Katalog CVE (hal. 761)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.065 (Critical 36.624 · High 106.293 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 31 Okt 2026, 12:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 38.001–38.050 dari 266.065 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-72600 A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer PII via the...	7.5 High	—	0,61%	11 Agt 2026
CVE-2026-72599 An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to execute arbitrary SQL via the news item page ID parameter. The parameter is concat...	9.8 Critical	—	0,61%	11 Agt 2026
CVE-2026-72598 A server-side request forgery vulnerability in Apioo Fusio 8.8.3 allows authenticated consumer-role users to make the server issue HTTP requests to internal network addre...	6.5 Medium	—	0,37%	11 Agt 2026
CVE-2026-72597 A server-side request forgery vulnerability in Friendica through the 2026.08-dev branch allows authenticated users with a free self-registered account to probe internal n...	6.5 Medium	—	0,34%	11 Agt 2026
CVE-2026-72596 A broken access control vulnerability in Ghost Foundation Ghost 5.x allows authenticated Author-role users to delete posts owned by other users. The post model permissibl...	8.1 High	—	0,38%	11 Agt 2026
CVE-2026-72595 A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to update ticket records belonging to other teams via the Ticke...	8.1 High	—	0,35%	11 Agt 2026
CVE-2026-72563 A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to overwrite lead records belonging to other teams via the Lead...	8.1 High	—	0,35%	11 Agt 2026
CVE-2026-72562 An SQL injection vulnerability in Pimcore admin-ui-classic-bundle through version 2.3 allows authenticated backend users to execute arbitrary SQL via the DataObject grid...	8.8 High	—	0,43%	11 Agt 2026
CVE-2026-72561 A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 allows any authenticated non-administrative user to reconfigure the platform glo...	8.8 High	—	0,42%	11 Agt 2026
CVE-2026-72560 A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev0 exists because SSRF_PROTECTION_ENABLED is set to false by default. The import-...	6.5 Medium	—	0,34%	11 Agt 2026
CVE-2026-72559 A stored cross-site scripting vulnerability in HortusFox 5.9 allows authenticated workspace members to inject persistent JavaScript into plant notes via Parsedown rendere...	5.4 Medium	—	0,23%	11 Agt 2026
CVE-2026-72558 An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause conca...	8.8 High	—	0,43%	11 Agt 2026
CVE-2026-72557 An unrestricted file upload vulnerability in Cockpit CMS 2.6.0 allows authenticated users to upload files of any extension including PHP scripts via the asset upload endp...	8.8 High	—	0,48%	11 Agt 2026
CVE-2026-72556 A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the Filter cla...	8.8 High	—	1,0%	11 Agt 2026
CVE-2026-72555 A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 exists because the Config.roles_active flag defaults to false, causing all permi...	8.1 High	—	0,37%	11 Agt 2026
CVE-2026-72554 A broken access control vulnerability in Ladybird Web Solution Faveo Helpdesk 2.0.3 allows any self-registered customer to read ticket conversations belonging to other cu...	6.5 Medium	—	0,37%	11 Agt 2026
CVE-2026-72553 A stored cross-site scripting vulnerability in ElkArte Forum 2.0 Beta 1 allows any registered member to inject persistent JavaScript into the profile fields cust_blurb an...	5.4 Medium	—	0,23%	11 Agt 2026
CVE-2026-72552 A server-side request forgery vulnerability in Dub as of 2026-07-10 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal o...	7.5 High	—	0,61%	11 Agt 2026
CVE-2026-72551 A remote code execution vulnerability in Apioo Fusio 8.8.3 allows authenticated users with the Developer role to execute arbitrary OS commands by exploiting a PHP-Sandbox...	8.8 High	—	1,0%	11 Agt 2026
CVE-2026-72550 An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view...	9.8 Critical	—	0,61%	11 Agt 2026
CVE-2026-72549 An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to map any email address or username to its intern...	5.3 Medium	—	0,48%	11 Agt 2026
CVE-2026-72548 An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any organisation tenant record via the...	7.5 High	—	0,61%	11 Agt 2026
CVE-2026-72547 An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to bulk import attendees into events belong...	7.1 High	—	0,28%	11 Agt 2026
