Katalog CVE (hal. 740)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.042 (Critical 36.621 · High 106.282 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 31 Okt 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 36.951–37.000 dari 266.042 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-73286 RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS get_condition_values folds attacker-controlled request headers from HeaderMap...	8.1 High	—	0,43%	12 Agt 2026
CVE-2026-73285 RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by RUSTFS_POLICY_PLUGIN_URL i...	7.5 High	—	0,47%	12 Agt 2026
CVE-2026-73284 RustFS is a distributed object storage system built in Rust. RustFS AddServiceAccount in rustfs/src/admin/handlers/service_account.rs accepts an attacker-controlled targe...	8.8 High	—	0,52%	12 Agt 2026
CVE-2026-73265 RustFS is a distributed object storage system built in Rust. RustFS authorizes explicit versionId reads in GetObject, CopyObject sources, and UploadPartCopy sources with...	6.5 Medium	—	0,42%	12 Agt 2026
CVE-2026-73264 Prowler is a cloud security platform. Prior to 5.33.1, an authenticated user with Lighthouse provider configuration access could supply an unvalidated base_url for the op...	7.6 High	—	0,44%	12 Agt 2026
CVE-2026-73263 Prowler is a cloud security platform. Prior to 5.36.0, the Kubernetes provider connection test accepted kubeconfig_content containing a legacy gcp auth-provider with conf...	9.9 Critical	—	0,65%	12 Agt 2026
CVE-2026-73262 Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/lib/outputs/html/html.py inserted finding.resource_tags, assembled by un...	5.4 Medium	—	0,30%	12 Agt 2026
CVE-2026-68760 jfrog artifactory An unauthenticated user may bypass authentication under specific cache conditions.	5.3 Medium	—	0,46%	12 Agt 2026
CVE-2026-68757 jfrog artifactory A user with access to a valid SAML response may impersonate another user under specific conditions.	7.5 High	—	0,27%	12 Agt 2026
CVE-2026-68756 jfrog artifactory A party with write access to stored session data may affect JFrog Artifactory under specific conditions.	6.6 Medium	—	0,47%	12 Agt 2026
CVE-2026-68755 jfrog artifactory A bundle writer may create misleading release promotion information under specific conditions.	4.3 Medium	—	0,26%	12 Agt 2026
CVE-2026-68754 jfrog artifactory A repository publisher without delete permission may modify protected package content under specific conditions.	6.5 Medium	—	0,31%	12 Agt 2026
CVE-2026-68753 jfrog artifactory An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way.	5.3 Medium	—	0,31%	12 Agt 2026
CVE-2026-68752 jfrog artifactory A Project Resource Manager may gain broader administrative privileges under specific conditions.	7.2 High	—	0,49%	12 Agt 2026
CVE-2026-67287 Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder < 6.8.0 - An unauthenticated attacker can create comments on instances with disabl...	6.3 Medium	—	0,42%	12 Agt 2026
CVE-2026-67286 Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder < 6.8.0 - An unauthenticated attacker can create arbitr...	6.3 Medium	—	0,52%	12 Agt 2026
CVE-2026-66382 jfrog artifactory An authenticated user may write files outside the intended Artifactory work directory under specific conditions.	4.3 Medium	—	0,35%	12 Agt 2026
CVE-2026-66381 jfrog artifactory A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions.	5.3 Medium	—	0,39%	12 Agt 2026
CVE-2026-66380 jfrog artifactory An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions.	4.3 Medium	—	0,30%	12 Agt 2026
CVE-2026-66379 jfrog artifactory An authenticated user may view private Puppet module metadata without repository read access.	4.3 Medium	—	0,30%	12 Agt 2026
CVE-2026-66378 jfrog artifactory An authenticated user without repository read permission may access private NuGet metadata under specific conditions.	4.3 Medium	—	0,30%	12 Agt 2026
CVE-2026-66377 jfrog artifactory An unauthenticated user may access restricted repository information under specific conditions.	5.3 Medium	—	0,36%	12 Agt 2026
CVE-2026-66376 jfrog artifactory Credentials for a deleted user may remain valid for a short period under specific conditions.	5.4 Medium	—	0,22%	12 Agt 2026
CVE-2026-66375 jfrog artifactory A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions.	8.1 High	—	0,40%	12 Agt 2026
CVE-2026-50561 Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. Prior to version 0.6.2, the project's authentication mechanism cont...	9.4 Critical	—	0,68%	12 Agt 2026
CVE-2026-49349 regclient is a Docker and OCI Registry Client in Go. Prior to version 0.11.5, credentials for a registry may be inadvertently leaked to external servers. A prerequisite f...	6.8 Medium	—	0,31%	12 Agt 2026
CVE-2026-49262 In the Aimeos Pagible content management system prior to version 0.10.4, the administrative proxy route (`cmsproxy`) is vulnerable to a Server-Side Request Forgery (SSRF)...	3.0 Low	—	0,17%	12 Agt 2026
