Katalog CVE (hal. 801)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.205 (Critical 36.640 · High 106.361 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 1 Nov 2026, 12:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 40.001–40.050 dari 266.205 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-16791 A temporary file creation vulnerability in the Linux version of Lenovo XClarity Essentials OneCLI 5.5.0 and below could allow a local low-privileged attacker to overwrite...	3.9 Low	—	0,13%	4 Agt 2026
CVE-2026-70474 flowiseai flowise Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to 3.1.3, Flowise has three OAuth2 credential endpoints that loo...	8.1 High	—	0,48%	4 Agt 2026
CVE-2026-70473 flowiseai flowise Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-history returns the entire...	8.5 High	—	0,45%	4 Agt 2026
CVE-2026-70472 flowiseai flowise Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise openai-assistants-vector-store endpoints accept a client-...	8.8 High	—	0,52%	4 Agt 2026
CVE-2026-70471 flowiseai flowise Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to 3.1.3, Flowise injects $vars into the code execution sandbox...	6.5 Medium	—	0,41%	4 Agt 2026
CVE-2026-69704 Atals-Livre contains a SQL injection vulnerability that allows attackers to manipulate database queries by passing unsanitized input through a GET parameter to the supp()...	6.5 Medium	—	0,33%	4 Agt 2026
CVE-2026-69703 Atlas-Livre contains an improper access control vulnerability in the admin controllers under Espace_admin/controleur/ that allows unauthenticated attackers to bypass sess...	9.8 Critical	—	0,59%	4 Agt 2026
CVE-2026-69702 SnailJob 1.7.0 contains a denial of service vulnerability in the FuryUtil.deserialize helper that allows authenticated attackers to crash the server by supplying a crafte...	6.5 Medium	—	0,55%	4 Agt 2026
CVE-2026-68743 fedoraproject sssd, redhat openshift container platform +1 lainnya A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the auth_token_length field against the remaining buffer size before pr...	7.1 High	—	0,13%	4 Agt 2026
CVE-2026-66300 SNOMED International Snowstorm contains a reflected XSS vulnerability within the "Web Route" redirection functionality. An attacker can inject arbitrary JavaScript which...	5.0 Medium	—	0,32%	4 Agt 2026
CVE-2026-49435 Keysight IxChariot Endpoint and associated products contain a stack-based buffer overflow. An unauthenticated remote attacker can send a specially crafted packet and exec...	9.8 Critical	—	1,4%	4 Agt 2026
CVE-2026-47781 PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during...	8.4 High	—	0,19%	4 Agt 2026
CVE-2026-47764 pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through write_to_fs. Install...	8.4 High	—	0,20%	4 Agt 2026
CVE-2026-13229 Zammad 7.1.0 contains an authenticated improper authorization vulnerability in the ticket article attachment cloning endpoint.	7.1 High	—	0,43%	4 Agt 2026
CVE-2026-0163 google android In multiple functions of vpu_ioctl.c, there is a possible use after free due to a use after free. This could lead to remote escalation of privilege with no additional exe...	9.8 Critical	—	0,38%	4 Agt 2026
CVE-2017-20242 Keysight IxChariot Endpoint before 9.5.102 contains a stack-based buffer overflow. An unauthenticated remote attacker can send a specially crafted packet to crash the end...	9.8 Critical	—	1,3%	4 Agt 2026
CVE-2017-20241 Keysight IxChariot Endpoint before 9.5.102 contains a heap-based buffer overflow. An unauthenticated remote attacker can send a specially crafted packet to crash the endp...	9.8 Critical	—	1,3%	4 Agt 2026
CVE-2026-70470 flowiseai flowise Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src...	9.8 Critical	—	0,97%	4 Agt 2026
CVE-2026-69264 flowiseai flowise Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by...	9.8 Critical	—	1,1%	4 Agt 2026
CVE-2026-47763 pdm is a Python package and dependency manager supporting the latest PEP standards. In versions prior to 2.27.0, pdm writes several project-local state or configuration f...	6.8 Medium	—	0,20%	4 Agt 2026
CVE-2026-47623 nvidia dynamo NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to...	8.2 High	—	0,69%	4 Agt 2026
CVE-2026-47622 nvidia dynamo NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause the generation of error messages that contain sensitive information. A successful exploit o...	5.3 Medium	—	0,46%	4 Agt 2026
CVE-2026-47621 nvidia dynamo NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause a race condition in the LoRA manager singleton initialization. A successful exploit of this...	6.5 Medium	—	0,42%	4 Agt 2026
CVE-2026-47620 nvidia dynamo NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause a race condition in the LoRA manager singleton initialization. A successful exploit of this...	6.5 Medium	—	0,42%	4 Agt 2026
CVE-2026-47619 nvidia dynamo NVIDIA Dynamo for Linux examples and recipes contain a vulnerability where an attacker could cause a system failure. A successful exploit of this vulnerability might lead...	8.1 High	—	0,77%	4 Agt 2026
