Katalog CVE (hal. 734)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 265.720 (Critical 36.587 · High 106.162 · KEV 1.764 · sejak 2020) · Pembaruan terakhir: 31 Okt 2026, 00:26 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 36.651–36.700 dari 265.720 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-66382 jfrog artifactory An authenticated user may write files outside the intended Artifactory work directory under specific conditions.	4.3 Medium	—	0,35%	12 Agt 2026
CVE-2026-66381 jfrog artifactory A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions.	5.3 Medium	—	0,39%	12 Agt 2026
CVE-2026-66380 jfrog artifactory An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions.	4.3 Medium	—	0,30%	12 Agt 2026
CVE-2026-66379 jfrog artifactory An authenticated user may view private Puppet module metadata without repository read access.	4.3 Medium	—	0,30%	12 Agt 2026
CVE-2026-66378 jfrog artifactory An authenticated user without repository read permission may access private NuGet metadata under specific conditions.	4.3 Medium	—	0,30%	12 Agt 2026
CVE-2026-66377 jfrog artifactory An unauthenticated user may access restricted repository information under specific conditions.	5.3 Medium	—	0,36%	12 Agt 2026
CVE-2026-66376 jfrog artifactory Credentials for a deleted user may remain valid for a short period under specific conditions.	5.4 Medium	—	0,22%	12 Agt 2026
CVE-2026-66375 jfrog artifactory A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions.	8.1 High	—	0,40%	12 Agt 2026
CVE-2026-50561 Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. Prior to version 0.6.2, the project's authentication mechanism cont...	9.4 Critical	—	0,68%	12 Agt 2026
CVE-2026-49349 regclient is a Docker and OCI Registry Client in Go. Prior to version 0.11.5, credentials for a registry may be inadvertently leaked to external servers. A prerequisite f...	6.8 Medium	—	0,31%	12 Agt 2026
CVE-2026-49262 In the Aimeos Pagible content management system prior to version 0.10.4, the administrative proxy route (`cmsproxy`) is vulnerable to a Server-Side Request Forgery (SSRF)...	3.0 Low	—	0,17%	12 Agt 2026
CVE-2026-47234 Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, `Session::setCookie()` logs full cookie values and `Session::s...	4.4 Medium	—	0,17%	12 Agt 2026
CVE-2026-47233 Admidio is an open-source user management solution. Version 5.0.9 added a missing `isAdministratorInventory()` gate to `case 'item_delete':` in `modules/inventory.php`. T...	6.5 Medium	—	0,31%	12 Agt 2026
CVE-2026-18171 Docker Sandboxes (sbx) applies the read-only intent of a runtime host mount to the in-guest container bind only: the underlying virtio-fs host-edge grant is added to the...	5.7 Medium	—	0,14%	12 Agt 2026
CVE-2026-14479 autodesk installer A maliciously crafted input, when processed by the Autodesk Installer IPC frame parser, may trigger improper validation of an input-specified position or offset, resultin...	5.5 Medium	—	0,15%	12 Agt 2026
CVE-2026-14478 autodesk installer A maliciously created executable, when executed on the victim's machine, may allow a local low-privileged attacker to inject unauthenticated IPC messages into named pipes...	7.8 High	—	0,15%	12 Agt 2026
CVE-2025-59324 CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to properly validate LUKS encryption and, if encryption is present, all CryptoPro file integrity checks are s...	9.1 Critical	—	0,20%	12 Agt 2026
CVE-2025-59323 CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to validate the integrity of the DataStore, a non-partitioned filesystem, responsible for storing configurati...	8.4 High	—	0,14%	12 Agt 2026
CVE-2025-59322 CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to properly handle decryption errors and allows encrypted volumes to be mounted as plaintext.	7.5 High	—	0,49%	12 Agt 2026
CVE-2025-59321 CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 contains a default TPM PCR policy that fails to consider the system boot state. This allows the TPM to be unsealed...	9.8 Critical	—	0,78%	12 Agt 2026
CVE-2025-59320 CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 stores TPM2.0 secrets in a serialized format within unused disk sectors. An unauthenticated attacker with physical...	4.6 Medium	—	0,24%	12 Agt 2026
CVE-2025-59319 CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to certify the integrity of the intended boot partition and selects the first partition index matching a hard...	7.2 High	—	0,67%	12 Agt 2026
CVE-2026-67285 Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.8.0 - An unauthenticated attacker can perform includes to ar...	9.2 Critical	—	0,51%	12 Agt 2026
CVE-2026-47232 Admidio is an open-source user management solution. Prior to version 5.0.10, the sensitive `mode=export` action in `modules/sso/keys.php` exports a PKCS#12 bundle contain...	4.3 Medium	—	0,13%	12 Agt 2026
CVE-2026-47231 Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/documents-files.php` gates state-changing modes by checking that the actor has `hasU...	8.1 High	—	0,35%	12 Agt 2026
