Katalog CVE (hal. 766)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.139 (Critical 36.631 · High 106.324 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 31 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 38.251–38.300 dari 266.139 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-10754 Pega Platform versions 8.5.0 through 25.1.2 are affected by an improper validation of cryptographic signatures that may allow an attacker to bypass security controls.	8.6 High	—	0,78%	10 Agt 2026
CVE-2026-72731 Discourse is an open-source discussion platform. From 2026.1.0-latest until 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, anyone able to run a parameterized Data E...	7.1 High	—	0,40%	10 Agt 2026
CVE-2026-72730 Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the Rich Text Editor rendered a chat-transcript username as HTML, al...	8.7 High	—	0,43%	10 Agt 2026
CVE-2026-72729 Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse-local-dates plugin rendered crafted local-date format...	2.0 Low	—	0,48%	10 Agt 2026
CVE-2026-72728 Discourse is an open-source discussion platform. Prior to 2026.1.7, an authenticated user could submit specially formed URLs that bypassed the Onebox allowlist and embedd...	6.3 Medium	—	0,31%	10 Agt 2026
CVE-2026-72727 Discourse is an open-source discussion platform. Prior to 026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, a low-privileged user could place crafted content in the moderation r...	4.8 Medium	—	0,40%	10 Agt 2026
CVE-2026-71577 A flaw was found in multicluster-global-hub. During a ManagedClusterMigration, the system incorrectly grants all managed hubs read access to a shared communication topic....	6.3 Medium	—	0,42%	10 Agt 2026
CVE-2026-71576 A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attac...	8.5 High	—	0,30%	10 Agt 2026
CVE-2026-63623 A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the `qemu-...	5.5 Medium	—	0,10%	10 Agt 2026
CVE-2026-56619 HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting (Reflected XSS) due to insufficient validation and output encoding of user-controlled input.	5.4 Medium	—	0,23%	10 Agt 2026
CVE-2026-12624 Vault’s ACL policy engine did not consistently enforce a wildcard (glob) deny rule against LIST requests made with a trailing slash on the denied path. This may allow a t...	4.3 Medium	—	0,27%	10 Agt 2026
CVE-2026-72726 Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an authenticated user could eavesdrop on private AI bot conversation...	6.5 Medium	—	0,45%	10 Agt 2026
CVE-2026-72725 Discourse is an open-source discussion platform. Prior to 2026.1.6, the staff action log model rendered unescaped previous and new value fields that could inject stored c...	5.4 Medium	—	0,30%	10 Agt 2026
CVE-2026-72724 Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, plugins/chat/lib/chat/onebox_handler.rb resolves Chat::Thread by rou...	4.3 Medium	—	0,63%	10 Agt 2026
CVE-2026-72723 Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, SiteSerializer.anonymous_default_navigation_menu_tags serializes tag...	5.3 Medium	—	0,53%	10 Agt 2026
CVE-2026-72722 Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, TopicLink.extract_from, TopicLink.ensure_entry_for, and TopicLink.du...	4.3 Medium	—	0,44%	10 Agt 2026
CVE-2026-72721 Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Onebox::DomainChecker.is_blocked? compares hostnames and SiteSetting...	5.3 Medium	—	0,59%	10 Agt 2026
CVE-2026-72720 Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, Discourse has HTML injection in PrettyText.format_for_email...	6.4 Medium	—	0,41%	10 Agt 2026
CVE-2026-72719 Chatwoot is a customer engagement suite. Prior to 4.9.0, Chatwoot allowed authenticated account administrators to transfer Portals, Automation Rules, Macros, and Twilio C...	6.7 Medium	—	0,58%	10 Agt 2026
CVE-2026-72718 goose is general-purpose AI agent that runs on your machine. Prior to 1.44.0, the `goose review` command runs the system `git` executable to gather the diff for review wi...	7.0 High	—	0,22%	10 Agt 2026
CVE-2026-66738 SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which b...	8.8 High	—	0,58%	10 Agt 2026
CVE-2026-56620 HCL BigFix Mobile is vulnerable to information disclosure due to improper handling of exceptions and verbose error reporting.	4.3 Medium	—	0,30%	10 Agt 2026
CVE-2026-48158 use-context-selector is a React useContextSelector hook in userland Between 2026-05-18 15:57:18 and 2026-05-19 15:24:34, the default branch contained malicious commits 9d...	9.3 Critical	—	0,67%	10 Agt 2026
CVE-2026-48048 XWiki Platform is a generic wiki platform. XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm was insufficient. Starting with version 6.2.1 and prior to versions 18....	7.5 High	—	2,0%	10 Agt 2026
