Katalog CVE (hal. 666)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 264.825 (Critical 36.490 · High 105.809 · KEV 1.762 · sejak 2020) · Pembaruan terakhir: 29 Okt 2026, 12:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 33.251–33.300 dari 264.825 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-47721 FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, POST /api/scheduler and DELETE /api/scheduler in server/api/scheduler/index.js d...	6.3 Medium	—	0,43%	18 Agt 2026
CVE-2026-47720 FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the TDengine DAQ storage connector's escapeTdString function in server/runtime/s...	5.3 Medium	—	0,64%	18 Agt 2026
CVE-2026-47719 FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY Socket.IO handlers in server/runti...	8.2 High	—	0,59%	18 Agt 2026
CVE-2026-19671 Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives...	6.5 Medium	—	0,44%	18 Agt 2026
CVE-2026-19670 Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restricted path (e.g. /htadmin, /auth, /admin_login, /ar...	5.4 Medium	—	0,24%	18 Agt 2026
CVE-2026-12520 The Sierra Wireless HL7800 cellular modem driver (drivers/modem/vendor_standalone/hl7800.c, located at drivers/modem/hl7800.c in v4.4.0 and earlier) parses AT responses w...	6.4 Medium	—	0,29%	18 Agt 2026
CVE-2026-70667 Lemur manages TLS certificate creation. Prior to 1.9.3, _validate_revocation_url in lemur/certificates/verify.py checked the original CRL or OCSP URL but the later reques...	6.3 Medium	—	0,18%	18 Agt 2026
CVE-2026-65959 Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint() in go/vt/vttablet...	5.3 Medium	—	0,43%	18 Agt 2026
CVE-2026-55166 Lemur manages TLS certificate creation. Prior to 1.9.2, authenticated users could influence an ACME authority acme_url without an effective server-side destination restri...	9.9 Critical	—	0,29%	18 Agt 2026
CVE-2026-55165 Lemur manages TLS certificate creation. Prior to 1.9.2, the JWT verifier in lemur/auth/service.py:130-137 used fetch_token_header to read header_data["alg"] from an unver...	4.8 Medium	—	0,15%	18 Agt 2026
CVE-2026-55164 Lemur manages TLS certificate creation. Prior to 1.9.2, lemur.users.service.update assigned a replacement password directly to users.password, while lemur/users/models.py...	4.9 Medium	—	0,29%	18 Agt 2026
CVE-2026-55163 Lemur manages TLS certificate creation. Prior to 1.9.2, PUT /api/1/roles/ in lemur/roles/views.py:298 authorized updates with RoleMemberPermission(role_id), which allowed...	6.3 Medium	—	0,22%	18 Agt 2026
CVE-2026-55162 Lemur manages TLS certificate creation. Prior to 1.9.2, lemur/certificates/verify.py accepted CRL Distribution Point and OCSP responder URLs from uploaded certificate ext...	6.3 Medium	—	0,22%	18 Agt 2026
CVE-2026-47630 nvidia triton inference server NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execut...	5.5 Medium	—	0,18%	18 Agt 2026
CVE-2026-47629 nvidia triton inference server NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause improper input validation. A successful exploit might lead to denial of se...	7.5 High	—	0,67%	18 Agt 2026
CVE-2026-47628 nvidia triton inference server NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an allocation of resources without limits. A successful exploit might lead...	7.5 High	—	0,67%	18 Agt 2026
CVE-2026-47627 nvidia triton inference server NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause path traversal. A successful exploit might lead to denial of service.	9.8 Critical	—	0,73%	18 Agt 2026
CVE-2026-47606 nvidia triton inference server NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execut...	9.1 Critical	—	0,74%	18 Agt 2026
CVE-2026-24185 NVIDIA NVOS for network switches contains a vulnerability in the secure shell (SSH) server configuration component while PKA-only mode is enabled, where an administrator...	7.1 High	—	0,30%	18 Agt 2026
CVE-2026-24184 nvidia cumulus linux NVIDIA Cumulus Linux contains a vulnerability in the Link Layer Discovery Protocol (LLDP) daemon component, where an unauthenticated attacker on an adjacent network could...	8.8 High	—	0,44%	18 Agt 2026
CVE-2026-24183 nvidia cumulus linux NVIDIA Cumulus Linux contains a vulnerability in the user management component, where an unprivileged user could use improper privilege management on the system. A succes...	7.8 High	—	0,18%	18 Agt 2026
CVE-2026-17106 The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the dest...	7.1 High	—	0,44%	18 Agt 2026
CVE-2025-9211 Unescaped stored values in application security page in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privilege...	6.7 Medium	—	0,47%	18 Agt 2026
CVE-2025-9210 Missing signature validation in JSON Web Tokens in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via...	8.1 High	—	0,26%	18 Agt 2026
