Katalog CVE (hal. 743)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.042 (Critical 36.621 · High 106.282 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 31 Okt 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 37.101–37.150 dari 266.042 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-73250 Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the Notepad++ Windows 11 x64 and ARM64 installer passes the attacker-influenced installation direc...	5.4 Medium	—	0,19%	11 Agt 2026
CVE-2026-73249 calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt} in src/calibre/srv/books.py...	7.5 High	—	0,44%	11 Agt 2026
CVE-2026-73248 calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled composite_template metadata from a malicious EPUB, OPF, PDF, or similar file through...	8.5 High	—	0,20%	11 Agt 2026
CVE-2026-73247 Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passe...	8.6 High	—	0,41%	11 Agt 2026
CVE-2026-73246 Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET...	7.5 High	—	0,60%	11 Agt 2026
CVE-2026-73245 Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's cli/src/main/resources/application.yml serves Micronaut management endpoints o...	6.5 Medium	—	0,33%	11 Agt 2026
CVE-2026-68067 The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching the suppli...	9.8 Critical	—	0,51%	11 Agt 2026
CVE-2026-67568 The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could result in forge...	9.1 Critical	—	0,42%	11 Agt 2026
CVE-2026-67558 The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryp...	7.4 High	—	0,27%	11 Agt 2026
CVE-2026-66875 In the Mira hormone monitor device firmware v1.7.1.47 build 01070147, a remote unauthenticated attacker within BLE range (approximately 10–30 meters) can silently rebind...	8.8 High	—	0,41%	11 Agt 2026
CVE-2026-66340 The Mira cloud authentication endpoints do not enforce per-account rate limiting, per-IP throttling, or account lockout after repeated failed login attempts. An attacker...	5.3 Medium	—	0,40%	11 Agt 2026
CVE-2026-66098 The Mira hormone monitor device firmware accepts a 0x01 write from any BLE central without authentication, causing the device to reboot into bootloader mode. An attacker...	6.5 Medium	—	0,32%	11 Agt 2026
CVE-2026-64934 The Mira cloud API accepts the firmware version reported by the companion app as authoritative for a given device, without independently attesting the version from the de...	4.3 Medium	—	0,31%	11 Agt 2026
CVE-2026-5917 libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows remo...	8.8 High	—	1,4%	11 Agt 2026
CVE-2026-29036 cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decode_pointer_inplace() function within cJSON_Utils.c that all...	7.5 High	—	0,44%	11 Agt 2026
CVE-2026-19560 google chrome Use after free in Blink in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium s...	8.8 High	—	0,41%	11 Agt 2026
CVE-2026-19559 google chrome Use after free in HTML in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium se...	8.8 High	—	0,41%	11 Agt 2026
CVE-2026-19558 google chrome Use after free in Extensions in Google Chrome prior to 151.0.7922.137 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code...	7.5 High	—	0,27%	11 Agt 2026
CVE-2026-19557 google chrome Use after free in TabStrip in Google Chrome on Mac prior to 151.0.7922.137 allowed a remote attacker who had compromised the renderer process to potentially perform a san...	8.3 High	—	0,30%	11 Agt 2026
CVE-2026-19556 google chrome Use after free in V8 in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium secu...	8.8 High	—	0,41%	11 Agt 2026
CVE-2026-18710 mongodb java driver A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cl...	6.5 Medium	—	0,15%	11 Agt 2026
CVE-2026-71290 apache httpclient Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the...	9.1 Critical	—	0,33%	11 Agt 2026
CVE-2026-66832 When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the user's live session token is appended to the URL as a query string parameter, and...	6.5 Medium	—	0,39%	11 Agt 2026
CVE-2026-66154 An insufficient certificate validation in a privileged communication workflow, was identified in a GMS application 9.5.1 (Build 9510.1044) and earlier versions which, und...	8.3 High	—	0,20%	11 Agt 2026
CVE-2026-66150 Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the Soni...	7.8 High	—	0,26%	11 Agt 2026
