Katalog CVE (hal. 730)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 265.720 (Critical 36.587 · High 106.162 · KEV 1.764 · sejak 2020) · Pembaruan terakhir: 31 Okt 2026, 00:26 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 36.451–36.500 dari 265.720 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-73326 CamaleonCMS contains a missing authorization vulnerability that allows any authenticated low-privileged user to access and modify plugin settings by reaching four unprote...	7.6 High	—	0,38%	12 Agt 2026
CVE-2026-73308 Budibase is an open-source low-code platform. Prior to 3.39.25, packages/server/src/api/controllers/automation.ts returned automation test results containing trigger.outp...	5.7 Medium	—	0,41%	12 Agt 2026
CVE-2026-73307 Budibase is an open-source low-code platform. Prior to 3.39.4, uploadUrl in packages/server/src/utilities/fileUtils.ts used a bare server-side fetch for string attachment...	4.9 Medium	—	0,43%	12 Agt 2026
CVE-2026-73306 Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the failure counter in packages/worker/src/api/controlle...	5.3 Medium	—	0,44%	12 Agt 2026
CVE-2026-73303 Budibase is an open-source low-code platform. Prior to 3.40.0, POST /api/v2/email on account.budibase.app accepted a client-controlled accountId without binding it to the...	8.2 High	—	0,31%	12 Agt 2026
CVE-2026-73269 A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming convention, can trigger the creat...	9.9 Critical	—	0,56%	12 Agt 2026
CVE-2026-73268 A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant with create or update permissions on ClusterCurator resources can inje...	9.9 Critical	—	0,88%	12 Agt 2026
CVE-2026-72809 SiYuan versions <= v3.7.2 (patched in v3.7.4) contain an authentication bypass vulnerability in the kernel's CheckAuth function, which grants the administrator role (Role...	8.0 High	—	0,30%	12 Agt 2026
CVE-2026-72808 SiYuan versions up to and including v3.7.2 (fixed in v3.7.4) contain an information disclosure vulnerability in the /api/asset/getFileAnnotation endpoint, which returns ....	5.8 Medium	—	0,35%	12 Agt 2026
CVE-2026-72807 SiYuan versions before v3.7.4 contain a second-order SQL injection vulnerability in attribute-view template columns that expose the queryBlocks function, which executes r...	8.0 High	—	0,33%	12 Agt 2026
CVE-2026-72806 SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the FilterViewByPublishAccess filter that fails to check publish password protection when...	5.8 Medium	—	0,38%	12 Agt 2026
CVE-2026-72805 SiYuan versions before v3.7.4 fail to enforce publish-access checks on getBlockBreadcrumb, getRefText, and getBlockTreeInfos endpoints, allowing disclosure of protected d...	5.8 Medium	—	0,30%	12 Agt 2026
CVE-2026-72804 SiYuan versions before v3.7.4 fail to validate publish-password tier in getGraph and getLocalGraph endpoints, allowing anonymous readers to retrieve block-level content o...	8.6 High	—	0,43%	12 Agt 2026
CVE-2026-72803 SiYuan versions before v3.7.4 fail to enforce publish-access checks in the getBlockAttrs and batchGetBlockAttrs endpoints. Attackers can retrieve block attributes includi...	5.8 Medium	—	0,30%	12 Agt 2026
CVE-2026-72802 SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the resolveAssetPath endpoint that returns absolute filesystem paths unmodified to CheckA...	5.3 Medium	—	0,30%	12 Agt 2026
CVE-2026-72801 SiYuan versions before v3.7.4 disclose encrypted-notebook key-derivation material and wrapped data keys through unauthenticated endpoints in publish mode. Attackers can r...	7.5 High	—	0,31%	12 Agt 2026
CVE-2026-72800 SiYuan versions before v3.7.4 fail to apply publish-access filtering to the getAttributeViewKeysByID endpoint, allowing authenticated readers to retrieve complete databas...	5.8 Medium	—	0,33%	12 Agt 2026
CVE-2026-72799 SiYuan before v3.7.4 (affected <=v3.7.2) fails to enforce publish-access filters on five filetree path-resolution endpoints (getFullHPathByID, getHPathByID, getPathByID,...	5.8 Medium	—	0,33%	12 Agt 2026
CVE-2026-72798 SiYuan versions before v3.7.4 fail to properly filter related-database content in renderAttributeView, allowing anonymous readers to access Relation and Rollup cell conte...	8.6 High	—	0,43%	12 Agt 2026
CVE-2026-72797 SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getEncryptedNotebookStatus endpoint that returns encrypted notebook identifiers, name...	5.8 Medium	—	0,30%	12 Agt 2026
CVE-2026-72796 SiYuan before v3.7.4 contains an access control bypass vulnerability where static-file routes in the server mux bypass publish-access controls enforced on the REST API. A...	5.8 Medium	—	0,35%	12 Agt 2026
CVE-2026-72795 SiYuan versions before v3.7.4 fail to filter embedded block content by publish access in the getBlockDOMWithEmbed and getBlockDOMsWithEmbed endpoints. Attackers can reque...	8.6 High	—	0,31%	12 Agt 2026
