.8 Medium	—	0,50%	20 Agt 2026
CVE-2026-64970 ATutor is vulnerable to Stored Cross Site Scripting in registration functionality. An attacker can register a new account and enter a JavaScript payload in the phone fie...	5.1 Medium	—	0,46%	20 Agt 2026
CVE-2026-64969 ATutor is vulnerable to Insecure Direct Object Reference (IDOR) attack in profile picture related endpoints. Any authenticated user, including a student, can supply anoth...	5.3 Medium	—	0,36%	20 Agt 2026
CVE-2026-64968 ATutor is vulnerable to Server-Side request forgery in import functionalities. An authenticated administrator can make the server request arbitrary internal HTTP endpoint...	5.1 Medium	—	0,40%	20 Agt 2026
CVE-2026-64967 A path traversal vulnerability in ATutor's error log viewer allows an attacker with administrative privileges to access arbitrary files outside the intended logs director...	6.9 Medium	—	0,49%	20 Agt 2026
CVE-2026-64966 ATutor is vulnerable to a Path Traversal vulnerability in ZIP extraction functionality. An attacker with instructor privileges can upload and extract a specially crafted...	8.7 High	—	0,72%	20 Agt 2026
CVE-2026-64965 ATutor is vulnerable to Missing Authorization Check on Test and Question Import endpoints. A low-privileged authenticated user (e.g. a student) enrolled in a course can...	5.3 Medium	—	0,39%	20 Agt 2026
CVE-2026-64964 ATutor generates predictable email confirmation tokens due to the use of insufficiently random values in the account confirmation functionality. Due to the use of predict...	6.3 Medium	—	0,37%	20 Agt 2026
CVE-2026-64963 A path traversal vulnerability in ATutor allows an authenticated user to access files from other course directories when the AT_FORCE_GET_FILE configuration option is ena...	2.3 Low	—	0,53%	20 Agt 2026
CVE-2026-64962 ATutor is vulnerable to Cross-Site Request Forgery (CSRF) in profile update functionality. An attacker can craft a malicious website which, when visited by an authenticat...	5.1 Medium	—	0,22%	20 Agt 2026
CVE-2026-64961 ATutor is vulnerable to authentication bypass . Although a token validation check is present in the auto-login functionality, the values required for token validation rem...	6.3 Medium	—	0,48%	20 Agt 2026
CVE-2026-64960 ATutor Gameme module allows users to upload files of any type and extension without restriction. Due to improper handling of file uploads, files are stored in a web-acces...	8.7 High	—	0,63%	20 Agt 2026
CVE-2026-15706 Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application (BMS) allows...	9.8 Critical	—	0,64%	20 Agt 2026
CVE-2026-77118 A heap out-of-bounds write exists in the Photo CD (PCD) decoder of GraphicsMagick. In DecodeImage() (coders/pcd.c), the Huffman delta loop advances its output pointer wit...	8.4 High	—	0,17%	20 Agt 2026
CVE-2026-7485 Incorrect authorization in frozen BI aggregations in Checkmk <2.5.0p2, <2.4.0p29, <2.3.0p47, and all 2.2.0 versions allows an authenticated user with restricted host and...	2.3 Low	—	0,35%	20 Agt 2026
CVE-2026-76989 A security vulnerability has been detected in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. This impacts an unknown function of the file source/src/enet_en...	5.3 Medium	—	0,72%	20 Agt 2026
CVE-2026-76988 A weakness has been identified in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. This affects the function CipConnMgrClass::forward_open of the file cipconn...	5.3 Medium	—	0,72%	20 Agt 2026
CVE-2026-76987 A security flaw has been discovered in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. The impacted element is the function CipAttribute::GetAttrData/CipAttr...	7.3 High	—	0,53%	20 Agt 2026
CVE-2026-74011 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in revmakx InfiniteWP Client allows Blind SQL Injection. This issue af...	7.6 High	—	0,38%	20 Agt 2026
CVE-2026-28164 Cross-Site Request Forgery (CSRF) vulnerability in HashThemes Easy Elementor Addons allows Cross Site Request Forgery. This issue affects Easy Elementor Addons: from n/a...	9.6 Critical	—	0,20%	20 Agt 2026
CVE-2026-28163 Missing Authorization vulnerability in myCred New User Approve allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects New User Appro...	5.3 Medium	—	0,29%	20 Agt 2026
CVE-2026-21784 HCL IntelliOps Event Management (IEM) is affected by missing or insecure Cross-Origin Security headers. This issue makes the application's environment and resources susce...	4.8 Medium	—	0,24%	20 Agt 2026
CVE-2026-18482 Neo.mjs contains a command injection vulnerability within the FileSystemService.mjs component of the ai/mcp/server/file-system MCP server, where the checkSyntax() and run...	9.8 Critical	—	3,4%	20 Agt 2026
CVE-2025-62306 HCL IntelliOps Event Management (IEM) is affected by information omission. The lack of information breaks auditability and observability of a workflow. if an attacker wer...	5.0 Medium	—	0,28%	20 Agt 2026
