Katalog CVE (hal. 805)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.205 (Critical 36.640 · High 106.361 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 1 Nov 2026, 12:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 40.201–40.250 dari 266.205 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-66314 microsoft edge chromium Time-of-check time-of-use (toctou) race condition in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.	5.3 Medium	—	0,57%	4 Agt 2026
CVE-2026-66313 microsoft edge chromium Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering locally.	6.8 Medium	—	0,23%	4 Agt 2026
CVE-2026-66312 microsoft edge chromium Buffer over-read in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.	8.8 High	—	1,1%	4 Agt 2026
CVE-2026-66311 microsoft edge chromium Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering locally.	6.2 Medium	—	0,41%	4 Agt 2026
CVE-2026-66310 microsoft edge External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.	7.1 High	—	0,36%	4 Agt 2026
CVE-2026-65804 microsoft edge chromium Improper control of generation of code ('code injection') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.	6.1 Medium	—	0,41%	4 Agt 2026
CVE-2026-65802 microsoft edge chromium External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network.	7.4 High	—	0,92%	4 Agt 2026
CVE-2026-62870 microsoft 365 apps, microsoft excel +3 lainnya Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.	8.8 High	—	0,82%	4 Agt 2026
CVE-2026-18686 A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function nas-web.add_user of the file /cgi-bin/glc of the component nas-web RPC...	9.8 Critical	—	4,7%	4 Agt 2026
CVE-2026-18685 A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Impacted is the function set_upgrade of the file /cgi-bin/glc of the component modem.so. Such...	9.8 Critical	—	3,6%	4 Agt 2026
CVE-2026-11836 Insufficient verification of data authenticity in Caliptra Core ROM and Core Firmware (validate_debug_unlock_token()) in subsystem mode allows an attacker with access to...	1.8 Low	—	0,11%	4 Agt 2026
CVE-2026-11835 Time-of-check time-of-use (TOCTOU) vulnerability combined with missing input validation in Caliptra Core ROM (UpdateResetFlow::run()) in subsystem mode allows a compromis...	5.7 Medium	—	0,11%	4 Agt 2026
CVE-2026-67978 An issue in the SBN UDP interface of NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via transmitting a crafted SBN frame.	7.5 High	—	0,32%	3 Agt 2026
CVE-2026-67673 A stack-based buffer overflow vulnerability exists in the cmd_edl function of OreSat Firmware v1.0. The vulnerability is triggered when processing the edl fw_flash comman...	4.6 Medium	—	0,22%	3 Agt 2026
CVE-2026-48399 adobe campaign Adobe Campaign Classic (ACC) is affected by a Violation of Secure Design Principles vulnerability that could result in a Security feature bypass. An attacker could levera...	7.5 High	—	0,87%	3 Agt 2026
CVE-2026-48333 adobe campaign Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could exploit this vulnerabili...	9.8 Critical	—	0,95%	3 Agt 2026
CVE-2026-48331 adobe campaign Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does...	10.0 Critical	—	0,95%	3 Agt 2026
CVE-2026-48330 adobe campaign Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arb...	10.0 Critical	—	1,0%	3 Agt 2026
CVE-2026-48326 adobe campaign Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arb...	9.9 Critical	—	0,97%	3 Agt 2026
CVE-2026-48323 adobe campaign Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code exe...	10.0 Critical	—	1,4%	3 Agt 2026
CVE-2026-48317 adobe campaign Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability that could result in a...	9.6 Critical	—	0,94%	3 Agt 2026
CVE-2026-18684 A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. This issue affects the function remove_profile of the file /cgi-bin/glc of the component modem.so. This m...	9.8 Critical	—	3,6%	3 Agt 2026
CVE-2026-18667 A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code with elevated privileges by inducing an operator to connect the sensor to an attacker-con...	9.6 Critical	—	0,72%	3 Agt 2026
CVE-2026-69249 python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 42.0.0 through 48.0.0, when resolving invalid c...	8.7 High	—	0,26%	3 Agt 2026
CVE-2026-69248 cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 45.0.0 through 48.0.0, if an intermediate constrained...	6.9 Medium	—	0,24%	3 Agt 2026
CVE-2026-69247 cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7_decrypt_der, pkcs7_decrypt_pem, an...	8.2 High	—	0,27%	3 Agt 2026
