Katalog CVE (hal. 779)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.172 (Critical 36.633 · High 106.354 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 1 Nov 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 38.901–38.950 dari 266.172 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-17593 sonatype nexus repository manager An account holding the nexus:settings:update permission in Nexus Repository 3 (or the equivalent nexus:settings permission in the legacy Nexus Repository 2) could submit...	7.2 High	—	0,77%	7 Agt 2026
CVE-2026-14644 sonatype nexus repository manager Nexus Repository 3 contained a privilege escalation vulnerability in the REST privileges API. An authenticated user with permission to manage privileges could, under cert...	7.2 High	—	0,61%	7 Agt 2026
CVE-2026-66059 Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, a field-level permissions bypass exposes restricted DocType fields. This issue is fixed i...	5.3 Medium	—	0,48%	7 Agt 2026
CVE-2026-62996 Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. From 5.0.0 until 5.8.4, Smarty's stream: resource-name...	6.9 Medium	—	0,51%	7 Agt 2026
CVE-2026-62992 Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to 5.8.2 (and 4.5.7 on the 4.x line), Security::...	6.9 Medium	—	0,53%	7 Agt 2026
CVE-2026-48093 The Code Embed WordPress plugin prior to version 2.6.1 is vulnerable to stored Cross-Site Scripting (XSS) through the external URL embed feature in post content. The vuln...	6.5 Medium	—	0,29%	7 Agt 2026
CVE-2026-19210 A vulnerability has been found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=save_upload. Suc...	6.3 Medium	—	0,40%	7 Agt 2026
CVE-2026-19209 A flaw has been found in SourceCodester Photo Share Website 1.0. The affected element is an unknown function of the file /social/index.php?page=home. This manipulation of...	3.5 Low	—	0,35%	7 Agt 2026
CVE-2026-19208 A vulnerability was detected in WonderTrader up to 0.9.9. Impacted is the function TraderDD::queryTrades of the file src/TraderDD/TraderDD.cpp. The manipulation of the ar...	3.7 Low	—	0,43%	7 Agt 2026
CVE-2026-19264 Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and streams t...	9.8 Critical	—	1,0%	7 Agt 2026
CVE-2026-19207 A security vulnerability has been detected in PHPGurukul Company Visitor Management System 1.0. This issue affects some unknown processing of the file /manage-newvisitors...	2.4 Low	—	0,37%	7 Agt 2026
CVE-2026-18497 A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for parsing TrueType font files. The vulnerability exis...	7.1 High	—	0,18%	7 Agt 2026
CVE-2022-4995 Weaver (Fanwei) E-cology 9.0 versions prior to 10.52 contain a file upload vulnerability that allows a remote, unauthenticated attacker to upload arbitrary files, includi...	9.8 Critical	—	1,2%	7 Agt 2026
CVE-2026-66914 Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD < 3.30.0, < 4.7.0, < 6.0.1 - An unauthenticated attacker could download files from both inside an...	9.2 Critical	—	1,5%	7 Agt 2026
CVE-2026-61477 An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes an...	2.3 Low	—	0,16%	7 Agt 2026
CVE-2026-37171 supertokens A lack of tenant separation in SuperTokens Inc. SuperTokens Core v6.0.0 to v11.4.0 allows an authenticated party in one tenant to access sessions, data, and endpoints of...	9.6 Critical	—	0,25%	7 Agt 2026
CVE-2026-19206 A security flaw has been discovered in MZ Automation libiec61850 up to 1.6.1. This affects the function SVReceiver_stopThreadless of the file src/sampled_values/sv_subscr...	5.3 Medium	—	0,17%	7 Agt 2026
CVE-2026-16637 OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlist and leak Earthdata headers (User-Id, Echo-Token)...	6.5 Medium	—	0,46%	7 Agt 2026
CVE-2026-15570 An improper restriction of URL schemes and destinations in the SmartCenter browserseturl command in the Telefunken TE24553B45V2DZ Smart TV running on the Vestel MB181 / V...	7.1 High	—	0,26%	7 Agt 2026
CVE-2026-66838 elixir-ecto postgrex Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in elixir-ecto postgrex allows SQL Injection via the :comment option of...	8.2 High	—	0,40%	7 Agt 2026
CVE-2026-66494 Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0 - An unauthenticated attacker can store malicious JavaScript...	8.7 High	—	0,50%	7 Agt 2026
CVE-2026-56794 dell openmanage server administrator Dell OpenManage Server Administrator, versions prior to 11.1.0.2, contains a Relative Path Traversal vulnerability. A low privileged attacker with remote access could pot...	6.5 Medium	—	0,45%	7 Agt 2026
CVE-2026-56793 dell openmanage server administrator Dell OpenManage Server Administrator, versions prior to 11.1.0.2, contains an Improper Authentication vulnerability. An unauthenticated attacker with remote access could...	9.8 Critical	—	0,53%	7 Agt 2026
CVE-2026-48094 The ShareOpenly WordPress plugin prior to version 1.2.1 contains a Cross-Site Scripting vulnerability caused by the absence of WordPress's `esc_url()` escaping function o...	5.3 Medium	—	0,53%	7 Agt 2026
CVE-2026-15816 A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-q...	7.5 High	—	0,37%	7 Agt 2026