CVE-2026-47230 Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/documents-files.php` mode `file_rename_save` shares the same root-cause shape as the...	6.5 Medium	—	0,30%	12 Agt 2026
CVE-2026-47229 Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/sso/clients.php` validates an `adm_csrf_token` on every state-changing branch except...	5.4 Medium	—	0,14%	12 Agt 2026
CVE-2026-47228 Admidio is an open-source user management solution. `modules/registration.php` mode `send_login` regenerates a random password for `user_uuid_assigned`, stores its bcrypt...	5.2 Medium	—	0,16%	12 Agt 2026
CVE-2026-47227 Admidio is an open-source user management solution. `modules/categories.php` checks that the supplied `type` parameter (`ANN`, `EVT`, `ROL`, `USF`, …) corresponds to a mo...	6.5 Medium	—	0,33%	12 Agt 2026
CVE-2026-16999 Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking. This issue affec...	6.3 Medium	—	0,17%	12 Agt 2026
CVE-2025-59327 In CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4, bootxsa.efi fails to properly validate LUKS encryption and, if encryption is present, all CryptoPro file integr...	7.5 High	—	0,19%	12 Agt 2026
CVE-2025-59326 CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to enforce IMA policy protections across temporary file systems, allowing for unsigned code to be executed fr...	9.8 Critical	—	0,65%	12 Agt 2026
CVE-2025-59325 CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to encrypt the initramfs contents, allowing for the offline recovery of secrets and cryptographic details.	7.5 High	—	0,31%	12 Agt 2026
CVE-2026-71408 fortinet fortios A allocation of resources without limits or throttling vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS...	5.3 Medium	—	0,62%	12 Agt 2026
CVE-2026-71407 fortinet fortios A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6 may allow an unauthenticated attacker who can bypass stack pro...	8.1 High	—	0,51%	12 Agt 2026
CVE-2026-70468 fortinet fortimanager, fortinet fortimanager cloud A authentication bypass using an alternate path or channel vulnerability in Fortinet FortiManager 7.6.1, FortiManager 7.4.3 through 7.4.5, FortiManager 7.2.5 through 7.2....	8.1 High	—	0,46%	12 Agt 2026
CVE-2026-70467 fortinet fortisiem A server-side request forgery (ssrf) vulnerability in Fortinet FortiSIEM 7.5.0, FortiSIEM 7.4.0 through 7.4.2, FortiSIEM 7.3.0 through 7.3.5, FortiSIEM 7.2 all versions,...	3.8 Low	—	0,26%	12 Agt 2026
CVE-2026-70466 fortinet fortiweb A incomplete list of disallowed inputs vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4 all versions, FortiWeb 7.2 all v...	5.3 Medium	—	0,31%	12 Agt 2026
CVE-2026-57858 Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event ow...	8.9 High	—	0,37%	12 Agt 2026
CVE-2026-53996 NetBSD's hdaudio(4) driver in sys/dev/hdaudio/hdaudio.c contains a missing access control vulnerability that allows unprivileged local attackers to invoke the HDAUDIO_FGR...	7.0 High	—	0,13%	12 Agt 2026
CVE-2026-47226 Admidio is an open-source user management solution. Prior to version 5.0.10, an authenticated Admidio member with upload rights on any one folder can permanently delete f...	6.5 Medium	—	0,35%	12 Agt 2026
CVE-2026-26035 fortinet fortiweb An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11, Fo...	9.8 Critical	—	0,75%	12 Agt 2026
CVE-2026-70560 Ultimate POS (Stock Management & Point of Sale) contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrar...	5.4 Medium	—	0,20%	12 Agt 2026
CVE-2026-70465 fortinet forticlient A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 throug...	8.1 High	—	0,52%	12 Agt 2026
CVE-2026-18044 The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later uses to address the message sent by its property requ...	3.7 Low	—	0,14%	12 Agt 2026
CVE-2026-17008 The Quick Paypal Payments WordPress plugin through 5.7.50 does not verify the paid amount, receiver, or payment status in its PayPal IPN handler and marks an order paid o...	5.3 Medium	—	0,16%	12 Agt 2026
CVE-2026-16990 The Payment Button for PayPal WordPress plugin through 1.2.3.44 does not enforce the merchant-configured price server-side and trusts a client-supplied payment amount, al...	5.3 Medium	—	0,32%	12 Agt 2026
CVE-2026-16747 The Kirki WordPress plugin before 6.2.1 does not properly authorise its front-end form submission REST routes and passes attacker-controlled input through shortcode execu...	6.5 Medium	—	0,37%	12 Agt 2026
CVE-2026-16621 The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that payment actually succeeded before completing an order in its PayPal retur...	5.3 Medium	—	0,16%	12 Agt 2026
CVE-2026-15213 The Welcart e-Commerce WordPress plugin before 2.11.33 does not verify the authenticity of its convenience-store / bank-transfer settlement callback: an unauthenticated r...	5.3 Medium	—	0,16%	12 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.