Katalog CVE (hal. 721)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 265.400 (Critical 36.562 · High 106.027 · KEV 1.764 · sejak 2020) · Pembaruan terakhir: 30 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 36.001–36.050 dari 265.400 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-73621 gitpython project gitpython GitPython before 3.1.56 contains an argument injection vulnerability in the Commit.count() method, which forwards keyword arguments to 'git rev-list' without the check_un...	5.4 Medium	—	0,36%	13 Agt 2026
CVE-2026-73620 gitpython project gitpython GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allowing attackers to pass unsafe options via kwargs. Atta...	8.1 High	—	0,57%	13 Agt 2026
CVE-2026-73619 gitpython project gitpython GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --add-file and --add-virtual-file options. Attackers can supply...	6.5 Medium	—	0,41%	13 Agt 2026
CVE-2026-73618 Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON q...	8.3 High	—	0,36%	13 Agt 2026
CVE-2026-73617 Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplied parameters are enriched with handlebars using no...	7.1 High	—	0,34%	13 Agt 2026
CVE-2026-73616 OpenRemote notification deletion endpoints fail to enforce realm boundaries, allowing any realm administrator to delete notifications belonging to other realms. Attackers...	6.5 Medium	—	0,31%	13 Agt 2026
CVE-2026-73615 Network-AI versions before 5.15.1 contain a security matcher bypass vulnerability where SandboxPolicy evaluates raw command strings with quotes preserved while the execut...	8.8 High	—	0,65%	13 Agt 2026
CVE-2026-73614 Network-AI ClaudeHookBridge before 5.15.1 truncates the target string to 500 characters before evaluating denyPatterns, while Claude Code executes the full untruncated co...	8.8 High	—	0,68%	13 Agt 2026
CVE-2026-73613 filebrowser versions before 2.63.19 contain an out-of-scope file deletion vulnerability in the TUS upload cache eviction mechanism that allows authenticated users with on...	8.2 High	—	0,56%	13 Agt 2026
CVE-2026-73612 File Browser before v2.63.22 fails to validate access rules for descendants during recursive copy, rename, and delete operations, allowing authenticated users to bypass p...	8.1 High	—	0,48%	13 Agt 2026
CVE-2026-73611 File Browser versions from 2.50.0 through 2.63.21 fail to validate JWT expiration when proxy authentication is configured with a non-default logout page. Attackers with a...	6.8 Medium	—	0,43%	13 Agt 2026
CVE-2026-73610 SiYuan before v3.7.4 contains an information disclosure vulnerability in the local storage filter that returns the administrator's entire storage map with only three keys...	5.8 Medium	—	0,26%	13 Agt 2026
CVE-2026-73609 SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getBookmarkLabels endpoint that returns all bookmark labels in the workspace without...	5.8 Medium	—	0,33%	13 Agt 2026
CVE-2026-73608 SiYuan's development branch (endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in v3.7.4-alpha.3) contains a missing-authorization vulnera...	8.6 High	—	0,31%	13 Agt 2026
CVE-2026-73607 SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attack...	5.8 Medium	—	0,25%	13 Agt 2026
CVE-2026-73606 SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/block/getRefIDs endpoint that fails to check password-protected document tiers....	5.8 Medium	—	0,33%	13 Agt 2026
CVE-2026-73605 SiYuan versions before v3.7.4 contain a path traversal vulnerability in the getUniqueFilename endpoint that allows anonymous readers to probe filesystem existence without...	5.8 Medium	—	0,33%	13 Agt 2026
CVE-2026-73604 flowiseai flowise Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Au...	6.5 Medium	—	0,41%	13 Agt 2026
CVE-2026-73603 flowiseai flowise Flowise before 3.1.4 fails to validate chatflow visibility in the unauthenticated text-to-speech endpoint, allowing attackers to abuse private chatflow TTS credentials. U...	5.3 Medium	—	0,33%	13 Agt 2026
CVE-2026-73602 flowiseai flowise Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment...	9.9 Critical	—	0,83%	13 Agt 2026
CVE-2026-73601 flowiseai flowise Flowise versions before 3.1.3 contain a remote code execution vulnerability in the Custom MCP node when CUSTOM_MCP_PROTOCOL is set to stdio, allowing authenticated users...	8.8 High	—	1,1%	13 Agt 2026
CVE-2026-73488 flowiseai flowise Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET /api/v1/organization/customer-default-source endpoint that allows authe...	6.5 Medium	—	0,37%	13 Agt 2026
CVE-2026-73487 flowiseai flowise Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows unauthenticated attackers to inject malicious code vi...	9.8 Critical	—	0,96%	13 Agt 2026
CVE-2026-73486 flowiseai flowise Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's customReadCSV parameter that allows authenticated attackers to execute arbitrary Pyth...	8.8 High	—	0,66%	13 Agt 2026