CVE-2026-71560 apache fory Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing structs cont...	9.1 Critical	—	0,77%	7 Agt 2026
CVE-2026-71559 apache fory Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted data containi...	7.5 High	—	0,80%	7 Agt 2026
CVE-2026-71558 apache fory Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can b...	9.8 Critical	—	0,99%	7 Agt 2026
CVE-2026-54218 Use of hard-coded cryptographic key vulnerability in Tobit Laboratories AG TeamDavid's Webbox. For users created locally in David, passwords are stored in various files...	8.8 High	—	0,46%	7 Agt 2026
CVE-2026-54217 Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to a stored XSS vulnerability. An attacker can send an email containing malicious JavaScript code. Whe...	5.3 Medium	—	0,44%	7 Agt 2026
CVE-2026-54216 Tobit Laboratories AG TeamDavid's Webbox application contains a reflected cross-site scripting (XSS) vulnerability. By sending a specially crafted link including an arb...	5.3 Medium	—	0,45%	7 Agt 2026
CVE-2026-54215 Tobit Laboratories AG TeamDavid's Webbox contains an open redirect vulnerability via the “replyUrl” parameter. An attacker can exploit this vulnerability to craft a UR...	5.3 Medium	—	0,46%	7 Agt 2026
CVE-2026-54214 Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to HTTP header injection through the “cType” URL parameter, which allows arbitrary modification of the...	5.3 Medium	—	0,46%	7 Agt 2026
CVE-2026-54213 Tobit Laboratories AG TeamDavid's Webbox application exposes a functionality that allows the server to be shut down when a specific endpoint (/internalRestart) is access...	9.2 Critical	—	0,71%	7 Agt 2026
CVE-2026-54212 Tobit Laboratories AG TeamDavid's Webbox application implements an API endpoint that is vulnerable to a buffer overflow condition. By submitting a specially crafted JSON...	9.5 Critical	—	0,67%	7 Agt 2026
CVE-2026-54211 Tobit Laboratories AG TeamDavid's Webbox application’s endpoint “//serverClient_close.html” is vulnerable to a buffer overflow vulnerability in multiple form data parame...	9.5 Critical	—	0,64%	7 Agt 2026
CVE-2026-54210 Tobit Laboratories AG TeamDavid's Webbox application implements various file upload functionalities that are vulnerable to a buffer overflow condition. By specifying an...	9.5 Critical	—	0,67%	7 Agt 2026
CVE-2026-54209 Tobit Laboratories AG TeamDavid's Webbox application handles password changes using a function triggered by including the string "(editini)" in the file path, writing th...	8.9 High	—	0,41%	7 Agt 2026
CVE-2026-54208 Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to arbitrary file write, allowing an unauthenticated attacker to create or write into existing files o...	8.5 High	—	0,52%	7 Agt 2026
CVE-2026-54207 Tobit Laboratories AG TeamDavid's Webbox 's move archive functionality (“!ArcEntryMove”) accepts an arbitrary path, which can be set to network locations using UNC paths...	6.3 Medium	—	0,49%	7 Agt 2026
CVE-2026-54206 Tobit Laboratories AG TeamDavid's Webbox 's sending email, fax, SMS, etc. functionality accepts a @@INCLUDE command, which can be set to network locations using UNC path...	6.3 Medium	—	0,49%	7 Agt 2026
CVE-2026-54205 Tobit Laboratories AG TeamDavid's Webbox 's link storing functionality (//ServerClient_celink.htm) accepts a “pathname” parameter, which can be set to network locations...	6.3 Medium	—	0,49%	7 Agt 2026
CVE-2026-54204 Tobit Laboratories AG TeamDavid's Webbox 's search functionality accepts a “pathnameroot” parameter, which can be set to network locations using UNC paths (e.g., “\\Ser...	7.7 High	—	0,57%	7 Agt 2026
CVE-2026-54203 Memory Leak to an Unauthorized Actor vulnerability in Tobit Laboratories AG TeamDavid's Webbox allows reading of sensitive information. When accessing the URL “/.well-kno...	9.2 Critical	—	0,56%	7 Agt 2026
CVE-2026-54202 Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a path traversal vulnerability in the archive creation functionality. Because the archive path is user-contro...	8.5 High	—	0,45%	7 Agt 2026
CVE-2026-54201 Tobit Laboratories AG TeamDavid's Webbox does not enforce authentication or authorization checks when serving these log files. As a result, attackers can obtain sensit...	6.9 Medium	—	0,57%	7 Agt 2026
CVE-2026-54200 Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a local file inclusion vulnerability in the send email, fax, SMS, etc. functionality. By specifying an '@@atta...	8.4 High	—	0,40%	7 Agt 2026
CVE-2026-54199 Tobit Laboratories AG TeamDavid's Webbox is vulnerable to HTTP header injection through the request body in the application's link storing functionality (//ServerClien...	5.3 Medium	—	0,45%	7 Agt 2026
CVE-2026-12071 The Webbox of TeamDavid by Tobit Laboratories AG constructs redirect URLs using user-supplied input, which is appended to the redirect target in a 302 HTTP response. By...	5.3 Medium	—	0,46%	7 Agt 2026
CVE-2026-12070 Tobit Laboratories AG TeamDavid's Webbox is vulnerable to an arbitrary file deletion vulnerability in the send email, fax, SMS, etc. functionality. By specifying an @@...	8.4 High	—	0,40%	7 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.