Katalog CVE (hal. 694)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 265.359 (Critical 36.559 · High 106.016 · KEV 1.764 · sejak 2020) · Pembaruan terakhir: 30 Okt 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 34.651–34.700 dari 265.359 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-73054 SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the WebSocket endpoint caused by differential parsing of query parameters between authenti...	7.5 High	—	0,54%	15 Agt 2026
CVE-2026-73053 SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in the unicode2Emoji function that fails to sanitize codepoint branch output. Attackers can cra...	9.0 Critical	—	0,52%	15 Agt 2026
CVE-2026-73052 SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates them directly into option elements via innerHTML in the sort menu. Attackers...	9.0 Critical	—	0,52%	15 Agt 2026
CVE-2026-73050 SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site scripting through eight unescaped re...	9.0 Critical	—	0,43%	15 Agt 2026
CVE-2026-73047 siyuan versions <= 3.7.3 (fixed in v3.7.4) contain a server-side template injection vulnerability in the attribute-view Template calculation feature (introduced in v3.7.0...	6.2 Medium	—	0,19%	15 Agt 2026
CVE-2026-73046 SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth() middleware. The HTTP Basic Authentication branch, which guards nearly the e...	9.8 Critical	—	0,79%	15 Agt 2026
CVE-2026-73045 SiYuan before 3.7.4 contains an improper restriction of excessive authentication attempts vulnerability in the authFilePublishAccess endpoint that allows unauthenticated...	7.5 High	—	0,52%	15 Agt 2026
CVE-2026-73044 SiYuan versions before v3.7.4 fail to validate or escape table column width values, allowing stored cross-site scripting injection into style attributes. Attackers can in...	9.0 Critical	—	0,43%	15 Agt 2026
CVE-2026-73043 SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which renders user-authored Go templates and stores outp...	9.0 Critical	—	0,64%	15 Agt 2026
CVE-2026-73042 SiYuan before v3.7.4 fails to properly escape database menu metadata in HTML interpolation, allowing stored values to execute script when users open group, view, or field...	9.0 Critical	—	0,52%	15 Agt 2026
CVE-2026-73041 SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious markup into a...	9.0 Critical	—	0,43%	15 Agt 2026
CVE-2026-19916 A vulnerability was detected in code-projects Online Food Order System 1.0. The affected element is an unknown function of the file edit_food_items.php. Performing a mani...	3.5 Low	—	0,35%	15 Agt 2026
CVE-2026-19906 A weakness has been identified in pkp pkp-lib 3.3.0/3.4.0/3.5.0. This vulnerability affects the function setData of the file classes/user/form/APIProfileForm.php of the c...	3.7 Low	—	0,49%	15 Agt 2026
CVE-2026-19905 A weakness has been identified in Jinher OA 1.0. Impacted is an unknown function of the file /C6/JHSoft.Web.HrmAttendance/attendance_out_approve.aspx. This manipulation o...	7.3 High	—	0,41%	15 Agt 2026
CVE-2026-18855 The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ll_delete_link_fields function in all versi...	9.1 Critical	—	1,4%	15 Agt 2026
CVE-2026-19904 A vulnerability was found in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file /admin/index.php?page=site_settings of the c...	2.4 Low	—	0,37%	15 Agt 2026
CVE-2026-19903 A vulnerability has been found in SourceCodester Online Clothing Store 1.0. This affects an unknown part of the file /db/shopping.sql of the component SQL Database Backup...	5.3 Medium	—	0,53%	15 Agt 2026
CVE-2026-19901 A security flaw has been discovered in LB-LINK X-PRO 1.0.22-20231206. This affects an unknown function of the file /etc/config/easycwmp. The manipulation results in hard-...	8.1 High	—	0,77%	15 Agt 2026
CVE-2026-19598 The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9...	9.8 Critical	—	2,3%	15 Agt 2026
CVE-2026-19900 A vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206. The impacted element is an unknown function of the file /etc/shadow. The manipulation leads to hard-coded...	8.1 High	—	2,9%	15 Agt 2026
CVE-2026-19899 A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. The affected element is an unknown function of the file /edit_teacher.php. Executi...	7.3 High	—	0,43%	15 Agt 2026
CVE-2026-19898 A vulnerability was found in VictoriaMetrics up to 1.146.0. Impacted is the function requestHandler of the file app/vmauth/main.go of the component VMAuth Authentication...	3.7 Low	—	0,75%	15 Agt 2026
CVE-2026-19897 A vulnerability has been found in mangroup dtale up to 3.22.0. This issue affects the function Login of the file dtale/auth.py of the component Login Endpoint. Such manip...	3.7 Low	—	0,57%	15 Agt 2026
CVE-2026-19896 A flaw has been found in mangroup dtale up to 3.22.0. This vulnerability affects the function build_secret_key of the file dtale/app.py of the component Flask Session Coo...	3.7 Low	—	0,49%	15 Agt 2026
