Katalog CVE (hal. 833)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.261 (Critical 36.656 · High 106.368 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 2 Nov 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 41.601–41.650 dari 266.261 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-64685 imagemagick ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, the BGR decoder does not check for an end-of...	5.3 Medium	—	0,21%	30 Jul 2026
CVE-2026-62946 imagemagick ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to both 6.9.13-52 and 7.1.2-27, processing an extremely l...	4.7 Medium	—	0,12%	30 Jul 2026
CVE-2026-62363 imagemagick ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, a heap buffer over-write can occur in the fx...	5.0 Medium	—	0,13%	30 Jul 2026
CVE-2026-62343 imagemagick ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 6.9.13-51 and 7.0.1-0 and above prior to 7.1.2-26, an...	4.7 Medium	—	0,09%	30 Jul 2026
CVE-2026-67595 VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded in the Blade template responsible for rendering security OTP emails, allow...	8.1 High	—	0,76%	29 Jul 2026
CVE-2026-15157 nodejs undici undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before...	5.4 Medium	—	0,26%	29 Jul 2026
CVE-2026-14643 nodejs undici undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 u...	7.5 High	—	0,40%	29 Jul 2026
CVE-2025-69949 kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in check_availability.php via the parameters emailid and email.	7.3 High	—	0,21%	29 Jul 2026
CVE-2025-69945 kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /doctor/edit-patient.php?editid=1.	7.3 High	—	0,20%	29 Jul 2026
CVE-2025-69944 kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in the view-medhistory.php endpoint via the viewid parameter.	7.3 High	—	0,20%	29 Jul 2026
CVE-2025-69943 kishan0725 Hospital Management System 4.0 is vulnerale to SQL Injection in get_doctor.php via the parameters doctor and specilizationid.	9.8 Critical	—	0,34%	29 Jul 2026
CVE-2025-69942 kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /hms/doctor/view-patient.php?viewid=1.	9.8 Critical	—	0,32%	29 Jul 2026
CVE-2025-67408 Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in /save_user.php via the parameter status.	7.3 High	—	0,20%	29 Jul 2026
CVE-2025-67407 Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_student.php via parameters fname and student_class.	7.3 High	—	0,20%	29 Jul 2026
CVE-2025-67406 https://www.sourcecodester.com Advocate office management system 1.0 is affected by: SQL Injection. The impact is: execute arbitrary code (remote). The component is: cont...	7.3 High	—	0,34%	29 Jul 2026
CVE-2025-67405 Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_password.php via the parameter new_password.	7.3 High	—	0,20%	29 Jul 2026
CVE-2025-67404 Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in save_stud.php via the parameters fname, lname, and student_class.	9.8 Critical	—	0,32%	29 Jul 2026
CVE-2025-67403 Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_class.php via the parameter class_name.	9.8 Critical	—	0,32%	29 Jul 2026
CVE-2026-67439 OliveTin gives safe and simple access to predefined shell commands from a web interface. Prior to 3000.17.0, the service/internal/api/api.go StartActionAndWait and StartA...	4.3 Medium	—	0,43%	29 Jul 2026
CVE-2026-67438 OliveTin gives access to predefined shell commands from a web interface. From 3000.2.0 until 3000.17.0, the service/internal/executor/arguments.go checkShellArgumentSafet...	6.6 Medium	—	1,6%	29 Jul 2026
CVE-2026-67437 OliveTin gives access to predefined shell commands from a web interface. From 3000.0.0 until 3000.17.0, the service/internal/auth/otoauth2/restapi_auth_oauth2.go OAuth2 l...	7.5 High	—	0,64%	29 Jul 2026
CVE-2026-65975 pydantic ai Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. In versions 1.88.0 up to but not including 1.107.1 and 2.0.0b1 up to b...	6.5 Medium	—	0,33%	29 Jul 2026
CVE-2026-54249 pydantic ai Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.65.0 through 1.105.0, and 2.0.0b1 through 2.0.0b5, a client that submits me...	6.8 Medium	—	0,32%	29 Jul 2026