CVE-2026-66149 Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the Soni...	7.8 High	—	0,26%	11 Agt 2026
CVE-2026-66148 An authenticated command injection vulnerability was identified in GMS Command-Line Interface (CLI) 9.5.1 (Build 9510.1044) and earlier versions which allows low-privileg...	6.3 Medium	—	1,1%	11 Agt 2026
CVE-2026-66147 An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform...	9.4 Critical	—	1,8%	11 Agt 2026
CVE-2026-63177 Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the raw, unnorma...	7.1 High	—	0,37%	11 Agt 2026
CVE-2026-63134 Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` protects file extraction with libarchive's secure flags, but creates directo...	5.4 Medium	—	0,42%	11 Agt 2026
CVE-2026-63133 Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` extracts uploaded archives with no limit on entry count, directory depth, to...	6.5 Medium	—	0,55%	11 Agt 2026
CVE-2026-55676 Malcolm is a network traffic analysis tool suite. The file-upload component (FilePond PHP backend) accepts uploads at `POST /server/php/submit.php` and stores them in a d...	8.8 High	—	0,60%	11 Agt 2026
CVE-2026-48765 TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege read collaborator to extract a workspace OAuth `credentialsId` from a readable bot confi...	9.9 Critical	—	0,46%	11 Agt 2026
CVE-2026-48763 TypeBot is a chatbot builder tool. Versions prior to 3.17.0 expose a deprecated public upload endpoint at `GET /api/v1/typebots/{typebotId}/blocks/{blockId}/storage/uploa...	8.2 High	—	0,53%	11 Agt 2026
CVE-2026-48762 TypeBot is a chatbot builder tool. Prior to version 3.16.0, the OpenAI "Create Transcription" action handler fetches a user-supplied audio URL using `fetch()` without app...	5.4 Medium	—	0,30%	11 Agt 2026
CVE-2026-29035 CivetWeb (commit 4a4f0c95) contains a heap and stack buffer overflow vulnerability in the read_websocket() function that allows unauthenticated remote attackers to corrup...	6.5 Medium	—	0,61%	11 Agt 2026
CVE-2026-19579 snipeitapp snipe-it Snipe-IT before 8.6.0 contains an authorization bypass (insecure direct object reference) in the asset checkout-request cancellation endpoint. The cancel_by_admin and req...	5.4 Medium	—	0,34%	11 Agt 2026
CVE-2026-19550 redhat enterprise linux, freeipa A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowin...	8.2 High	—	0,47%	11 Agt 2026
CVE-2026-18634 An insecure handling of serialized objects vulnerability was found in the one of the service of GMS application 9.5.1 (Build 9510.1044) and earlier versions. A local atta...	8.4 High	—	0,34%	11 Agt 2026
CVE-2026-15606 The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.9. This is due to the plugin not pr...	8.8 High	—	0,59%	11 Agt 2026
CVE-2026-14863 FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by upload...	8.8 High	—	2,5%	11 Agt 2026
CVE-2026-73283 openbsd openssh In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.	2.5 Low	—	0,15%	11 Agt 2026
CVE-2026-73282 openbsd openssh In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.	4.8 Medium	—	0,16%	11 Agt 2026
CVE-2026-73281 openbsd openssh In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is...	3.5 Low	—	0,16%	11 Agt 2026
CVE-2026-73244 kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated POST /listFiles endpoint in server/src/main/java/cn/keking...	5.3 Medium	—	0,44%	11 Agt 2026
CVE-2026-73243 kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated GET /addTask endpoint in kkFileView is omitted from TrustH...	5.8 Medium	—	0,43%	11 Agt 2026
CVE-2026-73242 freerdp FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP's winpr/libwinpr/sspi/Kerberos/kerberos.c kerberos_DecryptMessage function fails...	9.1 Critical	—	0,40%	11 Agt 2026
CVE-2026-73241 freerdp FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP server-side RDSTLS in libfreerdp/core/rdstls.c accepts an attacker-supplied RDST...	7.5 High	—	0,47%	11 Agt 2026
CVE-2026-73235 FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the Xerces SAX2 XMLReader constructed in src/Base/Reader.cpp by Base::XMLReader::XM...	6.1 Medium	—	0,12%	11 Agt 2026
CVE-2026-73234 FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, PropertyFileIncluded::Restore() in src/App/PropertyFile.cpp concatenates an attacke...	7.8 High	—	0,24%	11 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.