Katalog CVE (hal. 687)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 265.211 (Critical 36.541 · High 105.926 · KEV 1.762 · sejak 2020) · Pembaruan terakhir: 30 Okt 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 34.301–34.350 dari 265.211 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-74896 Advisory jahlives openssl encrypt openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in the DangerousPatternVisitor AST analyzer that fails to detect dunder attribute traversal t...	9.8 Critical	—	0,56%	17 Agt 2026
CVE-2026-74895 Advisory jahlives openssl encrypt openssl_encrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute malicious plugi...	9.8 Critical	—	0,68%	17 Agt 2026
CVE-2026-74894 Advisory jahlives openssl encrypt openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty Bearer token string without valid...	9.8 Critical	—	0,66%	17 Agt 2026
CVE-2026-74893 Advisory jahlives openssl encrypt openssl_encrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can for...	8.8 High	—	0,45%	17 Agt 2026
CVE-2026-74892 Advisory jahlives openssl encrypt openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers...	7.5 High	—	0,51%	17 Agt 2026
CVE-2026-74891 Advisory jahlives openssl encrypt openssl_encrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL...	9.8 Critical	—	0,52%	17 Agt 2026
CVE-2026-74890 Advisory jahlives openssl encrypt openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when the PYTEST_...	5.5 Medium	—	0,21%	17 Agt 2026
CVE-2026-74889 Advisory jahlives openssl encrypt openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinism. Attacke...	9.8 Critical	—	0,35%	17 Agt 2026
CVE-2026-74888 Advisory jahlives openssl encrypt openssl_encrypt versions before 1.4.0 use a non-standard PBKDF2 key derivation construction with iterations=1 per call in an outer loop, creating a KDF whose security pro...	7.5 High	—	0,27%	17 Agt 2026
CVE-2026-74887 Advisory jahlives openssl encrypt openssl_encrypt before 1.4.0 imports Python's non-cryptographic 'random' module (Mersenne Twister PRNG) at line 15 of openssl_encrypt/modules/pqc.py. No direct calls to r...	5.9 Medium	—	0,30%	17 Agt 2026
CVE-2026-74886 Advisory jahlives openssl encrypt openssl_encrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST analyzer's...	9.8 Critical	—	0,68%	17 Agt 2026
CVE-2026-74885 Advisory jahlives openssl encrypt openssl_encrypt versions before 1.4.0 contain a logging bug in restore_hidden_modules() that logs module counts after clearing, always showing zero restored modules and c...	3.6 Low	—	0,21%	17 Agt 2026
CVE-2026-74884 Advisory jahlives openssl encrypt openssl_encrypt versions before 1.4.0 contain a path traversal vulnerability in the _is_safe_path method where the plugin_id parameter is not sanitized before constructin...	7.5 High	—	0,44%	17 Agt 2026
CVE-2026-74883 Advisory jahlives openssl encrypt openssl_encrypt versions before 1.4.0 contain a sandbox bypass vulnerability where the plugin sandbox fails to restrict alternative file access methods like pathlib.Path...	8.8 High	—	0,48%	17 Agt 2026
CVE-2026-74882 Advisory jahlives openssl encrypt openssl_encrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trusted_prox...	9.1 Critical	—	0,17%	17 Agt 2026
CVE-2026-74881 Advisory jahlives openssl encrypt openssl_encrypt versions before 1.4.0 configure CORS with allow_origins set to wildcard and allow_credentials enabled to true. Attackers can create malicious websites tha...	9.3 Critical	—	0,36%	17 Agt 2026
CVE-2026-74880 Advisory jahlives openssl encrypt openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server log...	9.8 Critical	—	0,56%	17 Agt 2026
CVE-2026-74879 Advisory jahlives openssl encrypt openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticat...	7.5 High	—	0,44%	17 Agt 2026
CVE-2026-74878 Advisory jahlives openssl encrypt openssl_encrypt versions before 1.4.0 use an in-memory rate limiter for TOTP brute-force protection that is not shared across workers and is lost on server restart. Attac...	9.8 Critical	—	0,75%	17 Agt 2026
CVE-2026-74877 Advisory jahlives openssl encrypt openssl_encrypt versions before 1.4.0 contain a missing ownership verification vulnerability in the revoke_key method that allows authenticated clients to revoke any othe...	8.8 High	—	0,45%	17 Agt 2026
CVE-2026-74876 Advisory jahlives openssl encrypt openssl_encrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.from_dict() that creates key bundles from untrusted data without verifying signatures. At...	9.8 Critical	—	0,35%	17 Agt 2026
CVE-2026-74875 Advisory jahlives openssl encrypt openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attac...	9.8 Critical	—	0,27%	17 Agt 2026
CVE-2026-74874 Advisory jahlives openssl encrypt openssl_encrypt versions before 1.4.0 use Python's non-cryptographic random module for steganographic pixel selection in the generate_pseudorandom_sequence function. Atta...	7.5 High	—	0,44%	17 Agt 2026
CVE-2026-74873 Advisory jahlives openssl encrypt openssl_encrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read proce...	5.5 Medium	—	0,32%	17 Agt 2026
