Katalog CVE (hal. 816)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.209 (Critical 36.641 · High 106.361 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 1 Nov 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 40.751–40.800 dari 266.209 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-18481 Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an authenticated remote user to steal session tokens and escalat...	7.3 High	—	0,51%	31 Jul 2026
CVE-2026-18321 Buffer overflow in NTPsec's Zyfer refclock allows local attacker to crash ntpd	4.7 Medium	—	0,11%	31 Jul 2026
CVE-2026-55100 hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values including name, use...	8.7 High	—	0,56%	31 Jul 2026
CVE-2026-54737 @phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep() recursively merges user-supp...	7.3 High	—	0,46%	31 Jul 2026
CVE-2026-54729 DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.5, is_url_safe can treat localhost as safe when DNS reso...	8.7 High	—	0,48%	31 Jul 2026
CVE-2026-54725 vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1.23.1, parseVaultConfig() in pkg/webhook/config.go...	9.6 Critical	—	0,45%	31 Jul 2026
CVE-2026-34497 johnsoncontrols fms employee Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Johnson Controls FM Systems Employee allows Cross-Site Scripting (XSS). Th...	5.4 Medium	—	0,23%	31 Jul 2026
CVE-2026-34495 johnsoncontrols fms employee Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls FM Systems Employee allows Stored XSS. This issue...	5.4 Medium	—	0,23%	31 Jul 2026
CVE-2026-34490 johnsoncontrols xaap Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise compromised devic...	5.5 Medium	—	0,10%	31 Jul 2026
CVE-2026-21662 johnsoncontrols fms employee Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files. This issue affects FM Systems Employe...	9.8 Critical	—	0,50%	31 Jul 2026
CVE-2026-67822 Tenda W6-S 1.0.0.4(510) contains a stack-based buffer overflow vulnerability in the /goform/wifiSSIDset endpoint. The function formwrlSSIDset uses sprintf to copy user-co...	9.8 Critical	—	0,52%	31 Jul 2026
CVE-2026-58048 Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context.	9.4 Critical	—	0,56%	31 Jul 2026
CVE-2026-58047 HTTP Smuggling in cPanel allows potential leak of credentials.	5.6 Medium	—	0,52%	31 Jul 2026
CVE-2026-54707 OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6.4, OnionSha...	5.4 Medium	—	0,40%	31 Jul 2026
CVE-2026-54706 OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6.4, OnionSha...	4.8 Medium	—	0,34%	31 Jul 2026
CVE-2026-52856 Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connecti...	7.5 High	—	0,61%	31 Jul 2026
CVE-2026-52855 Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configuration-file t...	9.9 Critical	—	0,51%	31 Jul 2026
CVE-2026-67607 LightFTP 2.3.1 contains a residual race condition vulnerability (an incomplete fix for CVE-2024-11144) in the worker_thread_cleanup() function of ftpserv.c that allows re...	5.9 Medium	—	0,40%	31 Jul 2026
CVE-2026-59232 Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM before 5.3.7 allows authenticated users holding the create or update lead permission to execute ar...	5.3 Medium	—	0,53%	31 Jul 2026
CVE-2026-59231 Server-Side Request Forgery in the PDF export component in maalfer Pentestify before 1.1.0 allows authenticated users to cause outbound HTTP GET requests from the server...	5.3 Medium	—	0,45%	31 Jul 2026
CVE-2026-56571 hcltech icontrol HCL iControl was affected by Improper Error Handling vulnerabilities. It involves Out of memory, null pointer exceptions, system call failure, database unavailable, netwo...	5.3 Medium	—	0,29%	31 Jul 2026
CVE-2026-56570 hcltech icontrol HCL iControl was affected by Auto complete Enabled vulnerabilities. It involves expose sensitive information such as: Valid usernames, Email addresses used for login, Acc...	5.3 Medium	—	0,30%	31 Jul 2026
CVE-2026-56569 hcltech icontrol HCL iControl was affected by Sensitive Data Exposure vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or applic...	3.3 Low	—	0,14%	31 Jul 2026
CVE-2026-56568 hcltech icontrol HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages vulnerabilities. It involves application displays raw server/API error me...	5.3 Medium	—	0,33%	31 Jul 2026
CVE-2026-56567 hcltech icontrol HCL iControl v4.3.0 was affected by Security Misconfiguration vulnerabilities. It involves the public exposure of internal configuration files due to improper web server...	3.3 Low	—	0,14%	31 Jul 2026
CVE-2026-52857 Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, unbounded json, yaml, and xml configuration-file par...	5.5 Medium	—	0,16%	31 Jul 2026
