Katalog CVE (hal. 758)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.065 (Critical 36.624 · High 106.293 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 31 Okt 2026, 12:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 37.851–37.900 dari 266.065 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-72925 SWC is a TypeScript / JavaScript compiler written in Rust. Prior to @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0, the minifyJson processing in crates...	6.1 Medium	—	0,34%	11 Agt 2026
CVE-2026-72922 AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.70, AutoGPT's autogpt_platform/bac...	8.2 High	—	0,48%	11 Agt 2026
CVE-2026-72921 SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filer_server_handlers.go allowed_prefixes authorization check used strings.HasPrefix on raw path...	8.1 High	—	0,43%	11 Agt 2026
CVE-2026-72920 SeaweedFS is a distributed storage system. Prior to 4.24, the filer registers the SeaweedIdentityAccessManagement gRPC service without mandatory authentication when jwt.f...	9.8 Critical	—	0,78%	11 Agt 2026
CVE-2026-47702 TypeBot is a chatbot builder tool. In version 3.16.1, API tokens (bearer credentials used to authenticate against the builder API) are stored in the database as cleartext...	9.1 Critical	—	0,30%	11 Agt 2026
CVE-2026-18860 Velociraptor allows multi-tenant deployments named "Orgs". By default Velociraptor, uses the ROOT org, but users can create child orgs for other tenants within the same...	8.7 High	—	0,44%	11 Agt 2026
CVE-2026-18636 The Velociraptor gRPC API has a VFSGetBuffer endpoint which allows reading files from the datastore. To prevent users from reading sensitive files or accessing other orgs...	6.8 Medium	—	0,40%	11 Agt 2026
CVE-2026-18635 Velociraptor's VQL has a query() plugin which allows running a VQL query in a different org or user context. To be able to run as a different user, the calling user needs...	7.2 High	—	0,46%	11 Agt 2026
CVE-2026-18129 Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MITM position...	8.1 High	—	1,5%	11 Agt 2026
CVE-2026-18127 External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over an S3 bucket...	7.7 High	—	0,72%	11 Agt 2026
CVE-2026-18125 An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker to crash an agent service.	7.5 High	—	1,6%	11 Agt 2026
CVE-2026-17535 Velociraptor's NTFS parsing library mishandles several out of bound and memory exhaustion bugs which may be triggered by maliciously crafted NTFS images. Typically Veloc...	6.2 Medium	—	0,16%	11 Agt 2026
CVE-2026-17061 A Deserialization of Untrusted Data vulnerability affecting SIMULIA Execution Engine from Release 2023 through Release 2026 could lead to an unauthenticated remote code e...	10.0 Critical	—	0,81%	11 Agt 2026
CVE-2026-73210 A Server-Side Request Forgery (SSRF) vulnerability existed in Lookyloo's PlaywrightCapture when the only_global_lookup option was enabled. PlaywrightCapture implements t...	5.1 Medium	—	0,47%	11 Agt 2026
CVE-2026-51584 An issue in usememos v0.27.1 allows a remote attacker to achieve account takeover via the ssoCredentials branch of the SignIn handler in server/router/api/v1/auth_service...	9.8 Critical	—	0,61%	11 Agt 2026
CVE-2026-51583 An issue in usememos through v0.30.0 allows a remote authenticated attacker to perform Server-Side Request Forgery (SSRF) via the Webhook validation mechanism in internal...	8.5 High	—	0,40%	11 Agt 2026
CVE-2026-48056 Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 improperly validate executable paths supplied to the r...	10.0 Critical	—	0,55%	11 Agt 2026
CVE-2026-48046 Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 contain an unvalidated auto-updater URL vulnerability th...	9.3 Critical	—	0,36%	11 Agt 2026
CVE-2026-46670 YesWiki is a wiki system written in PHP. Prior to version 4.6.4, an unauthenticated SQL injection in the Bazar form-import path (`FormManager::create()`) allows any unau...	9.8 Critical	—	2,0%	11 Agt 2026
CVE-2026-19539 Authorization Bypass Through User-Controlled Key in the ticket management component in Roskus Prospero Flow CRM before 5.4.9 allows authenticated users of any company to...	8.6 High	—	0,44%	11 Agt 2026
CVE-2026-19434 Cross-site Scripting in the finding renderer in maalfer Pentestify before 2.3.1 allows authenticated users to execute arbitrary JavaScript in the application origin via H...	5.1 Medium	—	0,47%	11 Agt 2026
CVE-2026-72785 Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding only the viewCategories permission (without saveCategor...	4.3 Medium	—	0,27%	11 Agt 2026
CVE-2026-72784 Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulnerability in the GraphQL save<Volume>Asset mutation...	5.4 Medium	—	0,24%	11 Agt 2026
CVE-2026-72783 Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal weakness in the ensurePathIsContained function of the Lo...	6.2 Medium	—	0,20%	11 Agt 2026
CVE-2026-72782 Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 interpolate environment variables and secrets (via ${ENV_VAR} strings in the elementId parame...	6.5 Medium	—	0,39%	11 Agt 2026
