Katalog CVE (hal. 677)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 264.859 (Critical 36.491 · High 105.819 · KEV 1.762 · sejak 2020) · Pembaruan terakhir: 29 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 33.801–33.850 dari 264.859 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-39255 Buffer Overflow vulnerability in SteelSeries GG (macOS) v.107.0.0 allows a remote attacker to execute arbitrary code via the libSSEdevice.dylib, dup_wcs components	9.8 Critical	—	0,80%	17 Agt 2026
CVE-2026-39254 Buffer Overflow vulnerability in SteelSeries GG (macOS) v.107.0.0 allows a remote attacker to execute arbitrary code via the libSSEdevice.dylib, CxAudioHidDevice::DeviceG...	9.8 Critical	—	0,80%	17 Agt 2026
CVE-2026-35219 Budibase is an open-source low-code platform. Prior to 3.41.3, automation steps in packages/server/src/automations/steps/outgoingWebhook.ts, packages/server/src/automatio...	7.1 High	—	0,47%	17 Agt 2026
CVE-2026-34789 FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, src/App/PropertyPythonObject.cpp in PropertyPythonObject::Restore() passes the atta...	7.0 High	—	0,20%	17 Agt 2026
CVE-2026-34399 FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, FreeCAD's BIM Workbench contains an eval() call on untrusted data from SVG t...	7.8 High	—	0,20%	17 Agt 2026
CVE-2026-34398 FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, src/Mod/BIM/bimcommands/BimProjectManager.py in the BIM Project Manager Load...	7.8 High	—	0,22%	17 Agt 2026
CVE-2026-19589 Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow unintended file system modification and could lead to code execution. A u...	7.1 High	—	0,19%	17 Agt 2026
CVE-2026-75014 A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the file /admin/get_barcode_data.php. This manipu...	7.3 High	—	0,43%	17 Agt 2026
CVE-2026-75013 A vulnerability was detected in TOTOLINK EX1200L 9.3.5u.6146_B20201023. This affects the function setWizardCfg of the file /cgi-bin/cstecgi.cgi. The manipulation results...	6.5 Medium	—	0,66%	17 Agt 2026
CVE-2026-75012 A security vulnerability has been detected in TOTOLINK EX1200L 9.3.5u.6146_B20201023. Affected by this issue is the function setPasswordCfg of the file /cgi-bin/cstecgi.c...	6.5 Medium	—	0,66%	17 Agt 2026
CVE-2026-71858 Notepad++ is a free and open-source source code editor. Prior to 8.9.7, macros loaded from an attacker-controlled shortcuts.xml bypass the HMAC validation applied to User...	5.4 Medium	—	0,12%	17 Agt 2026
CVE-2026-71553 ApostropheCMS is an open-source Node.js content management system. In 4.32.0 and earlier, PATCH /api/v1/article/:id accepts the inherited path toString.call and passes it...	7.1 High	—	0,43%	17 Agt 2026
CVE-2026-71486 vllm vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the /v1/completions/derender and /v1/chat/completions/derender endpoints accept caller...	4.3 Medium	—	0,37%	17 Agt 2026
CVE-2026-71472 A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource (CR) editor, to inje...	9.1 Critical	—	0,91%	17 Agt 2026
CVE-2026-70495 A flaw was found in search-v2-operator. This component's `search-serviceaccount` has overly broad permissions, allowing it to impersonate users and groups across the enti...	8.8 High	—	0,16%	17 Agt 2026
CVE-2026-68005 An issue in ACME mini_httpd 1.30 and prior allows a remote attacker to cause a denial of service via the HTTP request header parser in the handle_request() function	7.5 High	—	0,58%	17 Agt 2026
CVE-2026-68004 An issue in OSSRS SRS (Simple Realtime Server) <v5.0.213 allows a remote attacker to execute arbitrary code via RTMP publish authorization, vhost-level security configura...	9.8 Critical	—	0,79%	17 Agt 2026
CVE-2026-67678 File Upload vulnerability in RainyGao-Hithub DocSys v.2.02.80 allows a remote attacker to execute arbitrary code	9.8 Critical	—	0,78%	17 Agt 2026
CVE-2026-63670 ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml() can pass disallowed executable markup through packages/sanitize-html/in...	6.1 Medium	—	0,33%	17 Agt 2026
CVE-2026-63669 ApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module's move() operation fails to enforce the destination parent's _create p...	6.5 Medium	—	0,31%	17 Agt 2026
CVE-2026-63667 ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/import-export/lib/formats/gzip.js constructs an at...	6.5 Medium	—	0,46%	17 Agt 2026
CVE-2026-57485 Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.9.0, the /api/v1/pipeline/handleData endpoint in app/core/sr...	8.5 High	—	0,42%	17 Agt 2026
CVE-2026-57233 Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to unzipDestTo without canonical co...	8.1 High	—	0,51%	17 Agt 2026
CVE-2026-54758 Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the expandNppEnvironmentStrs function in PowerEditor/src/WinControls/StaticDialog/RunDlg/RunDlg.cp...	7.8 High	—	0,19%	17 Agt 2026
