Katalog CVE (hal. 744)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.042 (Critical 36.621 · High 106.282 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 31 Okt 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 37.151–37.200 dari 266.042 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-73233 FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the FEM Displacement Constraint task dialog in src/Mod/Fem/Gui/TaskFemConstraintDis...	8.5 High	—	0,20%	11 Agt 2026
CVE-2026-73232 ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to cause an out-of-memory denial of service because the response size guard...	7.5 High	—	0,63%	11 Agt 2026
CVE-2026-73231 Faker generates massive amounts of fake data in the browser and Node.js. Prior to 10.5.0, the faker.helpers.fake method in src/modules/helpers/eval.ts allows attacker-con...	7.8 High	—	0,21%	11 Agt 2026
CVE-2026-73230 Ente provides end-to-end encrypted cloud services and security tools. Prior to 2026.07.28, Ente 2of3 card format version 1 stored the secret byte length and 32-bit FNV-1a...	5.9 Medium	—	0,16%	11 Agt 2026
CVE-2026-73229 Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's rest_framework/renderers.py AdminRenderer.render(...	4.3 Medium	—	0,37%	11 Agt 2026
CVE-2026-73036 Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk theme's Python virtualenv prompt segment that allows local attackers to inject arb...	4.4 Medium	—	0,18%	11 Agt 2026
CVE-2026-73034 DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting di...	9.8 Critical	—	5,7%	11 Agt 2026
CVE-2026-73032 PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows attackers to execute arbitrary JavaScript by returning malicious code from an LLM en...	9.6 Critical	—	0,56%	11 Agt 2026
CVE-2026-73031 telegram-search contains a stored cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript in victims' browsers by sending crafted...	8.7 High	—	0,66%	11 Agt 2026
CVE-2026-71845 redhat advanced cluster management for kubernetes, redhat insights-client A flaw was found in insights-client. The setDefault() function logs the value of every environment variable it processes, including CCX_TOKEN, a bearer credential used in...	7.7 High	—	0,50%	11 Agt 2026
CVE-2026-71475 redhat advanced cluster management for kubernetes, redhat insights-client A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spoke', can inject unencoded data into the Insights API URL path. This occurs becaus...	6.8 Medium	—	0,69%	11 Agt 2026
CVE-2026-71474 redhat advanced cluster management for kubernetes, redhat insights-client A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret...	7.1 High	—	0,16%	11 Agt 2026
CVE-2026-71468 A flaw was found in acm-search-v2-api-rhel9. When the `getFederationConfig` function refreshes its cache, it improperly reuses a user's bearer token for all subsequent fe...	5.3 Medium	—	0,42%	11 Agt 2026
CVE-2026-71467 A flaw was found in search-v2-api. The authentication middleware in the affected component unconditionally skips authentication when a request includes an `Upgrade: webso...	7.5 High	—	0,83%	11 Agt 2026
CVE-2026-70339 microsoft edge chromium Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.	5.4 Medium	—	0,41%	11 Agt 2026
CVE-2026-66146 Multiple Cross-Site Scripting (XSS) vulnerabilities were identified in GMS 9.5.1 (Build 9510.1044) and earlier versions that allow a remote attacker to execute javascript...	6.1 Medium	—	0,30%	11 Agt 2026
CVE-2026-66145 An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510.1044) and earlier versions which allows remote attacker to read sensitive d...	9.1 Critical	—	0,66%	11 Agt 2026
CVE-2026-65655 When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions de...	2.3 Low	—	0,37%	11 Agt 2026
CVE-2026-48813 Flawfinder is a a static analysis tool for finding vulnerabilities in C/C++ source code. Versions prior to 2.0.20 have an improper input neutralization issue leading to o...	8.7 High	—	0,44%	11 Agt 2026
CVE-2026-48804 python-socketio is a Python implementation of the Socket.IO realtime client and server. The python-socketio server stores binary `EVENT` and `ACK` messages in memory whil...	7.5 High	—	0,49%	11 Agt 2026
CVE-2026-45618 LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, it is possible to execute arbitrary code with crafted templates. Version 10.26.0...	10.0 Critical	—	0,82%	11 Agt 2026
CVE-2026-19091 The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file p...	8.1 High	—	1,1%	11 Agt 2026
