Katalog CVE (hal. 781)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.172 (Critical 36.633 · High 106.354 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 1 Nov 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 39.001–39.050 dari 266.172 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-65667 microsoft teams Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network.	10.0 Critical	—	0,80%	7 Agt 2026
CVE-2026-63508 microsoft planetary computer Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elevate privileges over a network.	10.0 Critical	—	0,80%	7 Agt 2026
CVE-2026-62918 microsoft teams Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network.	7.5 High	—	0,50%	7 Agt 2026
CVE-2026-62896 microsoft teams Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over a network.	9.6 Critical	—	0,69%	7 Agt 2026
CVE-2026-62873 microsoft windows admin center Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network.	9.8 Critical	—	0,61%	7 Agt 2026
CVE-2026-62836 microsoft azure sql managed instance Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an unauthorized attacker to elevate privileges over a network.	10.0 Critical	—	0,65%	7 Agt 2026
CVE-2026-62830 microsoft azure sre agent Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.	9.9 Critical	—	0,78%	7 Agt 2026
CVE-2026-59118 microsoft power apps Improper authorization in Copilot Cowork allows an unauthorized attacker to elevate privileges over a network.	9.3 Critical	—	0,72%	7 Agt 2026
CVE-2026-59115 microsoft entra provisioning service '.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.	9.9 Critical	—	1,0%	7 Agt 2026
CVE-2026-56162 microsoft azure sql database Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network.	10.0 Critical	—	0,90%	7 Agt 2026
CVE-2026-56161 microsoft azure logic apps Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network.	9.6 Critical	—	0,69%	7 Agt 2026
CVE-2026-50515 microsoft azure service bus Deserialization of untrusted data in Azure Service Bus allows an authorized attacker to execute code over a network.	9.9 Critical	—	1,7%	7 Agt 2026
CVE-2026-50481 microsoft azure active directory Modification of assumed-immutable data (maid) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.	9.9 Critical	—	0,82%	7 Agt 2026
CVE-2026-49163 microsoft application insights profiler Improper limitation of a pathname to a restricted directory ('path traversal') in Application Insights Profiler allows an authorized attacker to elevate privileges over a...	8.8 High	—	1,0%	7 Agt 2026
CVE-2026-17264 Opening a crafted DICOM file containing malicious JPEG-compressed pixel data triggers an attacker-controlled heap out-of-bounds write, which may allow an attacker to remo...	4.3 Medium	—	0,48%	7 Agt 2026
CVE-2026-8325 autodesk revit A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to c...	7.8 High	—	0,19%	6 Agt 2026
CVE-2026-7867 A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedeskto...	7.8 High	—	0,17%	6 Agt 2026
CVE-2026-7406 autodesk advance steel, autodesk autocad +10 lainnya A maliciously crafted BMP file, when parsed through certain Autodesk products, can force a Untrusted Pointer Dereference vulnerability. A malicious actor can leverage thi...	7.8 High	—	0,19%	6 Agt 2026
CVE-2026-7405 autodesk advance steel, autodesk autocad +10 lainnya A maliciously crafted TIF file, when parsed through certain Autodesk products during image import, can cause an Out-of-Bounds Read in the image handling library. A malici...	5.5 Medium	—	0,16%	6 Agt 2026
CVE-2026-71555 PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. From 2.1.0 until 4.14.1, PILOS does not send a Cross-Origin-Opener-Policy response...	4.1 Medium	—	0,29%	6 Agt 2026
CVE-2026-71554 h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and f...	5.3 Medium	—	0,42%	6 Agt 2026
CVE-2026-71498 node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated (incomplete) multi-byte UTF-8...	5.1 Medium	—	0,17%	6 Agt 2026
CVE-2026-71497 jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control...	4.7 Medium	—	0,30%	6 Agt 2026
CVE-2026-71488 league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have qu...	7.5 High	—	0,63%	6 Agt 2026
CVE-2026-71478 league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link filter can be...	6.1 Medium	—	0,36%	6 Agt 2026
CVE-2026-71476 Nx is a monorepo solution for TypeScript and polyglot codebases. From version 20.8.0 until 22.7.7 and 23.0.2, the Nx self-hosted HTTP remote cache extracts downloaded cac...	8.7 High	—	0,87%	6 Agt 2026
