Katalog CVE (hal. 802)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.205 (Critical 36.640 · High 106.361 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 1 Nov 2026, 12:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 40.051–40.100 dari 266.205 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-63456 Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mecha...	9.8 Critical	—	0,80%	4 Agt 2026
CVE-2026-63455 Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mecha...	9.8 Critical	—	0,80%	4 Agt 2026
CVE-2026-58075 A vulnerability allowing an unauthenticated attacker to read arbitrary files from the host, which can be further leveraged toescalate privileges locally.	8.7 High	—	0,42%	4 Agt 2026
CVE-2026-58074 A vulnerability allowing a high-privileged user to execute arbitrary code on the server.	8.6 High	—	0,53%	4 Agt 2026
CVE-2026-58073 A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent andobtain that agent's credentials.	9.5 Critical	—	0,32%	4 Agt 2026
CVE-2026-58072 A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execution.	9.0 Critical	—	0,53%	4 Agt 2026
CVE-2026-58071 A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied appliance API asPortal Administrator during a short window af...	8.2 High	—	0,42%	4 Agt 2026
CVE-2026-58067 A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to exhaust host memory and cause adenial of service.	8.7 High	—	0,45%	4 Agt 2026
CVE-2026-56848 A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-a...	7.5 High	—	0,52%	4 Agt 2026
CVE-2026-48121 @langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0 and below are vulnerable to N...	6.7 Medium	—	0,36%	4 Agt 2026
CVE-2026-18787 A vulnerability was identified in GL.iNet AX1800 up to 4.8.3. The affected element is the function remove_rule of the file /usr/share/gl-ngx/oui-rpc.lua of the component...	8.8 High	—	3,2%	4 Agt 2026
CVE-2026-18785 A vulnerability was determined in o6 open62541 ca356b088ada7dee824d1b4acd07c1ff07ce242b. Impacted is the function UA_Client_getRemoteDataTypes of the file examples/custom...	5.3 Medium	—	0,16%	4 Agt 2026
CVE-2026-18784 A vulnerability was found in o6 open62541 up to 1.5.5. This issue affects the function UA_Client_readNodeClassAttribute of the file src/client/ua_client_highlevel.c. Perf...	5.3 Medium	—	0,17%	4 Agt 2026
CVE-2026-18775 A vulnerability has been found in NousResearch hermes-agent up to 0.16.0. This vulnerability affects the function browser_snapshot of the file tools/browser_tool.py of th...	6.3 Medium	—	0,38%	4 Agt 2026
CVE-2026-18774 A flaw has been found in NousResearch hermes-agent up to 0.16.0. This affects the function save_url_image of the file agent/image_gen_provider.py of the component xAI Ima...	6.3 Medium	—	0,35%	4 Agt 2026
CVE-2026-15920 djangoproject django An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in...	6.1 Medium	—	0,35%	4 Agt 2026
CVE-2026-15830 djangoproject django An issue was discovered in Django 6.0 before 6.0.9 and 5.2 before 5.2.18. GeoDjango's `django.contrib.gis.geos.GEOSGeometry` is subject to a potential denial-of-service w...	5.3 Medium	—	1,1%	4 Agt 2026
CVE-2026-15337 djangoproject django An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.utils.translation.check_for_language()` is subject to a potential denial-of-service atta...	5.3 Medium	—	0,59%	4 Agt 2026
CVE-2026-15314 tp-link tapo p110 firmware Tapo P110 v1 smart Wi-Fi Plug contains an improper boundary validation vulnerability in the handling of authenticated HTTP request bodies due to insufficient input valida...	7.5 High	—	0,76%	4 Agt 2026
CVE-2026-15307 djangoproject django An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing...	8.8 High	—	1,1%	4 Agt 2026
CVE-2025-29296 H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Magic NX15 V100R017, H3C Magic R1510 V100R016, H3C NE36 Pro V1...	9.8 Critical	—	2,3%	4 Agt 2026
CVE-2026-69254 flowiseai flowise Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, executeJavaScriptCode() accepted caller-provided nodeVMOptions an...	8.8 High	—	0,69%	4 Agt 2026
CVE-2026-69253 flowiseai flowise Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to version 3.1.3, several custom-tool components — AgentAsTool,...	8.8 High	—	0,66%	4 Agt 2026
CVE-2026-69252 flowiseai flowise Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feat...	8.8 High	—	0,54%	4 Agt 2026
CVE-2026-69110 OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the temp and stat...	9.1 Critical	—	0,84%	4 Agt 2026
CVE-2026-69100 LAMP Rapid Development Platform through 5.6.2, fixed in commit 84b0c27, contains a remote code execution vulnerability in GlueFactory that executes unsandboxed Groovy scr...	8.8 High	—	1,0%	4 Agt 2026
