Katalog CVE (hal. 674)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 264.859 (Critical 36.491 · High 105.819 · KEV 1.762 · sejak 2020) · Pembaruan terakhir: 29 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 33.651–33.700 dari 264.859 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-75839 ArcadeDB (com.arcadedb:arcadedb-server) versions <= 26.7.3 contain an insecure direct object reference (IDOR) vulnerability in the Raft cluster-info endpoints (GetCluster...	4.3 Medium	—	0,31%	18 Agt 2026
CVE-2026-75838 DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers...	5.1 Medium	—	0,39%	18 Agt 2026
CVE-2026-75837 Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restriction. A delegated admin.users operator can...	9.1 Critical	—	0,49%	18 Agt 2026
CVE-2026-75836 The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav's admin-next/API stack) before 1.0.14 fails to enforce the authorize requirement in MenubarController::exe...	8.8 High	—	0,47%	18 Agt 2026
CVE-2026-75835 Grav API plugin (getgrav/grav-plugin-api) before 1.0.14 contains a missing authorization vulnerability in userPassesAuthorize() (AbstractApiController.php). The function...	4.3 Medium	—	0,31%	18 Agt 2026
CVE-2026-75834 Grav before 2.0.14 contains a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Security.php). All XSS detection pat...	5.4 Medium	—	0,26%	18 Agt 2026
CVE-2026-75833 The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0's admin-next/API stack) before version 1.0.14 contains an open redirect weakness in SsoController::san...	4.2 Medium	—	0,22%	18 Agt 2026
CVE-2026-75832 The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before version 1.0.14 (fixed in 1.0.15) contains a missing authorization vulnerability in BlueprintPa...	4.3 Medium	—	0,30%	18 Agt 2026
CVE-2026-75831 Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The media URL fr...	7.6 High	—	0,35%	18 Agt 2026
CVE-2026-75830 grav-plugin-api (getgrav/grav-plugin-api) versions >= 1.0.0-beta.10 and <= 1.0.14 contain a path traversal vulnerability in the PagesController::batchCopy() method. An in...	7.1 High	—	0,39%	18 Agt 2026
CVE-2026-75829 grav-plugin-api versions before 1.0.15 fail to validate Twig content in the translate() endpoint, allowing attackers with api.pages.write permission to persist pages with...	8.1 High	—	0,41%	18 Agt 2026
CVE-2026-75828 Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function where unpaired quotes in unquoted attribute values bypass event-handle...	8.7 High	—	0,39%	18 Agt 2026
CVE-2026-75827 Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a pos...	8.8 High	—	0,86%	18 Agt 2026
CVE-2026-75774 A vulnerability was determined in karakeep-app karakeep up to 0.32.0. The impacted element is an unknown function of the file apps/web/server/auth.ts of the component OAu...	3.7 Low	—	0,58%	18 Agt 2026
CVE-2026-75107 Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append, spacer text, section text, and select option labels in form template...	5.4 Medium	—	0,24%	18 Agt 2026
CVE-2026-74908 Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer only checks for the exact extension 'svg', allowing .svgz and .xhtml files...	4.6 Medium	—	0,26%	18 Agt 2026
CVE-2026-74907 Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching instead of directory-boundary vali...	5.9 Medium	—	0,43%	18 Agt 2026
CVE-2026-74906 SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight publish-mode reader-facing endpoints that filter results using the visibility list instead...	7.5 High	—	0,38%	18 Agt 2026
CVE-2026-74905 SiYuan before v3.7.4 contains a server-side request forgery (SSRF) vulnerability in the isPrivateIP function in kernel/util/net.go, used by SSRFSafeDialer to enforce SSRF...	7.1 High	—	0,39%	18 Agt 2026
CVE-2026-74904 SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go (including getRefText, checkBlockExist, and getBlockBre...	7.5 High	—	0,45%	18 Agt 2026
CVE-2026-74903 SiYuan before v3.7.4 contains an insufficient access control vulnerability in the /api/lute/spinBlockDOM endpoint, which is guarded only by CheckAuth middleware instead o...	4.3 Medium	—	0,25%	18 Agt 2026
CVE-2026-74902 SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into HTML via i...	8.6 High	—	0,20%	18 Agt 2026
CVE-2026-5224 Cleartext storage of sensitive information vulnerability in Kriptok Crypto and Information Technologies Industry Trade Inc. Cryptosim allows Retrieve Embedded Sensitive D...	5.7 Medium	—	0,17%	18 Agt 2026
CVE-2026-15585 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AKIN Software Computer Import Export Industry and Trade Ltd. AKINSOFT Wolv...	7.5 High	—	0,50%	18 Agt 2026
CVE-2026-75773 A vulnerability was found in karakeep-app karakeep up to 0.32.0. The affected element is the function authorize of the file apps/web/server/auth.ts of the component Login...	3.7 Low	—	0,65%	18 Agt 2026
