Katalog CVE (hal. 63) — KUTIM-CSIRT

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 258.286 (Critical 35.887 · High 103.298 · KEV 1.745 · sejak 2020) · Pembaruan terakhir: 15 Okt 2026, 12:38 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 3.101–3.150 dari 258.286 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-109615 Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks d...	6.5 Medium	—	0,25%	12 Okt 2026
CVE-2026-109614 Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticated users to read financial data beyond their permitted role. Attackers...	6.5 Medium	—	0,26%	12 Okt 2026
CVE-2026-109613 Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization chec...	7.1 High	—	0,27%	12 Okt 2026
CVE-2026-109612 Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-site scripting vulnerability in a report view that interpolates stored record names into ma...	7.3 High	—	0,21%	12 Okt 2026
CVE-2026-109611 Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization check...	4.3 Medium	—	0,19%	12 Okt 2026
CVE-2026-109610 Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks....	6.5 Medium	—	0,22%	12 Okt 2026
CVE-2026-109609 Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation. Authenticated attackers with...	6.5 Medium	—	0,28%	12 Okt 2026
CVE-2026-109608 Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in several endpoints that lack input validation. Any authenticated user, in...	8.8 High	—	0,25%	12 Okt 2026
CVE-2026-109604 Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability because a tool view interpolates stored record names into mark...	7.3 High	—	0,21%	12 Okt 2026
CVE-2026-109603 Frappe Framework 15.x before 15.107.3 and 16.x before 16.17.0 relies on a vulnerable pdfkit library (CVE-2025-26240) for PDF generation, enabling server-side request forg...	3.3 Low	—	0,24%	12 Okt 2026
CVE-2026-109602 Frappe before 15.118.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability in dashboard chart filters because jQuery renders entered filter value...	5.4 Medium	—	0,17%	12 Okt 2026
CVE-2026-109601 Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML. Attackers who...	6.5 Medium	—	0,28%	12 Okt 2026
CVE-2026-109600 Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sending Document Follow email notifications. A disabled...	5.3 Medium	—	0,24%	12 Okt 2026
CVE-2026-109599 Frappe before 15.113.3 and 16.x before 16.25.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Auth...	4.3 Medium	—	0,19%	12 Okt 2026
CVE-2026-109598 Frappe Framework before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in the whitelisted send_sms API endpoint, which does not verify th...	4.3 Medium	—	0,19%	12 Okt 2026
CVE-2026-109597 Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit h...	5.4 Medium	—	0,17%	12 Okt 2026
CVE-2026-109596 Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via nested-mou...	5.5 Medium	—	0,14%	12 Okt 2026
CVE-2026-109595 Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ESBuild's fal...	5.5 Medium	—	0,14%	12 Okt 2026
CVE-2026-109574 Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through the Sass c...	5.5 Medium	—	0,14%	12 Okt 2026
CVE-2026-109573 phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single quotes with backslashes that are treated literally when MySQL or...	8.1 High	—	0,26%	12 Okt 2026
CVE-2026-109572 Open WebUI from 0.8.6 before 0.11.4 contains a privilege escalation vulnerability in the terminal proxy that allows authenticated users to reach the Terminals administrat...	7.6 High	—	0,30%	12 Okt 2026
CVE-2026-108938 A flaw has been found in code-projects Matrimonial System 1.0. This issue affects some unknown processing of the file db/matrimony.sql. This manipulation causes files or...	5.3 Medium	—	0,31%	12 Okt 2026
CVE-2026-108937 A vulnerability was detected in code-projects Online Ticket Reservation System 1.0. This vulnerability affects unknown code of the file /database/medallion.sql. The manip...	5.3 Medium	—	0,33%	12 Okt 2026
CVE-2026-108936 A security vulnerability has been detected in Edimax BR-6208AC 1.32. This affects an unknown part of the file /goform/formQoS of the component QoS Page. The manipulation...	2.4 Low	—	0,20%	12 Okt 2026
CVE-2026-108935 A weakness has been identified in Edimax BR-6208AC 1.32. Affected by this issue is some unknown functionality of the file /goform/formPortFw of the component Port Forward...	2.4 Low	—	0,25%	12 Okt 2026
