Katalog CVE (hal. 745)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.042 (Critical 36.621 · High 106.282 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 31 Okt 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 37.201–37.250 dari 266.042 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-18701 mongodb An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server process to terminate unexpectedly by submitting a...	6.5 Medium	—	0,40%	11 Agt 2026
CVE-2026-18700 mongodb An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying...	6.5 Medium	—	0,40%	11 Agt 2026
CVE-2026-18699 mongodb An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to terminate unexpectedly by submittin...	6.5 Medium	—	0,40%	11 Agt 2026
CVE-2026-18698 mongodb An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that should req...	5.4 Medium	—	0,24%	11 Agt 2026
CVE-2026-18697 mongodb An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) process to terminate unexpectedly by submitting a speci...	7.5 High	—	0,44%	11 Agt 2026
CVE-2026-18696 mongodb An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default privileges to perform certain data-definition operations, such a...	6.5 Medium	—	0,40%	11 Agt 2026
CVE-2026-18695 mongodb An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaField could allow an authenticated user with write access to...	6.5 Medium	—	0,40%	11 Agt 2026
CVE-2026-18694 mongodb An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileges to cause certain malformed geometry data to be stored and...	7.1 High	—	0,40%	11 Agt 2026
CVE-2026-18693 mongodb An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to become inco...	7.6 High	—	0,34%	11 Agt 2026
CVE-2026-18692 mongodb An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to be used aft...	8.8 High	—	0,58%	11 Agt 2026
CVE-2026-18691 mongodb An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used when one...	8.8 High	—	0,36%	11 Agt 2026
CVE-2026-18690 mongodb An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that their assi...	8.1 High	—	0,41%	11 Agt 2026
CVE-2026-18688 mongodb An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-bounds memory read by providing a specially formed numeric param...	7.1 High	—	0,40%	11 Agt 2026
CVE-2026-18687 mongodb MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain request parameters against the collection's encrypted field co...	7.1 High	—	0,23%	11 Agt 2026
CVE-2026-15426 The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions...	8.8 High	—	0,66%	11 Agt 2026
CVE-2026-73219 CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with write access to a CVAT job can submit a batc...	5.3 Medium	—	0,47%	11 Agt 2026
CVE-2026-73218 Cursor is a code editor built for programming with AI. Prior to 3.0.0, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode, when Docker Desktop and the...	7.7 High	—	0,63%	11 Agt 2026
CVE-2026-73217 Cursor is a code editor built for programming with AI. Prior to 3.1.2, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode to replace a virtual environm...	7.7 High	—	0,43%	11 Agt 2026
CVE-2026-73216 Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, shutdown_client_connection() in src/server/ns_turn_server.c prematurely calls dec_qu...	6.5 Medium	—	0,57%	11 Agt 2026
CVE-2026-73215 Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, turnports_allocate_even() in src/apps/relay/turn_ports.c marks the unused odd siblin...	7.1 High	—	0,45%	11 Agt 2026
CVE-2026-73214 Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, dtls_server_input_handler() and create_new_connected_udp_socket() in src/apps/relay/...	8.2 High	—	0,58%	11 Agt 2026
CVE-2026-73213 Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, addr_less_eq() in src/client/ns_turn_ioaddr.c uses a component-wise comparison for n...	5.8 Medium	—	0,41%	11 Agt 2026
CVE-2026-73212 Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.1, good_peer_addr() in src/server/ns_turn_server.c uses ioa_addr_in_range() in src/clie...	5.8 Medium	—	0,50%	11 Agt 2026
CVE-2026-73211 PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollowModel.updateScore() interpolates the attacker-controlled ActivityPub actor inbox...	9.8 Critical	—	0,73%	11 Agt 2026
CVE-2026-73090 PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpdateActivity and processUpdateVideo accept an ActivityPub Update containing a Vide...	9.3 Critical	—	0,40%	11 Agt 2026
CVE-2026-72713 XAgent contains a path traversal vulnerability in the workspace file endpoint that allows self-registered or default-credential users to read arbitrary files on the host...	7.5 High	—	0,84%	11 Agt 2026
CVE-2026-72712 Nmap versions up to and including 7.99 contains a denial of service vulnerability that allows remote attackers to crash the application by sending a crafted packet contai...	6.5 Medium	—	0,50%	11 Agt 2026
CVE-2026-71398 adobe campaign Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An...	10.0 Critical	—	1,2%	11 Agt 2026
CVE-2026-71362 Advisory adobe commerce Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain el...	9.1 Critical	KEV	90,5%	11 Agt 2026
CVE-2026-69113 Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video wi...	5.4 Medium	—	0,27%	11 Agt 2026
CVE-2026-69102 MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in application-maxkey.properties that allows unauthenticated attackers to forg...	9.8 Critical	—	0,64%	11 Agt 2026
CVE-2026-65680 microsoft onedrive Improper link resolution before file access ('link following') in Microsoft OneDrive allows an authorized attacker to elevate privileges locally.	6.7 Medium	—	0,39%	11 Agt 2026
CVE-2026-48790 Turso CLI is the command line interface (CLI) to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform JWT to `settings.json` using V...	5.5 Medium	—	0,15%	11 Agt 2026
CVE-2026-48771 ishankportfolio is a portfolio website. Prior to version 1.0.1, contact form submissions could potentially be exposed due to improperly secured client-side database confi...	8.2 High	—	0,35%	11 Agt 2026
CVE-2026-48767 TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to obtain a live Google Sheets OAuth access token for that w...	7.6 High	—	0,43%	11 Agt 2026
CVE-2026-48494 TypeBot is a chatbot builder tool. In version 3.16.1, an authenticated user who has read access to any typebot can resume a WhatsApp preview webhook session that belongs...	7.1 High	—	0,47%	11 Agt 2026
CVE-2026-48447 adobe lightroom Lightroom Classic is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker co...	7.7 High	—	0,22%	11 Agt 2026
CVE-2026-48441 adobe lightroom Lightroom Classic is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system...	8.6 High	—	0,31%	11 Agt 2026
CVE-2026-48416 adobe commerce b2b, adobe commerce Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to by...	7.5 High	—	0,83%	11 Agt 2026
CVE-2026-48415 adobe commerce Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulne...	8.3 High	—	0,56%	11 Agt 2026
CVE-2026-48414 adobe commerce Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnera...	8.7 High	—	0,33%	11 Agt 2026
CVE-2026-48413 adobe commerce Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnera...	8.7 High	—	0,70%	11 Agt 2026
CVE-2026-48412 adobe commerce Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker with high privileges could exploit this vuln...	7.2 High	—	0,56%	11 Agt 2026
CVE-2026-48411 adobe commerce Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker with high privileges could leverage thi...	4.9 Medium	—	0,63%	11 Agt 2026
CVE-2026-48410 adobe lightroom Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of th...	7.8 High	—	0,26%	11 Agt 2026
CVE-2026-48409 adobe lightroom Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of th...	7.8 High	—	0,26%	11 Agt 2026
CVE-2026-48408 adobe lightroom Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of th...	7.8 High	—	0,26%	11 Agt 2026
CVE-2026-48407 adobe lightroom Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of th...	7.8 High	—	0,26%	11 Agt 2026
CVE-2026-48406 adobe lightroom Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of th...	7.8 High	—	0,26%	11 Agt 2026
CVE-2026-48405 adobe lightroom Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of th...	7.8 High	—	0,26%	11 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.