Katalog CVE (hal. 791)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.187 (Critical 36.636 · High 106.360 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 1 Nov 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 39.501–39.550 dari 266.187 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-19023 Untrusted pointer dereference in the render_bin_output function in the h5dump tool in HDF5 before 2.3.0 allows attackers to cause a denial of service via a variable-lengt...	6.8 Medium	—	0,17%	5 Agt 2026
CVE-2026-71321 Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, the internal island renderer endpoint `/__nuxt_island/...` decodes and ha...	7.5 High	—	0,74%	5 Agt 2026
CVE-2026-71320 Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /__nuxt_island/ props into...	8.1 High	—	0,71%	5 Agt 2026
CVE-2026-71319 Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools (development mode only) exposes a bidirectional RPC channel over the Vite HMR W...	9.6 Critical	—	0,63%	5 Agt 2026
CVE-2026-71318 Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an attacker can supply a top-level `as` prop to the /__nuxt_island/ endpo...	4.8 Medium	—	0,32%	5 Agt 2026
CVE-2026-71316 Nuxt is an open-source web development framework for Vue.js. From 4.4.0 until 4.5.1, runtime cache:nuxt:payload entries for /<page>/_payload.json can be returned before r...	7.5 High	—	0,51%	5 Agt 2026
CVE-2026-67865 S2OPC 1.7.3 contains an out-of-bounds read in RepublishResponse handling. This allows a remote attacker to cause a denial of service	7.5 High	—	0,76%	5 Agt 2026
CVE-2026-67864 An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via the NodeManagement type-instantiation logic component	7.5 High	—	0,76%	5 Agt 2026
CVE-2025-63823 My Safetipin Android Application 5.2.1 contains Hardcoded credentials in the authentication module, which allows remote attackers to bypass authentication and gain unauth...	9.8 Critical	—	0,81%	5 Agt 2026
CVE-2025-63822 SirenGPS Android Application 2.19.44 is vulnerable to Incorrect Access Control. An authenticated attacker can manipulate user identifier parameters to bypass authorizatio...	8.1 High	—	0,39%	5 Agt 2026
CVE-2026-71315 Nuxt is an open-source web development framework for Vue.js. From 3.21.7 until 3.21.10 and 4.5.1, mixed-case routeRules keys can fail to match case-folded lookups when ro...	8.2 High	—	0,47%	5 Agt 2026
CVE-2026-71314 Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an unauthenticated attacker can use a server island v-for prop, including...	7.5 High	—	0,91%	5 Agt 2026
CVE-2026-71313 rclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in backend/loc...	6.9 Medium	—	0,30%	5 Agt 2026
CVE-2026-71312 rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into...	8.0 High	—	0,49%	5 Agt 2026
CVE-2026-71311 rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encodin...	6.4 Medium	—	0,39%	5 Agt 2026
CVE-2026-71310 rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, the shared HTTP CONNECT helper in lib/proxy...	5.9 Medium	—	0,61%	5 Agt 2026
CVE-2026-71309 rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic does not corre...	8.6 High	—	0,46%	5 Agt 2026
CVE-2026-34966 Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operati...	7.6 High	—	0,39%	5 Agt 2026
CVE-2026-18959 A flaw has been found in yushine InnoShop up to 0.8.2. Affected by this issue is the function FileManagerController::destroyFiles of the file innopacks/restapi/routes/pan...	5.4 Medium	—	0,54%	5 Agt 2026
CVE-2026-18839 An integer underflow was found in the popt library when formatting help text for option tables that exceed the terminal width. A local user who can cause an application t...	2.2 Low	—	0,13%	5 Agt 2026
CVE-2026-18411 The KARR Security System and SWDS dealer-installed automotive anti-theft systems use a shared Bluetooth authentication key across affected devices. An attacker within Blu...	8.1 High	—	0,34%	5 Agt 2026
CVE-2026-17583 thermofisher abi prism 310 data collection software, thermofisher abi prism 3100/3100-avant data collection software +6 lainnya The affected Thermo Fisher Applied Biosystems Genetic Analyzers are vulnerable because .fsa/.hid output files can be edited. An attacker could tamper with these files, a...	8.4 High	—	0,14%	5 Agt 2026
CVE-2026-15996 github enterprise server A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause excessive CPU consumption and exhaust the p...	7.5 High	—	0,77%	5 Agt 2026
CVE-2026-70618 Spacebar Server before commit 51da17c contains a missing authorization vulnerability that allows any authenticated user to enumerate complete guild membership by querying...	4.3 Medium	—	0,33%	5 Agt 2026
CVE-2026-70617 Spacebar Server before commit dcfd910 contains a missing authorization vulnerability that allows any authenticated attacker to add themselves to arbitrary group DM channe...	8.1 High	—	0,41%	5 Agt 2026
