Katalog CVE (hal. 710)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 265.369 (Critical 36.560 · High 106.018 · KEV 1.764 · sejak 2020) · Pembaruan terakhir: 30 Okt 2026, 12:27 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 35.451–35.500 dari 265.369 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-73667 OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.0-rc.2, OpenChoreo Workflow Plane templates under samples/getting-...	8.8 High	—	0,86%	13 Agt 2026
CVE-2026-73666 OpenChoreo is a developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.1, the OpenChoreo Backstage backend hardcoded backend.auth.dangerouslyDisableDefaultAuth...	8.2 High	—	0,68%	13 Agt 2026
CVE-2026-73665 sangoma freepbx FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.use(checkAuth) in node/lib/server.js, but Socket.IO version 4 applie...	9.8 Critical	—	0,33%	13 Agt 2026
CVE-2026-73664 FreePBX is an open source IP PBX. From 17.0.5.34 until 17.0.11, the publicKeySave AJAX endpoint in Backup.class.php accepts an authenticated administrator's SSH public ke...	8.6 High	—	0,51%	13 Agt 2026
CVE-2026-73663 sangoma freepbx FreePBX is an open source IP PBX. From 16.0.0 until 16.0.11 and 17.0.4, the FreePBX missedcall module places the inbound Caller ID name from crafted SIP From headers into...	9.8 Critical	—	0,38%	13 Agt 2026
CVE-2026-73662 sangoma freepbx FreePBX is an open source IP PBX. From 17.0.1 until 17.0.7, the FreePBX Music on Hold module permits dangerous command-line options for /usr/bin/mpg123 and other allowed...	7.2 High	—	0,88%	13 Agt 2026
CVE-2026-73661 sangoma freepbx FreePBX is an open source IP PBX. Prior to 16.0.47 and 17.0.30, the FreePBX Framework module permits a crafted backup to restore the hidden AUTHTYPE setting with the valu...	6.5 Medium	—	0,31%	13 Agt 2026
CVE-2026-73660 FreePBX is an open source IP PBX. Prior to 16.0.6 and 17.0.5.4, the FreePBX Text-To-Speech module allows an authenticated administrator to save a TTS destination name tha...	7.5 High	—	0,77%	13 Agt 2026
CVE-2026-73659 Trigger.dev is the open-source platform for building AI workflows in TypeScript. From 4.4.2 until 4.5.0, the packet presign routes in apps/webapp/app/routes/api.v1.packet...	8.1 High	—	0,51%	13 Agt 2026
CVE-2026-73658 Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5, Aws4FetchClient.buildUrl() and Aws4FetchClient.pr...	8.2 High	—	0,41%	13 Agt 2026
CVE-2026-73657 Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.4, `POST /api/v1/runs/:runParam/replay` in apps/weba...	4.2 Medium	—	0,18%	13 Agt 2026
CVE-2026-73489 Russh is a Rust SSH client & server library. Prior to 0.62.4, an authenticated SSH client can cause a denial of service by sending a pty-req channel request with more tha...	4.3 Medium	—	0,45%	13 Agt 2026
CVE-2026-73479 dua-cli fails to filter terminal escape sequences when printing marked file paths after exiting the TUI interface. Attackers can craft file names containing OSC/CSI escap...	5.0 Medium	—	0,17%	13 Agt 2026
CVE-2026-73428 Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is past...	4.6 Medium	—	0,35%	13 Agt 2026
CVE-2026-73421 NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate access by checking only for the existence of the...	9.1 Critical	—	0,64%	13 Agt 2026
CVE-2026-73420 NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-lin...	9.1 Critical	—	0,73%	13 Agt 2026
CVE-2026-73417 jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 3.3.0 until 4.5.10 and 4.6.2, Jupyter...	8.6 High	—	0,75%	13 Agt 2026
CVE-2026-73416 jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.0 until 4.5.10 and 4.6.2, in jupy...	6.1 Medium	—	0,66%	13 Agt 2026
CVE-2026-73408 Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multipleStatements and inserted an unescaped tableName i...	7.6 High	—	0,45%	13 Agt 2026
CVE-2026-73305 Budibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign called validateGlobalRoleUpdate without checking appBuilder.appId or role...	8.8 High	—	0,52%	13 Agt 2026
CVE-2026-73304 Budibase is an open-source low-code platform. Prior to 3.39.25, GET /api/users/metadata and GET /api/users/metadata/:id returned user objects processed by packages/server...	4.9 Medium	—	0,49%	13 Agt 2026
