Katalog CVE (hal. 667)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 264.825 (Critical 36.490 · High 105.809 · KEV 1.762 · sejak 2020) · Pembaruan terakhir: 29 Okt 2026, 12:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 33.301–33.350 dari 264.825 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-61696 Forem is open source software for building communities. In versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c, a malicious value submitted through feedback_m...	6.3 Medium	—	0,32%	18 Agt 2026
CVE-2026-54570 AngleSharp is a .NET library for parsing angle bracket based hyper-texts. Prior to 1.5.0, MathAnnotationXmlElement in AngleSharp/Mathml/Dom/Internal/MathAnnotationXmlElem...	6.9 Medium	—	0,33%	18 Agt 2026
CVE-2026-54552 sh provides Python process launching. Prior to 2.2.4, the _uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an...	7.9 High	—	0,17%	18 Agt 2026
CVE-2026-53533 aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.1, SMTP.mail(), SMTP.rcpt(), SMTP.vrfy(), and SMTP.expn() send caller-supplied addresses with...	6.9 Medium	—	0,53%	18 Agt 2026
CVE-2026-52610 An arbitrary file write/directory traversal vulnerability in reportico-web <= 8.1.0 allows remote attackers to create or overwrite files anywhere on the filesystem subjec...	9.1 Critical	—	1,1%	18 Agt 2026
CVE-2026-52609 A reflected cross-site scripting (XSS) vulnerability in reportico-web <= 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by inc...	6.1 Medium	—	0,31%	18 Agt 2026
CVE-2026-52608 An incorrect access control vulnerability in reportico-web <= 8.1.0 allows an unauthenticated attacker to inject arbitrary php code into the PreExecuteCode attribute of a...	9.8 Critical	—	0,89%	18 Agt 2026
CVE-2026-52607 A directory traversal vulnerability in reportico-web <= 8.1.0 allows remote attackers to expose or execute arbitrary php files on the web server by specifying the filenam...	6.5 Medium	—	0,75%	18 Agt 2026
CVE-2026-50167 Kurrier is a modern, self-hosted workspace for email, calendar, contacts, and storage. Prior to 1.2.4, Kurrier API endpoints for listing and retrieving webhook and identi...	5.3 Medium	—	0,47%	18 Agt 2026
CVE-2026-50161 libre is a generic library for real-time communications with asynchronous input and output support. Prior to 4.8.1, the websock_decode() function in src/websock/websock.c...	9.3 Critical	—	0,72%	18 Agt 2026
CVE-2026-50143 The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.10...	8.1 High	—	0,49%	18 Agt 2026
CVE-2026-49452 WeasyPrint helps web developers to create PDF documents. Prior to 69.0, WeasyPrint embeds unescaped HTML presentational-hint attribute values into CSS in weasyprint/css/_...	6.5 Medium	—	0,37%	18 Agt 2026
CVE-2026-48508 Lemur manages TLS certificate creation. Prior to 1.9.1, StrictRolePermission and AuthorityCreatorPermission in lemur/auth/permissions.py call flask_principal.Permission._...	8.8 High	—	0,33%	18 Agt 2026
CVE-2026-44472 Saleor is an e-commerce platform. From 2.10.0rc1 until 3.21.67, 3.22.63, and 3.23.22, the account activation flow treats email verification as sufficient proof of account...	8.1 High	—	0,63%	18 Agt 2026
CVE-2026-32657 Dell AppSync Version 4.6.0.0, Dell Metro Node Version 8.0.0, Dell UCC Edge Version 3.0.1, Dell VxRail Version 8.0.322, Dell PowerMax Version 10.3.0, Dell Unity Version 5....	7.3 High	—	0,17%	18 Agt 2026
CVE-2021-43717 An issue exists in pson EH-TW5350 Epson iProjection.apk v3.2.6. If you identify a projector equipped with an iProjection function, you can access the projector using hard...	9.8 Critical	—	0,61%	18 Agt 2026
CVE-2021-43716 Verification Bypass vulnerability exists in EPSON 150075647YWWV110 EasyMP Network Updater Ver.1.20. The Epson projector can be updated by encrypted firmware through USB.	9.8 Critical	—	0,35%	18 Agt 2026
CVE-2026-75924 A flaw was found in managed-serviceaccount. A compromised addon-manager pod, due to its ClusterRole granting excessive permissions, can read any secret across all namespa...	8.7 High	—	0,27%	18 Agt 2026
CVE-2026-75897 Improper input validation in the capabilities route handler in OpenSearch Dashboards - the size of the request payload is not bounded - might allow remote attackers to ca...	7.5 High	—	0,72%	18 Agt 2026
CVE-2026-73372 joomla! Joomla! Core - [20260809] - Improper ACL checks when injection schema.org contact data in Joomla 5.1.0-5.4.7 and 6.0.0-6.1.2 - An improper access check injects contact in...	4.3 Medium	—	0,29%	18 Agt 2026
CVE-2026-73336 joomla! Joomla! Core - [20260806] - XSS through schema.org outputs in Joomla 5.1.0-5.4.7, 6.0.0-6.1.2 - Improper escaping flags lead to an XSS vector in schema.org markup outputs...	6.4 Medium	—	0,27%	18 Agt 2026
