Katalog CVE (hal. 637)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 264.555 (Critical 36.456 · High 105.703 · KEV 1.760 · sejak 2020) · Pembaruan terakhir: 29 Okt 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 31.801–31.850 dari 264.555 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-76245 stigmem (pip package stigmem-node) version 0.9.0a1 contains a timestamp-handling mismatch in federation peer-token validation that can cause valid peer tokens to be incor...	7.1 High	—	0,24%	19 Agt 2026
CVE-2026-76244 stigmem-node contains an insecure default configuration vulnerability that allows federation traffic to traverse networks without mTLS protection when non-loopback endpoi...	9.1 Critical	—	0,27%	19 Agt 2026
CVE-2026-76243 stigmem versions before 0.9.0a2 allow unauthenticated access when authentication is disabled on non-loopback deployments. Attackers can perform read, write, and federatio...	9.2 Critical	—	0,56%	19 Agt 2026
CVE-2026-76242 stigmem-node 0.9.0a1 accepts federation peer key material during peer registration without a separate administrator out-of-band fingerprint approval step. On nodes that a...	9.1 Critical	—	0,35%	19 Agt 2026
CVE-2026-76241 stigmem-node 0.9.0a1 allows plugin signature enforcement to be disabled via a single configuration flag without a second explicit acknowledgment. If that setting is carri...	7.3 High	—	0,12%	19 Agt 2026
CVE-2026-76240 stigmem-node 0.9.0a1 interpolates Postgres backend schema identifiers into SQL strings without defensive quoting. In the affected code path the schema value is operator-c...	7.5 High	—	0,38%	19 Agt 2026
CVE-2026-76239 Stigmem before 0.9.0a11 fails to validate the delivery_address parameter when creating webhook subscriptions, allowing authenticated users to specify internal loopback an...	6.3 Medium	—	0,32%	19 Agt 2026
CVE-2026-76238 stigmem versions before 0.9.0a12 contain a broken object level authorization vulnerability in the decay sweep endpoint that allows authenticated attackers with write cred...	7.2 High	—	0,36%	19 Agt 2026
CVE-2026-76237 stigmem-node before 0.9.0a12 contains a broken object level authorization (cross-tenant BOLA) vulnerability in the quarantine review endpoints. On multi-tenant deployment...	8.6 High	—	0,36%	19 Agt 2026
CVE-2026-76236 stigmem-node before 0.9.0a12 contains a cross-tenant broken object level authorization (BOLA) flaw in the RTBF (right-to-be-forgotten) tombstone mechanism. issue_tombston...	7.2 High	—	0,36%	19 Agt 2026
CVE-2026-76234 libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check length and cla...	7.5 High	—	0,31%	19 Agt 2026
CVE-2026-76233 Renovate versions from 39.53.0 before 40.33.0 contain a command injection vulnerability in the gleam manager where the depName parameter is appended to gleam deps update...	6.7 Medium	—	1,0%	19 Agt 2026
CVE-2026-76232 Renovate versions from 31.51.0 before 40.33.0 contain a command injection vulnerability in the helmv3 manager where the repository parameter is appended to helm registry...	6.7 Medium	—	1,0%	19 Agt 2026
CVE-2026-76231 Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appended to instal...	6.7 Medium	—	1,0%	19 Agt 2026
CVE-2026-76230 Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended to npm inst...	6.7 Medium	—	1,0%	19 Agt 2026
CVE-2026-76229 Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names are appended...	6.7 Medium	—	1,0%	19 Agt 2026
CVE-2026-76228 Renovate versions >=32.124.0 and before 42.68.5 (and Mend renovate-ce/renovate-ee before 13.3.0) contain a command injection vulnerability in Gradle Wrapper artifact hand...	6.7 Medium	—	0,96%	19 Agt 2026
CVE-2026-76227 Renovate versions from 42.68.1 before 42.96.3 and from 43.0.0 before 43.4.4, including the renovate/renovate Docker images, and Mend Renovate CE/EE images (renovate-ce, r...	5.5 Medium	—	0,15%	19 Agt 2026
CVE-2026-76226 Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attack...	6.3 Medium	—	0,29%	19 Agt 2026
CVE-2026-76225 ArcadeDB before 26.8.1 contains a server-side request forgery vulnerability in the OpenCypher LOAD CSV implementation that fails to validate HTTP/HTTPS URLs. Authenticate...	7.7 High	—	0,35%	19 Agt 2026
CVE-2026-76224 ArcadeDB before 26.8.1 (arcadedb-gremlin, affected <= 26.7.3) contains a remote code execution vulnerability in its Gremlin query engine. Although the engine defaults to...	8.8 High	—	0,85%	19 Agt 2026
CVE-2026-76223 ArcadeDB (com.arcadedb) versions 26.7.3 and earlier fail to enforce the UPDATE_SCHEMA permission check when a DEFINE FUNCTION statement targets an already-existing functi...	7.1 High	—	0,35%	19 Agt 2026
CVE-2026-76222 gitpython project gitpython GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths outside the...	8.2 High	—	0,42%	19 Agt 2026
CVE-2026-76221 gitpython project gitpython GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by inje...	8.8 High	—	0,77%	19 Agt 2026
CVE-2026-76220 gitpython project gitpython GitPython before 3.1.58 contains a command execution vulnerability in the check_unsafe_options guard that can be bypassed by combining a single-character kwarg with split...	8.8 High	—	0,91%	19 Agt 2026