CVE-2026-75627 Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing req...	9.8 Critical	—	0,84%	18 Agt 2026
CVE-2026-75626 SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elemen...	9.3 Critical	—	0,33%	18 Agt 2026
CVE-2026-19608 A flaw was found in the group policy provider of Keycloak authorization services, which is used to manage fine-grained access control to resources. The issue occurs when...	5.3 Medium	—	0,27%	18 Agt 2026
CVE-2026-19447 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fileorbis Informatics Services Trade Inc. FileOrbis allows Stored XS...	5.4 Medium	—	0,23%	18 Agt 2026
CVE-2024-14046 A security vulnerability has been detected in OpenBoxes up to 0.9.1. This issue affects the function DocumentController of the file grails-app/controllers/org/pih/warehou...	6.3 Medium	—	0,43%	18 Agt 2026
CVE-2026-18929 Carbone is vulnerable to Denial of Service due to lack of protection against zip bombs when processing .docx files. The library uses yazl for zip decompression without va...	6.9 Medium	—	0,51%	18 Agt 2026
CVE-2026-43971 Improper Encoding or Escaping of Output vulnerability in ninenines cowlib allows Link header directive smuggling via unescaped special characters in cow_link:link/1. cow...	6.3 Medium	—	0,52%	18 Agt 2026
CVE-2024-14045 A weakness has been identified in OpenBoxes up to 0.9.2. This vulnerability affects unknown code of the file grails-app/controllers/org/pih/warehouse/RoleInterceptor.groo...	6.3 Medium	—	0,43%	18 Agt 2026
CVE-2026-34884 apache skywalking mcp SSRF via set_skywalking_url Tool and GraphQL expression injection vulnerability in Apache SkyWalking MCP. This issue affects Apache SkyWalking MCP: 0.1.0. Users are...	9.8 Critical	—	0,69%	18 Agt 2026
CVE-2026-15371 Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code d...	8.1 High	—	0,37%	18 Agt 2026
CVE-2026-75091 The Quill Forms \| Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and includin...	7.2 High	—	0,32%	18 Agt 2026
CVE-2026-15748 The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_upload function. This is...	9.8 Critical	—	4,1%	18 Agt 2026
CVE-2026-75151 A vulnerability has been found in SourceCodester Onlne Examination & Learning Management System 1.0. Affected by this vulnerability is an unknown functionality. The manip...	4.3 Medium	—	0,23%	18 Agt 2026
CVE-2026-11801 The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.2. This is due to the plugin not p...	7.5 High	—	1,6%	18 Agt 2026
CVE-2026-75094 A flaw has been found in COMFAST CF-N1-S 2.6.0.1. This impacts the function sub_44B438 of the file /cgi-bin/mbox-config?method=SET&section=ptest_ssid of the component CGI...	9.1 Critical	—	3,2%	18 Agt 2026
CVE-2026-75093 A security vulnerability has been detected in sonos tract up to 0.23.4. This impacts the function Tensor::from_raw_dt_align of the file data/src/tensor.rs of the componen...	4.3 Medium	—	0,59%	18 Agt 2026
CVE-2026-75090 A vulnerability was detected in EricLBuehler Mistral.rs up to 0.8.22. Affected by this issue is the function convert_gguf_to_hf_tokenizer of the file mistralrs-core/src/g...	4.3 Medium	—	0,69%	18 Agt 2026
CVE-2026-75089 A weakness has been identified in PHPGurukul Complaint Management System 1.0. Affected by this issue is some unknown functionality of the file user/check_availability.php...	7.3 High	—	0,43%	18 Agt 2026
CVE-2026-75088 A vulnerability was determined in itsourcecode Hospital Management System 1.0. This impacts an unknown function of the file /viewbilling.php. Executing a manipulation of...	6.3 Medium	—	0,33%	18 Agt 2026
CVE-2026-75087 A vulnerability was found in itsourcecode Hospital Management System 1.0. This affects an unknown function of the file /viewdepartment.php. Performing a manipulation of t...	6.3 Medium	—	0,33%	18 Agt 2026
CVE-2026-75086 A vulnerability has been found in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /viewroom.php. Such manipulation of...	6.3 Medium	—	0,33%	18 Agt 2026
CVE-2026-75082 A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/register of the component Customer-Registration Not...	4.3 Medium	—	0,45%	18 Agt 2026
CVE-2026-75081 A vulnerability was detected in Webkul Bagisto up to 2.4.4. Impacted is an unknown function of the file /customer/account/rma/store. The manipulation of the argument rma_...	4.3 Medium	—	0,37%	18 Agt 2026
CVE-2026-75080 A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This issue affects some unknown processing of the file /edit_subject1....	7.3 High	—	0,43%	18 Agt 2026
CVE-2026-75079 A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. This vulnerability affects unknown code of the file /edit_subject2.php. Executing...	7.3 High	—	0,43%	18 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.