CVE-2026-69098 kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the check_connection endpoint that allows unauthenticated attackers to instantiate arbitrary...	9.8 Critical	—	0,91%	4 Agt 2026
CVE-2026-25292 qualcomm sm6225p firmware, qualcomm sm6450p firmware +58 lainnya Memory Corruption when processing untrusted user input in the fastboot command handler for audio framework configuration.	7.6 High	—	0,16%	4 Agt 2026
CVE-2026-25289 qualcomm sm7550p firmware, qualcomm sm7635p firmware +58 lainnya Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values.	9.6 Critical	—	0,19%	4 Agt 2026
CVE-2026-25288 qualcomm orne firmware, qualcomm palawan25 firmware +52 lainnya Transient DOS when processing a short target wake time channel usage response frame with insufficient packet size.	7.4 High	—	0,16%	4 Agt 2026
CVE-2026-24084 qualcomm sdx57m firmware, qualcomm sdx61 firmware +58 lainnya Weak configuration when UE does not verify the consistency of its additional security capabilities with the replayed capabilities.	7.5 High	—	0,25%	4 Agt 2026
CVE-2026-24083 qualcomm qam8295p firmware, qualcomm qca6696 firmware +1 lainnya Memory Corruption while processing IOCTL device driver requests with invalid arguments.	7.8 High	—	0,10%	4 Agt 2026
CVE-2026-24080 qualcomm qam8295p firmware, qualcomm qca6574au firmware +34 lainnya Memory Corruption when handling malformed request parameters in the fingerprint TA.	7.8 High	—	0,10%	4 Agt 2026
CVE-2026-24079 qualcomm ar8035 firmware, qualcomm csra6620 firmware +58 lainnya Cryptographic Issue while processing registration requests with malformed or missing authentication parameters.	8.1 High	—	0,21%	4 Agt 2026
CVE-2026-24078 qualcomm 5g fixed wireless access platform firmware, qualcomm ar8035 firmware +58 lainnya Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling.	6.5 Medium	—	0,17%	4 Agt 2026
CVE-2026-24077 qualcomm aqt1000 firmware, qualcomm ar8035 firmware +58 lainnya Information Disclosure when processing wireless network channel switch information with improperly formatted length fields.	6.5 Medium	—	0,17%	4 Agt 2026
CVE-2026-24076 qualcomm aqt1000 firmware, qualcomm cologne firmware +50 lainnya Memory Corruption when processing registry values with incorrect types using a direct query method.	6.7 Medium	—	0,11%	4 Agt 2026
CVE-2026-21366 qualcomm lemans au lgit firmware, qualcomm lemansau firmware +31 lainnya Memory corruption while processing a packet with a size close to the maximum allowed value.	7.8 High	—	0,10%	4 Agt 2026
CVE-2026-18801 OpenMeter contains a stored, or second-order, SQL injection vulnerability in the handling of customer usage-attribution values. An attacker who can create or update a...	9.3 Critical	—	0,39%	4 Agt 2026
CVE-2026-18773 A vulnerability was detected in NousResearch hermes-agent up to 2026.6.5. Affected by this issue is the function _check_slash_access of the file gateway/run.py of the com...	6.3 Medium	—	0,35%	4 Agt 2026
CVE-2026-10032 google a2ui/web core The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply a javascri...	6.1 Medium	—	0,13%	4 Agt 2026
CVE-2026-69251 flowiseai flowise Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise record manager and agent memory nodes allowed users to se...	8.8 High	—	2,7%	4 Agt 2026
CVE-2026-69250 flowiseai flowise Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the OAuth2 token refresh endpoint POST /api/v1/oauth2-credential/...	7.5 High	—	0,57%	4 Agt 2026
CVE-2026-68494 The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete. Thi...	8.7 High	—	0,46%	4 Agt 2026
CVE-2026-67618 marimo before 0.23.15 contains a configuration injection vulnerability that allows notebook authors to exfiltrate operator API keys by embedding a malicious base_url in P...	6.5 Medium	—	0,30%	4 Agt 2026
CVE-2026-67200 Perspective 5.0.0 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files from the server filesystem by including lit...	7.5 High	—	0,85%	4 Agt 2026
CVE-2026-67199 Perspective 5.0.0 contains a denial of service vulnerability that allows remote attackers to block the server event loop indefinitely by submitting a crafted expression c...	6.5 Medium	—	0,52%	4 Agt 2026
CVE-2026-67198 Perspective 5.0.0 contains a denial-of-service vulnerability in the VirtualServer protocol dispatcher that allows unauthenticated remote attackers to crash the server pro...	7.5 High	—	0,30%	4 Agt 2026
CVE-2026-67196 Perspective 5.0.0 contains a cross-site scripting vulnerability in the built-in Debug plugin that allows attackers to inject arbitrary HTML and JavaScript by writing tabl...	5.4 Medium	—	0,26%	4 Agt 2026
CVE-2026-67195 Perspective 5.0.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary operating system commands by submitting crafte...	8.8 High	—	1,2%	4 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.