CVE-2026-76219 gitpython project gitpython GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.from_tree, IndexFile.reset, and IndexFile.merge_tree methods that append c...	8.1 High	—	0,54%	19 Agt 2026
CVE-2026-76218 gitpython project gitpython GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template p...	8.8 High	—	0,83%	19 Agt 2026
CVE-2026-76217 gitpython project gitpython GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove() and Head.checkout(). Attackers can supply --pat...	6.5 Medium	—	0,41%	19 Agt 2026
CVE-2026-76216 Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three...	7.5 High	—	0,36%	19 Agt 2026
CVE-2026-76215 phpmyfaq phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments and attachments. Unauthenticated attackers can retri...	5.3 Medium	—	0,35%	19 Agt 2026
CVE-2026-76214 phpmyfaq phpMyFAQ before 4.1.7 fails to persist the WebAuthn login challenge generated by prepareForLogin, because neither WebAuthn controller saves the mutated key objects back t...	7.4 High	—	0,39%	19 Agt 2026
CVE-2026-76213 phpmyfaq phpMyFAQ before 4.1.7 contains a brute-force vulnerability in the two-factor authentication step where the failure counter is session-scoped and reset on each successful...	7.4 High	—	0,45%	19 Agt 2026
CVE-2026-76212 phpmyfaq phpMyFAQ before 4.1.7, when configured to use PostgreSQL via the native pgsql PHP extension, declares an incorrect LIKE ESCAPE character ('=') in the Search/Database/Pgsq...	5.3 Medium	—	0,43%	19 Agt 2026
CVE-2026-76211 phpmyfaq phpMyFAQ before 4.1.7 fails to properly enforce CONFIGURATION_EDIT permission on admin API read endpoints for LDAP, Elasticsearch, OpenSearch, and dashboard configuration...	4.3 Medium	—	0,29%	19 Agt 2026
CVE-2026-76210 phpmyfaq phpMyFAQ before 4.1.6 does not adequately sanitize HTML in FAQ answers before generating PDFs via TCPDF. An attacker with permission to create or edit FAQ content can emb...	6.5 Medium	—	0,42%	19 Agt 2026
CVE-2026-76209 phpmyfaq phpMyFAQ versions before v4.1.6 fail to validate the security.enableRegistration setting in API endpoints, allowing attackers to create user accounts when registration is...	4.3 Medium	—	0,29%	19 Agt 2026
CVE-2026-76208 phpmyfaq phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass vulnerability in AuthLdap::create(). When LDAP authentication is enabled, after a successful LDAP b...	8.2 High	—	0,44%	19 Agt 2026
CVE-2026-76207 phpmyfaq phpMyFAQ before 4.1.7 contains a two-factor authentication bypass vulnerability where remember-me tokens are issued before 2FA verification completes. Attackers with vali...	8.1 High	—	0,46%	19 Agt 2026
CVE-2026-76206 phpmyfaq phpMyFAQ versions before 4.1.7 fail to validate active status in the PDF export endpoint, allowing unauthenticated attackers to retrieve draft FAQ metadata. Attackers can...	5.3 Medium	—	0,36%	19 Agt 2026
CVE-2026-76205 phpmyfaq phpMyFAQ before 4.1.7 contains a SQL injection vulnerability in the glossary create and update endpoints caused by truncating an escaped string before embedding it in a S...	8.1 High	—	0,43%	19 Agt 2026
CVE-2026-75920 phpmyfaq phpMyFAQ before v4.1.6 writes content backup ZIP archives to the web-accessible document root at content.zip, exposing sensitive files including database credentials. Una...	5.3 Medium	—	0,36%	19 Agt 2026
CVE-2026-75919 phpmyfaq phpMyFAQ before 4.1.7 contains an authentication bypass vulnerability in SetupController that allows unauthenticated attackers to run database migrations and create confi...	5.3 Medium	—	0,55%	19 Agt 2026
CVE-2026-75918 phpmyfaq phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user tracking is enabled. Unauthenticated attackers can read the tracking f...	8.8 High	—	0,49%	19 Agt 2026
CVE-2026-75917 SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file-tree picker's hover-tooltip generation (app/src/util/pathName.ts, getLeaf()/movePathTo()) u...	8.6 High	—	0,23%	19 Agt 2026
CVE-2026-75916 SiYuan through 3.7.3 contains a cross-site scripting vulnerability in the '((' block-reference autocomplete hint popup. In genHintItemHTML() (app/src/protyle/hint/extend....	8.6 High	—	0,23%	19 Agt 2026
CVE-2026-75148 cgltf through 1.15 contains an integer overflow vulnerability in the non-sparse accessor bounds check within cgltf_validate() that allows remote attackers to cause memory...	6.1 Medium	—	0,20%	19 Agt 2026
CVE-2026-75114 Joomla Extension - yootheme.com - Open redirect in CommentController::twitterAuthenticate() in Zoo < 4.1.64 - The referer request parameter is passed straight to setRedir...	5.1 Medium	—	0,41%	19 Agt 2026
CVE-2026-74804 Advisory Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element() in Zoo < 4.1.64 - The filter_type request value is interpolated into the quer...	9.3 Critical	—	0,39%	19 Agt 2026
CVE-2026-74803 Advisory Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64 - The image element accepts arbitrary files when the client-supplied Content-Type...	10.0 Critical	—	0,43%	19 Agt 2026
CVE-2026-71694 An issue in Berkeley Out-of-Order Machine (BOOM) / BoomTile RTL benchmark v1.2 2d08d0d8b4563212175212f9db0e69f6e68c9619 allows a remote attacker to execute arbitrary code...	8.8 High	—	0,38%	19 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.