Katalog CVE (hal. 668)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 264.825 (Critical 36.490 · High 105.809 · KEV 1.762 · sejak 2020) · Pembaruan terakhir: 29 Okt 2026, 12:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 33.351–33.400 dari 264.825 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-30250 Cross-site scripting vulnerability in the user documentation field in Beta Systems Software AG ANOW! Automate v.3.3.1.90 allows a remote attacker to execute arbitrary cod...	6.1 Medium	—	0,36%	18 Agt 2026
CVE-2026-19869 @neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication r...	7.6 High	—	0,49%	18 Agt 2026
CVE-2026-18963 A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloa...	9.1 Critical	—	4,7%	18 Agt 2026
CVE-2026-75926 gohugo hugo Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file syst...	8.6 High	—	0,28%	18 Agt 2026
CVE-2026-75915 CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the js_execution tool that fails to scrub parent process environment variables...	7.5 High	—	0,68%	18 Agt 2026
CVE-2026-75914 CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the image_analyze tool that fails to canonicalize symlinks before reading files. Attackers can...	7.5 High	—	0,53%	18 Agt 2026
CVE-2026-75913 CodeWhale (codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain an argument injection vulnerability in the git_show tool. The model-supplied rev parameter i...	9.3 Critical	—	0,48%	18 Agt 2026
CVE-2026-75912 CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the git_blame tool that allows attackers to read arbitrary files by injecting git options...	7.4 High	—	0,45%	18 Agt 2026
CVE-2026-75911 CodeWhale versions before 0.8.64 fail to properly validate the allow_shell configuration parameter from project config files, allowing attackers to enable arbitrary shell...	7.8 High	—	0,25%	18 Agt 2026
CVE-2026-75904 libmodplug through 0.8.9.1 contains an out-of-bounds read in pat_smplooped in src/load_pat.cpp. The function validates only the upper bound of its sample index against MA...	3.3 Low	—	0,19%	18 Agt 2026
CVE-2026-75859 CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing attackers to read arbitrary files on the victim's system....	7.5 High	—	0,53%	18 Agt 2026
CVE-2026-75858 CodeWhale (packages codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain a remote code execution vulnerability in the rlm_eval tool. The tool's approval_req...	7.8 High	—	0,36%	18 Agt 2026
CVE-2026-75857 CodeWhale versions >= 0.8.41 and < 0.8.64 contain a vulnerability in the exec_shell_interact (alias exec_interact) tool, whose approval_requirement returns ApprovalRequir...	7.0 High	—	0,16%	18 Agt 2026
CVE-2026-75856 CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerability in DNS pinning logic that fails to prevent time-of-check-time-of-use attacks. Attacker...	8.6 High	—	0,50%	18 Agt 2026
CVE-2026-75485 A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc insp...	5.5 Medium	—	0,20%	18 Agt 2026
CVE-2026-73834 A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. Certain ACM wrapper Custom Resources that embed Secret data are colle...	5.5 Medium	—	0,11%	18 Agt 2026
CVE-2026-73373 joomla! Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On s...	9.8 Critical	—	0,65%	18 Agt 2026
CVE-2026-73371 joomla! Joomla! Core - [20260808] - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform...	4.3 Medium	—	0,29%	18 Agt 2026
CVE-2026-73337 joomla! Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks.	7.5 High	—	0,46%	18 Agt 2026
CVE-2026-73073 vim Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an i...	7.8 High	—	0,15%	18 Agt 2026
CVE-2026-72532 joomla! Joomla! Core - [20260806] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users...	5.4 Medium	—	0,26%	18 Agt 2026
CVE-2026-71574 joomla! Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized us...	6.5 Medium	—	0,34%	18 Agt 2026
CVE-2026-71477 mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.1, release tar archives record mise/bin/mise with user and group ID 1001 and packaging/sta...	6.7 Medium	—	0,13%	18 Agt 2026
CVE-2026-71365 A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extracts the st...	7.7 High	—	0,49%	18 Agt 2026
CVE-2026-63328 Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under ~/.trivy/plugins without confining plugin...	6.8 Medium	—	0,19%	18 Agt 2026
CVE-2026-62684 File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, the Link storag...	2.7 Low	—	0,43%	18 Agt 2026
