Katalog CVE (hal. 746)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.042 (Critical 36.621 · High 106.282 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 31 Okt 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 37.251–37.300 dari 266.042 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-48404 adobe lightroom Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of th...	7.8 High	—	0,26%	11 Agt 2026
CVE-2026-48397 adobe lightroom Lightroom Classic is affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An at...	8.6 High	—	0,97%	11 Agt 2026
CVE-2026-48381 adobe campaign Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arb...	9.0 Critical	—	0,79%	11 Agt 2026
CVE-2026-47940 adobe lightroom Lightroom Classic is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploit...	7.8 High	—	0,31%	11 Agt 2026
CVE-2026-47705 TypeBot is a chatbot builder tool. Version 3.16.1 has a CSV injection vulnerability in the result export functionality. The application does not sanitize or escape user-s...	9.6 Critical	—	0,56%	11 Agt 2026
CVE-2026-27302 adobe campaign Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An...	10.0 Critical	—	1,2%	11 Agt 2026
CVE-2026-20917 Exposure of sensitive information caused by incorrect data forwarding during transient execution for some Intel(R) Processors within Ring 0: Hypervisor and Kernel may all...	4.0 Medium	—	0,11%	11 Agt 2026
CVE-2026-20901 intel xeon bronze 3408u firmware, intel xeon gold 5403n firmware +58 lainnya Improper input validation for some Intel(R) Xeon(R) processors within firmware may allow an escalation of privilege. Startup code and smm adversary with a privileged user...	5.3 Medium	—	0,10%	11 Agt 2026
CVE-2026-20712 Incomplete cleanup in some UEFI firmware for some Intel(R) reference platforms within UEFI may allow an information disclosure. System software adversary with a privilege...	4.0 Medium	—	0,16%	11 Agt 2026
CVE-2026-0465 A Use‑After‑Free (UAF) vulnerability in the AMD Ryzen™ Master Utility Driver could allow a local attacker to access kernel memory, potentially resulting in loss of availa...	5.6 Medium	—	0,15%	11 Agt 2026
CVE-2025-54512 A DLL hijacking vulnerability within the AMD Ryzen Master installation could allow a local user-privileged attacker to escalate privileges, potentially resulting in arbit...	7.0 High	—	0,16%	11 Agt 2026
CVE-2025-0046 Incorrect directory permissions could allow a local user to escalate their privileges, potentially resulting in arbitrary code execution.	7.0 High	—	0,14%	11 Agt 2026
CVE-2022-50997 Weaver (Fanwei) E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extr...	7.5 High	—	0,62%	11 Agt 2026
CVE-2016-20097 Weaver (Fanwei) E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthenticated remote attackers to read arbitrary files...	7.5 High	—	0,63%	11 Agt 2026
CVE-2026-73089 Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries,...	7.5 High	—	0,66%	11 Agt 2026
CVE-2026-73088 Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached uncon...	7.5 High	—	0,66%	11 Agt 2026
CVE-2026-73087 Dozzle is a realtime log viewer for docker containers. From 10.5.2 until 10.6.15, the isBlockedIP SSRF guard in internal/notification/dispatcher/webhook.go, used by safeD...	2.3 Low	—	0,47%	11 Agt 2026
CVE-2026-73086 nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coer...	7.4 High	—	0,30%	11 Agt 2026
CVE-2026-73085 Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.36.0, the jwtAuthCheck function in server/auth/TokenManager.js treats JWTs with the refresh token...	5.3 Medium	—	0,47%	11 Agt 2026
CVE-2026-73084 Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query parameter d...	6.1 Medium	—	0,36%	11 Agt 2026
CVE-2026-73083 Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, in SANDBOX_CODE_ONLY mode, the engine loads the compiled user module with importFresh(),...	7.6 High	—	0,25%	11 Agt 2026
CVE-2026-73082 Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the POST /api/v1/projects/:projectId/mcp-server/validate-agent-mcp-tool endpoint makes an...	5.3 Medium	—	0,43%	11 Agt 2026
CVE-2026-73081 Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, the worker's code-compilation pipeline builds the on-disk path for a Code step from the s...	8.7 High	—	0,53%	11 Agt 2026