CVE-2026-50782 Jinher OA C6 contains an XML External Entity (XXE) injection vulnerability in the /c6/JHSoft.Web.HrmAttendance/sp_manager_getUserlist.aspx/GetXmlHttp endpoint. An unauthe...	7.5 High	—	0,59%	29 Jul 2026
CVE-2026-46678 pydantic ai Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.56.0 through 1.98.0, when an application opts a URL into force_download='al...	5.9 Medium	—	0,38%	29 Jul 2026
CVE-2026-16728 nodejs undici undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a parti...	6.5 Medium	—	0,29%	29 Jul 2026
CVE-2026-13309 Autel MaxiCharger AC Elite Home NFC Stack-based Buffer Overflow Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute...	6.8 Medium	—	0,34%	29 Jul 2026
CVE-2026-13308 Autel MaxiCharger AC Elite Home WebSockets Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on...	8.1 High	—	0,78%	29 Jul 2026
CVE-2026-13307 Autel MaxiCharger AC Elite Home USB Heap-based Buffer Overflow Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute a...	6.8 Medium	—	0,34%	29 Jul 2026
CVE-2026-13306 Autel MaxiCharger AC Elite Home USB Authentication Bypass Vulnerability. This vulnerability allows physically present attackers to bypass authentication on affected insta...	4.3 Medium	—	0,27%	29 Jul 2026
CVE-2026-13305 Autel MaxiCharger AC Elite Home Software Update Improper Verification of Cryptographic Signature Arbitrary Code Execution Vulnerability. This vulnerability allows physica...	6.4 Medium	—	0,17%	29 Jul 2026
CVE-2025-65340 kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /betweendates-detailsreports.php.	9.8 Critical	—	0,32%	29 Jul 2026
CVE-2025-65337 Sourcecodester Fantastic Blog CMS 1.0 is vulnerable to Cross Site Scripting (XSS) in pageEditMember.php via the address field.	6.1 Medium	—	0,19%	29 Jul 2026
CVE-2026-6336 gitlab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions co...	5.3 Medium	—	0,46%	29 Jul 2026
CVE-2026-6267 gitlab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions...	5.3 Medium	—	0,61%	29 Jul 2026
CVE-2026-67436 Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In 6.0.0 and earlier, the redfish-* plugins built re...	8.3 High	—	0,42%	29 Jul 2026
CVE-2026-67435 linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations. Prior to version 6.0.0, lib.url.fetch() followed cross-origin...	6.0 Medium	—	0,50%	29 Jul 2026
CVE-2026-67433 Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In version 6.0.0, the logfile check legacy database...	5.8 Medium	—	0,11%	29 Jul 2026
CVE-2026-67432 MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem rea...	7.5 High	—	0,78%	29 Jul 2026
CVE-2026-67431 MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem doe...	8.3 High	—	0,36%	29 Jul 2026
CVE-2026-6102 MSI Center NTIOLib_X64 Origin Validation Error Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected inst...	7.8 High	—	0,12%	29 Jul 2026
CVE-2026-67430 MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem doe...	5.3 Medium	—	0,37%	29 Jul 2026
CVE-2026-63119 MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StdioTransport and MCP::Client::Stdio in t...	6.2 Medium	—	0,19%	29 Jul 2026
CVE-2026-63118 MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem doe...	6.9 Medium	—	0,24%	29 Jul 2026
CVE-2026-5492 DriveLock Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations...	6.5 Medium	—	1,6%	29 Jul 2026
CVE-2026-5491 DriveLock Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations...	7.5 High	—	1,8%	29 Jul 2026
CVE-2026-5490 DriveLock SQL Injection Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of DriveLock. Auth...	8.8 High	—	0,71%	29 Jul 2026
CVE-2026-5489 DriveLock Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations...	5.3 Medium	—	1,5%	29 Jul 2026
CVE-2026-5487 DriveLock Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations...	7.5 High	—	1,8%	29 Jul 2026
CVE-2026-5057 ATEN Unizon RpcProvider Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affe...	7.5 High	—	0,74%	29 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.