CVE-2026-18141 A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible (EDA). An unauthenticated remote attacker can bypass mutual Transport L...	8.2 High	—	0,43%	31 Jul 2026
CVE-2026-17566 pgadmin 4 pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line...	9.9 Critical	—	0,67%	31 Jul 2026
CVE-2026-17351 pgadmin 4 The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's execute_sql_query tool to parse, via sqlparse, as exactly one no...	9.0 Critical	—	0,48%	31 Jul 2026
CVE-2026-17350 pgadmin 4 The per-tool permission system (custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3) did not enforce its permission check consistently. In SERVER mode...	5.4 Medium	—	0,38%	31 Jul 2026
CVE-2026-17349 pgadmin 4 /misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing server, clones that server via Server....	9.6 Critical	—	0,40%	31 Jul 2026
CVE-2026-17348 pgadmin 4 In SERVER mode, pgAdmin 4 enforces authentication per route via the @pga_login_required decorator; the application's before_request hook only handles desktop-mode auto-lo...	6.5 Medium	—	0,42%	31 Jul 2026
CVE-2026-17347 pgadmin 4 The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with %u in the...	8.8 High	—	0,72%	31 Jul 2026
CVE-2026-17346 pgadmin 4 The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen COMMENT ON / pgstattuple / pgstatindex templates to it, but missed several sinks that...	8.8 High	—	0,62%	31 Jul 2026
CVE-2026-16504 Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password ("zulip"), and DISABLE_HTTPS=True.	9.8 Critical	—	0,48%	31 Jul 2026
CVE-2026-16503 Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces (0.0.0.0:5432) with a default database password se...	9.1 Critical	—	0,43%	31 Jul 2026
CVE-2026-10686 zephyrproject zephyr Zephyr's IPv6 forwarding path re-sent routed unicast packets without ever decrementing the IPv6 hop limit. Both routing branches of ipv6_route_packet() (subsys/net/ip) we...	7.5 High	—	0,52%	31 Jul 2026
CVE-2025-62347 HCL iControl was affected by Improper Input Validation vulnerability. It is vulnerable to unexpected system behavior and potential security bypasses. This was caused by a...	4.3 Medium	—	0,31%	31 Jul 2026
CVE-2026-67350 Serendipity before 2.6.1 contains an open redirect vulnerability in exit.php that allows unauthenticated attackers to redirect users to arbitrary external sites by supply...	4.3 Medium	—	0,35%	31 Jul 2026
CVE-2026-18446 openjsf fast-uri fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in pla...	7.5 High	—	0,38%	31 Jul 2026
CVE-2026-10685 zephyrproject zephyr The Zephyr Bluetooth GATT client CCC-write response handler gatt_write_ccc_rsp() in subsys/bluetooth/host/gatt.c invoked the application's params->subscribe() callback af...	7.6 High	—	0,30%	31 Jul 2026
CVE-2026-65636 Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr (Elixir.Ymlr module) allows attackers to inject arbitrary content into generated YAML document...	2.1 Low	—	0,20%	31 Jul 2026
CVE-2026-28145 Insufficient Verification of Data Authenticity vulnerability in StylemixThemes MasterStudy LMS allows Manipulating User State. This issue affects MasterStudy LMS: from n...	5.3 Medium	—	0,16%	31 Jul 2026
CVE-2026-28144 Insertion of Sensitive Information Into Sent Data vulnerability in Flipper Code WP Maps allows Retrieve Embedded Sensitive Data. This issue affects WP Maps: from n/a thr...	4.3 Medium	—	0,30%	31 Jul 2026
CVE-2026-18358 A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handl...	7.5 High	—	0,66%	31 Jul 2026
CVE-2026-17561 Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim Software, Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Code Inj...	9.8 Critical	—	0,56%	31 Jul 2026
CVE-2026-15227 Missing authorization in Checkmk <2.5.0p10, <2.4.0p35, <2.3.0p49, and 2.2.0 (EOL) allows an authenticated user lacking the "Edit foreign Reports" permission to modify rep...	5.3 Medium	—	0,35%	31 Jul 2026
CVE-2026-46594 A reflected cross-site scripting (XSS) vulnerability has been identified in the PHP Jabbers - PHP Poll Script. A malicious attacker can craft a specially crafted URL that...	5.1 Medium	—	0,55%	31 Jul 2026
CVE-2026-46593 A SQL injection vulnerability has been identified in the PHP Jabbers - PHP Poll Script. Improper neutralization of input provided by user to pjAdminPolls.controller.php e...	8.6 High	—	0,38%	31 Jul 2026
CVE-2025-67651 A Cross-Site Request Forgery (CSRF) vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attributes allows a...	6.9 Medium	—	0,22%	31 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.