Katalog CVE (hal. 635)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 264.414 (Critical 36.443 · High 105.610 · KEV 1.760 · sejak 2020) · Pembaruan terakhir: 28 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 31.701–31.750 dari 264.414 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-75919 phpmyfaq phpMyFAQ before 4.1.7 contains an authentication bypass vulnerability in SetupController that allows unauthenticated attackers to run database migrations and create confi...	5.3 Medium	—	0,55%	19 Agt 2026
CVE-2026-75918 phpmyfaq phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user tracking is enabled. Unauthenticated attackers can read the tracking f...	8.8 High	—	0,49%	19 Agt 2026
CVE-2026-75917 SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file-tree picker's hover-tooltip generation (app/src/util/pathName.ts, getLeaf()/movePathTo()) u...	8.6 High	—	0,23%	19 Agt 2026
CVE-2026-75916 SiYuan through 3.7.3 contains a cross-site scripting vulnerability in the '((' block-reference autocomplete hint popup. In genHintItemHTML() (app/src/protyle/hint/extend....	8.6 High	—	0,23%	19 Agt 2026
CVE-2026-75148 cgltf through 1.15 contains an integer overflow vulnerability in the non-sparse accessor bounds check within cgltf_validate() that allows remote attackers to cause memory...	6.1 Medium	—	0,20%	19 Agt 2026
CVE-2026-75114 Joomla Extension - yootheme.com - Open redirect in CommentController::twitterAuthenticate() in Zoo < 4.1.64 - The referer request parameter is passed straight to setRedir...	5.1 Medium	—	0,41%	19 Agt 2026
CVE-2026-74804 Advisory Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element() in Zoo < 4.1.64 - The filter_type request value is interpolated into the quer...	9.3 Critical	—	0,39%	19 Agt 2026
CVE-2026-74803 Advisory Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64 - The image element accepts arbitrary files when the client-supplied Content-Type...	10.0 Critical	—	0,43%	19 Agt 2026
CVE-2026-71694 An issue in Berkeley Out-of-Order Machine (BOOM) / BoomTile RTL benchmark v1.2 2d08d0d8b4563212175212f9db0e69f6e68c9619 allows a remote attacker to execute arbitrary code...	8.8 High	—	0,38%	19 Agt 2026
CVE-2026-70424 dell openmanage enterprise Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A low privi...	6.5 Medium	—	0,45%	19 Agt 2026
CVE-2026-70423 dell openmanage enterprise Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with remot...	6.5 Medium	—	0,38%	19 Agt 2026
CVE-2026-70422 dell openmanage enterprise Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low...	8.8 High	—	0,44%	19 Agt 2026
CVE-2026-70421 dell openmanage enterprise Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Privilege Management vulnerability. A high privileged attacker with remote access could potentia...	7.2 High	—	0,46%	19 Agt 2026
CVE-2026-65612 nnn does not sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or inside an extracted archive whos...	5.1 Medium	—	0,44%	19 Agt 2026
CVE-2026-65611 nnn does not sanitize the path variable. An attacker can create a directory on a shared filesystem, removable media, or inside an extracted archive whose name contains a...	5.1 Medium	—	0,44%	19 Agt 2026
CVE-2026-65610 nnn stores homelen variable as uchar_t, which can only represent values in the range 0-255. An attacker who can influence the victim's execution environment can provide a...	2.4 Low	—	0,17%	19 Agt 2026
CVE-2026-65609 nnn is vulnerable to Out-of-Bound write vulnerability. Due to lack of validation of attacker-controlled length fields deserialized from a session file, a crafted session...	2.4 Low	—	0,15%	19 Agt 2026
CVE-2026-56088 dell openmanage enterprise Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low...	8.8 High	—	0,44%	19 Agt 2026
CVE-2026-54796 dell openmanage enterprise Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability....	7.2 High	—	2,0%	19 Agt 2026
CVE-2026-54795 dell openmanage enterprise Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability....	8.8 High	—	2,3%	19 Agt 2026
CVE-2026-54794 dell openmanage enterprise Dell OpenManage Enterprise, versions prior to 4.7.0, contains a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker with remote access could pot...	7.2 High	—	0,28%	19 Agt 2026