CVE-2026-47618 nvidia dynamo NVIDIA Dynamo for Linux contains a vulnerability in the Rust multimodal media fetcher where an attacker could cause server-side request forgery. A successful exploit of t...	7.5 High	—	0,56%	4 Agt 2026
CVE-2026-47617 nvidia dynamo NVIDIA Dynamo for Linux contains a vulnerability in the multimodal media fetcher where an attacker may cause server-side request forgery via DNS rebinding. A successful e...	7.5 High	—	0,56%	4 Agt 2026
CVE-2026-47616 nvidia dynamo NVIDIA Dynamo for Linux contains a vulnerability in the multimodal media fetcher where an attacker may cause server-side request forgery. A successful exploit of this vul...	7.5 High	—	0,56%	4 Agt 2026
CVE-2026-47615 nvidia dynamo NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause server-side request forgery by supplying a crafted URL in a multimodal request. A successful...	7.5 High	—	0,56%	4 Agt 2026
CVE-2026-47614 nvidia dynamo NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause server-side request forgery. A successful exploit of this vulnerability might lead to informa...	7.5 High	—	0,56%	4 Agt 2026
CVE-2026-47613 nvidia dynamo NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause improper limitation of a pathname to a restricted directory by supplying a crafted local path...	7.5 High	—	0,56%	4 Agt 2026
CVE-2026-47612 nvidia dynamo NVIDIA Dynamo for Linux contains a vulnerability in the image loading component where an attacker may cause improper limitation of a pathname to a restricted directory. A...	7.5 High	—	0,82%	4 Agt 2026
CVE-2026-47487 nvidia triton inference server NVIDIA Triton Inference Server for Linux contains a vulnerability where a user could cause files outside the model repository to be read, written to, or modified by provi...	7.1 High	—	0,23%	4 Agt 2026
CVE-2026-24255 nvidia dynamo NVIDIA Dynamo for Linux contains a vulnerability in the multimodal embedding cache, where an attacker could cause a hash collision by submitting images that share an iden...	7.5 High	—	0,55%	4 Agt 2026
CVE-2026-24254 nvidia dynamo NVIDIA Dynamo for Linux contains a vulnerability in the multimodal serving topology, where an attacker could cause an out-of-bounds write. A successful exploit of this vu...	9.8 Critical	—	0,89%	4 Agt 2026
CVE-2026-24253 nvidia dynamo NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to denial of...	8.2 High	—	0,64%	4 Agt 2026
CVE-2026-18830 Insufficient input validation in Amazon Bedrock AgentCore harness might allow an authenticated remote user to execute configured tools bypassing model invocation and secu...	8.1 High	—	0,51%	4 Agt 2026
CVE-2026-18790 A weakness has been identified in Systerel S2OPC up to 1.7.3. This affects the function LockedStaMac_ProcessMsg_DeleteMonitoredItemsResponse of the file src/ClientServer/...	3.3 Low	—	0,16%	4 Agt 2026
CVE-2026-18788 A security flaw has been discovered in Trippo ResponsiveFilemanager up to 9.14.0. The impacted element is an unknown function of the file filemanager/dialog.php. The mani...	7.3 High	—	0,50%	4 Agt 2026
CVE-2026-69263 flowiseai flowise Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the mitigation for CVE-2025-8943 blocked -y and --yes flags on np...	9.8 Critical	—	0,66%	4 Agt 2026
CVE-2026-69262 flowiseai flowise Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, `DELETE /api/v1/chatflows/:id` authorized requests with checkAnyP...	8.1 High	—	0,52%	4 Agt 2026
CVE-2026-69259 flowiseai flowise Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the SQLite Record Manager node in packages/components/nodes/recor...	8.8 High	—	0,82%	4 Agt 2026
CVE-2026-69258 flowiseai flowise Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the unauthenticated POST /api/v1/prediction/:id endpoint accepted...	9.1 Critical	—	0,67%	4 Agt 2026
CVE-2026-69257 flowiseai flowise Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise's HTTP security module httpSecurity.ts did not normalize...	8.6 High	—	0,43%	4 Agt 2026
CVE-2026-69256 flowiseai flowise Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent node allowed users to provide Python code that is ex...	8.8 High	—	1,0%	4 Agt 2026
CVE-2026-69255 flowiseai flowise Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent in packages/components/nodes/agents/CSVAgent/CSVAgen...	8.8 High	—	0,60%	4 Agt 2026
CVE-2026-64634 A vulnerability allowing local privilege escalation to the Reporter service context.	8.4 High	—	0,15%	4 Agt 2026
CVE-2026-64633 A vulnerability allowing remote unauthenticated code execution on the agent host.	10.0 Critical	—	0,60%	4 Agt 2026
CVE-2026-64631 A vulnerability allowing a low-privileged user to inject SQL and extract database contents.	8.6 High	—	0,40%	4 Agt 2026
CVE-2026-64630 A vulnerability allowing a low-privileged user to retrieve report data outside the scope of a shared report link.	5.3 Medium	—	0,35%	4 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.