Katalog CVE (hal. 715)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 265.369 (Critical 36.560 · High 106.018 · KEV 1.764 · sejak 2020) · Pembaruan terakhir: 30 Okt 2026, 12:27 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 35.701–35.750 dari 265.369 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-58314 Two SSRF findings in Gitea 1.26.2	7.7 High	—	0,40%	13 Agt 2026
CVE-2026-57897 Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs	6.5 Medium	—	0,41%	13 Agt 2026
CVE-2026-57894 Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration	8.5 High	—	0,36%	13 Agt 2026
CVE-2026-57886 Cross-repository issue/comment attachment re-linking can expose private attachment content	5.9 Medium	—	0,31%	13 Agt 2026
CVE-2026-56755 Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload	6.2 Medium	—	0,17%	13 Agt 2026
CVE-2026-56750 Gitea Remember-Me Token Theft Not Invalidating Attacker Session	9.1 Critical	—	0,48%	13 Agt 2026
CVE-2026-56657 Gitea SSH Key Parser Denial of Service	6.2 Medium	—	0,17%	13 Agt 2026
CVE-2026-56654 Privilege Escalation via Access Token Scope Escalation in API	9.8 Critical	—	0,83%	13 Agt 2026
CVE-2026-56443 Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118	9.6 Critical	—	0,53%	13 Agt 2026
CVE-2026-55987 OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)	8.1 High	—	0,41%	13 Agt 2026
CVE-2026-55986 Email Management API Bypasses ManageCredentials Feature Restrictions	5.4 Medium	—	0,32%	13 Agt 2026
CVE-2026-55984 Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service	2.7 Low	—	0,46%	13 Agt 2026
CVE-2026-55982 OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes	9.1 Critical	—	0,51%	13 Agt 2026
CVE-2026-55402 absolute secure access CVE-2026-55402 is an out of bounds read vulnerability in Secure Access servers prior to version 14.57. Attackers with an ‘in the middle’ position can send specially cra...	5.9 Medium	—	0,41%	13 Agt 2026
CVE-2026-54481 Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)	7.5 High	—	0,30%	13 Agt 2026
CVE-2026-50105 RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)	4.3 Medium	—	0,36%	13 Agt 2026
CVE-2026-42931 Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint	6.5 Medium	—	0,53%	13 Agt 2026
CVE-2026-24791 Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes	8.1 High	—	0,45%	13 Agt 2026
CVE-2026-24059 The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- and repository-level equivalents) creates a new runner registration token if none exists,...	6.5 Medium	—	0,42%	13 Agt 2026
CVE-2026-23603 Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim	3.1 Low	—	0,29%	13 Agt 2026
CVE-2026-13051 Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy diagnostic...	9.1 Critical	—	0,56%	13 Agt 2026
CVE-2026-13048 Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because load_lexicon interpolates the lang...	8.2 High	—	0,56%	13 Agt 2026
CVE-2022-4993 HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message...	9.1 Critical	—	0,63%	13 Agt 2026
CVE-2026-73671 Saurus CMS Community Edition contains an unauthenticated open redirect vulnerability in the logout handling code in classes/port.inc.php, where the url parameter supplied...	6.1 Medium	—	0,31%	13 Agt 2026
CVE-2026-73670 A CMS contains a SQL injection vulnerability in admin/db_data.php at line 509 that allows authenticated administrators to inject arbitrary SQL into a SHOW COLUMNS FROM st...	7.2 High	—	0,53%	13 Agt 2026
CVE-2026-73576 synacor zimbra collaboration suite In Zimbra Collaboration (ZCS) before 10.1.17, weak cryptographic key generation vulnerability exists in the OnlyOffice integration. The zimbraDocumentEditingJwtSecret is...	6.5 Medium	—	0,33%	13 Agt 2026
CVE-2026-73575 synacor zimbra collaboration suite In Zimbra Collaboration (ZCS) before 10.1.17, a Cross-Site Request Forgery (CSRF) vulnerability exists in the Exchange Web Services (EWS) endpoint of Zimbra Collaboration...	3.5 Low	—	0,15%	13 Agt 2026
CVE-2026-73574 synacor zimbra collaboration suite In Zimbra Collaboration before 10.1.17, a local file inclusion (LFI) vulnerability exists in the Zimbra Classic Web Client due to improper validation of the fu request pa...	6.5 Medium	—	0,33%	13 Agt 2026