CVE-2026-72531 joomla! Joomla! Core - [20260804] - Improper ACL checks for custom fields webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized u...	5.4 Medium	—	0,26%	18 Agt 2026
CVE-2026-71573 joomla! Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper implementation prevented configured CORS origins from being p...	8.3 High	—	0,34%	18 Agt 2026
CVE-2026-71572 joomla! Joomla! Core - [20260801] - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2 - Lack of output processing allowed a header injection in the m...	5.4 Medium	—	0,24%	18 Agt 2026
CVE-2026-70415 Dell PowerStore SDNAS contains a Buffer Copy without Checking Size of Input vulnerability in NFS/RPC. An unauthenticated attacker with remote access could potentially exp...	8.1 High	—	0,61%	18 Agt 2026
CVE-2026-69220 The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client...	8.7 High	—	0,73%	18 Agt 2026
CVE-2026-69219 The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client...	8.7 High	—	0,73%	18 Agt 2026
CVE-2026-67271 Dell PowerStore SDNAS, contains an Out-of-bounds Write vulnerability in SMB/CIFS. An unauthenticated attacker with remote access could potentially exploit this vulnerabil...	9.8 Critical	—	0,83%	18 Agt 2026
CVE-2026-66783 A flaw was found in the `submariner-operator` component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability allows a cluster administrator, or any u...	4.4 Medium	—	0,36%	18 Agt 2026
CVE-2026-66782 A flaw was found in the Submariner operator. This vulnerability allows for the exposure of a long-lived broker service account (SA) bearer token within the Submariner Cus...	5.8 Medium	—	0,38%	18 Agt 2026
CVE-2026-66781 A flaw was found in the Submariner operator. The Submariner Custom Resource (CR), used for configuring network connectivity, stores the IPsec pre-shared key (PSK) in an u...	5.4 Medium	—	0,40%	18 Agt 2026
CVE-2026-63337 The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.tools.jsonrpc.Proced...	7.5 High	—	0,56%	18 Agt 2026
CVE-2026-63336 The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.client.ConnectionFac...	5.1 Medium	—	0,31%	18 Agt 2026
CVE-2026-63335 The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.31.0, inbound AMQP command assembly in...	6.3 Medium	—	0,52%	18 Agt 2026
CVE-2026-61574 authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the Remote Access Control endpoint list returns every configured endpoint to any authentica...	8.8 High	—	0,62%	18 Agt 2026
CVE-2026-57580 authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAME_LINK or EMAIL_LINK user-mat...	9.4 Critical	—	0,59%	18 Agt 2026
CVE-2026-55106 authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, a diagnostic action on the LDAP Source API does not enforce the object-level read-authoriza...	5.3 Medium	—	0,44%	18 Agt 2026
CVE-2026-54730 authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the enterprise Google Chrome device-trust stages advance the flow without confirming that t...	8.6 High	—	0,68%	18 Agt 2026
CVE-2026-52723 ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integrati...	9.1 Critical	—	0,38%	18 Agt 2026
CVE-2026-52606 A reflected cross-site scripting (XSS) vulnerability in reportico-web <= 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by inc...	6.1 Medium	—	0,31%	18 Agt 2026
CVE-2026-50578 ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integrati...	7.5 High	—	0,31%	18 Agt 2026
CVE-2026-50577 ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integrati...	7.4 High	—	0,51%	18 Agt 2026
CVE-2026-50576 ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integrati...	6.8 Medium	—	0,49%	18 Agt 2026
CVE-2026-50126 Adaguc-server is an open source geographical information system to visualize, combine, compare and share real-time meteorological, climatological and remote sensing data...	4.0 Medium	—	0,18%	18 Agt 2026
CVE-2026-49228 Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product operations allow a low-pri...	8.8 High	—	0,55%	18 Agt 2026
CVE-2026-49225 Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product revision operations allow...	8.3 High	—	0,48%	18 Agt 2026
CVE-2026-49224 Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post revision operations allow a l...	8.3 High	—	0,48%	18 Agt 2026
CVE-2026-49223 Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product review operations allow a...	7.6 High	—	0,42%	18 Agt 2026
CVE-2026-49222 Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product question operations allow...	7.6 High	—	0,42%	18 Agt 2026
CVE-2026-48744 Saleor is an e-commerce platform. From 3.14.67 until 3.21.67, 3.22.63, and 3.23.22, a broken authorization check in saleor/permission/utils.py can incorrectly authorize u...	6.5 Medium	—	0,38%	18 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.