CVE-2026-72546 An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to inject attendees and orders into events...	7.1 High	—	0,28%	11 Agt 2026
CVE-2026-72545 An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to write to any contact record via the u...	7.5 High	—	0,54%	11 Agt 2026
CVE-2026-72544 An integrity verification vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to forge document audit-trail entries via the trig...	7.5 High	—	0,25%	11 Agt 2026
CVE-2026-72543 An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any contact record via the g...	7.5 High	—	0,61%	11 Agt 2026
CVE-2026-72542 A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows authenticated operators to write job progress and read job metrics for any job in t...	5.4 Medium	—	0,30%	11 Agt 2026
CVE-2026-72541 A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema via the up...	6.5 Medium	—	0,30%	11 Agt 2026
CVE-2026-72539 An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to read legacy ownerless draft scripts that co...	6.5 Medium	—	0,40%	11 Agt 2026
CVE-2026-72538 An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users to achieve remote code execution via the git_clone pull step branch fiel...	8.8 High	—	0,98%	11 Agt 2026
CVE-2026-72537 A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to take over any use...	8.8 High	—	0,40%	11 Agt 2026
CVE-2026-72536 A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to manipulate any tenant Stripe subscription via the stri...	8.6 High	—	0,57%	11 Agt 2026
CVE-2026-72535 A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via...	8.6 High	—	0,57%	11 Agt 2026
CVE-2026-72534 A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to gain superuser pr...	8.8 High	—	0,42%	11 Agt 2026
CVE-2026-72533 An authentication bypass vulnerability in Portainer CE through 2.44.0 allows authenticated low-privileged users to bypass Docker proxy authorization checks via non-canoni...	8.8 High	—	0,56%	11 Agt 2026
CVE-2026-50237 A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with...	7.4 High	—	0,47%	11 Agt 2026
CVE-2026-50236 An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path...	7.4 High	—	0,47%	11 Agt 2026
CVE-2026-13739 commvault A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerability related to the handling of arbitrary target URLs. Softw...	9.8 Critical	—	0,48%	11 Agt 2026
CVE-2026-13738 commvault CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. Software customers upgrade to resolved maintenance rel...	9.8 Critical	—	0,67%	11 Agt 2026
CVE-2026-13737 commvault CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all C...	9.8 Critical	—	0,67%	11 Agt 2026
CVE-2026-58231 SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient...	10.0 Critical	—	0,86%	11 Agt 2026
CVE-2026-73162 Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests: * /account/follow * /account/delete_notification...	5.3 Medium	—	0,25%	11 Agt 2026
CVE-2026-33922 A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input parameter. A loc...	6.0 Medium	—	0,17%	11 Agt 2026
CVE-2026-33921 The Windows installer deployed Npcap leaving its access restriction option at the insecure default value, so the driver was accessible to every local user of the host ins...	5.2 Medium	—	0,13%	11 Agt 2026
CVE-2026-73161 Affected versions of cti-transmute improperly handle conversion-table values passed through the search highlighting feature. The highlight() function previously returned...	5.1 Medium	—	0,40%	11 Agt 2026
CVE-2026-73160 Affected versions of cti-transmute contain an SSRF vulnerability in the /fetch_misp_event and /misp_search_events endpoints. The URL validation routine checked whether...	8.7 High	—	0,41%	11 Agt 2026
CVE-2026-73159 Affected versions of cti-transmute allow a tag's icon value to be stored and later interpolated into HTML through Vue's v-html. The helper mapIcon() previously constructe...	5.1 Medium	—	0,40%	11 Agt 2026
CVE-2026-73158 Affected versions of cti-transmute insufficiently validate saved graph configuration data. Graph configurations can contain style properties that are later consumed by Pi...	5.1 Medium	—	0,40%	11 Agt 2026
CVE-2026-73157 Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-browser interface using HTML interpolation. Because fields such as even...	2.3 Low	—	0,44%	11 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.