Katalog CVE (hal. 737)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 265.720 (Critical 36.587 · High 106.162 · KEV 1.764 · sejak 2020) · Pembaruan terakhir: 31 Okt 2026, 00:26 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 36.801–36.850 dari 265.720 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-19559 google chrome Use after free in HTML in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium se...	8.8 High	—	0,41%	11 Agt 2026
CVE-2026-19558 google chrome Use after free in Extensions in Google Chrome prior to 151.0.7922.137 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code...	7.5 High	—	0,27%	11 Agt 2026
CVE-2026-19557 google chrome Use after free in TabStrip in Google Chrome on Mac prior to 151.0.7922.137 allowed a remote attacker who had compromised the renderer process to potentially perform a san...	8.3 High	—	0,30%	11 Agt 2026
CVE-2026-19556 google chrome Use after free in V8 in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium secu...	8.8 High	—	0,41%	11 Agt 2026
CVE-2026-18710 mongodb java driver A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cl...	6.5 Medium	—	0,15%	11 Agt 2026
CVE-2026-71290 apache httpclient Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the...	9.1 Critical	—	0,33%	11 Agt 2026
CVE-2026-66832 When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the user's live session token is appended to the URL as a query string parameter, and...	6.5 Medium	—	0,39%	11 Agt 2026
CVE-2026-66154 An insufficient certificate validation in a privileged communication workflow, was identified in a GMS application 9.5.1 (Build 9510.1044) and earlier versions which, und...	8.3 High	—	0,20%	11 Agt 2026
CVE-2026-66150 Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the Soni...	7.8 High	—	0,26%	11 Agt 2026
CVE-2026-66149 Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the Soni...	7.8 High	—	0,26%	11 Agt 2026
CVE-2026-66148 An authenticated command injection vulnerability was identified in GMS Command-Line Interface (CLI) 9.5.1 (Build 9510.1044) and earlier versions which allows low-privileg...	6.3 Medium	—	1,1%	11 Agt 2026
CVE-2026-66147 An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform...	9.4 Critical	—	1,8%	11 Agt 2026
CVE-2026-63177 Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the raw, unnorma...	7.1 High	—	0,37%	11 Agt 2026
CVE-2026-63134 Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` protects file extraction with libarchive's secure flags, but creates directo...	5.4 Medium	—	0,42%	11 Agt 2026
CVE-2026-63133 Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` extracts uploaded archives with no limit on entry count, directory depth, to...	6.5 Medium	—	0,55%	11 Agt 2026
CVE-2026-55676 Malcolm is a network traffic analysis tool suite. The file-upload component (FilePond PHP backend) accepts uploads at `POST /server/php/submit.php` and stores them in a d...	8.8 High	—	0,60%	11 Agt 2026
CVE-2026-48765 TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege read collaborator to extract a workspace OAuth `credentialsId` from a readable bot confi...	9.9 Critical	—	0,46%	11 Agt 2026
CVE-2026-48763 TypeBot is a chatbot builder tool. Versions prior to 3.17.0 expose a deprecated public upload endpoint at `GET /api/v1/typebots/{typebotId}/blocks/{blockId}/storage/uploa...	8.2 High	—	0,53%	11 Agt 2026
CVE-2026-48762 TypeBot is a chatbot builder tool. Prior to version 3.16.0, the OpenAI "Create Transcription" action handler fetches a user-supplied audio URL using `fetch()` without app...	5.4 Medium	—	0,30%	11 Agt 2026
CVE-2026-29035 CivetWeb (commit 4a4f0c95) contains a heap and stack buffer overflow vulnerability in the read_websocket() function that allows unauthenticated remote attackers to corrup...	6.5 Medium	—	0,61%	11 Agt 2026
CVE-2026-19579 snipeitapp snipe-it Snipe-IT before 8.6.0 contains an authorization bypass (insecure direct object reference) in the asset checkout-request cancellation endpoint. The cancel_by_admin and req...	5.4 Medium	—	0,34%	11 Agt 2026
CVE-2026-19550 redhat enterprise linux, freeipa A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowin...	8.2 High	—	0,47%	11 Agt 2026
CVE-2026-18634 An insecure handling of serialized objects vulnerability was found in the one of the service of GMS application 9.5.1 (Build 9510.1044) and earlier versions. A local atta...	8.4 High	—	0,34%	11 Agt 2026
CVE-2026-15606 The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.9. This is due to the plugin not pr...	8.8 High	—	0,59%	11 Agt 2026
CVE-2026-14863 FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by upload...	8.8 High	—	2,5%	11 Agt 2026
