Katalog CVE (hal. 726)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 265.720 (Critical 36.587 · High 106.162 · KEV 1.764 · sejak 2020) · Pembaruan terakhir: 31 Okt 2026, 00:26 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 36.251–36.300 dari 265.720 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-6464 postgresql Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY F...	8.1 High	—	0,36%	13 Agt 2026
CVE-2026-49827 WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP f...	9.8 Critical	—	0,86%	13 Agt 2026
CVE-2026-49478 Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Versions through 1.8.5 improperly follow cross-host redirec...	8.7 High	—	0,28%	13 Agt 2026
CVE-2026-19385 postgresql Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pg_dum...	8.8 High	—	0,43%	13 Agt 2026
CVE-2026-18408 postgresql Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client oper...	8.8 High	—	0,36%	13 Agt 2026
CVE-2026-18024 postgresql Buffer over-read in PostgreSQL ascii() SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a crafted text value. This is the...	4.3 Medium	—	0,30%	13 Agt 2026
CVE-2026-16241 postgresql Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via sending a bytea value lacki...	3.8 Low	—	0,34%	13 Agt 2026
CVE-2026-16239 postgresql Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cur...	8.8 High	—	0,68%	13 Agt 2026
CVE-2026-16238 postgresql Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via confla...	8.8 High	—	0,41%	13 Agt 2026
CVE-2026-15742 postgresql Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running...	8.8 High	—	0,60%	13 Agt 2026
CVE-2026-15741 postgresql SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression d...	8.8 High	—	0,44%	13 Agt 2026
CVE-2026-14681 postgresql Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct TLS connection....	4.2 Medium	—	0,08%	13 Agt 2026
CVE-2026-14680 postgresql Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to fu...	8.8 High	—	0,42%	13 Agt 2026
CVE-2026-14679 postgresql Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT parameter count. The attack can write only 0x0 and...	8.2 High	—	0,29%	13 Agt 2026
CVE-2026-14678 postgresql Buffer over-read in PostgreSQL pg_trgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory values, via...	4.3 Medium	—	0,30%	13 Agt 2026
CVE-2026-14677 postgresql Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via cra...	8.8 High	—	0,41%	13 Agt 2026
CVE-2026-14676 postgresql Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operating system user running the database, via crafted que...	8.8 High	—	0,44%	13 Agt 2026
CVE-2026-14673 postgresql Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that...	3.8 Low	—	0,27%	13 Agt 2026
CVE-2026-14672 postgresql Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count....	5.3 Medium	—	0,39%	13 Agt 2026
CVE-2026-14671 postgresql Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerg...	8.8 High	—	0,42%	13 Agt 2026
CVE-2026-14670 postgresql Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via...	8.8 High	—	0,44%	13 Agt 2026
CVE-2026-14669 postgresql Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the database...	8.8 High	—	0,66%	13 Agt 2026
CVE-2026-14668 postgresql Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the value of an arbitrary 4-...	8.1 High	—	0,33%	13 Agt 2026
CVE-2026-14666 postgresql Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security polici...	4.2 Medium	—	0,21%	13 Agt 2026
CVE-2026-14664 postgresql Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pas...	8.8 High	—	0,44%	13 Agt 2026
CVE-2026-14663 postgresql Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and Op...	6.5 Medium	—	0,11%	13 Agt 2026
CVE-2026-14662 postgresql Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write ou...	8.8 High	—	0,46%	13 Agt 2026
CVE-2025-52640 HCL AION is affected by a vulnerability where the shared storage used by product components is architected without sufficient access separation. Processes sharing the sto...	4.7 Medium	—	0,11%	13 Agt 2026
CVE-2026-73629 Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the serendipity_url_allowed() filter that fails to block hex-encoded IPv4 addresses, IPv6...	8.5 High	—	0,32%	13 Agt 2026