CVE-2026-67977 An integer overflow in the Svc::FileDownlink::SendPartial component of fprime framework v4.2.2 allows attackers to cause a Denial of Service (DoS) via a crafted input.	7.5 High	—	0,49%	3 Agt 2026
CVE-2026-67975 Incorrect access control in NASA cFS v7.0.1 allows attackers to arbitrarily remove low-index subscriptions and add new streams via sending TO_LAB add/remove subscription...	7.5 High	—	0,36%	3 Agt 2026
CVE-2026-67974 A parser boundary flaw in the Software Bus Network (SBN) application's peer subscription message handling in NASA cFS v7.0.1 allows attackers to cause a Denial of Service...	7.5 High	—	0,53%	3 Agt 2026
CVE-2026-67973 An issue in the CFDP receive path of NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via replaying final CFDP PDUs.	7.5 High	—	0,34%	3 Agt 2026
CVE-2026-67970 Incorrect access control in the DS_SetDestPathCmd() component of NASA cFS v7.0.1 allows attackers to access sensitive components via a path traversal.	7.5 High	—	0,39%	3 Agt 2026
CVE-2026-67969 An issue in the HS_MonitorApplications() component of NASA cFS v7.0.1 allows attackers to force the processor to reset via supplying a crafted HS.AppMon_Tbl entry.	7.5 High	—	0,38%	3 Agt 2026
CVE-2026-67617 Microweber CMS through 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system that allows admin-authenticated attackers to inject arbit...	4.8 Medium	—	0,27%	3 Agt 2026
CVE-2026-67616 Camaleon CMS through 2.9.2, fixed in commit 88ab703, contains a missing authorization vulnerability on the drafts endpoint that allows any authenticated low-privileged us...	4.3 Medium	—	0,44%	3 Agt 2026
CVE-2026-48115 Misskey is an open source, federated social media platform. All Misskey servers running versions 2024.5.0 and later, but prior to 2026.5.4, contain a vulnerability in the...	6.3 Medium	—	0,42%	3 Agt 2026
CVE-2026-47746 Misskey is an open source, federated social media platform. Versions 12.37.0 and later, but prior to 2026.5.4, are vulnerable to timing attacks during JSON-LD signature v...	8.9 High	—	0,28%	3 Agt 2026
CVE-2026-46714 Misskey is an open source, federated social media platform. IVersions 8.63.0 and later, but prior to 2026.5.4, contain a vulnerability that can cause the Misskey web clie...	5.1 Medium	—	0,45%	3 Agt 2026
CVE-2026-46713 Misskey is an open source, federated social media platform. Versions 12.37.0 and later, but prior to 2026.5.4, contain a vulnerability in the JSON-LD signature validation...	9.2 Critical	—	0,28%	3 Agt 2026
CVE-2026-46712 Misskey is an open source, federated social media platform. Versions 2025.3.2 and later, but prior to 2026.5.4, contain a vulnerability where a lack of proper permission...	2.3 Low	—	0,36%	3 Agt 2026
CVE-2026-18682 A security flaw has been discovered in OpenAkita up to 1.27.12. This vulnerability affects unknown code of the file /api/upload of the component File Upload API. The mani...	3.1 Low	—	0,39%	3 Agt 2026
CVE-2026-10849 zephyrproject zephyr The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response from the update server into a heap buffer in response_json_cb() (subs...	7.5 High	—	0,51%	3 Agt 2026
CVE-2026-69246 Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL han...	7.2 High	—	0,37%	3 Agt 2026
CVE-2026-69245 Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, SetCookie::matchesDomain() gives every subdomain of a cookie Domain that cookie unless SetCookie::matc...	6.5 Medium	—	0,20%	3 Agt 2026
CVE-2026-69244 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while bui...	7.1 High	—	0,53%	3 Agt 2026
CVE-2026-69243 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating t...	6.3 Medium	—	0,44%	3 Agt 2026
CVE-2026-69240 Advisory Sequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dialect is set to oracle. The escape function defined in sql-string.js do...	9.8 Critical	—	0,54%	3 Agt 2026
CVE-2026-67976 The Ref::SignalGen component of fprime framework v4.2.2 does not validate the safety of user-controlled parameters, allowing attackers to cause a Denial of Service (DoS)...	7.5 High	—	0,49%	3 Agt 2026
CVE-2026-67972 An issue in the CF_CFDP_RecvMd() component of NASA cFS v7.0.1 allows attackers to contrl where received content and data is stored, possibly leading to an information dis...	7.5 High	—	0,44%	3 Agt 2026
CVE-2026-66065 Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. Versions prior to 0.42.1 have...	8.4 High	—	0,24%	3 Agt 2026
CVE-2026-52521 A SQL injection vulnerability in Z-BlogPHP 1.7.5 allows authenticated attackers to execute arbitrary SQL commands via the id parameter in the CommentBat feature.	8.1 High	—	0,40%	3 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.