Katalog CVE (hal. 800)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.205 (Critical 36.640 · High 106.361 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 1 Nov 2026, 12:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 39.951–40.000 dari 266.205 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-51144 Cross Site Scripting vulnerability in Soliton Systems MailZen Management Protal v.2.62, v.2.63 allows a remote attacker to execute arbitrary code via the Role Name, First...	6.1 Medium	—	0,36%	4 Agt 2026
CVE-2026-45103 OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the TCP message framing layer parses the Content-Length h...	7.5 High	—	0,59%	4 Agt 2026
CVE-2026-45100 OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions 3.4.0-beta through 3.6.5 and 4.0.0-beta contain a buffer overflow in the {s.b64encode} str...	9.1 Critical	—	0,83%	4 Agt 2026
CVE-2026-45084 OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions 3.4.0 through 3.6.5 contain a denial of service vulnerability in the presence module. When...	8.7 High	—	0,66%	4 Agt 2026
CVE-2026-18817 A security flaw has been discovered in Baserow up to 2.3.2. Affected by this issue is the function BaserowImpersonateAuthTokenSerializer of the file backend/src/baserow/a...	2.2 Low	—	0,32%	4 Agt 2026
CVE-2026-18816 A vulnerability was identified in Baserow up to 2.3.2. Affected by this vulnerability is the function verify of the file backend/src/baserow/api/two_factor_auth/views.py...	5.0 Medium	—	0,43%	4 Agt 2026
CVE-2026-18814 A vulnerability was found in H3C NX15 V100R017. This impacts the function reload.reload_config of the file /api/esps. The manipulation results in command injection. The a...	7.2 High	—	3,6%	4 Agt 2026
CVE-2026-70588 Ghost is a Node.js content management system. From 5.26.0 until 6.54.1, the Universal Import feature in Ghost Admin failed to properly sanitize imported content resulting...	5.0 Medium	—	0,43%	4 Agt 2026
CVE-2026-70554 MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data i...	9.8 Critical	—	1,2%	4 Agt 2026
CVE-2026-70494 openwebui open webui Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, the DELETE /api/v1/folders/{id} handler in backend/open_we...	8.1 High	—	0,55%	4 Agt 2026
CVE-2026-70493 openwebui open webui Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the built-in knowledge search path in backend/open_webui/to...	6.5 Medium	—	0,59%	4 Agt 2026
CVE-2026-70492 openwebui open webui Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, src/lib/components/chat/Messages/Markdown/KatexRenderer.sv...	5.4 Medium	—	0,40%	4 Agt 2026
CVE-2026-70491 openwebui open webui Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. In 0.10.2 and earlier, the GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/...	6.5 Medium	—	0,48%	4 Agt 2026
CVE-2026-70490 openwebui open webui Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, the terminal WebSocket route in backend/open_webui/routers/...	6.3 Medium	—	0,28%	4 Agt 2026
CVE-2026-70489 openwebui open webui Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, automation recurrence parsing in backend/open_webui/utils/a...	6.5 Medium	—	0,57%	4 Agt 2026
CVE-2026-70488 openwebui open webui Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the sync cleanup endpoint authorized write access to the kn...	4.3 Medium	—	0,37%	4 Agt 2026
CVE-2026-70487 openwebui open webui Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, inline direct model metadata accepted client-supplied knowl...	6.5 Medium	—	0,42%	4 Agt 2026
CVE-2026-67979 Incorrect access control in the Executive Services dynamic application start path component of NASA cFS v7.0.1 allows attackers to execute arbitrary code via placing a sh...	9.1 Critical	—	0,50%	4 Agt 2026
CVE-2026-66902 Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an ungated system call. The Pluggable subclass reads credentia...	9.8 Critical	—	0,70%	4 Agt 2026
CVE-2026-66901 Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON. The URLs t...	7.5 High	—	0,52%	4 Agt 2026
CVE-2026-65986 CVAT is an open source interactive video and image annotation tool for computer vision. Versions 2.5.0 through 2.66.0 contain a XSS vulnerability that can be accessed thr...	8.5 High	—	0,41%	4 Agt 2026
CVE-2026-54020 openwebui open webui Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.0, Open WebUI resolved a hostname during URL validation and rejected p...	6.3 Medium	—	0,25%	4 Agt 2026
CVE-2026-51401 vim An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vms_fixfilename() function within file vim/src/os_vms.c	7.7 High	—	0,20%	4 Agt 2026
CVE-2026-51400 vim An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vms_fixfilename() function within file vim/src/os_vms.c	8.4 High	—	0,18%	4 Agt 2026
CVE-2026-45538 OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions 4.0.0 and prior, processing a SIP message with a header name longer than 255 bytes caus...	9.8 Critical	—	0,80%	4 Agt 2026
