Katalog CVE (hal. 792)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.187 (Critical 36.636 · High 106.360 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 1 Nov 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 39.551–39.600 dari 266.187 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-7658 langflow IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate the username field, allowing attackers to inject path traversal sequences and bypass containment checks....	6.5 Medium	—	0,51%	5 Agt 2026
CVE-2026-70612 electronjs electron Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, requests to op...	5.4 Medium	—	0,43%	5 Agt 2026
CVE-2026-63457 hpe integrated lights-out 6 firmware A potential denial of service vulnerability exists in HPE Integrated Lights-Out 6 (iLO 6) prior to v1.78.	6.5 Medium	—	0,27%	5 Agt 2026
CVE-2026-48168 PraisonAI is a multi-agent teams system. In versions prior to 4.6.40, the bundled Claude GitHub Actions workflow is vulnerable to command injection because it embeds an a...	10.0 Critical	—	1,5%	5 Agt 2026
CVE-2026-18485 There is a local privilege escalation vulnerability recently discovered in the NI-PAL kernel driver. This may allow a local, authenticated user to escalate privileges an...	7.8 High	—	0,17%	5 Agt 2026
CVE-2026-17633 langflow IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to code injection.	8.8 High	—	0,68%	5 Agt 2026
CVE-2026-17632 langflow IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of Python code during AST-based sec...	8.8 High	—	0,88%	5 Agt 2026
CVE-2026-17624 langflow IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.1...	8.8 High	—	0,68%	5 Agt 2026
CVE-2026-10547 langflow IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate ownership in the deprecated POST /api/v1/build/{flow_id}/vertices endpoint, allowing an authenticated use...	8.1 High	—	0,41%	5 Agt 2026
CVE-2026-9081 langflow IBM Langflow OSS 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 contains a Server-Side Request Forgery (SSRF) vulnerability in the validate_model_provider_key() function...	7.1 High	—	0,31%	5 Agt 2026
CVE-2026-7657 langflow IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow server-side request forgery (SSRF) due to incomplete and ineffective SSRF protection enforcement.	6.5 Medium	—	0,38%	5 Agt 2026
CVE-2026-70611 electronjs electron Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3, the DevTools r...	6.9 Medium	—	0,19%	5 Agt 2026
CVE-2026-70610 electronjs electron Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4, objects copied...	5.4 Medium	—	0,56%	5 Agt 2026
CVE-2026-70609 electronjs electron Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, the mode optio...	5.7 Medium	—	0,53%	5 Agt 2026
CVE-2026-70608 electronjs electron Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.1, a sandboxed iframe without...	7.2 High	—	0,43%	5 Agt 2026
CVE-2026-70448 Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks when processing Ivy report files.	7.1 High	—	0,32%	5 Agt 2026
CVE-2026-70447 Missing permission checks in Jenkins AWS CodeBuild Plugin 0.59 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored...	4.3 Medium	—	0,27%	5 Agt 2026
CVE-2026-70446 Missing permission checks in Jenkins CodeSonar Plugin 3.6.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in...	4.3 Medium	—	0,27%	5 Agt 2026
CVE-2026-70445 Missing permission checks in Jenkins Sauce OnDemand Plugin 2.2.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stor...	4.3 Medium	—	0,27%	5 Agt 2026
CVE-2026-70444 A missing permission check in Jenkins Violation Comments to GitLab Plugin 2.62.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of...	4.3 Medium	—	0,30%	5 Agt 2026
CVE-2026-70443 Jenkins Horreum Plugin 0.16.162.v33b_4a_a_b_5f828 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permissi...	4.3 Medium	—	0,27%	5 Agt 2026
CVE-2026-70442 Jenkins Google Chat Notification Plugin 166.ve6b_de280f2e8 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure...	4.3 Medium	—	0,27%	5 Agt 2026
CVE-2026-70441 Jenkins Summary Display Plugin 1.15 and earlier does not escape the job name in a JavaScript context in build report pages, resulting in a stored cross-site scripting (XS...	5.4 Medium	—	0,23%	5 Agt 2026
CVE-2026-70440 Jenkins Qualys Container Scanning Connector Plugin 1.8.0.5 and earlier does not escape user-controlled field values in a JavaScript context, resulting in a stored cross-s...	5.4 Medium	—	0,23%	5 Agt 2026
