Katalog CVE (hal. 808)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.209 (Critical 36.641 · High 106.361 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 1 Nov 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 40.351–40.400 dari 266.209 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-69089 Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark(), which passes its unsanitized $image argument to RocketTheme\Toolbox\ResourceLocator\U...	7.5 High	—	0,46%	3 Agt 2026
CVE-2026-69088 Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls (Class::method) in blueprint dynamic-field directives because Blueprint::isSaf...	8.1 High	—	0,30%	3 Agt 2026
CVE-2026-69087 The Grav form plugin (getgrav/grav-plugin-form) before 9.1.13 contains an open redirect vulnerability. Since v9.1.11, the redirect process action evaluates user-supplied...	6.5 Medium	—	0,37%	3 Agt 2026
CVE-2026-69086 SiYuan versions before v3.7.3 fail to validate the avID parameter on all code branches in attribute-view read endpoints, allowing attackers to construct traversal paths t...	7.7 High	—	0,53%	3 Agt 2026
CVE-2026-69085 SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenated directly...	10.0 Critical	—	1,4%	3 Agt 2026
CVE-2026-69084 SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle...	10.0 Critical	—	1,6%	3 Agt 2026
CVE-2026-69083 SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader t...	10.0 Critical	—	0,48%	3 Agt 2026
CVE-2026-68587 SiYuan versions before v3.7.3 contain an information disclosure vulnerability in the getHeadingDeleteTransaction, getHeadingLevelTransaction, and getHeadingInsertTransact...	8.6 High	—	0,32%	3 Agt 2026
CVE-2026-68586 SiYuan before v3.7.3 fails to apply publish-access filters to the getBacklinkDoc and getBackmentionDoc content endpoints (/api/ref/getBacklinkDoc and /api/ref/getBackment...	8.6 High	—	0,41%	3 Agt 2026
CVE-2026-68585 SiYuan versions before v3.7.3 contain a metadata disclosure vulnerability in the /api/block/getBlockInfo endpoint that returns document root metadata including title for...	5.8 Medium	—	0,24%	3 Agt 2026
CVE-2026-68584 SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returning endpoints getHeadingChildrenDOM, getHeading*Transacti...	8.6 High	—	0,54%	3 Agt 2026
CVE-2026-67608 Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an OS command injection vulnerability in action_audio.php that allows a...	7.2 High	—	2,4%	3 Agt 2026
CVE-2026-64827 Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an authentication bypass vulnerability in set_env.php where the redirec...	9.8 Critical	—	0,83%	3 Agt 2026
CVE-2026-18642 Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-o...	7.8 High	—	0,37%	3 Agt 2026
CVE-2026-18601 A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5. This impacts the function ovpn-client.check_config of the file /cgi-bin/glc of the component ovpn-client.so Na...	9.8 Critical	—	3,6%	3 Agt 2026
CVE-2026-18600 A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. This affects the function network.switch_info/network.switch_status of the file /usr/lib/oui-httpd/rpc/ne...	8.8 High	—	3,2%	3 Agt 2026
CVE-2026-18108 timlegge net Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accepts an EncryptedAssertion whose decrypted content carries no...	9.8 Critical	—	0,31%	3 Agt 2026
CVE-2026-18092 timlegge net Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because new_from_xml reads assertion identity with document-wide XPat...	8.1 High	—	0,34%	3 Agt 2026
CVE-2026-18089 timlegge net Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when no trust anc...	7.5 High	—	0,23%	3 Agt 2026
CVE-2026-56609 hcltech icontrol HCL iControl is affected by Weak SSL/TLS Version Supported vulnerability. It was observed that the application was using weak TLS versions such as TLS 1.0 and 1.1. These...	6.5 Medium	—	0,15%	3 Agt 2026
CVE-2026-56608 hcltech icontrol HCL iControl is affected by Missing Access Control vulnerability. The application failed to enforce proper granular access controls, allowing users to access or view admi...	5.3 Medium	—	0,27%	3 Agt 2026
CVE-2026-2346 Authorization bypass through User-Controlled key vulnerability in Menulux Software Inc. Mobile App allows Software Integrity Attack. This issue affects Mobile App: throu...	9.8 Critical	—	0,51%	3 Agt 2026
CVE-2026-18599 A flaw has been found in GL.iNet GL-MT3000 up to 4.4.5. The impacted element is the function logread.set_config of the file /usr/lib/oui-httpd/rpc/logread of the componen...	8.0 High	—	4,4%	3 Agt 2026
CVE-2026-18598 A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function logread.get_system_log of the file /usr/lib/oui-httpd/rpc/logread of t...	8.8 High	—	3,2%	3 Agt 2026