CVE-2026-73573 synacor zimbra collaboration suite In Zimbra Collaboration (ZCS) before 10.1.17, a path traversal vulnerability exists in the Zimbra Briefcase document editing functionality due to improper validation of t...	6.5 Medium	—	0,45%	13 Agt 2026
CVE-2026-73572 synacor zimbra collaboration suite In Zimbra Collaboration (ZCS) before 10.1.17, a stored cross-site scripting (XSS) vulnerability exists in the Zimbra Classic Web Client due to insufficient sanitization o...	6.1 Medium	—	0,26%	13 Agt 2026
CVE-2026-73571 synacor zimbra collaboration suite An authorization bypass vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.17 due to improper authorization validation in delegated email sending functionalit...	4.3 Medium	—	0,26%	13 Agt 2026
CVE-2026-73570 Advisory synacor zimbra collaboration suite A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are en...	8.9 High	KEV	71,7%	13 Agt 2026
CVE-2026-73559 vllm vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.26.0, the /v1/completions CompletionRequest.prompt field in vllm/entrypoints/openai...	6.5 Medium	—	0,58%	13 Agt 2026
CVE-2026-73533 Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tamper...	9.8 Critical	—	0,65%	13 Agt 2026
CVE-2026-73532 Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampere...	9.8 Critical	—	0,67%	13 Agt 2026
CVE-2026-73515 PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeo...	8.1 High	—	0,57%	13 Agt 2026
CVE-2026-73514 The address_standardizer extension for PostGIS through 3.7.0, fixed in commit 423570b, contains an out-of-bounds write vulnerability that allows a database user with the...	8.8 High	—	0,82%	13 Agt 2026
CVE-2026-55401 absolute secure access CVE-2026-55401 is a null dereference vulnerability on the load-balancing sub-system of Secure Access servers prior to 14.57. Attackers can send an unauthenticated packe...	5.3 Medium	—	0,40%	13 Agt 2026
CVE-2026-55400 absolute secure access CVE-2026-55400 is an integer underflow in Secure Access servers prior to version 14.57. Attackers with an authenticated session can send specially crafted traffic to a...	6.5 Medium	—	0,37%	13 Agt 2026
CVE-2026-19744 Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via...	5.1 Medium	—	0,47%	13 Agt 2026
CVE-2026-19710 A vulnerability was found in SourceCodester Simple Student Information System. Affected by this vulnerability is an unknown functionality of the file app/admin/department...	7.3 High	—	0,43%	13 Agt 2026
CVE-2026-19487 Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass....	5.3 Medium	—	0,42%	13 Agt 2026
CVE-2026-73558 vllm vLLM is an inference and serving engine for large language models. Prior to 0.27.0, an integer overflow in blockIdx.x * 2 * d in activation_kernels.cu can cause act_and_m...	5.3 Medium	—	0,41%	13 Agt 2026
CVE-2026-73557 vllm vLLM is an inference and serving engine for large language models. From 0.20.2rc0 until 0.26.0, safe_load_prompt_embeds in vllm/renderers/embed_utils.py uses torch.sparse...	5.3 Medium	—	0,25%	13 Agt 2026
CVE-2026-73556 vllm vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structured_outputs.regex parameter in vllm/v1/structured_output/backend_lm_format_...	5.3 Medium	—	0,52%	13 Agt 2026
CVE-2026-73555 vllm vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the validation_exception_handler in vllm/entrypoints/openai/server_utils.py converts F...	5.3 Medium	—	0,41%	13 Agt 2026
CVE-2026-73509 OpenList a file list program that supports multiple storage. Prior to 4.2.4, the authenticated /api/fs/batch_rename handler in server/handles/fsbatch.go authorizes only t...	7.6 High	—	0,52%	13 Agt 2026
CVE-2026-73508 netty Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.dns.AbstractDnsRecord, io.netty.hand...	7.5 High	—	0,63%	13 Agt 2026
CVE-2026-73507 netty Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.xml.XmlFrameDecoder.decode() failed...	7.5 High	—	0,79%	13 Agt 2026
CVE-2026-73506 Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, write(s rune) in src/terminal/writer.go emitted attacker-contr...	6.1 Medium	—	0,18%	13 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.