CVE-2026-72971 microsoft windows 11 26h1 Improper link resolution before file access ('link following') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to perform tamp...	5.5 Medium	—	0,36%	11 Agt 2026
CVE-2026-71390 adobe c2pa, adobe c2pa-web +1 lainnya CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerab...	4.0 Medium	—	0,27%	11 Agt 2026
CVE-2026-71389 adobe c2pa, adobe c2pa-web +1 lainnya CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could ex...	6.2 Medium	—	0,26%	11 Agt 2026
CVE-2026-71387 adobe coldfusion ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exp...	8.8 High	—	0,51%	11 Agt 2026
CVE-2026-71386 adobe coldfusion is affected by a Cross-site Scripting (XSS) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this...	8.8 High	—	0,55%	11 Agt 2026
CVE-2026-71384 adobe coldfusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security m...	9.6 Critical	—	0,46%	11 Agt 2026
CVE-2026-71383 adobe coldfusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security m...	7.3 High	—	0,59%	11 Agt 2026
CVE-2026-71331 microsoft windows 10 1809, microsoft windows server 2019 +2 lainnya Integer overflow or wraparound in Windows Device Health Attestation (DHA) allows an unauthorized attacker to execute code over a network.	8.1 High	—	0,71%	11 Agt 2026
CVE-2026-70355 microsoft sharepoint server Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges ov...	8.7 High	—	0,78%	11 Agt 2026
CVE-2026-70354 microsoft visual studio 2022, microsoft visual studio 2026 +2 lainnya Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.	7.8 High	—	0,36%	11 Agt 2026
CVE-2026-70348 microsoft windows 11 24h2, microsoft windows 11 25h2 +1 lainnya Improper link resolution before file access ('link following') in Windows Management Services allows an authorized attacker to deny service locally.	5.5 Medium	—	0,44%	11 Agt 2026
CVE-2026-70347 microsoft windows 10 1607, microsoft windows 10 1809 +11 lainnya Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.	7.8 High	—	0,33%	11 Agt 2026
CVE-2026-70346 microsoft windows 10 1607, microsoft windows 10 1809 +11 lainnya Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.	7.8 High	—	0,33%	11 Agt 2026
CVE-2026-70345 microsoft windows 10 1607, microsoft windows 10 1809 +11 lainnya Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.	7.8 High	—	0,33%	11 Agt 2026
CVE-2026-70344 microsoft windows 10 1607, microsoft windows 10 1809 +11 lainnya Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.	7.8 High	—	0,33%	11 Agt 2026
CVE-2026-70340 microsoft azure cyclecloud Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.	8.8 High	—	0,80%	11 Agt 2026
CVE-2026-70338 microsoft powershell Improper control of generation of code ('code injection') in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally.	7.8 High	—	0,36%	11 Agt 2026
CVE-2026-70337 microsoft powershell Relative path traversal in Microsoft PowerShell Core allows an unauthorized attacker to execute code over a network.	8.8 High	—	0,94%	11 Agt 2026
CVE-2026-70336 microsoft visual studio code Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.	8.8 High	—	0,82%	11 Agt 2026
CVE-2026-70335 microsoft visual studio code Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to ele...	7.8 High	—	0,46%	11 Agt 2026
CVE-2026-70330 microsoft windows 10 1607, microsoft windows 10 1809 +11 lainnya Heap-based buffer overflow in Windows DNS allows an authorized attacker to elevate privileges locally.	7.8 High	—	0,34%	11 Agt 2026
CVE-2026-70329 microsoft 365 apps, microsoft office 2019 +3 lainnya Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.	8.8 High	—	0,82%	11 Agt 2026
CVE-2026-70328 microsoft 365 apps, microsoft excel +4 lainnya Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.	6.5 Medium	—	0,92%	11 Agt 2026
CVE-2026-70327 microsoft 365 apps, microsoft excel +4 lainnya Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.	6.5 Medium	—	0,92%	11 Agt 2026
CVE-2026-70326 microsoft sharepoint server Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.	8.8 High	—	0,78%	11 Agt 2026
CVE-2026-70325 microsoft 365 apps, microsoft 365 +3 lainnya Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.	5.5 Medium	—	0,44%	11 Agt 2026
CVE-2026-70324 microsoft sharepoint server Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.	8.8 High	—	0,94%	11 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.