Katalog CVE (hal. 806)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.209 (Critical 36.641 · High 106.361 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 1 Nov 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 40.251–40.300 dari 266.209 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-67976 The Ref::SignalGen component of fprime framework v4.2.2 does not validate the safety of user-controlled parameters, allowing attackers to cause a Denial of Service (DoS)...	7.5 High	—	0,49%	3 Agt 2026
CVE-2026-67972 An issue in the CF_CFDP_RecvMd() component of NASA cFS v7.0.1 allows attackers to contrl where received content and data is stored, possibly leading to an information dis...	7.5 High	—	0,44%	3 Agt 2026
CVE-2026-66065 Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. Versions prior to 0.42.1 have...	8.4 High	—	0,24%	3 Agt 2026
CVE-2026-52521 A SQL injection vulnerability in Z-BlogPHP 1.7.5 allows authenticated attackers to execute arbitrary SQL commands via the id parameter in the CommentBat feature.	8.1 High	—	0,40%	3 Agt 2026
CVE-2026-52520 Emlog CMS <= 2.6.14 contains a stored cross-site scripting (XSS) vulnerability in the article publishing module (/admin/article.php). A remote authenticated attacker can...	5.4 Medium	—	0,28%	3 Agt 2026
CVE-2026-52102 An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 allows attackers to execute arbitrary commands as root via injecting shel...	9.8 Critical	—	2,9%	3 Agt 2026
CVE-2026-51775 SQL injection vulnerability in Fastadmin v.1.6.1.20250430 allows an attacker to exectue arbitrary code via the application/common/controller/Backend.php component	9.8 Critical	—	0,47%	3 Agt 2026
CVE-2026-51190 The "s init" command in Serverless-Devs @serverless-devs/s <= 3.1.11 passes unsanitized user input to child_process.spawn() with shell: true. A URL ending in ".git" bypas...	9.8 Critical	—	1,9%	3 Agt 2026
CVE-2026-49132 OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary HTML or JavaScript by embedding payloa...	5.4 Medium	—	0,19%	3 Agt 2026
CVE-2026-49131 OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers with firewall rule management privileges to inject arbitra...	5.4 Medium	—	0,29%	3 Agt 2026
CVE-2026-48113 Chisel is a TCP/UDP tunnel, transported over HTTP and secured via SSH. In versions prior to 1.11.5, authenticated clients can bypass --authfile ACL restrictions and tunne...	8.5 High	—	0,39%	3 Agt 2026
CVE-2026-48063 Baileys is a cocket-based TS/JavaScript API for WhatsApp Web. In versions prior to both 6.7.22 and 7.0.0-rc12, any Baileys session can be sent a malicious payload via th...	9.3 Critical	—	0,22%	3 Agt 2026
CVE-2026-48061 Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions prior to 2.22.0, an attacker can bypass the allowed hosts validation by omitting the Ho...	5.9 Medium	—	0,38%	3 Agt 2026
CVE-2026-41447 FirmaCheck for Windows before 1.3.16 contains a DLL hijacking vulnerability that allows local attackers to execute arbitrary code by placing a crafted openssl.cnf file in...	7.8 High	—	0,17%	3 Agt 2026
CVE-2026-18738 Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that allows unauthenticated remote attackers to plant spreadsheet formulas into exported...	4.7 Medium	—	0,49%	3 Agt 2026
CVE-2026-18737 Shlink contains a blind SQL injection vulnerability that allows any authenticated API key holder to inject arbitrary SQL fragments by supplying an unvalidated direction v...	6.5 Medium	—	0,40%	3 Agt 2026
CVE-2026-18736 Shlink contains a server-side request forgery vulnerability that allows authenticated API key holders to cause the server to issue arbitrary HTTP GET requests by supplyin...	5.0 Medium	—	0,33%	3 Agt 2026
CVE-2026-18733 A prompt injection vulnerability in the shell tool in Amazon Strands Agents Tools before 0.8.0 might allow remote actors to execute arbitrary operating system commands on...	8.8 High	—	0,57%	3 Agt 2026
CVE-2026-18648 A vulnerability was detected in Blix Email Blue Mail Calendar App 2.2.305. Impacted is the function FileDirectory.getDataColumn/FileDirectory.getFileFromUri of the compon...	5.3 Medium	—	0,21%	3 Agt 2026
CVE-2026-18647 A security vulnerability has been detected in jina-ai reader up to 1574bfd380d249c86c82db4dace0d9c8fe17e2b1. This issue affects the function isValidTLD of the file /backe...	7.3 High	—	0,47%	3 Agt 2026
CVE-2026-18646 A weakness has been identified in danpros HTMLy up to 3.1.1. This vulnerability affects unknown code of the file /system/htmly.php of the component Author Name Handler. E...	5.3 Medium	—	0,77%	3 Agt 2026
CVE-2026-18645 A security flaw has been discovered in danpros HTMLy up to 3.1.1. This affects the function add_content of the file /system/admin/admin.php of the component Admin Content...	5.4 Medium	—	0,54%	3 Agt 2026
CVE-2026-69198 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on...	6.9 Medium	—	0,48%	3 Agt 2026