CVE-2026-19895 A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This affects the function Login::index of the file app/Config/Filters.php of the comp...	3.7 Low	—	0,63%	15 Agt 2026
CVE-2026-19474 fastify-multipart @fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles() can leave completed temp...	7.5 High	—	0,49%	15 Agt 2026
CVE-2026-18549 fastify-multipart @fastify/multipart is a multipart form-data parser for Fastify. In versions from 5.3.0 up to but not including 10.1.1, when the busboy fileSize limit truncates a file par...	7.5 High	—	0,60%	15 Agt 2026
CVE-2026-18500 fastify/jwt @fastify/jwt is a JSON Web Token plugin for Fastify. In versions before 10.2.2, a per-request verification key passed to request.jwtVerify({ key }) is silently overridden...	8.1 High	—	0,26%	15 Agt 2026
CVE-2026-18165 fastify/oauth2 @fastify/oauth2 is an OAuth 2.0 plugin for Fastify. In versions from 7.2.0 up to but not including 8.3.0, the plugin validates the OAuth state, and with PKCE the code ver...	5.4 Medium	—	0,13%	15 Agt 2026
CVE-2026-15689 Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in _default_email_password_reset and _de...	9.8 Critical	—	0,84%	15 Agt 2026
CVE-2026-74576 In the Linux kernel, the following vulnerability has been resolved: mm/slab: prevent unbounded recursion in free path with new kmalloc type Commit 280ea9c3154b ("mm/sla...	7.5 High	—	0,67%	15 Agt 2026
CVE-2026-74575 In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Prevent XDomain delayed work use-after-free on disconnect tb_xdp_handle_request() runs...	8.8 High	—	0,24%	15 Agt 2026
CVE-2026-74574 In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() The failed_dev_add and failed_de...	7.8 High	—	0,12%	15 Agt 2026
CVE-2026-74573 In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE arm_vsmmu_vsid_to_sid() maps...	9.3 Critical	—	0,19%	15 Agt 2026
CVE-2026-74572 In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: fix deadlock between metadata writeback and transaction commit When writing out metada...	7.5 High	—	0,35%	15 Agt 2026
CVE-2026-74570 In the Linux kernel, the following vulnerability has been resolved: ntfs: harden runlist realloc size calculations Add a shared helper to safely convert runlist element...	9.8 Critical	—	0,55%	15 Agt 2026
CVE-2026-74569 In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() sip_help_tcp() stores...	9.8 Critical	—	0,39%	15 Agt 2026
CVE-2026-74568 In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Fix race between LPI release and re-registration Fix a potential race between decr...	9.3 Critical	—	0,19%	15 Agt 2026
CVE-2026-74567 In the Linux kernel, the following vulnerability has been resolved: keys: fix out-of-bounds read in keyring_get_key_chunk() For description-level chunks keyring_get_key...	7.1 High	—	0,12%	15 Agt 2026
CVE-2026-74565 In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: make nft_object rhltable per table The nft_object rhltable is global, this all...	7.8 High	—	0,12%	15 Agt 2026
CVE-2026-74564 In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH The XT_HASHLIMIT_RATE_M...	7.1 High	—	0,12%	15 Agt 2026
CVE-2026-74563 In the Linux kernel, the following vulnerability has been resolved: rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() rds_tcp_laddr_check() lo...	7.8 High	—	0,12%	15 Agt 2026
CVE-2026-74562 In the Linux kernel, the following vulnerability has been resolved: nexthop: take nh->lock for f6i_list walks in replace check and notify fib6_check_nh_list() and __nex...	8.8 High	—	0,17%	15 Agt 2026
CVE-2026-74561 In the Linux kernel, the following vulnerability has been resolved: nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush nh_rt_cache_flush() walks nh->f6i_list du...	8.8 High	—	0,17%	15 Agt 2026
CVE-2026-74557 In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer iscsi_scsi_cmd_rsp() copies the sense...	7.5 High	—	0,33%	15 Agt 2026
CVE-2026-74556 Advisory In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer iscsi_tcp_hdr_dissect(...	9.8 Critical	—	0,40%	15 Agt 2026
CVE-2026-74554 In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix out-of-bounds clear_bit in ath12k_mac_dp_peer_cleanup() ath12k_mac_dp_peer_cleanup...	8.8 High	—	0,34%	15 Agt 2026
CVE-2026-74551 In the Linux kernel, the following vulnerability has been resolved: hwmon: (nzxt-smart2) DMA-align output buffer Sashiko reports: When send_output_report() calls hid_h...	7.8 High	—	0,13%	15 Agt 2026
CVE-2026-74550 In the Linux kernel, the following vulnerability has been resolved: net: do not send ICMP/NDISC Redirects when peer allocation fails When inet_getpeer_v4() or inet_getp...	7.5 High	—	0,48%	15 Agt 2026
CVE-2026-74549 In the Linux kernel, the following vulnerability has been resolved: hwmon: (nct6775-core) Prevent access to unsupported weight registers Sashiko reports: During initia...	7.8 High	—	0,13%	15 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.