CVE-2021-43718 An Authentication Bypass vulnerability exists in EPSON EH-TW5350 EPSON 150075647YWWV110, which could let a remote malicious user cause a Denial of Service via specially c...	5.3 Medium	—	0,52%	18 Agt 2026
CVE-2026-75625 Kraken agents fail to verify peer-to-peer downloaded blobs against their requested SHA-256 digest before committing to the content-addressable cache, relying only on CRC3...	9.0 Critical	—	0,24%	18 Agt 2026
CVE-2026-75130 Context7 through 2.1.2 contains a prompt injection vulnerability that allows attackers to execute malicious instructions in connected AI coding agents by injecting unsani...	9.0 Critical	—	0,49%	18 Agt 2026
CVE-2026-74046 wazuh Wazuh 4.4.0 before 4.14.7 contains a denial of service vulnerability in the fdecompress_files() function within cluster.py that allows authenticated cluster peers to exha...	4.9 Medium	—	0,58%	18 Agt 2026
CVE-2026-74044 wazuh Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows authenticated cluster peers to delete arbitrary directory contents by supplying a traversal-...	6.5 Medium	—	0,60%	18 Agt 2026
CVE-2026-74039 wazuh Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 contain a denial of service vulnerability that allows authenticated attackers with allow_run_as enabled to exhaust CPU resources...	6.5 Medium	—	0,56%	18 Agt 2026
CVE-2026-74038 wazuh Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers to cause denial of service by enrolling an agent with a dot...	7.1 High	—	0,55%	18 Agt 2026
CVE-2026-73502 kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of servic...	5.3 Medium	—	0,51%	18 Agt 2026
CVE-2026-71880 Interpretation of untrusted input in template engine in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to access server-si...	7.6 High	—	0,48%	18 Agt 2026
CVE-2026-71879 Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authentica...	9.1 Critical	—	0,86%	18 Agt 2026
CVE-2026-71878 Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows rem...	9.2 Critical	—	0,86%	18 Agt 2026
CVE-2026-71551 Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. Prior to 18.13.0, the EXEC IPC handler in electron/ipc-handlers...	7.8 High	—	0,22%	18 Agt 2026
CVE-2026-69160 OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasPrefix(reque...	6.5 Medium	—	0,40%	18 Agt 2026
CVE-2026-68927 MobSF is a mobile application security testing tool used. Prior to 4.5.1, get_browsable_activities in mobsf/StaticAnalyzer/views/android/manifest_analysis.py validates on...	3.0 Low	—	0,33%	18 Agt 2026
CVE-2026-68924 MobSF is a mobile application security testing tool used. Prior to 4.5.1, the unzip function in mobsf/StaticAnalyzer/views/common/shared_func.py logs that an archive memb...	4.9 Medium	—	0,59%	18 Agt 2026
CVE-2026-68923 MobSF is a mobile application security testing tool used. Prior to 4.5.1, mobsf/MobSF/settings.py places django.middleware.csrf.CsrfViewMiddleware only in the deprecated...	6.5 Medium	—	0,26%	18 Agt 2026
CVE-2026-68922 MobSF is a mobile application security testing tool used. Prior to 4.5.1, find_icon_path_zip in mobsf/StaticAnalyzer/views/android/icon_analysis.py uses the Android manif...	5.5 Medium	—	0,46%	18 Agt 2026
CVE-2026-67921 Cross-Site Request Forgery (CSRF) vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigurer.java and the CsrfConfigurer.java components. This allows a...	9.3 Critical	—	0,30%	18 Agt 2026
CVE-2026-67920 An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the run.halo.app.migration.impl.MigrationServiceImpl.restoreWorkdir(), and org.springframew...	8.8 High	—	0,94%	18 Agt 2026
CVE-2026-67846 Berkeley Out-of-Order Machine (BOOM) commit 5223e44cfeb26f41380057a2eb4d651197475f69 contains a potential incorrect privilege assignment issue in the v3 and v4 NBDTLB imp...	7.8 High	—	0,16%	18 Agt 2026
CVE-2026-67262 Dell PowerStore contains a Missing Authorization vulnerability. An attacker with access to a mapped host could exploit this vulnerability to read from or write to LUNs th...	8.1 High	—	0,40%	18 Agt 2026
CVE-2026-66780 A flaw was found in the submariner-operator component. The `submariner-k8s-broker-cluster` Role, which is assigned to joined clusters, possesses excessive permissions. Th...	6.5 Medium	—	0,58%	18 Agt 2026
CVE-2026-63643 MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, the ADD_CALENDAR handler in defaultmodules/calendar/node_helper.js accepts an attacker-cont...	6.3 Medium	—	0,67%	18 Agt 2026
CVE-2026-63642 MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, checkArticleUrl in defaultmodules/newsfeed/node_helper.js accepts the CHECK_ARTICLE_URL not...	6.3 Medium	—	0,50%	18 Agt 2026
CVE-2026-63641 MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, MagicMirror applies ipWhitelist only as Express middleware, while the Socket.IO server in j...	2.3 Low	—	0,43%	18 Agt 2026
CVE-2026-63640 MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/node_helper.js pas...	4.3 Medium	—	0,30%	18 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.