Katalog CVE (hal. 678)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 264.859 (Critical 36.491 · High 105.819 · KEV 1.762 · sejak 2020) · Pembaruan terakhir: 29 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 33.851–33.900 dari 264.859 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-59894 sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.forma...	6.2 Medium	—	0,13%	17 Agt 2026
CVE-2026-59893 sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQL_REGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly sca...	7.5 High	—	0,34%	17 Agt 2026
CVE-2026-54284 sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token...	8.7 High	—	0,33%	17 Agt 2026
CVE-2026-51346 SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via t...	9.1 Critical	—	0,70%	17 Agt 2026
CVE-2026-50772 An issue in Squirro Cognitive Search < 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload to the password reset function.	9.8 Critical	—	0,68%	17 Agt 2026
CVE-2026-50771 Cross Site Scripting vulnerability in Squirro Cognitive Search < 3.14.2 allows a remote attacker to execute arbtirary code via the Email Notification, Create Evaluation S...	6.1 Medium	—	0,31%	17 Agt 2026
CVE-2026-50770 An issue in Squirro Cognitive Search before v.3.14.2 allows a remote attacker to escalate privileges via a crafted request.	9.8 Critical	—	0,61%	17 Agt 2026
CVE-2026-50769 The CRM+ application before and including version 2025.6 from Brainformatik is vulnerable to SQL Injection (time-based) vulnerability. The check conflict endpoint index.p...	9.8 Critical	—	0,60%	17 Agt 2026
CVE-2026-50768 File Upload vulnerability in T-Systems International GmbH ImageMaster Version: 9.14.2.8.1 allows a remote attacker to execute arbitrary code via the add attachments featu...	8.8 High	—	0,67%	17 Agt 2026
CVE-2026-48053 Kolibri is an offline-first education platform. Prior to version 0.19.4, several Kolibri API endpoints accept an unvalidated `baseurl` parameter and fetch attacker-contro...	5.8 Medium	—	0,38%	17 Agt 2026
CVE-2026-46345 compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the `-o/--output` argument in `trestle author jinja` allows...	8.4 High	—	0,20%	17 Agt 2026
CVE-2026-33437 Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, the Get Info workflow in app/core/src/main/resources/te...	8.1 High	—	0,40%	17 Agt 2026
CVE-2026-9771 The flash_copy() system call is verified by z_vrfy_flash_copy() in drivers/flash/flash_util.c. On builds with CONFIG_USERSPACE enabled, this handler is the kernel-side tr...	8.8 High	—	0,14%	17 Agt 2026
CVE-2026-68518 Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, _sanitize_mustache_dict() in glances/actions.py sanitizes individual Mustache values befo...	8.8 High	—	0,17%	17 Agt 2026
CVE-2026-68517 Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the cors_origins guard in glances/outputs/glances_restful_api.py uses exact list equality...	6.5 Medium	—	0,46%	17 Agt 2026
CVE-2026-61666 websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.2, WebSocket::Driver.server() passes a malformed Host header to URI.parse in lib/websock...	8.9 High	—	0,45%	17 Agt 2026
CVE-2026-40145 A vulnerability exists in the interaction between a Endpoint Privilege Management (Windows Deployment) support utility and the agent's tamper protection controls. Under c...	7.1 High	—	0,16%	17 Agt 2026
CVE-2026-12630 Zephyr's 6LoWPAN IP Header Compression (IPHC) uncompression code contains an out-of-bounds read in get_ihpc_inlined_size() (subsys/net/ip/6lo.c). The destination inline s...	4.3 Medium	—	0,26%	17 Agt 2026
CVE-2026-12629 The ARM PL011 UART driver in drivers/serial/uart_pl011.c fails to acknowledge receive error interrupts. On the PL011, the framing, parity, break, and overrun error interr...	4.6 Medium	—	0,23%	17 Agt 2026
CVE-2026-12519 The WNC-M14A2A LTE-M modem driver mishandles unsolicited %NOTIFYEV: events in on_cmd_socknotifyev() (drivers/modem/vendor_standalone/wncm14a2a.c). The response line is li...	5.0 Medium	—	0,24%	17 Agt 2026
CVE-2026-75060 jetbrains pycharm In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP tools	8.4 High	—	0,18%	17 Agt 2026
CVE-2026-75059 jetbrains pycharm In JetBrains PyCharm before 2026.2.1 code execution via Quick Documentation was possible	4.4 Medium	—	0,18%	17 Agt 2026