CVE-2026-70439 Jenkins XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permission checks, allowing attackers lacking appropriate permissions to invoke the conversion funct...	6.5 Medium	—	0,27%	5 Agt 2026
CVE-2026-70438 A missing permission check in Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of...	4.3 Medium	—	0,27%	5 Agt 2026
CVE-2026-70437 Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfa_f0215cf5 and earlier does not use a constant-time comparison function when checking whether the provided and e...	3.7 Low	—	0,27%	5 Agt 2026
CVE-2026-70436 Jenkins External Workspace Manager Plugin 1.4.1 and earlier does not perform a permission check (1.4.0 and earlier) or performs an improper permission check (1.4.1) when...	4.3 Medium	—	0,29%	5 Agt 2026
CVE-2026-70435 A missing permission check in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using at...	4.2 Medium	—	0,19%	5 Agt 2026
CVE-2026-70434 A cross-site request forgery (CSRF) vulnerability in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers to connect to an attacker-specified URL using attacker...	4.2 Medium	—	0,11%	5 Agt 2026
CVE-2026-70433 Missing permission checks in Jenkins HCL AppScan Plugin 1.8.3 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored...	4.3 Medium	—	0,27%	5 Agt 2026
CVE-2026-70432 A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier allows attackers to execute arbitrary code in the context of...	8.8 High	—	0,30%	5 Agt 2026
CVE-2026-70431 Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier provides Groovy scripting features that do not integrate with Script Security Plugin, allowing attackers with Item...	8.8 High	—	0,64%	5 Agt 2026
CVE-2026-70430 jenkins Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, a...	2.7 Low	—	0,48%	5 Agt 2026
CVE-2026-70429 jenkins Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attackers able to create new users or...	6.5 Medium	—	0,42%	5 Agt 2026
CVE-2026-70428 jenkins Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with Item/Config...	4.3 Medium	—	0,66%	5 Agt 2026
CVE-2026-70427 jenkins Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of `.tar` and `.tar.gz` archiv...	4.3 Medium	—	0,66%	5 Agt 2026
CVE-2026-70426 In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is no...	9.0 Critical	—	0,52%	5 Agt 2026
CVE-2026-44605 A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database...	5.5 Medium	—	0,18%	5 Agt 2026
CVE-2026-17625 langflow IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.1...	8.8 High	—	0,81%	5 Agt 2026
CVE-2026-10716 Directus contains an authenticated SQL injection vulnerability in the collection creation flow when the instance uses PostgreSQL with PostGIS enabled. An administrator ca...	7.5 High	—	0,42%	5 Agt 2026
CVE-2026-10128 langflow IBM Langflow OSS 1.0.0 through 1.10.3 allows authenticated users can exploit a built-in Langflow component to read arbitrary server environment variables, exposing sensit...	6.5 Medium	—	0,26%	5 Agt 2026
CVE-2026-9077 langflow IBM Langflow OSS 1.0.0 through 1.10.3 Langflow allows remote authenticated attackers to bypass localhost-only restrictions and write arbitrary MCP server configurations t...	8.5 High	—	0,44%	5 Agt 2026
CVE-2026-8446 langflow IBM Langflow OSS 1.0.0 through 1.10.3 contain an authentication bypass vulnerability in the Model Context Protocol (MCP) composer endpoint when mcp_composer_enabled=true...	7.5 High	—	0,49%	5 Agt 2026
CVE-2026-7646 langflow IBM Langflow OSS 1.0.0 through 1.10.3 allows users to read arbitrary files from the server filesystem, including other users' uploaded documents, the JWT signing secret,...	6.5 Medium	—	0,50%	5 Agt 2026
CVE-2026-70607 electronjs electron Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, some window op...	5.3 Medium	—	0,56%	5 Agt 2026
CVE-2026-20313 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal securit...	7.7 High	—	0,42%	5 Agt 2026
CVE-2026-20312 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal securit...	8.8 High	—	0,31%	5 Agt 2026
CVE-2026-20311 A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, remote attacker with low privileges to cause a denial of serv...	6.3 Medium	—	0,25%	5 Agt 2026
CVE-2026-20310 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal securit...	9.1 Critical	—	0,59%	5 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.