Katalog CVE (hal. 759)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.065 (Critical 36.624 · High 106.293 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 31 Okt 2026, 12:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 37.901–37.950 dari 266.065 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-64629 A vulnerability has been identified in Parasolid V38.0 (All versions < V38.0.235), Parasolid V38.1 (All versions < V38.1.230). The affected applications contains an out o...	7.8 High	—	0,16%	11 Agt 2026
CVE-2026-59701 A vulnerability has been identified in Simcenter Femap (All versions < V2606.0001). The affected applications contains an out of bounds read vulnerability while parsing s...	7.8 High	—	0,16%	11 Agt 2026
CVE-2026-59700 A vulnerability has been identified in Simcenter Femap (All versions < V2606.0001). The affected applications contains an out of bounds read vulnerability while parsing s...	7.8 High	—	0,16%	11 Agt 2026
CVE-2026-59693 A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.233.16-7862), Desigo PXC3 (All versions < V01.21.233.16-7862), Desigo PXC4 (All versions < V02.2...	4.3 Medium	—	0,24%	11 Agt 2026
CVE-2026-59086 A vulnerability has been identified in Simcenter Femap (All versions < V2606), Simcenter Nastran (All versions < V2606). The affected applications contain a stack overflo...	7.8 High	—	0,15%	11 Agt 2026
CVE-2026-58115 A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with Node-RED installed). Affected dev...	10.0 Critical	—	0,95%	11 Agt 2026
CVE-2026-57263 A vulnerability has been identified in LOGO! Soft Comfort (All versions < V9). The project password feature in the affected products stores the password as an unsalted SH...	6.8 Medium	—	0,11%	11 Agt 2026
CVE-2026-57262 A vulnerability has been identified in LOGO! Soft Comfort (All versions < V9). Affected products use a static, hardcoded AES master key to encrypt project files. This cou...	6.8 Medium	—	0,15%	11 Agt 2026
CVE-2026-50064 siemens solid edge se2025, siemens solid edge se2026 A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected applications...	7.8 High	—	0,16%	11 Agt 2026
CVE-2026-50063 siemens solid edge se2025, siemens solid edge se2026 A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected applications...	7.8 High	—	0,16%	11 Agt 2026
CVE-2026-50062 siemens solid edge se2025, siemens solid edge se2026 A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected applications...	7.8 High	—	0,16%	11 Agt 2026
CVE-2026-50061 siemens solid edge se2025, siemens solid edge se2026 A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected applications...	7.8 High	—	0,16%	11 Agt 2026
CVE-2026-50060 siemens solid edge se2025, siemens solid edge se2026 A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected applications...	7.8 High	—	0,16%	11 Agt 2026
CVE-2026-50059 siemens solid edge se2025, siemens solid edge se2026 A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected applications...	7.8 High	—	0,16%	11 Agt 2026
CVE-2026-50058 siemens solid edge se2025, siemens solid edge se2026 A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected applications...	7.8 High	—	0,16%	11 Agt 2026
CVE-2026-18972 An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header \"Grpc-Metadata-USER\". This can lead to an account takeov...	9.6 Critical	—	0,35%	11 Agt 2026
CVE-2026-72610 A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the borrowers => edit_borrowers permission...	4.3 Medium	—	0,34%	11 Agt 2026
CVE-2026-72609 An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the acquisition => order_receive permission to r...	7.1 High	—	0,37%	11 Agt 2026
CVE-2026-72608 A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => label_creator permission to e...	6.5 Medium	—	0,38%	11 Agt 2026
CVE-2026-72607 A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => items_batchmod permission to...	7.1 High	—	0,45%	11 Agt 2026
CVE-2026-72606 A server-side request forgery vulnerability in Pinry through 2.1.13 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal o...	7.5 High	—	0,48%	11 Agt 2026
CVE-2026-72605 A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profile/create en...	7.5 High	—	0,54%	11 Agt 2026
CVE-2026-72604 A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to delete arbitrary files on the server via the admin panel fi...	6.5 Medium	—	0,52%	11 Agt 2026
CVE-2026-72603 An OS command injection vulnerability in wg-easy 15.3.0 allows users with the clients.create permission to execute arbitrary commands as root by injecting newline-delimit...	9.9 Critical	—	2,2%	11 Agt 2026