CVE-2026-73283 openbsd openssh In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.	2.5 Low	—	0,15%	11 Agt 2026
CVE-2026-73282 openbsd openssh In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.	4.8 Medium	—	0,16%	11 Agt 2026
CVE-2026-73281 openbsd openssh In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is...	3.5 Low	—	0,16%	11 Agt 2026
CVE-2026-73244 kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated POST /listFiles endpoint in server/src/main/java/cn/keking...	5.3 Medium	—	0,44%	11 Agt 2026
CVE-2026-73243 kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated GET /addTask endpoint in kkFileView is omitted from TrustH...	5.8 Medium	—	0,43%	11 Agt 2026
CVE-2026-73242 freerdp FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP's winpr/libwinpr/sspi/Kerberos/kerberos.c kerberos_DecryptMessage function fails...	9.1 Critical	—	0,40%	11 Agt 2026
CVE-2026-73241 freerdp FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP server-side RDSTLS in libfreerdp/core/rdstls.c accepts an attacker-supplied RDST...	7.5 High	—	0,47%	11 Agt 2026
CVE-2026-73235 FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the Xerces SAX2 XMLReader constructed in src/Base/Reader.cpp by Base::XMLReader::XM...	6.1 Medium	—	0,12%	11 Agt 2026
CVE-2026-73234 FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, PropertyFileIncluded::Restore() in src/App/PropertyFile.cpp concatenates an attacke...	7.8 High	—	0,24%	11 Agt 2026
CVE-2026-73233 FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the FEM Displacement Constraint task dialog in src/Mod/Fem/Gui/TaskFemConstraintDis...	8.5 High	—	0,20%	11 Agt 2026
CVE-2026-73232 ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to cause an out-of-memory denial of service because the response size guard...	7.5 High	—	0,63%	11 Agt 2026
CVE-2026-73231 Faker generates massive amounts of fake data in the browser and Node.js. Prior to 10.5.0, the faker.helpers.fake method in src/modules/helpers/eval.ts allows attacker-con...	7.8 High	—	0,21%	11 Agt 2026
CVE-2026-73230 Ente provides end-to-end encrypted cloud services and security tools. Prior to 2026.07.28, Ente 2of3 card format version 1 stored the secret byte length and 32-bit FNV-1a...	5.9 Medium	—	0,16%	11 Agt 2026
CVE-2026-73229 Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's rest_framework/renderers.py AdminRenderer.render(...	4.3 Medium	—	0,37%	11 Agt 2026
CVE-2026-73036 Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk theme's Python virtualenv prompt segment that allows local attackers to inject arb...	4.4 Medium	—	0,18%	11 Agt 2026
CVE-2026-73034 DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting di...	9.8 Critical	—	5,7%	11 Agt 2026
CVE-2026-73032 PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows attackers to execute arbitrary JavaScript by returning malicious code from an LLM en...	9.6 Critical	—	0,56%	11 Agt 2026
CVE-2026-73031 telegram-search contains a stored cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript in victims' browsers by sending crafted...	8.7 High	—	0,66%	11 Agt 2026
CVE-2026-71845 redhat advanced cluster management for kubernetes, redhat insights-client A flaw was found in insights-client. The setDefault() function logs the value of every environment variable it processes, including CCX_TOKEN, a bearer credential used in...	7.7 High	—	0,50%	11 Agt 2026
CVE-2026-71475 redhat advanced cluster management for kubernetes, redhat insights-client A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spoke', can inject unencoded data into the Insights API URL path. This occurs becaus...	6.8 Medium	—	0,69%	11 Agt 2026
CVE-2026-71474 redhat advanced cluster management for kubernetes, redhat insights-client A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret...	7.1 High	—	0,16%	11 Agt 2026
CVE-2026-71468 A flaw was found in acm-search-v2-api-rhel9. When the `getFederationConfig` function refreshes its cache, it improperly reuses a user's bearer token for all subsequent fe...	5.3 Medium	—	0,42%	11 Agt 2026
CVE-2026-71467 A flaw was found in search-v2-api. The authentication middleware in the affected component unconditionally skips authentication when a request includes an `Upgrade: webso...	7.5 High	—	0,83%	11 Agt 2026
CVE-2026-70339 microsoft edge chromium Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.	5.4 Medium	—	0,41%	11 Agt 2026
CVE-2026-66146 Multiple Cross-Site Scripting (XSS) vulnerabilities were identified in GMS 9.5.1 (Build 9510.1044) and earlier versions that allow a remote attacker to execute javascript...	6.1 Medium	—	0,30%	11 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.