Katalog CVE (hal. 782)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.172 (Critical 36.633 · High 106.354 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 1 Nov 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 39.051–39.100 dari 266.172 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-70630 ffmpeg FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso...	5.5 Medium	—	0,18%	6 Agt 2026
CVE-2026-70629 ffmpeg FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows...	5.5 Medium	—	0,18%	6 Agt 2026
CVE-2026-70628 ffmpeg FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allow...	7.8 High	—	0,15%	6 Agt 2026
CVE-2026-70559 Dinky's SysConfigController.getAll() handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation that short-circuits the class-level @SaCheckLogin,...	7.5 High	—	0,45%	6 Agt 2026
CVE-2026-70558 Dinky's POST /download/uploadFromRsByLocal handler passes the caller-supplied path parameter directly to new File(path) and file.transferTo(dest) with no path validation....	9.8 Critical	—	0,82%	6 Agt 2026
CVE-2026-70557 diboot-core's POST /common/load-related-data endpoint resolves caller-supplied field names to any @TableField column of any entity and returns those values for all rows,...	6.5 Medium	—	0,39%	6 Agt 2026
CVE-2026-67689 SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the `field` and `order` parameters in paginated list endpoints	9.8 Critical	—	0,77%	6 Agt 2026
CVE-2026-67688 ICS-Park Smart Park Management System v2.0 contains an unrestricted file upload vulnerability in the file upload module. This allows a remote attacker to execute arbitrar...	9.8 Critical	—	0,78%	6 Agt 2026
CVE-2026-67687 Insecure Permissions vulnerability in ics-park v.2.0 allows a remote attacker to escalate privileges via the /system/role/save endpoint in RoleController.java and system/...	8.8 High	—	0,53%	6 Agt 2026
CVE-2026-67622 flowiseai flowise Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to access creden...	9.9 Critical	—	0,48%	6 Agt 2026
CVE-2026-67621 flowiseai flowise Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perform unauthorized document store operations by acce...	7.6 High	—	0,42%	6 Agt 2026
CVE-2026-67434 PHP_CodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards. Prior to versions 3.13.6 and 4.0.2, PHP_CodeSniffer contains a command in...	7.3 High	—	1,1%	6 Agt 2026
CVE-2026-67422 pymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to and including 11.0, four inline processors (caret, tilde, betterem, an...	7.5 High	—	0,61%	6 Agt 2026
CVE-2026-65400 Advisory apple macos An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe...	9.8 Critical	KEV	1,7%	6 Agt 2026
CVE-2026-64677 Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in...	5.9 Medium	—	1,0%	6 Agt 2026
CVE-2026-64665 Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, when OAuth login was enabled with a provider that does not guarantee ve...	8.1 High	—	0,54%	6 Agt 2026
CVE-2026-64664 Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could use an endpoint intended for...	4.3 Medium	—	0,34%	6 Agt 2026
CVE-2026-64663 Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, manipulating user-supplied input incorporated into Antlers templates co...	6.5 Medium	—	0,40%	6 Agt 2026
CVE-2026-64662 Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could view content from entries the...	6.5 Medium	—	0,42%	6 Agt 2026
CVE-2026-64655 GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the --signer-...	2.1 Low	—	0,34%	6 Agt 2026
CVE-2026-64654 GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed externally controlled gist, API, pull request, relea...	5.3 Medium	—	0,77%	6 Agt 2026
CVE-2026-64653 GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing UR...	5.1 Medium	—	0,51%	6 Agt 2026
CVE-2026-64652 GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain fine-grain...	3.3 Low	—	0,16%	6 Agt 2026
CVE-2026-63725 sysPass's FileBackupService::doBackupFiles() in lib/SP/Services/Backup/FileBackupService.php around line 388 builds a tar shell command by string-concatenating the backup...	7.2 High	—	0,44%	6 Agt 2026
