Katalog CVE (hal. 777)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.172 (Critical 36.633 · High 106.354 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 1 Nov 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 38.801–38.850 dari 266.172 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-46405 OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, in OpenBao's Kerberos auth method on the `GET` handler, or when an `Authorizat...	5.3 Medium	—	0,62%	7 Agt 2026
CVE-2026-45808 OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's namespaces provide multi-tenant separation. A tenant who intentional...	7.1 High	—	0,43%	7 Agt 2026
CVE-2026-11743 The SF32LB MPI QSPI NOR flash driver (drivers/flash/flash_sf32lb_mpi_qspi_nor.c) validated the flash offset and length on its read and write paths with the test (offset +...	6.6 Medium	—	0,15%	7 Agt 2026
CVE-2026-11742 The kernel queue helper z_queue_node_peek() in kernel/queue.c dereferences a node taken from a queue's data_q list, reading the node's flag byte and, for items enqueued v...	3.6 Low	—	0,13%	7 Agt 2026
CVE-2026-9031 An input validation vulnerability exists in the HTTP-WRITEOEM handler due to insufficient validation of user-supplied data before it is processed by internal flash-write...	6.8 Medium	—	0,26%	7 Agt 2026
CVE-2026-9030 A denial-of-service vulnerability exists in httpd service on Archer A6 v4 where the asynchronous systool instruction handlng path in httpd does not properly synchronize o...	6.8 Medium	—	0,20%	7 Agt 2026
CVE-2026-71381 Adobe Genuine Software Integrity Service on Windows is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker co...	4.0 Medium	—	0,27%	7 Agt 2026
CVE-2026-69207 Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.34, the built-in CORS middleware, hono/cors, is vulnerable to a regula...	5.3 Medium	—	0,61%	7 Agt 2026
CVE-2026-66061 Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.0, the iOS Companion app treats tag links (NFC or QR) delive...	7.1 High	—	0,17%	7 Agt 2026
CVE-2026-66060 Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.3, the Companion app treats tag links (NFC or QR) delivered...	7.1 High	—	0,17%	7 Agt 2026
CVE-2026-59717 Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.6.1, the Android Companion app is vulnerable to an open redirec...	4.3 Medium	—	0,38%	7 Agt 2026
CVE-2026-54338 JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place a...	5.3 Medium	—	0,44%	7 Agt 2026
CVE-2026-50540 Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Prior to version 4.0.0...	9.6 Critical	—	0,61%	7 Agt 2026
CVE-2026-47664 Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, the `$import-...	8.6 High	—	0,21%	7 Agt 2026
CVE-2026-47663 Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's ty...	8.7 High	—	0,41%	7 Agt 2026
CVE-2026-47662 Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's ty...	8.7 High	—	0,41%	7 Agt 2026
CVE-2026-46358 OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's inline auth functionality incorrectly redacted audit log entries, re...	5.4 Medium	—	0,21%	7 Agt 2026
CVE-2026-19246 A vulnerability has been found in HKUDS nanobot up to 0.2.1. This affects the function _download_image_data_url of the file nanobot/providers/image_generation.py of the c...	6.3 Medium	—	0,37%	7 Agt 2026
CVE-2026-19245 A flaw has been found in HKUDS nanobot up to 0.2.1. The impacted element is the function ExecTool._prepare_command of the file nanobot/agent/tools/shell.py of the compone...	3.3 Low	—	0,17%	7 Agt 2026
CVE-2026-19244 A vulnerability was detected in HKUDS nanobot up to 0.2.1. The affected element is the function connect_mcp_servers of the file nanobot/agent/tools/mcp.py of the componen...	4.7 Medium	—	0,48%	7 Agt 2026
CVE-2026-11425 Domoticz versions prior to 2026.3 contains a stored cross-site scripting vulnerability in the mobile dashboard that allows authenticated attackers to inject arbitrary HTM...	4.4 Medium	—	0,25%	7 Agt 2026
CVE-2026-71870 pypdf project pypdf pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause large memory consumption when pypdf/_cmap.py function parse_bfrange pars...	3.3 Low	—	0,13%	7 Agt 2026
CVE-2026-66151 SonicWall Global VPN Client version 4.10.8.1108 and earlier is vulnerable to an out-of-bounds kernel memory read in the SWIPsec.sys driver, which could allow a local atta...	5.5 Medium	—	0,16%	7 Agt 2026
