Katalog CVE (hal. 796)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.205 (Critical 36.640 · High 106.361 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 1 Nov 2026, 12:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 39.751–39.800 dari 266.205 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-71247 Documenso's sign-field-with-token.ts, used by the live document-signing UI, allows a recipient with the ASSISTANT role to fetch and complete fields belonging to any later...	6.5 Medium	—	0,30%	5 Agt 2026
CVE-2026-71246 Pixelfed's SearchController (behind the auth middleware) accepts a URL via its remote-search parameters and fetches it server-side through ActivityPubFetchService, whose...	4.3 Medium	—	0,27%	5 Agt 2026
CVE-2026-71244 Paperless-ngx's MailAccountViewSet.test action, when called with an existing account's ID and a masked password field, reuses the stored password, account_type, refresh_t...	6.5 Medium	—	0,34%	5 Agt 2026
CVE-2026-71243 The backmeup npm package assembles shell command strings by directly concatenating its option values (name, source, destination, filter) - e.g. cmd = "mkdir -p " + path.j...	8.8 High	—	0,52%	5 Agt 2026
CVE-2026-71242 Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and other sibling...	8.3 High	—	0,37%	5 Agt 2026
CVE-2026-71241 Book-Management-System's Flask API endpoints /student, /record, /books, /find_stu_book, and /find_not_return_book are missing the @login_required decorator that protects...	7.5 High	—	0,49%	5 Agt 2026
CVE-2026-71240 DjangoCRM's toggle_default_sorting view is the only route in common/urls.py that is not wrapped in login_required or staff_member_required, and it redirects to a caller-s...	4.3 Medium	—	0,33%	5 Agt 2026
CVE-2026-71239 DjangoCRM's massmail module renders user-controlled EmlMessage fields (subject, content) through Django's Template constructor with no sanitization, in at least three loc...	8.1 High	—	0,39%	5 Agt 2026
CVE-2026-71238 DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used fo...	9.1 Critical	—	0,44%	5 Agt 2026
CVE-2026-71237 Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from ['pwd'] with no sanitization and concatenates it into a raw SQL stri...	9.8 Critical	—	0,78%	5 Agt 2026
CVE-2026-71236 Grocy's API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies incoming field values with HTMLPurifier, then manually r...	8.7 High	—	0,35%	5 Agt 2026
CVE-2026-71235 Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Lua script engine...	8.8 High	—	0,52%	5 Agt 2026
CVE-2026-71234 Documize Community's attachment download route (domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware) accepts a query parame...	7.5 High	—	0,39%	5 Agt 2026
CVE-2026-71233 InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive {!! ->terms !!} (resources/views/portal...	8.7 High	—	0,35%	5 Agt 2026
CVE-2026-71232 MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist o...	7.2 High	—	0,54%	5 Agt 2026
CVE-2026-71231 IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT * FROM users WHERE ID='<decoded lastLogin cookie>' after base64-decoding the cl...	9.8 Critical	—	0,67%	5 Agt 2026
CVE-2026-66747 Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/...	9.8 Critical	—	0,79%	5 Agt 2026
CVE-2026-60009 eclipse theia In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled deployment. The handler takes...	8.8 High	—	0,44%	5 Agt 2026
CVE-2026-17578 Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation before reaching NIST SP 800-38D recommended usage limit for AES-GCM encryption keys...	2.3 Low	—	0,24%	5 Agt 2026
CVE-2026-14574 eclipse theia In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge` function in `@theia/core` recursively merges preference values without rejectin...	6.5 Medium	—	0,40%	5 Agt 2026
CVE-2026-14304 eclipse accessibility tools framework, soumu michecker In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 and ACTF based application miChecker versions up to 3...	5.5 Medium	—	0,23%	5 Agt 2026
CVE-2026-12609 eclipse theia In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/hostedPlugin/:pluginId/:path(*)` HTTP endpoint, which resolv...	7.5 High	—	1,6%	5 Agt 2026
CVE-2026-44945 A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user with the default user...	9.1 Critical	—	0,56%	5 Agt 2026
CVE-2026-25703 NeuVector through 5.4.9 is can potentially leak information from manager /network/graph API due to missing authentication and cached data containing sensitive information...	7.3 High	—	0,80%	5 Agt 2026
CVE-2026-15452 The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI Query String in all ve...	4.7 Medium	—	0,39%	5 Agt 2026