CVE-2026-102627 IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of file paths during...	8.8 High	—	0,53%	12 Okt 2026
CVE-2025-71432 Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vulnerability due to missing input validation on a certain page, allowing...	8.1 High	—	0,27%	12 Okt 2026
CVE-2025-71431 Frappe before 14.99.2 and 15.x before 15.86.0 contains an LDAP injection vulnerability because certain endpoints do not sanitize user-supplied parameters before using the...	5.3 Medium	—	0,25%	12 Okt 2026
CVE-2025-71430 Frappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross-site scripting vulnerability in the leaderboard page because user names are rendered without proper...	5.4 Medium	—	0,17%	12 Okt 2026
CVE-2024-58391 Frappe before 14.58.0 and 15.x before 15.4.0 contains a cross-site scripting vulnerability in printview because printview parameters are not escaped before being rendered...	4.3 Medium	—	0,26%	12 Okt 2026
CVE-2024-58390 Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege management vulnerability involving a certain document action that permits escalation from the...	8.8 High	—	0,27%	12 Okt 2026
CVE-2023-54412 Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-guest user...	6.5 Medium	—	0,22%	12 Okt 2026
CVE-2023-54411 Frappe framework before 13.32.0 uses weak authentication for print view access, because the print view key can be derived from data exposed by other whitelisted API endpo...	5.9 Medium	—	0,26%	12 Okt 2026
CVE-2023-54410 Frappe before 13.22.0 contains an improper authorization vulnerability that allows authenticated users to rename documents by exploiting a missing permission check. Attac...	4.3 Medium	—	0,19%	12 Okt 2026
CVE-2023-54409 Frappe before 13.46.1 and 14.x before 14.20.0 contains a cross-site scripting vulnerability because the html2text function weakly sanitizes user input. Authenticated atta...	4.8 Medium	—	0,22%	12 Okt 2026
CVE-2023-54408 Frappe before 13.52.0 and 14.x before 14.31.0 contains an HTML injection vulnerability caused by weak escaping of user-supplied content rendered in pages. Attackers can s...	6.1 Medium	—	0,20%	12 Okt 2026
CVE-2023-54407 Frappe 14.x before 14.45.0 contains an information disclosure vulnerability that allows users with error log access to view secrets stored in local variables captured in...	4.9 Medium	—	0,31%	12 Okt 2026
CVE-2023-54406 Frappe before 14.59.0 and 15.x before 15.5.0 contains a sandbox flaw where the frappe.flags.in_safe_exec global flag can become False during Server Script execution when...	4.9 Medium	—	0,32%	12 Okt 2026
CVE-2026-92876 IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to uncontrolled recursion.	7.5 High	—	0,31%	12 Okt 2026
CVE-2026-90921 IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper handling of malformed frames, resulting in termination o...	7.5 High	—	0,31%	12 Okt 2026
CVE-2026-90920 IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute arbitrary code due to improper control of code generation.	9.8 Critical	—	0,54%	12 Okt 2026
CVE-2026-90912 IBM Maximo AI Service 9.1.0, and 9.2.0 SaaS could allow a remote attacker to cause a denial of service due to uncontrolled recursion.	7.5 High	—	0,31%	12 Okt 2026
CVE-2026-90911 IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.	7.5 High	—	0,31%	12 Okt 2026
CVE-2026-84312 Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the configured Casdoor application name as a constant OAuth state value and...	7.1 High	—	0,18%	12 Okt 2026
CVE-2026-54459 FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creat...	4.3 Medium	—	0,10%	12 Okt 2026
CVE-2026-53922 odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on the same link can first obtain tw...	6.5 Medium	—	0,35%	12 Okt 2026
CVE-2026-49484 Code for IBM i is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, src/ui/views/objectBrowser.ts stores Ob...	5.1 Medium	—	0,24%	12 Okt 2026
CVE-2026-49483 Code for IBMi is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, IBMi components implementing IBMiCompone...	8.9 High	—	0,14%	12 Okt 2026
CVE-2026-44828 Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init_step/ through init_step_api without authentication, authorization, o...	9.3 Critical	—	0,36%	12 Okt 2026
CVE-2026-41210 Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. In version 6.1.0 and earlier, after a victim initiates a streaming session to a malicious h...	6.5 Medium	—	0,31%	12 Okt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.