CVE-2026-72602 A path traversal vulnerability in AsyncFuncAI deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to obtain directory listings for arbitrary file...	7.5 High	—	0,74%	11 Agt 2026
CVE-2026-72601 A broken access control vulnerability in CSZ CMS 1.3.2 allows unauthenticated remote attackers to read all form submissions including personally identifiable information...	7.5 High	—	0,61%	11 Agt 2026
CVE-2026-72600 A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer PII via the...	7.5 High	—	0,61%	11 Agt 2026
CVE-2026-72599 An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to execute arbitrary SQL via the news item page ID parameter. The parameter is concat...	9.8 Critical	—	0,61%	11 Agt 2026
CVE-2026-72598 A server-side request forgery vulnerability in Apioo Fusio 8.8.3 allows authenticated consumer-role users to make the server issue HTTP requests to internal network addre...	6.5 Medium	—	0,37%	11 Agt 2026
CVE-2026-72597 A server-side request forgery vulnerability in Friendica through the 2026.08-dev branch allows authenticated users with a free self-registered account to probe internal n...	6.5 Medium	—	0,34%	11 Agt 2026
CVE-2026-72596 A broken access control vulnerability in Ghost Foundation Ghost 5.x allows authenticated Author-role users to delete posts owned by other users. The post model permissibl...	8.1 High	—	0,38%	11 Agt 2026
CVE-2026-72595 A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to update ticket records belonging to other teams via the Ticke...	8.1 High	—	0,35%	11 Agt 2026
CVE-2026-72563 A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to overwrite lead records belonging to other teams via the Lead...	8.1 High	—	0,35%	11 Agt 2026
CVE-2026-72562 An SQL injection vulnerability in Pimcore admin-ui-classic-bundle through version 2.3 allows authenticated backend users to execute arbitrary SQL via the DataObject grid...	8.8 High	—	0,43%	11 Agt 2026
CVE-2026-72561 A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 allows any authenticated non-administrative user to reconfigure the platform glo...	8.8 High	—	0,42%	11 Agt 2026
CVE-2026-72560 A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev0 exists because SSRF_PROTECTION_ENABLED is set to false by default. The import-...	6.5 Medium	—	0,34%	11 Agt 2026
CVE-2026-72559 A stored cross-site scripting vulnerability in HortusFox 5.9 allows authenticated workspace members to inject persistent JavaScript into plant notes via Parsedown rendere...	5.4 Medium	—	0,23%	11 Agt 2026
CVE-2026-72558 An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause conca...	8.8 High	—	0,43%	11 Agt 2026
CVE-2026-72557 An unrestricted file upload vulnerability in Cockpit CMS 2.6.0 allows authenticated users to upload files of any extension including PHP scripts via the asset upload endp...	8.8 High	—	0,48%	11 Agt 2026
CVE-2026-72556 A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the Filter cla...	8.8 High	—	1,0%	11 Agt 2026
CVE-2026-72555 A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 exists because the Config.roles_active flag defaults to false, causing all permi...	8.1 High	—	0,37%	11 Agt 2026
CVE-2026-72554 A broken access control vulnerability in Ladybird Web Solution Faveo Helpdesk 2.0.3 allows any self-registered customer to read ticket conversations belonging to other cu...	6.5 Medium	—	0,37%	11 Agt 2026
CVE-2026-72553 A stored cross-site scripting vulnerability in ElkArte Forum 2.0 Beta 1 allows any registered member to inject persistent JavaScript into the profile fields cust_blurb an...	5.4 Medium	—	0,23%	11 Agt 2026
CVE-2026-72552 A server-side request forgery vulnerability in Dub as of 2026-07-10 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal o...	7.5 High	—	0,61%	11 Agt 2026
CVE-2026-72551 A remote code execution vulnerability in Apioo Fusio 8.8.3 allows authenticated users with the Developer role to execute arbitrary OS commands by exploiting a PHP-Sandbox...	8.8 High	—	1,0%	11 Agt 2026
CVE-2026-72550 An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view...	9.8 Critical	—	0,61%	11 Agt 2026
CVE-2026-72549 An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to map any email address or username to its intern...	5.3 Medium	—	0,48%	11 Agt 2026
CVE-2026-72548 An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any organisation tenant record via the...	7.5 High	—	0,61%	11 Agt 2026
CVE-2026-72547 An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to bulk import attendees into events belong...	7.1 High	—	0,28%	11 Agt 2026
CVE-2026-72546 An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to inject attendees and orders into events...	7.1 High	—	0,28%	11 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.