CVE-2026-51367 An issue in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to obtain sensitive information via the api_vedo/chat endpoint and the utente_chat paramete...	7.5 High	—	0,60%	19 Agt 2026
CVE-2026-51366 SQL Injection vulnerability in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to execute arbitrary code via the api_vedo/chat endpoint and the utente_...	9.9 Critical	—	0,78%	19 Agt 2026
CVE-2026-50720 The Ingenic T31 SoC boot ROM flash-boot verification path compares only a single 32-bit word of the RSA signature output against a single 32-bit word of the SHA-256 paylo...	6.4 Medium	—	0,13%	19 Agt 2026
CVE-2026-50719 The Ingenic T41, and probably also T32, T40, and A1 SoC boot ROMs parse and execute an attacker-controlled init table from the SPL header before checking the secure boot...	6.8 Medium	—	0,15%	19 Agt 2026
CVE-2026-43961 A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark ope...	7.8 High	—	0,16%	19 Agt 2026
CVE-2026-16019 Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Faydam Innovation Inc. FAYDAM Datalogger allows SQL Injection. This...	9.8 Critical	—	0,47%	19 Agt 2026
CVE-2024-58376 Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers with commit ac...	6.7 Medium	—	0,69%	19 Agt 2026
CVE-2020-37267 Renovate versions >=19.180.0 and <23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git http.extrahead...	7.5 High	—	0,43%	19 Agt 2026
CVE-2019-25766 Renovate versions >= 13.87.0 and <= 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is f...	7.5 High	—	0,43%	19 Agt 2026
CVE-2026-76235 A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a...	7.5 High	—	0,61%	19 Agt 2026
CVE-2026-73394 Unauthenticated Broken Access Control in Stitch Express <= 1.9.0 versions.	7.5 High	—	0,35%	19 Agt 2026
CVE-2026-73391 Unauthenticated SQL Injection in Total Donations <= 2.0.5 versions.	9.3 Critical	—	0,40%	19 Agt 2026
CVE-2026-73390 Unauthenticated Privilege Escalation in Total Donations <= 2.0.5 versions.	9.8 Critical	—	0,48%	19 Agt 2026
CVE-2026-73389 Unauthenticated PHP Object Injection in Kalles Addons <= 1.0.6 versions.	9.8 Critical	—	0,56%	19 Agt 2026
CVE-2026-73388 Unauthenticated SQL Injection in Nikstore Core <= 1.5 versions.	9.3 Critical	—	0,40%	19 Agt 2026
CVE-2026-73387 Unauthenticated Local File Inclusion in Resido <= 1.5 versions.	8.1 High	—	0,47%	19 Agt 2026
CVE-2026-73386 Unauthenticated Sensitive Data Exposure in Track Geolocation Of Users Using Contact Form 7 <= 3.0.2 versions.	7.5 High	—	0,42%	19 Agt 2026
CVE-2026-73385 Unauthenticated Broken Access Control in Outranking Plugin Options <= 1.1.3 versions.	7.5 High	—	0,35%	19 Agt 2026
CVE-2026-73384 Unauthenticated Sensitive Data Exposure in Pay with Contact Form 7 <= 1.0.4 versions.	7.5 High	—	0,42%	19 Agt 2026
CVE-2026-73364 Customer PHP Object Injection in Flexible Subscriptions <= 1.8.1 versions.	9.8 Critical	—	0,56%	19 Agt 2026
CVE-2026-73363 Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce < 2.0.8 versions.	6.5 Medium	—	0,30%	19 Agt 2026
CVE-2026-73354 Unauthenticated Cross Site Scripting (XSS) in SimplyRETS Real Estate IDX <= 3.2.8 versions.	7.1 High	—	0,25%	19 Agt 2026
CVE-2026-73347 Unauthenticated Privilege Escalation in TrueBooker <= 1.2.6 versions.	9.8 Critical	—	0,48%	19 Agt 2026
CVE-2026-73185 Unauthenticated SQL Injection in NGG Smart Image Search < 4.0.0 versions.	9.3 Critical	—	0,40%	19 Agt 2026
CVE-2026-73184 Unauthenticated Cross Site Scripting (XSS) in Global Gallery <= 11.1.2 versions.	7.1 High	—	0,25%	19 Agt 2026
CVE-2026-73183 Unauthenticated SQL Injection in Maps Marker Pro <= 4.32 versions.	9.3 Critical	—	0,40%	19 Agt 2026
CVE-2026-73182 Unauthenticated Cross Site Scripting (XSS) in BBQ Pro <= 3.9 versions.	7.1 High	—	0,25%	19 Agt 2026
CVE-2026-67364 Advisory Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2 - The form's optional custom-PHP post-submission handler is executed via eval(). T...	10.0 Critical	—	0,50%	19 Agt 2026
CVE-2026-67363 Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2 - The stripeCharges and payAuthorize endpoints accept the charge total from...	7.7 High	—	0,56%	19 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.