CVE-2026-65819 gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validat...	7.5 High	—	0,66%	7 Agt 2026
CVE-2026-62296 HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, XhtmlParser.java imposes no maximum element nest...	7.5 High	—	0,49%	7 Agt 2026
CVE-2026-62295 HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the JSON utility parser in org.hl7.fhir.utilitie...	7.5 High	—	0,49%	7 Agt 2026
CVE-2026-62293 HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the hidden scan command concatenates attacker-co...	5.0 Medium	—	0,17%	7 Agt 2026
CVE-2026-61808 LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disab...	9.8 Critical	—	2,5%	7 Agt 2026
CVE-2026-48039 Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads. Prior to version 1.0.109, `AuthInjectionMiddleware.dispatch()` at `http_auth_i...	9.1 Critical	—	0,59%	7 Agt 2026
CVE-2026-48007 Element Call is a native Matrix video conferencing application. Versions 0.5.17 through 0.19.3 report analytics data to a PostHog server, when configured to by a `posthog...	8.6 High	—	0,25%	7 Agt 2026
CVE-2026-47661 Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's `/...	8.7 High	—	0,62%	7 Agt 2026
CVE-2026-47660 Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's bu...	8.7 High	—	0,54%	7 Agt 2026
CVE-2026-47659 Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's `/...	8.7 High	—	0,62%	7 Agt 2026
CVE-2026-19243 A security vulnerability has been detected in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool._guard_command/ExecTool._spawn of the file nanobot/agent/tools/...	6.3 Medium	—	2,3%	7 Agt 2026
CVE-2026-19113 Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints. A remote ca...	5.3 Medium	—	0,40%	7 Agt 2026
CVE-2026-19017 Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect CA provider...	6.8 Medium	—	0,46%	7 Agt 2026
CVE-2026-19016 Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the {{session:write}} ACL permission for session deletion operations submitted through...	4.2 Medium	—	0,28%	7 Agt 2026
CVE-2026-19015 Consul Community Edition and Consul Enterprise 1.2.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect CA roots endpoint that may...	5.3 Medium	—	0,40%	7 Agt 2026
CVE-2026-19014 Consul Community Edition and Consul Enterprise 1.17.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect authorization endpoint tha...	4.3 Medium	—	0,36%	7 Agt 2026
CVE-2026-19012 Consul Community Edition and Consul Enterprise 1.18.0 through 2.0.2 are vulnerable to an authenticated denial of service in the Enterprise-to-Community Edition downgrade...	5.3 Medium	—	0,33%	7 Agt 2026
CVE-2026-15972 Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on the...	7.5 High	—	0,55%	7 Agt 2026
CVE-2026-15970 Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured with a custo...	4.2 Medium	—	0,21%	7 Agt 2026
CVE-2026-71852 pypdf project pypdf pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause long runtimes and large memory consumption when pypdf/_font.py function...	3.3 Low	—	0,13%	7 Agt 2026
CVE-2026-71851 crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random() using a custom variatio...	9.0 Critical	—	0,55%	7 Agt 2026
CVE-2026-71850 Hono is a Web application framework that provides support for any JavaScript runtime. From 3.8.0 to 4.12.33, memo() from hono/jsx retains the result of a server side rend...	4.8 Medium	—	0,27%	7 Agt 2026
CVE-2026-71849 Hono is a Web application framework that provides support for any JavaScript runtime. From 4.7.0 to 4.12.33, the Proxy Helper proxy() function in hono/proxy does not remo...	3.7 Low	—	0,36%	7 Agt 2026
CVE-2026-71848 Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.0 to 4.12.33, the languageDetector middleware is vulnerable to algorithmic...	5.3 Medium	—	0,51%	7 Agt 2026
CVE-2026-71847 Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves st...	8.7 High	—	0,43%	7 Agt 2026
CVE-2026-70561 TestLink 1.9.20 and prior contains an insecure direct object reference vulnerability that allows any authenticated user, including low-privilege guest accounts, to read a...	6.5 Medium	—	0,37%	7 Agt 2026
CVE-2026-69127 Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that...	6.9 Medium	—	0,70%	7 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.