CVE-2026-0931 Denial-of-service vulnerability in M-Files Server versions before 26.5.16015.3 allows an authenticated admin user to cause the M-Files Server process to crash and fail to...	6.9 Medium	—	0,41%	5 Agt 2026
CVE-2026-8029 The ZTE Smart Life app contains an SQL injection vulnerability that allows attackers to execute UNION SELECT statements to query sensitive data in the feedback.db databas...	3.9 Low	—	0,21%	5 Agt 2026
CVE-2026-10090 A flaw was found in the Application Subscription controller (multicluster-operators-subscription) of Red Hat Advanced Cluster Management for Kubernetes (ACM). A user with...	9.0 Critical	—	0,58%	5 Agt 2026
CVE-2026-10059 A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerabili...	9.1 Critical	—	0,64%	5 Agt 2026
CVE-2026-7726 The Layouts for WPBakery plugin for WordPress is vulnerable to unauthorized actions due to a missing capability check on the `Layouts_WPB_Remote::template_sync()` callbac...	6.5 Medium	—	0,47%	5 Agt 2026
CVE-2026-7693 The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 2.1.5.1 due to insufficient sanitization of the `fil...	7.2 High	—	3,0%	5 Agt 2026
CVE-2026-7520 The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `sign_in()` and `sign_up...	8.1 High	—	0,49%	5 Agt 2026
CVE-2026-7444 The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.16. This is due to missing or incor...	8.1 High	—	0,27%	5 Agt 2026
CVE-2026-7441 The Simple Yearly Archive plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `posttype` attribute of the `SimpleYearlyArchive` shortcode in all ver...	6.4 Medium	—	0,35%	5 Agt 2026
CVE-2026-7105 The Xpro Addons plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check on the `get_menu_content_editor()` function in all v...	4.3 Medium	—	0,35%	5 Agt 2026
CVE-2026-71215 art-template's sub-template resolution logic (src/compile/adapter/resolve-filename.js), used by both the include and extend template directives, resolves the target file...	7.5 High	—	0,56%	5 Agt 2026
CVE-2026-71214 The Aerie/PlanDev sequencing-server's authorization middleware (sequencing-server/src/app.ts) derives the caller's Hasura session role via getHasuraSession, which prefers...	9.8 Critical	—	0,48%	5 Agt 2026
CVE-2026-71213 Typemill's login endpoint (POST /tm/login, ControllerWebAuth::login) performs no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled, whic...	9.1 Critical	—	0,45%	5 Agt 2026
CVE-2026-71212 xidown (a yt-dlp/ffmpeg GUI wrapper) builds its yt-dlp command-line invocation (xidown/core/scanner.py and downloader.py) by appending the user-provided or scanned URL as...	4.4 Medium	—	0,16%	5 Agt 2026
CVE-2026-71211 MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _create_gateway_secret) with no validation of scheme,...	7.1 High	—	0,29%	5 Agt 2026
CVE-2026-71210 Mealie's AsyncSafeTransport SSRF guard (mealie/pkgs/safehttp/transport.py) resolves a target hostname once, checks the resolved IP against private-range rules, but then i...	5.3 Medium	—	0,23%	5 Agt 2026
CVE-2026-71209 audiobookshelf's authentication-exemption check (server/routers/Auth.js) matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /item...	7.5 High	—	2,2%	5 Agt 2026
CVE-2026-71208 KubeSphere's cluster-controller reconciliation (pkg/utils/clusterclient/clusterclient.go, addCluster) processes every Cluster custom resource's connection configuration a...	6.5 Medium	—	0,35%	5 Agt 2026
CVE-2026-71207 The Stock-Inventory-Management-System application's login.php assigns raw username/password values to and builds its authentication query by directly concatenating those...	9.8 Critical	—	0,71%	5 Agt 2026
CVE-2026-71206 Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetchi...	8.3 High	—	0,37%	5 Agt 2026
CVE-2026-71205 changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt count...	6.5 Medium	—	0,27%	5 Agt 2026
CVE-2026-71204 changedetection.io's /settings save handler builds an update dict from form.data['application'] and blind-merges it into the stored application settings via .update.	6.2 Medium	—	0,32%	5 Agt 2026
CVE-2026-71203 changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource registered at /...	5.3 Medium	—	0,31%	5 Agt 2026
CVE-2026-71202 The raster Rust crate's crop function (src/editor.rs) clamps the crop width/height against source dimensions but only clamps the offset_x/offset_y parameters against 0, n...	7.5 High	—	0,46%	5 Agt 2026
CVE-2026-70378 imagecli's pipeline operation (Carve::apply in src/image_ops.rs) only asserts , never validating that the ratio is positive. A negative ratio (e.g. -5) causes the compute...	7.5 High	—	0,33%	5 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.