CVE-2025-62300 HCL IntelliOps Event Management (IEM) is affected by a race condition. A "timing window" can occur where an attacker can modify the resource causing unpredictable behavio...	5.9 Medium	—	0,23%	20 Agt 2026
CVE-2025-62299 HCL IntelliOps Event Management (IEM) is affected by a least privileges violation which could allow an attacker to access the resource with the elevated privilege that co...	6.6 Medium	—	0,26%	20 Agt 2026
CVE-2026-77085 n8n n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG Agent tool. The tool sent requests to the user-supplied API URL using a raw H...	6.5 Medium	—	0,36%	20 Agt 2026
CVE-2026-77084 n8n n8n before 1.123.69 (and 2.x before 2.33.4 / 2.34.1) contains a code execution vulnerability in the Git node. The Git node executed certain repository-local git configura...	8.8 High	—	0,69%	20 Agt 2026
CVE-2026-77083 n8n n8n is a workflow automation platform. In versions prior to 1.123.69, 2.33.4, and 2.34.1, the JavaScript Code node's VM sandbox did not freeze the sandbox's Function.prot...	5.9 Medium	—	0,37%	20 Agt 2026
CVE-2026-77082 n8n n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contains a regular expression denial of service (ReDoS) vulnerability in the Filter and Switch nodes, whi...	4.3 Medium	—	0,47%	20 Agt 2026
CVE-2026-77081 n8n n8n before 1.123.69, 2.x before 2.33.4, and 2.x before 2.34.1 contain an allowed-domains bypass in the GraphQL node. When the node's Authentication parameter is set to ex...	7.1 High	—	0,38%	20 Agt 2026
CVE-2026-77080 n8n n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an arbitrary file read and write vulnerability in the Snowflake node, which passes free-form Exec...	8.8 High	—	0,57%	20 Agt 2026
CVE-2026-77079 n8n n8n before 2.34.1 and 2.33.4 contains an authorization bypass in the custom project role deletion (reassignment) path. When deleting a custom project role with a reassign...	8.8 High	—	0,45%	20 Agt 2026
CVE-2026-77077 n8n n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis functions b...	7.6 High	—	0,56%	20 Agt 2026
CVE-2026-77076 n8n n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain an information disclosure vulnerability in the GraphQL node. When a GraphQL request fails at the connection level...	6.5 Medium	—	0,49%	20 Agt 2026
CVE-2026-77075 n8n n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an expression injection vulnerability in resource-locator field link preview rendering. The edito...	7.3 High	—	0,46%	20 Agt 2026
CVE-2026-77074 n8n n8n versions before 1.123.69 contain a server-side request forgery vulnerability in the Edit Image node's Draw Text operation that allows authenticated users to inject MV...	6.5 Medium	—	0,36%	20 Agt 2026
CVE-2026-77073 n8n n8n versions before 2.34.1 contain a credential validation bypass in the MCP create_workflow_from_code tool when authentication type is set to an expression. Attackers wi...	4.3 Medium	—	0,35%	20 Agt 2026
CVE-2026-77072 n8n n8n before 1.123.69, 2.33.4, and 2.34.1 contains a stored cross-site scripting vulnerability in the Form node's completion page. The completion page applied its sandboxin...	7.6 High	—	0,31%	20 Agt 2026
CVE-2026-77071 n8n n8n before 1.123.69, 2.33.4, and 2.34.1 contains a PostgREST filter injection vulnerability in the Supabase node's Row Get Many, Delete, and Update operations, which buil...	9.8 Critical	—	0,62%	20 Agt 2026
CVE-2026-77070 n8n n8n before 1.123.69, 2.33.4, and 2.34.1 contains a NoSQL injection vulnerability in the MongoDB node's Find, Delete, and Aggregate operations, which parse the Query param...	9.8 Critical	—	0,51%	20 Agt 2026
CVE-2026-77069 n8n n8n before 1.123.69, 2.33.4, and 2.34.1 contains an SSRF protection bypass in the OAuth2 credential authorization-code-to-access-token exchange. While OAuth2 discovery an...	4.3 Medium	—	0,29%	20 Agt 2026
CVE-2026-77068 n8n n8n before 2.33.4 and 2.34.x before 2.34.1 contain a remote code execution vulnerability in the @n8n/workflow-sdk node-schema loader used for MCP node-schema loading. The...	8.8 High	—	0,93%	20 Agt 2026
CVE-2026-74021 Unauthenticated Broken Access Control in Chaplin <= 2.6.8 versions.	7.5 High	—	0,39%	20 Agt 2026
CVE-2026-74020 Unauthenticated Broken Access Control in Koji <= 2.2.1 versions.	7.5 High	—	0,39%	20 Agt 2026
CVE-2026-74019 Unauthenticated Broken Access Control in EPROLO Dropshipping <= 2.4.2 versions.	7.1 High	—	0,29%	20 Agt 2026
CVE-2026-74018 Subscriber Arbitrary File Upload in Warehouse Cargo <= 2.6.9 versions.	9.9 Critical	—	0,48%	20 Agt 2026
CVE-2026-74016 Subscriber Arbitrary File Upload in Smart Cleaning <= 4.8.6 versions.	9.9 Critical	—	0,48%	20 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.