CVE-2026-72794 siyuan versions before v3.7.4 expose the session cookie signing key through the /api/system/getConf endpoint to unauthenticated users in publish mode. Attackers can retri...	8.6 High	—	0,33%	12 Agt 2026
CVE-2026-72793 SiYuan versions before v3.7.4 fail to mask sensitive configuration fields in the /api/system/getConf endpoint, allowing anonymous or publish-reader users to obtain the se...	8.6 High	—	0,31%	12 Agt 2026
CVE-2026-72792 SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/tag/getTag endpoint that returns tag labels and occurrence counts from password-protecte...	5.8 Medium	—	0,33%	12 Agt 2026
CVE-2026-72791 SiYuan v3.7.4-alpha.1 (a pre-release; the endpoint does not exist in stable v3.7.3 or earlier) contains an information disclosure vulnerability in the /api/av/getAttribut...	5.8 Medium	—	0,33%	12 Agt 2026
CVE-2026-72790 SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/notebook/getNotebookInfo endpoint that returns notebook metadata without authorization c...	5.8 Medium	—	0,33%	12 Agt 2026
CVE-2026-72789 SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating them as publicly accessible by default. Anonymous readers can enumerate a...	8.6 High	—	0,37%	12 Agt 2026
CVE-2026-72788 SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the UILayout filter that fails to properly restrict administrator workspace state from pu...	5.8 Medium	—	0,38%	12 Agt 2026
CVE-2026-72787 Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element...	6.4 Medium	—	0,26%	12 Agt 2026
CVE-2026-72786 Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save action that allows authenticated users to change passwords without ve...	6.5 Medium	—	0,46%	12 Agt 2026
CVE-2026-72508 A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a namespace-admin tenant to...	9.9 Critical	—	0,81%	12 Agt 2026
CVE-2026-6821 gitlab GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could...	4.3 Medium	—	0,36%	12 Agt 2026
CVE-2026-67579 ash-hq ash framework Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pagination cur...	7.4 High	—	0,61%	12 Agt 2026
CVE-2026-63300 canonical lxd An improper validation vulnerability in the instancePostMigration function in lxd/instance_post.go of LXD allows an authenticated attacker with can_create_instances permi...	9.9 Critical	—	0,54%	12 Agt 2026
CVE-2026-63299 canonical lxd An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource l...	9.9 Critical	—	0,59%	12 Agt 2026
CVE-2026-63298 canonical lxd An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configur...	9.9 Critical	—	0,69%	12 Agt 2026
CVE-2026-63297 canonical lxd An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restrictions duri...	9.9 Critical	—	0,34%	12 Agt 2026
CVE-2026-63296 canonical lxd An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration. When migrating an instance...	9.9 Critical	—	0,44%	12 Agt 2026
CVE-2026-63295 canonical lxd An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When a project is configured with...	4.3 Medium	—	0,35%	12 Agt 2026
CVE-2026-63294 canonical lxd A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image or backup a...	9.9 Critical	—	0,88%	12 Agt 2026
CVE-2026-63293 canonical lxd A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image arch...	9.9 Critical	—	0,59%	12 Agt 2026
CVE-2026-62420 canonical lxd An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. Whe...	9.9 Critical	—	0,54%	12 Agt 2026
CVE-2026-59917 dell display and peripheral manager Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain Improper Access Control vulnerability. A low privileged attacker with local access...	7.8 High	—	0,15%	12 Agt 2026
CVE-2026-59916 dell display and peripheral manager Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain Improper Access Control vulnerability. A low privileged attacker with local access...	7.8 High	—	0,15%	12 Agt 2026
CVE-2026-59914 dell display and peripheral manager Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with...	7.8 High	—	0,18%	12 Agt 2026
CVE-2026-49466 Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting (XSS) in the `[drafts]`...	6.5 Medium	—	0,29%	12 Agt 2026
CVE-2026-4879 gitlab GitLab has remediated an issue in GitLab EE affecting all versions from 16.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could...	4.3 Medium	—	0,33%	12 Agt 2026
CVE-2026-46731 dell display and peripheral manager Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with...	7.8 High	—	0,18%	12 Agt 2026
CVE-2026-19657 scada-lts ScadaLTS 2.7.8.1 reflects user-supplied input into an HTML response without sanitization. An unauthenticated attacker who lures a victim into visiting a crafted URL can e...	6.1 Medium	—	0,28%	12 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.