Katalog CVE (hal. 819)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.229 (Critical 36.653 · High 106.363 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 2 Nov 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 40.901–40.950 dari 266.229 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-43830 A command injection vulnerability in the firmware upgrade file verification process could allow an attacker to execute arbitrary commands.	9.8 Critical	—	2,5%	31 Jul 2026
CVE-2026-43829 A stack-based buffer overflow vulnerability in the password functionality could allow an unauthenticated attacker to achieve code execution when the SafeEnhancement featu...	7.5 High	—	0,64%	31 Jul 2026
CVE-2026-18157 A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injection vulnerability in the APT bac...	7.8 High	—	0,36%	31 Jul 2026
CVE-2026-14541 Advisory google mcp toolbox for databases An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mcp-toolbox version 1.4.0. When a Google authService...	7.5 High	—	0,25%	31 Jul 2026
CVE-2026-14540 google mcp toolbox for databases A Server-Side Request Forgery (SSRF) vulnerability exists in the generic HTTP source and tool components of Google mcp-toolbox versions 0.3.0 through 1.4.0. While the too...	6.1 Medium	—	0,13%	31 Jul 2026
CVE-2026-14539 google mcp toolbox for databases An allocation of resources without limits vulnerability in the HTTP handler component of Google mcp-toolbox versions up to and including 1.4.0 allows an unauthenticated a...	7.5 High	—	0,24%	31 Jul 2026
CVE-2026-14538 google mcp toolbox for databases An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1.4.0 allows...	7.7 High	—	0,20%	31 Jul 2026
CVE-2026-14537 google mcp toolbox for databases Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0 and v1.4.0 allows an unauthenticated attacker to invoke tool...	9.8 Critical	—	0,25%	31 Jul 2026
CVE-2026-58039 A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths. This can lead to confidentiality impac...	3.3 Low	—	0,16%	31 Jul 2026
CVE-2026-66720 The GOOSE subscriber component improperly validates the UTC timestamp field in unauthenticated IEC 61850 GOOSE (EtherType 0x88B8) Layer-2 multicast messages. A speciall...	6.5 Medium	—	0,29%	30 Jul 2026
CVE-2026-66421 tugcantopaloglu openclaw agent dashboard OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in the administrator'...	9.3 Critical	—	0,63%	30 Jul 2026
CVE-2026-66420 MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated remote attackers to hijack authenticated administ...	8.8 High	—	0,22%	30 Jul 2026
CVE-2026-66369 The GOOSE parser contains an off-by-one boundary-handling flaw that can be triggered by a single unauthenticated Layer-2 multicast frame on the process bus. When specif...	6.5 Medium	—	0,29%	30 Jul 2026
CVE-2026-66364 The GOOSE payload parser contains a boundary handling flaw that can be triggered by a single unauthenticated Layer 2 multicast frame on the process bus. When processing...	6.5 Medium	—	0,29%	30 Jul 2026
CVE-2026-66360 The ISO Presentation layer contains a flaw in the handling of specific parameters during normal mode negotiation. A missing length check in the processing of the encode...	7.5 High	—	0,49%	30 Jul 2026
CVE-2026-66349 The MMS server connection handler contains a flaw in its processing of BER-encoded request data. When an MMS confirmed request PDU containing an extended BER tag is rec...	6.5 Medium	—	0,30%	30 Jul 2026
CVE-2026-65423 An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to trigger an out-of-bounds write.	8.8 High	—	0,80%	30 Jul 2026
CVE-2026-65421 The MMS BER decoder contains a flaw in decoding fixed-width BER fields (boolean/integer): an attacker-supplied length value is not validated, causing a read past the en...	6.5 Medium	—	0,29%	30 Jul 2026
CVE-2026-63550 The MMS BER decoder contains a boundary-handling flaw in the processing of certain fields within confirmed-request messages. When a crafted BER-encoded element is recei...	6.5 Medium	—	0,44%	30 Jul 2026
CVE-2026-63362 An unsigned integer underflow in the PubSub signature verification path in open62541 may allow a remote attacker to cause a denial of service via a crafted UDP packet.	5.9 Medium	—	1,8%	30 Jul 2026
CVE-2026-63035 A heap use-after-free vulnerability in the TransferSubscriptions service in open62541 may allow an authenticated attacker to cause a denial of service or potentially ex...	8.1 High	—	0,76%	30 Jul 2026
CVE-2026-63033 A crafted IEC 60870-5-104 I-frame with a declared object count exceeding what fits in the ASDU body causes InformationObject_ParseObjectAddress to read one byte past th...	6.5 Medium	—	0,46%	30 Jul 2026