CVE-2026-73485 flowiseai flowise Flowise before 3.1.3 contains a code injection vulnerability in the Airtable Agent node that allows unauthenticated attackers to execute arbitrary Python code by bypassin...	8.8 High	—	0,60%	13 Agt 2026
CVE-2026-73484 flowiseai flowise Flowise before 3.1.3 contains a sandbox escape vulnerability in pythonCodeValidator.ts that fails to block native Pandas DataFrame methods like to_csv, to_json, pipe, and...	8.1 High	—	0,44%	13 Agt 2026
CVE-2026-73483 flowiseai flowise Flowise (packages flowise and flowise-components) in versions <= 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user wit...	8.8 High	—	0,62%	13 Agt 2026
CVE-2026-45819 baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process terminat...	6.6 Medium	—	0,51%	13 Agt 2026
CVE-2026-18368 In Teltonika Networks RUTOS devices, a vulnerability exists in modbusgwd due to improper handling of Modbus TCP request data. A remote, unauthenticated attacker with ac...	6.0 Medium	—	0,25%	13 Agt 2026
CVE-2026-16455 In Teltonika Networks RUTOS devices running versions 7.07.1 through 7.24.1 and TSWOS devices running versions 1.03 through 1.10, a vulnerability exists whereby a lower pr...	6.9 Medium	—	0,29%	13 Agt 2026
CVE-2026-12263 Zohocorp ManageEngine Password Manager Pro versions before 13232 and PAM360 versions before 8551 are vulnerable to an authentication bypass vulnerability due to improper...	8.8 High	—	1,4%	13 Agt 2026
CVE-2026-59507 : Use of Hard-coded Credentials : Exposure of Sensitive Information to an Unauthorized Actor : Improper Access Control vulnerability in Priority Portal Generator addon to...	9.3 Critical	—	0,34%	13 Agt 2026
CVE-2026-59506 : Missing Authentication for Critical Function vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affects Portal...	9.3 Critical	—	0,41%	13 Agt 2026
CVE-2026-59505 : Improper Access Control vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affects Portal Generator addon to Pr...	8.6 High	—	0,39%	13 Agt 2026
CVE-2026-59504 : Client-Side Enforcement of Server-Side Security vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affects Port...	9.1 Critical	—	0,43%	13 Agt 2026
CVE-2026-59503 : Exposure of Sensitive Information to an Unauthorized Actor : Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Priority Portal Generato...	9.1 Critical	—	0,43%	13 Agt 2026
CVE-2026-59502 : Observable Discrepancy vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affects Portal Generator addon to Pri...	5.3 Medium	—	0,33%	13 Agt 2026
CVE-2026-59501 : Improper Access Control vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affects Portal Generator addon to Pr...	8.2 High	—	0,34%	13 Agt 2026
CVE-2026-59500 : Improper Authentication vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affects Portal Generator addon to Pr...	10.0 Critical	—	0,50%	13 Agt 2026
CVE-2026-59499 : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions).. This issue...	8.6 High	—	0,42%	13 Agt 2026
CVE-2026-19484 fastify/busyboy @fastify/busboy is a multipart form-data parser. In versions 3.1.0 through 3.2.0, a remote unauthenticated attacker can stall the Node.js event loop by sending a multipar...	7.5 High	—	0,62%	13 Agt 2026
CVE-2026-11970 This vulnerability allows a normal (non-admin) user to disable the Forcepoint One Endpoint SafariExtension and bypass DLP protection in F1E Mac OS before v26.04.5758.	4.8 Medium	—	0,16%	13 Agt 2026
CVE-2026-19696 wireshark Ixia IxVeriWave and Vector Informatik BLF file parser crashes in 4.6.0 to 4.6.7 allows denial of service on Windows	5.5 Medium	—	0,12%	13 Agt 2026
CVE-2026-19695 wireshark Gammu DCT3 trace file parser crash in 4.6.0 to 4.6.7 allows denial of service	5.5 Medium	—	0,12%	13 Agt 2026
CVE-2026-19694 wireshark TTX Logger file parser crash in 4.6.0 to 4.6.7 allows denial of service	5.5 Medium	—	0,13%	13 Agt 2026
CVE-2026-19481 fastify/busyboy @fastify/busboy is a multipart form-data parser. In versions 1.0.0 through 3.2.0, an attacker who can submit multipart form-data can crash the parser by sending a part he...	7.5 High	—	0,49%	13 Agt 2026
CVE-2026-16459 Padding oracle attack vulnerability in Oberon microsystem AG’s Oberon PSA Crypto library in all versions since 1.0.0 and prior to 2.1.1 allows an attacker to recover plai...	5.9 Medium	—	0,09%	13 Agt 2026
CVE-2026-16458 Padding oracle attack vulnerability in Oberon microsystem AG’s ocrypto library in all versions since 3.0.0 and prior to 4.0.1 allows an attacker to recover plaintexts via...	5.9 Medium	—	0,09%	13 Agt 2026
CVE-2026-15413 The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator-controlled REST API under /wp-json/link-factory/v1...	10.0 Critical	—	0,52%	13 Agt 2026
CVE-2026-14332 The Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin before 7.0.9 does not perform a capability check or nonce verification on one of its store-management act...	5.4 Medium	—	0,29%	13 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.