Katalog CVE (hal. 778)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.172 (Critical 36.633 · High 106.354 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 1 Nov 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 38.851–38.900 dari 266.172 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-66000 Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient's current docu...	2.3 Low	—	0,45%	7 Agt 2026
CVE-2026-48098 NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP address. Versions prior to 2.0.0 execute privileged system comm...	7.3 High	—	0,19%	7 Agt 2026
CVE-2026-48097 NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP address. Versions prior to 2.0.0 have a command execution vulne...	7.8 High	—	0,23%	7 Agt 2026
CVE-2026-19231 A security flaw has been discovered in SourceCodester Simple Doctors Appointment System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=de...	7.3 High	—	0,43%	7 Agt 2026
CVE-2026-19230 A vulnerability was identified in SourceCodester Photo Share Website 1.0. This affects an unknown part of the file /social/ajax.php?action=save_upload of the component Co...	3.5 Low	—	0,35%	7 Agt 2026
CVE-2026-17435 File::Rotate::Simple versions before 0.4.0 for Perl create the target of dangling symlinks when rotating files. When the file to be rotated is a symbolic link to a missi...	2.5 Low	—	0,14%	7 Agt 2026
CVE-2026-11430 Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook token check. When the webhook feature is enabled but no webhookToken is configured, a...	7.3 High	—	0,96%	7 Agt 2026
CVE-2025-71413 Malformed or out-of-sequence frames at the Aviation Very High Frequency Link Control X.25 layers cause repeated resets which may result in increased workload and reduced...	5.3 Medium	—	0,33%	7 Agt 2026
CVE-2025-71412 Injection of false emergency or status messages over CPDLC may lead to misallocation of resources, operational confusion, and improper response actions by flight crews, t...	7.1 High	—	0,30%	7 Agt 2026
CVE-2025-71411 Broadcast control frames can disconnect multiple aircraft simultaneously leading to delayed clearances and air traffic controller overload. This type of attack can be car...	5.3 Medium	—	0,33%	7 Agt 2026
CVE-2025-71410 Unnumbered Disconnect (U DISC) and malformed Aviation Very High Frequency Link Control frames can terminate sessions and lead to a loss of CPDLC functions requiring a rev...	5.3 Medium	—	0,33%	7 Agt 2026
CVE-2025-71409 Lack of authentication for Very High Frequency Data Link messages allows rogue ground stations to inject CPDLC messages leading to unexpected or misleading clearances and...	7.1 High	—	0,33%	7 Agt 2026
CVE-2025-63235 In sol commit 373d848 (2024-12-12), the broker does not fully release resources when handling malformed or duplicate CONNECT packets. When clients send invalid CONNECT pa...	7.5 High	—	0,38%	7 Agt 2026
CVE-2026-66058 Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, unrestricted access to a Document Follow API (update_follow) is possible for an authentic...	5.3 Medium	—	0,38%	7 Agt 2026
CVE-2026-64638 WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it...	8.9 High	—	0,89%	7 Agt 2026
CVE-2026-64637 Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root user account.	9.9 Critical	—	0,47%	7 Agt 2026
CVE-2026-64636 An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database.	7.7 High	—	0,40%	7 Agt 2026
CVE-2026-56818 netty Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, the RedisArrayAggregator Redis codec clears retained partia...	6.5 Medium	—	0,47%	7 Agt 2026
CVE-2026-47364 In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user-facing opt-out. Impact: Th...	6.5 Medium	—	0,44%	7 Agt 2026
CVE-2026-47363 In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session (including OAuth token...	6.3 Medium	—	0,26%	7 Agt 2026
CVE-2026-47362 In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase (noti...	4.6 Medium	—	0,24%	7 Agt 2026
CVE-2026-47361 In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-suppli...	6.4 Medium	—	0,29%	7 Agt 2026
CVE-2026-44965 In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities (IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCal...	5.5 Medium	—	0,16%	7 Agt 2026
CVE-2026-44964 In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard. A co-installed application c...	6.5 Medium	—	0,34%	7 Agt 2026
CVE-2026-19229 A vulnerability was determined in SourceCodester Online Clothing Store. Affected by this issue is some unknown functionality of the file /_notes/ of the component Dreamwe...	5.3 Medium	—	0,56%	7 Agt 2026