CVE-2026-52886 Notepad++ is a free and open-source source code editor. Prior to 8.9.7, Notepad++ validates the backupFilePath attribute from session.xml with std::wstring::starts_with a...	5.1 Medium	—	0,17%	17 Agt 2026
CVE-2026-19650 gitlab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under...	7.1 High	—	0,21%	17 Agt 2026
CVE-2026-19478 gitlab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under...	9.1 Critical	—	2,2%	17 Agt 2026
CVE-2026-75011 A flaw has been found in kylecui NetForensicMCP 2.1.0. Impacted is the function execAsync of the file index.js. Executing a manipulation of the argument interface/protoco...	6.3 Medium	—	1,8%	17 Agt 2026
CVE-2026-74238 TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpack() function that allows unauthenticated remote attackers to cause the...	7.5 High	—	0,48%	17 Agt 2026
CVE-2026-66792 A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subs...	9.9 Critical	—	0,69%	17 Agt 2026
CVE-2026-50776 Directory Traversal vulnerability in Pronis Loisirs Billetterie CSE - < 04/2026 allows a remote attacker to obtain sensitive information and execute arbitrary code.	7.5 High	—	1,8%	17 Agt 2026
CVE-2026-50775 A blind SSRF attack in DataHub v.1.5.0.1 allows a remote attacker to execute arbitrary code via the server retrieving an image from a crafted URL, and it fails to return...	9.8 Critical	—	0,79%	17 Agt 2026
CVE-2026-50774 An issue in GAPTEQ Designer v.3.5 allows a remote attacker to escalate privileges via the Company Manger role.	9.8 Critical	—	0,61%	17 Agt 2026
CVE-2026-50773 An issue in CGM Germany - CompuGroup Medical CGM ISIS MED 2510.1.0.20 allows a remote attacker to execute arbtirary code via a crafted .dll file.	7.8 High	—	0,27%	17 Agt 2026
CVE-2026-45698 Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the delete...	7.5 High	—	0,45%	17 Agt 2026
CVE-2026-17639 Certain HP Smart Tank All-in-One printers may be potentially vulnerable to a denial of service condition that allows an unauthenticated attacker to cause the device to be...	6.9 Medium	—	0,45%	17 Agt 2026
CVE-2026-12553 HP has identified a potential vulnerability in HP Web Jetadmin (WJA) that may allow an unauthenticated actor to read from or write to arbitrary files through a DLL hijack...	8.9 High	—	0,43%	17 Agt 2026
CVE-2026-74254 Advisory Joomla Extension - joomlack.fr - SQL injection in Page Builder CK < 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a SQL injection issue related to the sty...	9.3 Critical	—	0,39%	17 Agt 2026
CVE-2026-74253 Advisory Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer < 16.0.0 - Regular Labs Sourcerer before 16.0.0 processes {s...	10.0 Critical	—	0,32%	17 Agt 2026
CVE-2026-73523 COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unauthenticated remote attackers to cause the CAN listener to...	7.5 High	—	0,55%	17 Agt 2026
CVE-2026-73522 COVESA Open1722 through 0.9.2 contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to write past the end of a fixed 15-slot stack a...	7.5 High	—	4,0%	17 Agt 2026
CVE-2026-73424 Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel adapter in packages/integrations/vercel/src/serverless/entrypoint.ts acce...	6.5 Medium	—	0,38%	17 Agt 2026
CVE-2026-71980 Belledonne Communications bcg729 through 1.1.2 contains an out-of-bounds read vulnerability in the decodeSIDframe() function in src/cng.c that allows unauthenticated netw...	7.5 High	—	0,61%	17 Agt 2026
CVE-2026-71979 INDI (Instrument Neutral Distributed Interface) indiserver through 2.2.4.2, fixed in commit 96bbd7f, contains a stack buffer overflow vulnerability that allows unauthenti...	7.5 High	—	0,58%	17 Agt 2026
CVE-2026-71491 sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, group_comments in sqlparse/engine/grouping.py repeatedly rescans comment-only statements before...	8.7 High	—	0,26%	17 Agt 2026
CVE-2026-68520 Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, as_dict_secure() in glances/config.py checks only option names and exposes public_usernam...	5.3 Medium	—	0,41%	17 Agt 2026
CVE-2026-68519 Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run() in glances/actions.py ignores --disable-config-exec for on-alert act...	7.1 High	—	0,18%	17 Agt 2026
CVE-2026-62982 Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, _sanitize_mustache_dict() in glances/actions.py skips nested list and dictionary...	8.8 High	—	0,20%	17 Agt 2026
CVE-2026-59903 netty Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader...	7.5 High	—	0,32%	17 Agt 2026
CVE-2026-59902 netty Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler li...	7.5 High	—	0,37%	17 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.