CVE-2026-75058 jetbrains intellij idea In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers	5.5 Medium	—	0,15%	17 Agt 2026
CVE-2026-75057 jetbrains intellij idea In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log	6.2 Medium	—	0,17%	17 Agt 2026
CVE-2026-75056 jetbrains intellij idea In JetBrains IntelliJ IDEA before 2026.2.1 rCE via Markdown export tool was possible	7.8 High	—	0,19%	17 Agt 2026
CVE-2026-75055 jetbrains intellij idea In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE	5.5 Medium	—	0,15%	17 Agt 2026
CVE-2026-75054 jetbrains intellij idea In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projects	6.3 Medium	—	0,15%	17 Agt 2026
CVE-2026-75053 jetbrains intellij idea In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpoint	5.4 Medium	—	0,24%	17 Agt 2026
CVE-2026-75052 jetbrains intellij idea In JetBrains IntelliJ IDEA before 2026.2.1 command execution via crafted Markdown preview content was possible in trusted projects	4.4 Medium	—	0,18%	17 Agt 2026
CVE-2026-75051 jetbrains youtrack In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible	8.1 High	—	0,39%	17 Agt 2026
CVE-2026-75050 jetbrains youtrack In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters	6.5 Medium	—	1,1%	17 Agt 2026
CVE-2026-75049 jetbrains youtrack In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint	6.5 Medium	—	0,34%	17 Agt 2026
CVE-2026-75048 jetbrains youtrack In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible	8.2 High	—	0,32%	17 Agt 2026
CVE-2026-75047 jetbrains youtrack In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint	6.5 Medium	—	1,2%	17 Agt 2026
CVE-2026-75046 jetbrains youtrack In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint	4.3 Medium	—	0,27%	17 Agt 2026
CVE-2026-75045 jetbrains youtrack In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature	9.1 Critical	—	0,47%	17 Agt 2026
CVE-2026-75044 jetbrains youtrack In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox...	8.1 High	—	0,42%	17 Agt 2026
CVE-2026-74858 A vulnerability has been found in jae-jae fetcher-mcp up to 0.3.9. Impacted is the function fetch_url/fetch_urls of the file /latest/meta-data/iam/security-credentials/ o...	6.3 Medium	—	0,37%	17 Agt 2026
CVE-2026-73646 PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js...	7.5 High	—	0,53%	17 Agt 2026
CVE-2026-71479 New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.18, user-controlled image n, video seconds and...	9.1 Critical	—	0,65%	17 Agt 2026
CVE-2026-68762 In JetBrains Ktor before 3.4.1 potential DoS attack via WebSocket decompression was possible	5.9 Medium	—	0,37%	17 Agt 2026
CVE-2026-64868 New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.11, POST /api/stripe/webhook, POST /api/creem/w...	7.5 High	—	0,64%	17 Agt 2026
CVE-2026-64866 New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. From 0.9.1.3 until 1.0.0-rc.7, AdminResetPasskey in controller/pa...	5.1 Medium	—	0,47%	17 Agt 2026
CVE-2026-64865 New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.16, repeated PUT /api/user/self requests that u...	6.0 Medium	—	0,30%	17 Agt 2026
CVE-2026-64859 New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, in...	9.1 Critical	—	0,63%	17 Agt 2026
CVE-2026-59829 Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.1, on sites with category group moderation enabled, the review queue co...	4.3 Medium	—	0,38%	17 Agt 2026
CVE-2026-55704 Discourse is an open-source discussion platform. Prior o 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, users who were allowed to view a group’s activity, but were not permi...	4.3 Medium	—	0,27%	17 Agt 2026
CVE-2026-55674 Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an unauthenticated attacker could send a single request with a craft...	9.3 Critical	—	0,59%	17 Agt 2026
CVE-2026-53960 Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, hidden or otherwise unviewable first-post content was leaked as an e...	5.3 Medium	—	0,31%	17 Agt 2026
CVE-2026-40144 A memory-corruption vulnerability exists in a kernel-mode component of BeyondTrust Endpoint Privilege Management (Windows deployments) prior to version 26.1.2. Insufficie...	7.3 High	—	0,13%	17 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.