CVE-2026-18813 A vulnerability has been found in H3C NX15 V100R017. This affects the function delete of the file /api/esps. The manipulation of the argument esps.apcm.version leads to c...	7.2 High	—	3,6%	4 Agt 2026
CVE-2026-18812 A flaw has been found in H3C NX15 V100R017. The impacted element is the function esps.ipv6.wan of the file /api/esps. Executing a manipulation of the argument workMode ca...	7.2 High	—	3,6%	4 Agt 2026
CVE-2026-18811 A vulnerability was detected in H3C NX15 V100R017. The affected element is the function Add of the file /api/esps. Performing a manipulation of the argument esps.filter.u...	7.2 High	—	3,6%	4 Agt 2026
CVE-2026-13227 An Improper Authorization vulnerability exists in ERPNext version <v16.25.0 and <15.115.0 due to insufficient access control in the whitelisted API method erpnext.crm.do...	7.1 High	—	0,31%	4 Agt 2026
CVE-2026-70553 MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers to inject arbitrary PHP code into the application configuration file by s...	9.8 Critical	—	1,3%	4 Agt 2026
CVE-2026-70552 MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in the AJAX dispatcher that allows unauthenticated attackers to access admin-gated endpoints...	9.8 Critical	—	0,83%	4 Agt 2026
CVE-2026-70486 openwebui open webui Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, the terminal file-preview serveUrl iframe branch always gra...	5.4 Medium	—	0,38%	4 Agt 2026
CVE-2026-70485 openwebui open webui Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, Open WebUI checked whether a user-supplied URL destination...	7.1 High	—	0,35%	4 Agt 2026
CVE-2026-70484 openwebui open webui Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 until 0.11.0, the legacy chat-completions features block trusted a client...	5.4 Medium	—	0,41%	4 Agt 2026
CVE-2026-70483 openwebui open webui Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, DELETE /api/v1/chats/{id} cancelled a chat's in-flight task...	4.3 Medium	—	0,46%	4 Agt 2026
CVE-2026-70482 openwebui open webui Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.0, when ENABLE_OAUTH_TOKEN_EXCHANGE=True, /oauth/{provider}/to...	8.8 High	—	0,57%	4 Agt 2026
CVE-2026-70481 openwebui open webui Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.0, the standard channel message update and delete handlers acc...	5.4 Medium	—	0,43%	4 Agt 2026
CVE-2026-70480 openwebui open webui Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.34 until 0.11.0, Open WebUI renders vega and vega-lite fenced code blocks i...	4.1 Medium	—	0,35%	4 Agt 2026
CVE-2026-70479 openwebui open webui Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, with WEB_LOADER_ENGINE=playwright, the Playwright web loade...	7.7 High	—	0,47%	4 Agt 2026
CVE-2026-70478 flowiseai flowise Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint...	10.0 Critical	—	0,62%	4 Agt 2026
CVE-2026-70477 flowiseai flowise Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, a prompt injection sent to a chatflow using a CSV Agent node can...	9.8 Critical	—	0,81%	4 Agt 2026
CVE-2026-70476 flowiseai flowise Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, several organization billing endpoints in packages/server/src/ent...	8.2 High	—	0,52%	4 Agt 2026
CVE-2026-70475 flowiseai flowise Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the PUT /api/v1/executions/:id endpoint in packages/server/src/ro...	6.5 Medium	—	0,46%	4 Agt 2026
CVE-2026-48154 GoRest is a Golang starter kit built with the Gin framework for prototyping and developing RESTful APIs. In versions prior to 1.12.2 nMemorySecret2FA contains a race cond...	5.9 Medium	—	0,40%	4 Agt 2026
CVE-2026-47682 CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.6.0 through 2.64.0, an attacker with write access to a cloud storage...	7.1 High	—	0,45%	4 Agt 2026
CVE-2026-18810 A security vulnerability has been detected in H3C NX15 V100R017. Impacted is an unknown function of the file /api/wizard/networkSetup. Such manipulation leads to missing...	7.3 High	—	0,65%	4 Agt 2026
CVE-2026-18657 amazon kiro cli An uncontrolled search path element in Kiro CLI before version 2.10.0 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a maliciously cr...	7.8 High	—	0,23%	4 Agt 2026
CVE-2026-18656 amazon kiro ide An uncontrolled search path element in Kiro IDE before version 1.0.228 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a maliciously c...	7.8 High	—	0,22%	4 Agt 2026
CVE-2026-16793 An improper neutralization of special elements used in an operating system command vulnerability was reported in Lenovo XClarity Orchestrator (LXCO) 2.2.0 that could allo...	8.8 High	—	0,52%	4 Agt 2026
CVE-2026-16792 An improper certificate validation vulnerability was reported in multiple Lenovo XClarity Orchestrator (LXCO) 2.2.0 microservices that could allow an adjacent network att...	6.1 Medium	—	0,11%	4 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.