CVE-2026-63637 Dgraph is an open source distributed GraphQL database. Prior to 25.3.8, maybeQuoteArg in graphql/resolve/query_rewriter.go passes regexp filter strings into generated DQL...	8.6 High	—	0,41%	6 Agt 2026
CVE-2026-62857 Fedify is a TypeScript library for building federated server apps powered by ActivityPub. From version 1.2.0 through the affected 1.9, 1.10, 2.0, 2.1, 2.2, and 2.3 mainte...	8.8 High	—	0,42%	6 Agt 2026
CVE-2026-61632 PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. In versions up to and including 10.21.3, the b64 extension is vulnerable to a path tra...	5.3 Medium	—	0,40%	6 Agt 2026
CVE-2026-5857 Contiki-NG's MQTT client parse_publish_vhdr() in os/net/app-layer/mqtt/mqtt.c sets topic_len_received=1 before checking topic_len against the 64-byte limit, so an over-le...	8.1 High	—	0,92%	6 Agt 2026
CVE-2026-5856 Contiki-NG's DNS/mDNS resolver skip_name() in os/services/resolv/resolv.c walks DNS wire-format name labels with no packet-boundary check, and the caller in newdata() inv...	7.1 High	—	0,29%	6 Agt 2026
CVE-2026-5855 Contiki-NG's LwM2M TLV parser lwm2m_tlv_read() in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied buffer length argument and reads up to six bytes from the inpu...	7.5 High	—	0,72%	6 Agt 2026
CVE-2026-5336 The DataPress (Dataverse Integration) WordPress plugin before 2.91 does not properly restrict access to its template rendering feature and exposes the viewing user's data...	6.8 Medium	—	0,43%	6 Agt 2026
CVE-2026-54717 Silverstripe CMS is an open source content management system. Prior to 6.2.1, page breadcrumbs in the CMS are vulnerable to cross-site scripting when viewed using the pag...	5.4 Medium	—	0,34%	6 Agt 2026
CVE-2026-53984 Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data-injection vulnerability in the Socket.IO server's database_backup event...	9.1 Critical	—	0,73%	6 Agt 2026
CVE-2026-53983 Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthe...	8.6 High	—	0,57%	6 Agt 2026
CVE-2026-50159 Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injectio...	5.3 Medium	—	0,60%	6 Agt 2026
CVE-2026-49391 Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and results...	5.1 Medium	—	0,47%	6 Agt 2026
CVE-2026-48088 OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the route `POST /api/tenants/{tenantId...	9.4 Critical	—	0,38%	6 Agt 2026
CVE-2026-48087 OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the registration handler at `POST /api...	9.8 Critical	—	0,57%	6 Agt 2026
CVE-2026-48086 OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANT_ADMIN promotes themselves to...	9.9 Critical	—	0,44%	6 Agt 2026
CVE-2026-48085 OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.1, a fully provisioned OpenReception inst...	9.8 Critical	—	0,59%	6 Agt 2026
CVE-2026-48084 OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Versions prior to 1.0.2 don't throttle failed passphrase login...	7.4 High	—	0,39%	6 Agt 2026
CVE-2026-48083 OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the `/api/log` endpoint accepts unauth...	6.5 Medium	—	0,36%	6 Agt 2026
CVE-2026-48082 OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, the bootstrap challenge endpoint at `/...	3.7 Low	—	0,39%	6 Agt 2026
CVE-2026-48081 OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANT_ADMIN can store `javascript:`...	8.1 High	—	0,24%	6 Agt 2026
CVE-2026-48080 OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the `GET /api/tenants/{id}` endpoint r...	8.0 High	—	0,47%	6 Agt 2026
CVE-2026-48079 OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, when a user navigates to the `/logout`...	7.4 High	—	0,50%	6 Agt 2026
CVE-2026-48078 OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.5, the unauthenticated `/api/tenants/{id}...	5.3 Medium	—	0,34%	6 Agt 2026
CVE-2026-48077 OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.1.0, the GET handler at `/api/tenants/{id}/...	5.3 Medium	—	0,43%	6 Agt 2026
CVE-2026-48076 OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. The new-client booking flow in versions 1.0.1 and prior consis...	6.5 Medium	—	0,33%	6 Agt 2026
CVE-2026-48075 OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.5, the `add-to-tunnel` endpoint creates a...	6.5 Medium	—	0,42%	6 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.