CVE-2026-47754 Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.x through 2.19.1 and all 1.x versions contain an unauthenticated...	9.3 Critical	—	0,48%	10 Agt 2026
CVE-2026-72761 The webhook URL validator in `website/notifications/webhooks.py` uses `ip.is_global` to reject non-public addresses after DNS resolution. IPv6 transition addresses (NAT64...	6.9 Medium	—	0,47%	10 Agt 2026
CVE-2026-72760 Affected versions of MISP cti-transmute disclose users' email addresses through the account following-list endpoint. When an authenticated user follows another account, g...	5.3 Medium	—	0,38%	10 Agt 2026
CVE-2026-72759 In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization check. When a history record references a deleted...	6.9 Medium	—	0,48%	10 Agt 2026
CVE-2026-19433 Authorization Bypass Through User-Controlled Key in the contact management component in Roskus Prospero Flow CRM before 5.4.8 allows authenticated users of any company to...	8.6 High	—	0,44%	10 Agt 2026
CVE-2026-18412 OpenCart extensions are uploaded as zip files with .ocmod.zip extensions. Upon installation, the OpenCart v4.2.0.0 extension installer extracts these zip files, but does...	9.1 Critical	—	0,54%	10 Agt 2026
CVE-2026-72751 CTI-Transmute is affected by a stored cross-site scripting (XSS) vulnerability in the conversion graph used to visualise converted MISP and STIX content. Attacker-contro...	5.1 Medium	—	0,45%	10 Agt 2026
CVE-2026-71959 Bitwarden Server before 2026.7.2 does not verify that the caller is a member of the organization identified in a POST /collect request body, allowing any authenticated us...	5.8 Medium	—	0,48%	10 Agt 2026
CVE-2026-63106 ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product listing API where the rating parameter from the products endpoint is co...	9.8 Critical	—	0,50%	10 Agt 2026
CVE-2026-63105 ReadyEcommerce before 4.5.2 contains a stored cross-site scripting (XSS) vulnerability that allows authenticated customers to inject malicious HTML payloads through the c...	5.4 Medium	—	0,24%	10 Agt 2026
CVE-2026-59112 Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability in Estonian Information System Authority (RIA) lib...	4.4 Medium	—	0,12%	10 Agt 2026
CVE-2026-18503 Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded in...	2.4 Low	—	0,12%	10 Agt 2026
CVE-2026-18478 Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into the name of uploaded image, whi...	5.1 Medium	—	0,46%	10 Agt 2026
CVE-2026-16742 systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user	6.7 Medium	—	0,06%	10 Agt 2026
CVE-2026-15060 When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in...	4.7 Medium	—	0,08%	10 Agt 2026
CVE-2026-15059 Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.	5.5 Medium	—	0,16%	10 Agt 2026
CVE-2026-72692 A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to irreversibly decline any in-flight docume...	7.5 High	—	0,44%	10 Agt 2026
CVE-2026-72691 An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to mint MASTER_KEY-signed file access token...	7.5 High	—	0,65%	10 Agt 2026
CVE-2026-72690 An improper authorization vulnerability in Attendize through commit 9289acb allows an authenticated remote attacker to inject persistent mandatory survey questions into a...	7.1 High	—	0,41%	10 Agt 2026
CVE-2026-72689 A broken object-level authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read complete contract record...	7.5 High	—	0,53%	10 Agt 2026
CVE-2026-72688 A missing authentication vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read arbitrary stored documents via the...	7.5 High	—	0,61%	10 Agt 2026
CVE-2026-6374 Use of Hard-coded Credentials vulnerability in Zyxel Networks WAH7601 allows Read Sensitive Constants Within an Executable. This issue affects WAH7601: through 20.07.202...	7.3 High	—	0,25%	10 Agt 2026
CVE-2026-6373 Exposure of sensitive system information to an unauthorized control sphere vulnerability in Zyxel Networks WAH7601 allows Web Application Fingerprinting. This issue affe...	6.5 Medium	—	0,26%	10 Agt 2026
CVE-2026-68427 In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings __host1x_bo_unpin() drops the las...	7.8 High	—	0,13%	10 Agt 2026
CVE-2026-68426 Advisory In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb->prev after async crypto steals a GSO segment skb_gso_segment() leaves the segme...	9.8 Critical	—	0,37%	10 Agt 2026
CVE-2026-68425 In the Linux kernel, the following vulnerability has been resolved: IB/mad: Drop unmatched RMPP responses before reassembly Kernel-handled RMPP receive processing start...	7.1 High	—	0,26%	10 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.