CVE-2026-74872 Advisory jahlives openssl encrypt openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so mod...	9.8 Critical	—	0,68%	17 Agt 2026
CVE-2026-74871 Advisory jahlives openssl encrypt openssl_encrypt versions before 1.4.6 contain a key derivation flaw in sequential XOR composition mode where the last stage cancels out during key generation. When config...	5.5 Medium	—	0,11%	17 Agt 2026
CVE-2026-74870 Advisory jahlives openssl encrypt openssl_encrypt (pip) versions <= 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unconditionall...	3.3 Low	—	0,26%	17 Agt 2026
CVE-2026-74869 stoatchat before 0.15.0 contains a missing authorization vulnerability in the Subscribe message handler that allows authenticated attackers to enumerate members and monit...	7.7 High	—	0,35%	17 Agt 2026
CVE-2026-74868 SiYuan versions before 3.7.4 contain an unthrottled brute-force vulnerability in the Publish Service Basic Auth implementation (PublishServiceTransport.RoundTrip() in ker...	7.5 High	—	0,51%	17 Agt 2026
CVE-2026-74867 SiYuan versions before 3.7.4 contain a cross-site request forgery vulnerability in the session-cookie authentication branch of CheckAuth() that lacks Origin/Referer valid...	4.2 Medium	—	0,13%	17 Agt 2026
CVE-2026-74842 A vulnerability was found in Kira-Pgr PromptShopMCP up to 5bc0cd17358e19a5415d11a531088170d7b81452. Affected is the function download_image of the file server.py of the c...	6.3 Medium	—	0,37%	17 Agt 2026
CVE-2026-74802 SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint that explicitly disables origin validatio...	8.2 High	—	0,16%	17 Agt 2026
CVE-2026-74801 SiYuan before 3.7.4 fails to properly escape workspace directory paths when constructing command-line arguments for the elevated elevator.exe helper process. Attackers ca...	8.2 High	—	0,21%	17 Agt 2026
CVE-2026-74800 SiYuan before v3.7.4 fails to set Content-Disposition and X-Content-Type-Options headers when serving arbitrary file assets, allowing stored cross-site scripting attacks....	9.0 Critical	—	0,43%	17 Agt 2026
CVE-2026-74799 SiYuan before 3.7.4 registers Go net/http/pprof debug endpoints including heap and goroutine dumps without authentication when --mode flag is not set to exactly prod. Att...	9.3 Critical	—	0,54%	17 Agt 2026
CVE-2026-74798 SiYuan kernel before v3.7.4 contains a path traversal vulnerability in the database_clean MCP tool. The tool performs only an empty-string check on the id parameter befor...	8.7 High	—	0,51%	17 Agt 2026
CVE-2026-74845 Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute...	8.8 High	—	0,94%	17 Agt 2026
CVE-2026-58561 Null pointer dereference issue in the image codec module. Impact: Successful exploitation of this vulnerability may affect availability.	4.0 Medium	—	0,13%	17 Agt 2026
CVE-2026-58560 Null pointer dereference issue in the image codec module. Impact: Successful exploitation of this vulnerability may affect availability.	4.0 Medium	—	0,13%	17 Agt 2026
CVE-2026-49308 Permission control vulnerability in the clipboard module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.	5.5 Medium	—	0,12%	17 Agt 2026
CVE-2026-49307 Permission control vulnerability in the multi-mode input module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.	6.2 Medium	—	0,13%	17 Agt 2026
CVE-2026-49306 UAF vulnerability in the time and time zone module. Impact: Successful exploitation of this vulnerability may affect availability.	3.3 Low	—	0,11%	17 Agt 2026
CVE-2026-49305 Permission control vulnerability in the Wi-Fi enhancement module. Impact: Successful exploitation of this vulnerability may affect availability.	6.2 Medium	—	0,11%	17 Agt 2026
CVE-2026-49304 Permission control vulnerability in the device key management module. Impact: Successful exploitation of this vulnerability may affect availability.	6.2 Medium	—	0,11%	17 Agt 2026
CVE-2026-49303 Permission control vulnerability in the notification module. Impact: Successful exploitation of this vulnerability may affect availability.	5.1 Medium	—	0,11%	17 Agt 2026
CVE-2026-49302 Permission control vulnerability in the notification service module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.	6.2 Medium	—	0,13%	17 Agt 2026
CVE-2026-49301 Permission control vulnerability in the Gallery module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.	6.2 Medium	—	0,12%	17 Agt 2026
CVE-2026-20000 A vulnerability was detected in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /viewprescriptionrecord.php. The mani...	6.3 Medium	—	0,33%	17 Agt 2026
CVE-2026-19999 A security vulnerability has been detected in Open Asset Import Library Assimp Assimp 17c12da. The affected element is the function Assimp::MDLImporter::ParseBoneTrafoKey...	6.3 Medium	—	0,27%	17 Agt 2026
CVE-2026-19998 A weakness has been identified in code-projects Online Shopping System 1.0. Impacted is an unknown function of the file offersmail.php. Executing a manipulation of the ar...	4.3 Medium	—	0,47%	17 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.