CVE-2026-71447 AIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts. The affected templates inserted...	6.9 Medium	—	0,40%	6 Agt 2026
CVE-2026-71446 AIL Framework contains a stored cross-site scripting vulnerability in the crawler domain view. Crawled URLs were embedded directly into the JavaScript onclick handler use...	6.9 Medium	—	0,40%	6 Agt 2026
CVE-2026-71445 AIL Framework contained a reflected cross-site scripting vulnerability in the /tag/add_tags endpoint. When an error occurred while processing a tag operation, the applica...	8.2 High	—	0,40%	6 Agt 2026
CVE-2026-71439 Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.6.0 until 11.16.1, Mermaid Radar Diagrams allow ar...	5.3 Medium	—	0,53%	6 Agt 2026
CVE-2026-71438 Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid's configuration setters (merm...	2.4 Low	—	0,35%	6 Agt 2026
CVE-2026-71437 Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.5.0 until 11.16.1, Mermaid Architecture Diagrams a...	6.5 Medium	—	0,50%	6 Agt 2026
CVE-2026-71436 Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 10.6.0 until 10.9.8 and 11.16.1, Mermaid XY Charts ar...	5.3 Medium	—	0,58%	6 Agt 2026
CVE-2026-71435 Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, the default ("automagic") form notification email rendered user-submitt...	6.1 Medium	—	0,34%	6 Agt 2026
CVE-2026-71434 Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, public frontend forms did not enforce the file upload restrictions that...	5.3 Medium	—	0,41%	6 Agt 2026
CVE-2026-71433 LangGraph Checkpoint Postgres and SQLite Checkpoint are the Postgres and SQLite implementations of LangGraph's checkpoint saver. Prior to 3.1.1, the langgraph-checkpoint-...	5.3 Medium	—	0,36%	6 Agt 2026
CVE-2026-71430 node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.25.1, the WrappedRE2::Replace function built its replacement result and passed it to V8...	6.2 Medium	—	0,16%	6 Agt 2026
CVE-2026-71327 traefik Traefik is an open source HTTP reverse proxy and load balancer. From 3.0.0 until 3.6.25 and 3.7.10, Traefik's Kubernetes Gateway API provider in pkg/provider/kubernetes/g...	8.1 High	—	0,48%	6 Agt 2026
CVE-2026-71326 traefik Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.6.25 and 3.7.10, Traefik's BasicAuth middleware in pkg/middlewares/auth/basic_auth.go...	3.8 Low	—	0,34%	6 Agt 2026
CVE-2026-71325 traefik Traefik is an open-source edge router that makes publishing services a fun and easy experience. Prior to 2.11.54, 3.6.25, and 3.7.10, cross-namespace @kubernetescrd refer...	4.4 Medium	—	0,16%	6 Agt 2026
CVE-2026-71324 traefik Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.53, 3.6.24, and 3.7.9, Traefik's default HTTP reverse proxy forwards a plain HTTP/2 or HTTP/...	9.1 Critical	—	1,1%	6 Agt 2026
CVE-2026-70640 ggml llama.cpp llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI wrapper where bench_1model() and free_1context() lack...	7.0 High	—	0,24%	6 Agt 2026
CVE-2026-70639 ggml llama.cpp llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the LLaMA-Android JNI wrapper where the bench_1model() function fails to validate...	5.5 Medium	—	0,20%	6 Agt 2026
CVE-2026-70638 ggml llama.cpp llama.cpp builds b1886 through b7445 contain an integer overflow vulnerability in the LLaMA-Android JNI wrapper where the new_1batch() function multiplies sizeof(llama_se...	7.8 High	—	0,23%	6 Agt 2026
CVE-2026-70636 flowiseai flowise Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to access the OAuth2 credential refresh endpoint by exploiting...	7.5 High	—	0,66%	6 Agt 2026
CVE-2026-70635 timescaledb TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability that allows authenticated attackers to cause query-result integrity fail...	7.1 High	—	0,44%	6 Agt 2026
CVE-2026-70634 timescaledb TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read in the Dictionary compression reverse row iterator (tsl/src/compression/algorithms/dic...	8.1 High	—	0,53%	6 Agt 2026
CVE-2026-70633 timescaledb TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability in the Gorilla compression reverse row iterator that allows authenticate...	6.5 Medium	—	0,51%	6 Agt 2026
CVE-2026-70632 ffmpeg FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote...	7.8 High	—	0,20%	6 Agt 2026
CVE-2026-70631 ffmpeg FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An a...	5.5 Medium	—	0,18%	6 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.