CVE-2026-18574 An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server (MDS) could allow an unauthenticated remote a...	9.3 Critical	—	0,89%	3 Agt 2026
CVE-2026-69082 CTI-Transmute contained a cross-site request forgery vulnerability in the administrative user deletion functionality. The /account/delete/<id> endpoint accepted HTTP GET...	8.8 High	—	0,27%	3 Agt 2026
CVE-2026-69079 CTI-Transmute contains an uncontrolled resource-consumption vulnerability in the unauthenticated /activity_timeline endpoint. The endpoint accepts a user-controlled days...	8.7 High	—	0,54%	3 Agt 2026
CVE-2026-69078 CTI-Transmute is affected by a server-side request forgery vulnerability in the evaluation report PDF-generation functionality. User-controlled CTI content, including co...	8.8 High	—	0,41%	3 Agt 2026
CVE-2026-68742 fedoraproject sssd, redhat openshift container platform +1 lainnya A flaw was found in SSSD. The sss_nss_protocol_parse_addr() function in the NSS responder does not validate the addrlen field against the remaining packet body size. A lo...	5.5 Medium	—	0,13%	3 Agt 2026
CVE-2026-33591 A vulnerability in Wapt Server before version 2.6.1.17813 allows a remote unauthenticated attacker to bypass security restriction using a specially crafted packet and re...	10.0 Critical	—	0,71%	3 Agt 2026
CVE-2026-0392 eParakstītājs 3.0 for Windows before version 1.10.0 retrieves and executes its automatic updates over a channel that is not authenticated or integrity-protected. On each...	7.3 High	—	0,09%	3 Agt 2026
CVE-2026-69075 FlowIntel is affected by a stored cross-site scripting vulnerability through multiple user-controlled or administrator-controlled fields. Persisted values—including case...	6.9 Medium	—	0,49%	3 Agt 2026
CVE-2026-63563 Sharp and Toshiba Tec MFPs (multifunction printers) for a certain market have been shipped with the user authentication feature disabled in the initial configuration. Whe...	6.5 Medium	—	0,43%	3 Agt 2026
CVE-2026-63545 Sharp and Toshiba Tec MFPs (multifunction printers) caches data internally when printing, and leave them uncleared. They may be accessed later by other users.	2.4 Low	—	0,22%	3 Agt 2026
CVE-2026-62416 Network Scanner Tool and Network Scanner Tool Lite provided by Sharp Corporation, with the initial configuration, require no authentication and accept files unlimitedly....	5.3 Medium	—	0,64%	3 Agt 2026
CVE-2026-60011 Sharp and Toshiba Tec MFPs (multifunction printers) fail to properly authorize requests to directly access certain image data stored to the affected product.	5.3 Medium	—	0,40%	3 Agt 2026
CVE-2026-8794 PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to perform use...	6.9 Medium	—	0,68%	3 Agt 2026
CVE-2026-8793 PaperCut NG/MF does not properly restrict excessive authentication attempts within its login component. An unauthenticated remote attacker can exploit this vulnerability...	6.9 Medium	—	0,68%	3 Agt 2026
CVE-2026-28147 Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Exploiting Incorrectly Configured Acce...	5.4 Medium	—	0,29%	3 Agt 2026
CVE-2026-21555 In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed	7.5 High	—	0,71%	3 Agt 2026
CVE-2026-21554 In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed	7.5 High	—	0,71%	3 Agt 2026
CVE-2026-21553 In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed	7.5 High	—	0,71%	3 Agt 2026
CVE-2026-21552 In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed	7.5 High	—	0,71%	3 Agt 2026
CVE-2026-21551 In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed	7.5 High	—	0,71%	3 Agt 2026
CVE-2026-21550 In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed	7.5 High	—	0,71%	3 Agt 2026
CVE-2026-21549 In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed	7.5 High	—	0,71%	3 Agt 2026
CVE-2026-21548 In nr modem, there is a possible improper input validation. This could lead to remote denial of service with System execution privileges needed.	7.5 High	—	0,71%	3 Agt 2026
CVE-2026-18593 A weakness has been identified in vxcontrol PentAGI up to 2.1.0. This affects an unknown part of the file backend/pkg/templates/prompts/pentester.tmpl of the component To...	5.6 Medium	—	0,42%	3 Agt 2026
CVE-2026-18592 A security flaw has been discovered in osCommerce 4.14.63493. Affected by this issue is the function EmailController of the file app/lib/backend/controllers/EmailControll...	4.7 Medium	—	0,33%	3 Agt 2026
CVE-2026-18591 A vulnerability was identified in Meesho Online Shopping App up to 20260607 on Android. Affected by this vulnerability is an unknown functionality of the component com.me...	2.1 Low	—	0,11%	3 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.