CVE-2026-18844 The firmware of the Pulsetto Vagus Nerve Stimulator accepts several undisclosed commands over its Bluetooth Low Energy (BLE) interface. These commands are sent without au...	8.1 High	—	0,20%	11 Agt 2026
CVE-2026-16230 The Formidable Digital Signatures plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the delete_file function in all versions...	9.8 Critical	—	0,67%	11 Agt 2026
CVE-2026-13457 The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the (to...	7.5 High	—	0,85%	11 Agt 2026
CVE-2024-14042 A vulnerability was found in Open5GS up to 2.7.1. This affects the function hss_ogs_diam_s6a_air_cb/hss_ogs_diam_s6a_ulr_cb of the file src/hss/hss-s6a-path.c of the comp...	6.3 Medium	—	0,50%	11 Agt 2026
CVE-2026-73228 Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in rest_framework/request.py Request._parse() pass...	5.3 Medium	—	0,56%	11 Agt 2026
CVE-2026-73227 electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious RDP server to write attacker-cont...	8.1 High	—	0,49%	11 Agt 2026
CVE-2026-73226 electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.186, electerm allows an authenticated WebSocket client to invoke u...	8.8 High	—	0,75%	11 Agt 2026
CVE-2026-73225 electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to write attac...	8.1 High	—	0,49%	11 Agt 2026
CVE-2026-73224 electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to execute arb...	8.8 High	—	0,67%	11 Agt 2026
CVE-2026-73223 electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious SFTP server to write attacker-con...	8.1 High	—	0,49%	11 Agt 2026
CVE-2026-73222 Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the Claude Code Studio server launched by the --studio option in cli-tool...	8.8 High	—	0,32%	11 Agt 2026
CVE-2026-73221 CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with the Worker role can use predictable task-bas...	5.3 Medium	—	0,43%	11 Agt 2026
CVE-2026-72742 DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters that allows attackers with influence over language model outputs to r...	8.6 High	—	0,51%	11 Agt 2026
CVE-2026-69119 Taubyte Tau v1.1.10 contains a missing authorization vulnerability in the services/auth HTTP service that allows any authenticated user to read or permanently delete anot...	8.3 High	—	0,46%	11 Agt 2026
CVE-2026-69117 NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django ORM lookup...	6.5 Medium	—	0,32%	11 Agt 2026
CVE-2026-69115 OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitting POST re...	6.5 Medium	—	0,30%	11 Agt 2026
CVE-2026-48809 python-engineio is a Python implementation of the Engine.IO realtime client and server. Versions prior to 4.13.2 have two specific configurations of the python-engineio s...	7.5 High	—	0,49%	11 Agt 2026
CVE-2026-48802 python-engineio is a Python implementation of the Engine.IO realtime client and server. Prior to version 4.13.2, an attacker can cause the creation of unnecessary backgro...	7.5 High	—	0,58%	11 Agt 2026
CVE-2026-18712 mongodb An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthoriz...	8.1 High	—	0,24%	11 Agt 2026
CVE-2026-18711 mongodb An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to cause an internal reference to be used after the u...	7.1 High	—	0,49%	11 Agt 2026
CVE-2026-18709 mongodb An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypa...	6.4 Medium	—	0,20%	11 Agt 2026
CVE-2026-18708 mongodb An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control to be executed within the quer...	6.4 Medium	—	0,38%	11 Agt 2026
CVE-2026-18707 mongodb An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to terminate unexpectedly by submitti...	4.3 Medium	—	0,35%	11 Agt 2026
CVE-2026-18706 mongodb An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-management commands to cause an interna...	6.6 Medium	—	0,47%	11 Agt 2026
CVE-2026-18705 mongodb An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve documents from a different, protected...	6.5 Medium	—	0,36%	11 Agt 2026
CVE-2026-18704 mongodb An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations against collections they should...	6.5 Medium	—	0,29%	11 Agt 2026
CVE-2026-18703 mongodb An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certificate-based authentication m...	4.2 Medium	—	0,14%	11 Agt 2026
CVE-2026-18702 mongodb An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the entire server...	6.4 Medium	—	0,28%	11 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.