CVE-2026-47234 Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, `Session::setCookie()` logs full cookie values and `Session::s...	4.4 Medium	—	0,17%	12 Agt 2026
CVE-2026-47233 Admidio is an open-source user management solution. Version 5.0.9 added a missing `isAdministratorInventory()` gate to `case 'item_delete':` in `modules/inventory.php`. T...	6.5 Medium	—	0,31%	12 Agt 2026
CVE-2026-18171 Docker Sandboxes (sbx) applies the read-only intent of a runtime host mount to the in-guest container bind only: the underlying virtio-fs host-edge grant is added to the...	5.7 Medium	—	0,14%	12 Agt 2026
CVE-2026-14479 autodesk installer A maliciously crafted input, when processed by the Autodesk Installer IPC frame parser, may trigger improper validation of an input-specified position or offset, resultin...	5.5 Medium	—	0,15%	12 Agt 2026
CVE-2026-14478 autodesk installer A maliciously created executable, when executed on the victim's machine, may allow a local low-privileged attacker to inject unauthenticated IPC messages into named pipes...	7.8 High	—	0,15%	12 Agt 2026
CVE-2025-59324 CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to properly validate LUKS encryption and, if encryption is present, all CryptoPro file integrity checks are s...	9.1 Critical	—	0,20%	12 Agt 2026
CVE-2025-59323 CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to validate the integrity of the DataStore, a non-partitioned filesystem, responsible for storing configurati...	8.4 High	—	0,14%	12 Agt 2026
CVE-2025-59322 CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to properly handle decryption errors and allows encrypted volumes to be mounted as plaintext.	7.5 High	—	0,49%	12 Agt 2026
CVE-2025-59321 CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 contains a default TPM PCR policy that fails to consider the system boot state. This allows the TPM to be unsealed...	9.8 Critical	—	0,78%	12 Agt 2026
CVE-2025-59320 CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 stores TPM2.0 secrets in a serialized format within unused disk sectors. An unauthenticated attacker with physical...	4.6 Medium	—	0,24%	12 Agt 2026
CVE-2025-59319 CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to certify the integrity of the intended boot partition and selects the first partition index matching a hard...	7.2 High	—	0,67%	12 Agt 2026
CVE-2026-67285 Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.8.0 - An unauthenticated attacker can perform includes to ar...	9.2 Critical	—	0,51%	12 Agt 2026
CVE-2026-47232 Admidio is an open-source user management solution. Prior to version 5.0.10, the sensitive `mode=export` action in `modules/sso/keys.php` exports a PKCS#12 bundle contain...	4.3 Medium	—	0,13%	12 Agt 2026
CVE-2026-47231 Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/documents-files.php` gates state-changing modes by checking that the actor has `hasU...	8.1 High	—	0,35%	12 Agt 2026
CVE-2026-47230 Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/documents-files.php` mode `file_rename_save` shares the same root-cause shape as the...	6.5 Medium	—	0,30%	12 Agt 2026
CVE-2026-47229 Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/sso/clients.php` validates an `adm_csrf_token` on every state-changing branch except...	5.4 Medium	—	0,14%	12 Agt 2026
CVE-2026-47228 Admidio is an open-source user management solution. `modules/registration.php` mode `send_login` regenerates a random password for `user_uuid_assigned`, stores its bcrypt...	5.2 Medium	—	0,16%	12 Agt 2026
CVE-2026-47227 Admidio is an open-source user management solution. `modules/categories.php` checks that the supplied `type` parameter (`ANN`, `EVT`, `ROL`, `USF`, …) corresponds to a mo...	6.5 Medium	—	0,33%	12 Agt 2026
CVE-2026-16999 Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking. This issue affec...	6.3 Medium	—	0,17%	12 Agt 2026
CVE-2025-59327 In CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4, bootxsa.efi fails to properly validate LUKS encryption and, if encryption is present, all CryptoPro file integr...	7.5 High	—	0,19%	12 Agt 2026
CVE-2025-59326 CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to enforce IMA policy protections across temporary file systems, allowing for unsigned code to be executed fr...	9.8 Critical	—	0,65%	12 Agt 2026
CVE-2025-59325 CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to encrypt the initramfs contents, allowing for the offline recovery of secrets and cryptographic details.	7.5 High	—	0,31%	12 Agt 2026
CVE-2026-71408 fortinet fortios A allocation of resources without limits or throttling vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS...	5.3 Medium	—	0,62%	12 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.