CVE-2026-73628 Serendipity versions >= 2.3.5 and <= 2.6.0 contain a reflected cross-site scripting vulnerability in the search clean-URL route (/search/<term>). In include/functions_rou...	6.1 Medium	—	0,26%	13 Agt 2026
CVE-2026-73627 JupyterLab (pip package 'jupyterlab') versions >=4.1.0,<=4.5.9 and >=4.6.0,<=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps...	6.0 Medium	—	0,42%	13 Agt 2026
CVE-2026-73626 JupyterLab versions >=4.6.0,<=4.6.1 and <=4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install(). A missing 'await' caused the is_install_...	7.5 High	—	0,36%	13 Agt 2026
CVE-2026-73625 gitpython project gitpython GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options guard that can be bypassed by smuggling git options inside sing...	8.8 High	—	0,92%	13 Agt 2026
CVE-2026-73624 gitpython project gitpython GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that fails to validate git options passed through kwargs. A...	8.1 High	—	0,55%	13 Agt 2026
CVE-2026-73623 gitpython project gitpython GitPython before 3.1.54 contains an incomplete denylist in unsafe_git_clone_options that omits --template, allowing attackers to achieve arbitrary command execution durin...	8.8 High	—	0,84%	13 Agt 2026
CVE-2026-73622 gitpython project gitpython GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by s...	7.5 High	—	0,51%	13 Agt 2026
CVE-2026-73621 gitpython project gitpython GitPython before 3.1.56 contains an argument injection vulnerability in the Commit.count() method, which forwards keyword arguments to 'git rev-list' without the check_un...	5.4 Medium	—	0,36%	13 Agt 2026
CVE-2026-73620 gitpython project gitpython GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allowing attackers to pass unsafe options via kwargs. Atta...	8.1 High	—	0,57%	13 Agt 2026
CVE-2026-73619 gitpython project gitpython GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --add-file and --add-virtual-file options. Attackers can supply...	6.5 Medium	—	0,41%	13 Agt 2026
CVE-2026-73618 Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON q...	8.3 High	—	0,36%	13 Agt 2026
CVE-2026-73617 Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplied parameters are enriched with handlebars using no...	7.1 High	—	0,34%	13 Agt 2026
CVE-2026-73616 OpenRemote notification deletion endpoints fail to enforce realm boundaries, allowing any realm administrator to delete notifications belonging to other realms. Attackers...	6.5 Medium	—	0,31%	13 Agt 2026
CVE-2026-73615 Network-AI versions before 5.15.1 contain a security matcher bypass vulnerability where SandboxPolicy evaluates raw command strings with quotes preserved while the execut...	8.8 High	—	0,65%	13 Agt 2026
CVE-2026-73614 Network-AI ClaudeHookBridge before 5.15.1 truncates the target string to 500 characters before evaluating denyPatterns, while Claude Code executes the full untruncated co...	8.8 High	—	0,68%	13 Agt 2026
CVE-2026-73613 filebrowser versions before 2.63.19 contain an out-of-scope file deletion vulnerability in the TUS upload cache eviction mechanism that allows authenticated users with on...	8.2 High	—	0,56%	13 Agt 2026
CVE-2026-73612 File Browser before v2.63.22 fails to validate access rules for descendants during recursive copy, rename, and delete operations, allowing authenticated users to bypass p...	8.1 High	—	0,48%	13 Agt 2026
CVE-2026-73611 File Browser versions from 2.50.0 through 2.63.21 fail to validate JWT expiration when proxy authentication is configured with a non-default logout page. Attackers with a...	6.8 Medium	—	0,43%	13 Agt 2026
CVE-2026-73610 SiYuan before v3.7.4 contains an information disclosure vulnerability in the local storage filter that returns the administrator's entire storage map with only three keys...	5.8 Medium	—	0,26%	13 Agt 2026
CVE-2026-73609 SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getBookmarkLabels endpoint that returns all bookmark labels in the workspace without...	5.8 Medium	—	0,33%	13 Agt 2026
CVE-2026-73608 SiYuan's development branch (endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in v3.7.4-alpha.3) contains a missing-authorization vulnera...	8.6 High	—	0,31%	13 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.