CVE-2026-62357 Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40.0, CMS.INITBYDIM and CMS.INITBYPROB accept dimensions whose width times depth t...	8.8 High	—	0,52%	18 Agt 2026
CVE-2026-55839 Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdown_plugins/link.ts allows a user wit...	8.7 High	—	0,43%	18 Agt 2026
CVE-2026-49227 Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend comment operations allow a low-pri...	7.6 High	—	0,42%	18 Agt 2026
CVE-2026-49226 Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post operations allow a low-privil...	8.3 High	—	0,48%	18 Agt 2026
CVE-2026-49221 Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend digital asset operations allow a l...	8.8 High	—	0,55%	18 Agt 2026
CVE-2026-47245 MyBB is free and open source forum software. Prior to 1.8.40, the User CP Buddy/Ignore List component does not validate reciprocal buddy-list updates correctly. The userc...	4.3 Medium	—	0,37%	18 Agt 2026
CVE-2026-46482 ### Impact The registration component does not validate the text-based _Security Question_ CAPTCHA correctly, allowing attackers to bypass the challenge via a specially c...	5.3 Medium	—	0,45%	18 Agt 2026
CVE-2026-45734 MyBB is free and open source forum software. Prior to 1.8.40, the built-in CAPTCHA does not consistently enforce single-use semantics, allowing remote attackers to bypass...	5.3 Medium	—	0,55%	18 Agt 2026
CVE-2026-45129 MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rot...	4.6 Medium	—	0,18%	18 Agt 2026
CVE-2026-45128 MyBB is free and open source forum software. Prior to 1.8.40, the ACP Users View Manager module does not validate requests correctly, allowing same-site attackers to chan...	3.5 Low	—	0,17%	18 Agt 2026
CVE-2026-45127 MyBB is free and open source forum software. Prior to 1.8.40, the ACP Mass Mail module does not validate certain requests correctly, allowing same-site attackers to creat...	3.5 Low	—	0,17%	18 Agt 2026
CVE-2026-45126 MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Security Questions module does not validate the anti-CSRF token correctly, allowing same-site a...	3.5 Low	—	0,17%	18 Agt 2026
CVE-2026-45125 MyBB is free and open source forum software. Prior to 1.8.40, the Email User controller does not sanitize sender names correctly, resulting in mail header injection. memb...	5.3 Medium	—	0,41%	18 Agt 2026
CVE-2026-45124 MyBB is free and open source forum software. Prior to 1.8.40, the Mod CP Report Center does not check permissions consistently, allowing moderators without report-managem...	4.3 Medium	—	0,34%	18 Agt 2026
CVE-2026-45123 MyBB is free and open source forum software. Prior to 1.8.40, the remote requests feature does not correctly handle IPv6 addresses, resulting in a server-side request for...	4.3 Medium	—	0,37%	18 Agt 2026
CVE-2026-45122 MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not validate moderation permissions for the destination calendar when moving events...	4.3 Medium	—	0,34%	18 Agt 2026
CVE-2026-45121 MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not check permissions consistently when listing calendars, allowing authenticated u...	4.3 Medium	—	0,34%	18 Agt 2026
CVE-2026-45120 MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not verify private event status consistently, allowing users with viewing and moder...	5.4 Medium	—	0,30%	18 Agt 2026
CVE-2026-45119 MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correctly, allowing same-site attack...	4.6 Medium	—	0,17%	18 Agt 2026
CVE-2026-45118 MyBB is free and open source forum software. Prior to 1.8.40, the Contact module does not validate a redirect URL or protocol correctly, resulting in an open redirect and...	9.3 Critical	—	0,55%	18 Agt 2026
CVE-2026-45117 MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not properly escape user-supplied database configuration values written t...	9.8 Critical	—	1,1%	18 Agt 2026
CVE-2026-45116 MyBB is free and open source forum software. Prior to 1.8.40, the user datahandler does not properly validate checkbox and multiselect profile field types, resulting in s...	8.7 High	—	0,43%	18 Agt 2026
CVE-2026-45115 MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform JavaScript c...	8.7 High	—	0,42%	18 Agt 2026
CVE-2026-19501 CSV export functionality in Brainstorm Force SureForms version, <= 2.12.1, fails to neutralize spreadsheet formula characters in user-controlled form field names before g...	8.8 High	—	0,56%	18 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.