CVE-2026-69192 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and dec...	7.7 High	—	0,47%	3 Agt 2026
CVE-2026-69185 Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the serv...	7.5 High	—	0,63%	3 Agt 2026
CVE-2026-68981 apache nifi Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable max...	7.5 High	—	0,74%	3 Agt 2026
CVE-2026-68980 apache nifi Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset de...	9.1 Critical	—	0,48%	3 Agt 2026
CVE-2026-68979 apache nifi Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter valu...	9.8 Critical	—	0,81%	3 Agt 2026
CVE-2026-67599 ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component that allows authenticated attackers to execute arbitrary commands by submitting uns...	7.2 High	—	2,4%	3 Agt 2026
CVE-2026-67598 Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbou...	7.4 High	—	0,26%	3 Agt 2026
CVE-2026-66296 lud oaskit Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in lud oaskit allows reflected cross-site scripting via the default HTML error handler. O...	6.1 Medium	—	0,37%	3 Agt 2026
CVE-2026-62354 apache nifi Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to submit proposed Parameter values....	4.3 Medium	—	0,45%	3 Agt 2026
CVE-2026-58139 The DuckDB AWS extension for DuckDB contains a security policy bypass vulnerability that allows any database user with SQL execution permissions to extract plaintext AWS...	6.5 Medium	—	0,51%	3 Agt 2026
CVE-2026-48031 Advisory go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL. In versions prior to 2026-05-18, the JWT signing secret is hardcoded to th...	9.1 Critical	—	0,63%	3 Agt 2026
CVE-2026-47211 Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. In versions prior to 0.39.0, i...	8.4 High	—	0,19%	3 Agt 2026
CVE-2026-18655 Improper restriction of intended endpoints in the RabbitMQ broker connection tools of the Amazon MQ MCP Server (awslabs.amazon-mq-mcp-server) before 2.0.24 may allow a re...	6.5 Medium	—	0,42%	3 Agt 2026
CVE-2026-18654 amazon aws command line interface Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle atta...	6.8 Medium	—	0,46%	3 Agt 2026
CVE-2026-18644 A vulnerability was identified in danpros HTMLy up to 3.1.1. Affected by this issue is the function unlink of the file /system/htmly.php of the component Delete Username...	5.4 Medium	—	0,54%	3 Agt 2026
CVE-2026-18641 A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.13. Affected by this vulnerability is the function com.sbr.fort.f...	7.3 High	—	2,7%	3 Agt 2026
CVE-2026-18632 A security flaw has been discovered in langgenius dify up to 1.14.2. This issue affects the function jinja2.Template of the file api/core/helper/code_executor/jinja2/jinj...	6.3 Medium	—	0,39%	3 Agt 2026
CVE-2026-18631 A vulnerability was identified in jeequan jeepay up to 3.2.9. This vulnerability affects the function WebSecurityConfig of the file jeepay-manager/src/main/java/com/jeequ...	6.3 Medium	—	0,40%	3 Agt 2026
CVE-2026-59913 dell display and peripheral manager Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain a Missing Authentication for Critical Function vulnerability. A low privileged attac...	7.8 High	—	0,17%	3 Agt 2026
CVE-2026-59912 dell display and peripheral manager Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain an Improper Access Control vulnerability. A low privileged attacker with local acces...	7.8 High	—	0,15%	3 Agt 2026
CVE-2026-38447 osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current timestamp a...	9.8 Critical	—	0,67%	3 Agt 2026
CVE-2026-38446 A stored cross-site scripting (XSS) vulnerability exists in osTicket 1.18.3 due to improper sanitization of the thread entry title field. User-controlled input in the tit...	6.1 Medium	—	0,34%	3 Agt 2026
CVE-2026-38444 osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting (XSS) via the email From-header display name. The value is extracted without sanitization in include/class.m...	6.1 Medium	—	0,36%	3 Agt 2026
CVE-2026-18616 A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. The impacted element is the function server.set_peer of the file /cgi-bin/glc of the component wg-server....	9.8 Critical	—	3,6%	3 Agt 2026
CVE-2026-18615 A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5. The affected element is the function wg-server.generate_publickey of the file /cgi-bin/glc of the compone...	9.8 Critical	—	3,6%	3 Agt 2026
CVE-2026-18614 A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5. Impacted is the function s2s.enable_echo_server of the file /cgi-bin/glc of the component s2s.so Native Plugin...	9.8 Critical	—	3,6%	3 Agt 2026
CVE-2025-15631 tp-link omada fusion 2.5g firmware, tp-link omada er707-m2 firmware +58 lainnya A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing algorithm that does not provide sufficient protectio...	5.9 Medium	—	0,30%	3 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.