CVE-2026-70616 boringproxy through 0.10.0 contains a resource exhaustion vulnerability that allows any authenticated user to permanently exhaust server file descriptors, goroutines, and...	6.5 Medium	—	0,34%	5 Agt 2026
CVE-2026-70615 boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users with tunnel-creation permission to inject arbitrary l...	9.9 Critical	—	0,35%	5 Agt 2026
CVE-2026-69111 Milvus through 2.6.22 and 3.0.0 contains an unauthenticated denial of service vulnerability that allows remote attackers to terminate service components by sending a craf...	7.5 High	—	1,1%	5 Agt 2026
CVE-2026-68746 livebook Not Failing Securely ('Failing Open') vulnerability in livebook-dev livebook allows an unauthenticated network client to obtain full access to a Livebook server that enfo...	8.8 High	—	0,80%	5 Agt 2026
CVE-2026-66885 livebook Cross-Site Request Forgery (CSRF) vulnerability in livebook-dev livebook allows an attacker to authenticate a victim's browser session under the attacker's own Livebook T...	6.5 Medium	—	0,24%	5 Agt 2026
CVE-2026-66881 livebook Relative Path Traversal vulnerability in livebook-dev livebook allows an attacker-authored notebook to write a file with attacker-controlled content to an arbitrary path....	8.1 High	—	0,61%	5 Agt 2026
CVE-2026-66298 livebook Origin Validation Error vulnerability in livebook-dev livebook allows untrusted notebook output JavaScript to trigger session-wide keyboard shortcuts, including forced ev...	8.8 High	—	0,27%	5 Agt 2026
CVE-2026-66297 livebook Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) vulnerability in livebook-dev livebook allows command injection into generated de...	8.0 High	—	2,4%	5 Agt 2026
CVE-2026-55524 PraisonAI is a multi-agent teams system. In versions prior to 1.6.58, the web_crawl tool performs its SSRF check only on the initially supplied URL, allowing the protecti...	7.5 High	—	0,24%	5 Agt 2026
CVE-2026-55523 PraisonAI is a multi-agent teams system. In versions 1.5.128 through 1.6.57, the praisonaiagents.tools.web_crawl_tools.web_crawl() function is vulnerable to server-side r...	7.7 High	—	0,47%	5 Agt 2026
CVE-2026-55522 PraisonAI is a multi-agent teams system. In versions 3.9.26 through 4.6.57 of praiseonai and 0.12.12 through 1.6.57 of praiseonaiagents, the workflow "include" feature is...	7.8 High	—	0,22%	5 Agt 2026
CVE-2026-21766 The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials. Under certain very specific use cases and specifi...	5.4 Medium	—	0,30%	5 Agt 2026
CVE-2026-18958 A vulnerability was detected in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191def/a8d43a29aaf267e7ca97171d6dbb44057bcd7f8c. Affected by th...	7.3 High	—	0,41%	5 Agt 2026
CVE-2026-18954 amazon documentdb mcp server Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server before 1.0.12 might allow an authenticated MCP client to perform inappro...	5.5 Medium	—	0,16%	5 Agt 2026
CVE-2026-18953 amazon aws transform mcp server Improper limitation of a pathname to a restricted directory in the get_resource tool in Amazon awslabs.aws-transform-mcp-server 0.1.0 through 0.1.4 might allow a context-...	8.8 High	—	0,18%	5 Agt 2026
CVE-2026-17556 github enterprise server A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete arbitrary files and directories on the instan...	9.1 Critical	—	0,81%	5 Agt 2026
CVE-2026-9205 langflow IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensure_fernet_key() function.	9.8 Critical	—	0,30%	5 Agt 2026
CVE-2026-9201 langflow IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute arbitrary code due to a cryptographic weakness in the custom component validation m...	8.8 High	—	0,38%	5 Agt 2026
CVE-2026-9196 langflow IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant validation due to improper handling of LLM...	8.8 High	—	0,53%	5 Agt 2026
CVE-2026-9130 langflow IBM Langflow OSS 1.0.0 through 1.10.3 contain an authorization bypass vulnerability in the MemoryComponent that allows authenticated users to access chat history of other...	7.1 High	—	0,30%	5 Agt 2026
CVE-2026-8478 langflow IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code.	8.8 High	—	0,63%	5 Agt 2026
CVE-2026-8470 langflow IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fe...	9.1 Critical	—	0,11%	5 Agt 2026
CVE-2026-8183 langflow IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remo...	7.7 High	—	0,56%	5 Agt 2026
CVE-2026-8182 langflow IBM Langflow OSS 1.0.0 through 1.10.3 installations allow anyone on the internet to execute arbitrary code on the server without any credentials via 2 HTTP requests.	8.8 High	—	0,65%	5 Agt 2026
CVE-2026-7869 langflow IBM Langflow OSS 1.0.0 through 1.10.3 is vulnerable to Path Traversal in the Knowledge Bases API (`POST /api/v1/knowledge_bases`). This occurs because user-supplied knowl...	5.4 Medium	—	0,32%	5 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.