CVE-2026-72781 Craft CMS versions >= 5.0.0-RC1 before 5.10.7 and >= 4.0.0-RC1 before 4.18.3 contain a remote code execution vulnerability in the Twig sandbox mechanism. Because Craft ma...	8.8 High	—	0,79%	11 Agt 2026
CVE-2026-72780 Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers can replay captured logi...	6.5 Medium	—	0,39%	11 Agt 2026
CVE-2026-72779 Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2 contain an arbitrary file read vulnerability. The create() Twig function restricts class instantiation using...	4.5 Medium	—	0,38%	11 Agt 2026
CVE-2026-72778 Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control panel element...	8.8 High	—	0,80%	11 Agt 2026
CVE-2026-72775 n8n n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the PostgresTrigger node, which interpolates user-supplied identifier parameters (channe...	8.8 High	—	0,47%	11 Agt 2026
CVE-2026-72774 n8n n8n before 1.123.67, 2.31.5, and 2.32.1 contains a credential authorization bypass in the HTTP Request node. An authenticated member with edit access to a shared workflow...	6.5 Medium	—	0,44%	11 Agt 2026
CVE-2026-72773 n8n n8n before 2.31.5 and 2.32.x before 2.32.1 contain a path-confinement bypass in the @n8n/computer-use file-search (search_files) tool. A crafted search pattern can bypass...	7.7 High	—	0,57%	11 Agt 2026
CVE-2026-72772 n8n n8n before 2.32.1 (and before 2.31.5) is vulnerable to account takeover via the Token Exchange Embed Login feature. When a validly-signed incoming token was matched to a...	8.8 High	—	0,45%	11 Agt 2026
CVE-2026-72771 n8n n8n versions before 2.32.1 fail to enforce the Allowed HTTP Request Domains allowlist in multiple AI and LLM nodes when user-supplied base or endpoint URLs are configured...	6.5 Medium	—	0,36%	11 Agt 2026
CVE-2026-72770 n8n n8n versions before 1.123.67 contain a path traversal vulnerability in the Git node's fetch, pull, and push-tags operations that allows authenticated users to bypass repo...	6.5 Medium	—	0,70%	11 Agt 2026
CVE-2026-72769 n8n n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the VM expression engine. An authenticated user able to create or edit a workflow...	8.1 High	—	0,51%	11 Agt 2026
CVE-2026-72768 n8n n8n versions before 2.32.1 contain a server-side request forgery protection bypass vulnerability in the MCP Client node that allows authenticated users to bypass SSRF pro...	8.3 High	—	0,40%	11 Agt 2026
CVE-2026-72767 n8n n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a remote code execution vulnerability in the Git node. Authenticated users with rights to create...	8.8 High	—	0,88%	11 Agt 2026
CVE-2026-72766 n8n n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a type confusion vulnerability in the Send Email node, which does not enforce that its message fi...	7.5 High	—	0,44%	11 Agt 2026
CVE-2026-72765 n8n n8n before 2.31.5 and before 2.32.1 contain a sandbox escape vulnerability in expression evaluation. An authenticated user with permission to create or modify workflows c...	9.9 Critical	—	0,86%	11 Agt 2026
CVE-2026-72764 n8n n8n's JavaScript task runner shared a single module cache across all users' Code-node executions. In affected versions (before 1.123.67, 2.31.5, and 2.32.1), a user able...	8.8 High	—	0,81%	11 Agt 2026
CVE-2026-72763 n8n n8n before 1.123.67, 2.31.5, and 2.32.1 validates credential-access only for a node's top-level credentials and not for credentials referenced inside an Execute Sub-workf...	6.5 Medium	—	0,36%	11 Agt 2026
CVE-2026-72762 n8n n8n versions before 1.123.67, 2.31.5, and 2.32.1 contain an arbitrary file write vulnerability in the Edit Image node, which passes its output format parameter to the und...	8.8 High	—	0,48%	11 Agt 2026
CVE-2026-72750 n8n n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the Snowflake node's Execute Query operation, which interpolates expression values direc...	8.8 High	—	0,47%	11 Agt 2026
CVE-2026-72749 n8n n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields (Set) node. The node assigns output fields via a dot-notation path...	6.5 Medium	—	0,57%	11 Agt 2026
CVE-2026-72748 AVideo contains an unauthenticated arbitrary file write vulnerability in the aVideoEncoderChunk.json.php endpoint that allows remote attackers to write up to 4 GB of arbi...	9.1 Critical	—	1,2%	11 Agt 2026
CVE-2026-72747 AVideo fails to sanitize the phone field during user registration, allowing unauthenticated attackers to inject malicious JavaScript that persists in the database. When a...	7.2 High	—	0,35%	11 Agt 2026
CVE-2026-72744 Nuxt versions >= 4.4.7 and < 4.5.1, and >= 3.21.7 and < 3.21.10, contain an information disclosure vulnerability in the development server's Chrome DevTools workspace end...	6.2 Medium	—	0,18%	11 Agt 2026
CVE-2026-69109 A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.3). The affected application is vulnerable to a path traversal vulnerability due to...	7.5 High	—	0,62%	11 Agt 2026
CVE-2026-69108 A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.1). The affected application is vulnerable to a local privilege escalation due to a...	6.0 Medium	—	0,17%	11 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.