CVE-2026-61893 A crafted IEC 60870-5-104 I-frame with TypeID 104 (C_TS_NA_1) and an inflated object count causes TestCommand_getFromBuffer to read one byte past the end of the heap-al...	6.5 Medium	—	0,46%	30 Jul 2026
CVE-2026-56758 The ACSE layer contains a flaw in the processing of AARQ PDUs during MMS connection establishment. When parsing certain fields within the calling AP title, an attacker...	6.5 Medium	—	0,30%	30 Jul 2026
CVE-2026-10031 SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in...	5.4 Medium	—	0,19%	30 Jul 2026
CVE-2026-68563 A flaw was found in ansible-collection-redhat-leapp. When a remediation task is executed with elevated privileges and the `leapp_old_postgresql_data` option is selected,...	5.5 Medium	—	0,11%	30 Jul 2026
CVE-2026-68562 A flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp report content can manipulate it. When an operator...	6.2 Medium	—	0,25%	30 Jul 2026
CVE-2026-64816 RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open() in lut_processing.rs. On Windows, a UNC path in lutPath causes...	6.5 Medium	—	0,45%	30 Jul 2026
CVE-2026-63559 An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to read out-of-bounds heap memory, potentially disclo...	7.5 High	—	0,70%	30 Jul 2026
CVE-2026-62845 Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, the PostgreSQL and MySQL datastore drivers build DDL statements by interpolating the user...	4.7 Medium	—	0,32%	30 Jul 2026
CVE-2026-62246 Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, Kamaji derives a TenantControlPlane datastore schema, database user, and etcd key prefix...	8.5 High	—	0,36%	30 Jul 2026
CVE-2026-5846 The affected Watchfire Controller Software contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and encrypting HT...	5.7 Medium	—	0,21%	30 Jul 2026
CVE-2026-38709 TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to conta...	9.8 Critical	—	2,8%	30 Jul 2026
CVE-2026-18064 An incomplete fix for CVE-2026-15352 in the NASA core Flight System (cFS) Health and Safety (HS) application leaves a separate NULL pointer dereference reachable in ver...	7.5 High	—	0,61%	30 Jul 2026
CVE-2026-12562 The RCU II+ and Multiload II+ are vulnerable to an unauthenticated service that exposes a debug interface granting full root-level access to the embedded system. This v...	8.8 High	—	0,46%	30 Jul 2026
CVE-2026-68503 LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn ships default C2 credentials LazyOwn and LazyOwn in payload...	9.8 Critical	—	0,75%	30 Jul 2026
CVE-2026-68502 LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn's lazyc2.py registers an unauthenticated Socket.IO input ev...	9.8 Critical	—	0,97%	30 Jul 2026
CVE-2026-68501 Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /{_locale}/thank-you PageRe...	6.5 Medium	—	0,87%	30 Jul 2026
CVE-2026-68500 Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's POST /{_locale}/update-payment...	7.5 High	—	0,68%	30 Jul 2026
CVE-2026-68499 re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can...	6.2 Medium	—	0,18%	30 Jul 2026
CVE-2026-66803 microsoft azure cosmos db Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network.	10.0 Critical	—	0,90%	30 Jul 2026
CVE-2026-66418 tugcantopaloglu openclaw agent dashboard OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script payloads b...	9.3 Critical	—	0,63%	30 Jul 2026
CVE-2026-61526 AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2, the error.message...	6.1 Medium	—	0,34%	30 Jul 2026
CVE-2026-55777 GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. Prior to 1.11, the parse_ios() function us...	5.3 Medium	—	0,45%	30 Jul 2026
CVE-2026-55768 GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. Prior to version 1.11, the built-in WebSoc...	8.7 High	—	0,47%	30 Jul 2026
CVE-2026-54715 GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. In version 1.10.2, parse_browser assumes t...	7.1 High	—	0,45%	30 Jul 2026
CVE-2026-52539 Outstatic CMS <= 2.1.9 contains a hardcoded JWT signing secret. When the OST_TOKEN_SECRET environment variable is not set, the application falls back to the default value...	9.1 Critical	—	0,53%	30 Jul 2026
CVE-2026-35847 An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrary code via the ping function of the CheckUils.php file	9.8 Critical	—	0,66%	30 Jul 2026
CVE-2025-69947 SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in customeredit.php?id=1.	9.8 Critical	—	0,32%	30 Jul 2026
CVE-2025-69941 SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in addmeasurement.php?id=1.	9.8 Critical	—	0,32%	30 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.