CVE-2026-19213 A vulnerability was identified in WonderTrader up to 0.9.9. Affected is the function _undone_qty in the library src/WtCore/TraderAdapter.h of the component Pending Order...	4.3 Medium	—	0,37%	7 Agt 2026
CVE-2026-19082 Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-read from zero-count ASCII EXIF entries in copy_string_tags. copy_str...	7.5 High	—	0,37%	7 Agt 2026
CVE-2026-71557 go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct...	6.3 Medium	—	0,41%	7 Agt 2026
CVE-2026-71556 go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolv...	7.1 High	—	0,36%	7 Agt 2026
CVE-2026-68772 ZenML 0.94.6 contains a remote code execution vulnerability in the CloudpickleMaterializer component that allows attackers with write access to a shared artifact store to...	8.0 High	—	0,76%	7 Agt 2026
CVE-2026-67585 Allocation of Resources Without Limits or Throttling vulnerability in DivvyPayHQ absinthe_federation allows an unauthenticated remote attacker to abort the Erlang VM via...	8.7 High	—	0,71%	7 Agt 2026
CVE-2026-66062 SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit...	5.3 Medium	—	0,51%	7 Agt 2026
CVE-2026-20348 cisco secure endpoint A vulnerability in the XAR file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a r...	7.5 High	—	0,72%	7 Agt 2026
CVE-2026-20347 A vulnerability in the Mach-O file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as...	7.5 High	—	0,56%	7 Agt 2026
CVE-2026-20346 A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a r...	7.5 High	—	0,54%	7 Agt 2026
CVE-2026-20345 A vulnerability in the GPT file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a r...	7.5 High	—	0,56%	7 Agt 2026
CVE-2026-20339 A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as...	7.5 High	—	0,56%	7 Agt 2026
CVE-2026-20338 A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability...	7.5 High	—	0,56%	7 Agt 2026
CVE-2026-20337 A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability...	7.5 High	—	0,60%	7 Agt 2026
CVE-2026-19212 A vulnerability was determined in WonderTrader up to 0.9.9. This impacts an unknown function of the file src/Includes/WTSTradeDef.hpp of the component TraderATP Cash Trad...	4.3 Medium	—	0,47%	7 Agt 2026
CVE-2026-19211 A vulnerability was found in SourceCodester Photo Share Website 1.0. This affects an unknown function of the file /social/ajax.php?action=signup. Performing a manipulatio...	7.3 High	—	0,43%	7 Agt 2026
CVE-2026-17603 sonatype nexus repository manager Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set through the DataStore configuration API. A user holding the nx-dat...	8.8 High	—	0,87%	7 Agt 2026
CVE-2026-17601 sonatype nexus repository manager A user holding a permission to update privilege definitions could modify a wildcard privilege already assigned to their own role to grant broader permissions than they we...	7.2 High	—	0,52%	7 Agt 2026
CVE-2026-17600 sonatype nexus repository manager Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissions when that user's account was deleted, deactivat...	8.8 High	—	0,44%	7 Agt 2026
CVE-2026-17599 sonatype nexus repository manager Nexus Repository 3 contained an endpoint used to change the administrator account password during initial onboarding. This endpoint did not verify that onboarding was sti...	7.2 High	—	0,49%	7 Agt 2026
CVE-2026-17598 sonatype nexus repository manager Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creating or updating a scheduled task through the...	4.9 Medium	—	0,39%	7 Agt 2026
CVE-2026-17597 sonatype nexus repository manager Nexus Repository 3 contains a Server-Side Request Forgery (SSRF) vulnerability in the email configuration verification feature. A user holding the nexus:settings:update p...	2.7 Low	—	0,31%	7 Agt 2026
CVE-2026-17596 sonatype nexus repository manager Nexus Repository 3 was found to be vulnerable to stored cross-site scripting (XSS). A user with the nexus:blobstores:create or nexus:blobstores:update permission could se...	6.1 Medium	—	0,43%	7 Agt 2026
CVE-2026-17595 sonatype nexus repository manager Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors. An account holding the nexus:selectors:create permission could construct an expressio...	2.7 Low	—	0,39%	7 Agt 2026
CVE-2026-17594 sonatype nexus repository manager Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization vulnerability (CWE-863) in the repository-creation user interface. An individua...	4.9 Medium	—	0,99%	7 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.