CVE-2026-73302 Budibase is an open-source low-code platform. Prior to 3.39.30, the OIDC flow in packages/backend-core/src/middleware/passport/sso/oidc.ts resolved an email without getEm...	9.0 Critical	—	0,43%	13 Agt 2026
CVE-2026-73039 streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users' viewing stat...	5.4 Medium	—	0,30%	13 Agt 2026
CVE-2026-72857 Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase...	7.7 High	—	0,35%	13 Agt 2026
CVE-2026-72856 Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT /api/global/users/tenant/owner (changeTenantOwnerEmail) endpoint. On self-hosted...	8.1 High	—	0,48%	13 Agt 2026
CVE-2026-72855 Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-level users...	8.5 High	—	0,38%	13 Agt 2026
CVE-2026-72853 Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in identifiers....	7.6 High	—	0,34%	13 Agt 2026
CVE-2026-72851 Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTE_QUERY steps. Attackers can POST attacker-cont...	10.0 Critical	—	0,36%	13 Agt 2026
CVE-2026-72850 Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to upload files with traversal sequences that are preserved during expor...	9.1 Critical	—	0,52%	13 Agt 2026
CVE-2026-72849 Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a...	7.7 High	—	0,16%	13 Agt 2026
CVE-2026-72842 luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes without proper...	9.9 Critical	—	0,62%	13 Agt 2026
CVE-2026-72841 luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload, allowing authenticated users to perform path traversal and write arbitrary fi...	9.9 Critical	—	0,62%	13 Agt 2026
CVE-2026-72840 OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount config...	8.8 High	—	0,44%	13 Agt 2026
CVE-2026-72839 filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is enabled with default CreateUserDir setting. Unauthenticated attackers can...	9.8 Critical	—	0,57%	13 Agt 2026
CVE-2026-72776 AgenticSeek (commit fc242c7) contains an unauthenticated remote code execution vulnerability that allows any network-adjacent attacker to execute arbitrary commands by su...	9.8 Critical	—	1,1%	13 Agt 2026
CVE-2026-56865 A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled...	8.4 High	—	0,13%	13 Agt 2026
CVE-2026-56864 A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB t...	7.5 High	—	0,30%	13 Agt 2026
CVE-2026-56862 Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious cli...	7.5 High	—	0,57%	13 Agt 2026
CVE-2026-56860 Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic tim...	5.9 Medium	—	0,55%	13 Agt 2026
CVE-2026-56859 Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.	7.5 High	—	0,57%	13 Agt 2026
CVE-2026-56858 Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.	6.1 Medium	—	0,31%	13 Agt 2026
CVE-2026-56853 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeo...	7.5 High	—	0,57%	13 Agt 2026
CVE-2026-33818 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.	7.5 High	—	0,57%	13 Agt 2026
CVE-2026-19752 A vulnerability was found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. This affects the function parse-pdf of the file src/index.ts...	6.3 Medium	—	0,37%	13 Agt 2026
CVE-2026-19751 A flaw has been found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. The affected element is the function axios.get of the file src/in...	6.3 Medium	—	0,37%	13 Agt 2026
CVE-2026-19750 A flaw has been found in Tenda CH, CP and TX3 V21.x/V22.x/V25.x/V26.x/V27.x. Affected by this issue is some unknown functionality of the component SSH. Executing a manipu...	8.1 High	—	0,81%	13 Agt 2026
CVE-2026-8715 Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration that may al...	9.6 Critical	—	0,47%	13 Agt 2026
CVE-2026-73480 gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names conta...	5.0 Medium	—	0,17%	13 Agt 2026
CVE-2026-19749 A vulnerability was detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected by this vulnerability is an unkno...	3.7 Low	—	0,63%	13 Agt 2026
CVE-2026-19748 A security vulnerability has been detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected is the function CWe...	3.7 Low	—	0,49%	13 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.