Katalog CVE (hal. 835)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.261 (Critical 36.656 · High 106.368 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 2 Nov 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 41.701–41.750 dari 266.261 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-54727 proot-distro is a utility for managing proot containers. Prior to version 5.1.6, proot-distro restore accepted hardlink entries whose linkname referenced another installe...	8.2 High	—	0,19%	29 Jul 2026
CVE-2026-54693 ZITADEL is an open source identity management platform. From 2.43.0 through 2.71.19, from 3.0.0 until 3.4.11, and from 4.0.0 until 4.15.1, the email and phone self-manage...	8.2 High	—	0,58%	29 Jul 2026
CVE-2026-54680 Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/lo...	9.9 Critical	—	0,79%	29 Jul 2026
CVE-2026-54574 proot-distro is a utility for managing proot containers. Prior to version 5.1.5, proot-distro install extracted plain tarball root filesystems through _extract_plain_tar(...	8.2 High	—	0,21%	29 Jul 2026
CVE-2026-52791 fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c duri...	2.0 Low	—	0,15%	29 Jul 2026
CVE-2026-20316 cisco secure firewall management center A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected de...	5.3 Medium	KEV · ransomware	35,1%	29 Jul 2026
CVE-2026-18257 Improper validity period check for root issuer certificate in CycloneCrypto cryptographic wrapper of S2OPC allows a certificate issued by this root issuer to be considere...	5.6 Medium	—	0,16%	29 Jul 2026
CVE-2026-18255 A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account tokens for repositories they are not a member of, allowing an att...	7.2 High	—	0,77%	29 Jul 2026
CVE-2026-16729 nodejs undici undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domai...	6.5 Medium	—	0,28%	29 Jul 2026
CVE-2026-15144 fastify/rate-limit @fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 client can control a large addr...	5.3 Medium	—	0,40%	29 Jul 2026
CVE-2026-13697 nodejs undici undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a...	9.1 Critical	—	0,57%	29 Jul 2026
CVE-2025-60931 An Insecure Direct Object Reference (IDOR) in the Employee Compensation View function of Infor Global HR v11.24.10.01.33 allows unauthorized attackers to arbitrarily view...	7.5 High	—	0,29%	29 Jul 2026
CVE-2026-67193 Xlight FTP Server before 3.9.5 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the server's current GetTickCount() value...	5.3 Medium	—	0,41%	29 Jul 2026
CVE-2026-67192 Xlight FTP Server before 3.9.5 contains a pre-authentication stack buffer overflow vulnerability that allows unauthenticated attackers to corrupt stack memory by sending...	8.1 High	—	1,0%	29 Jul 2026
CVE-2026-67191 Xlight FTP Server before 3.9.5 contains a pre-authentication heap buffer overflow vulnerability that allows remote unauthenticated attackers to write past the end of a he...	9.8 Critical	—	0,96%	29 Jul 2026
CVE-2026-60113 nasa ait dsn AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface before 2.2.2 contains a missing authentication vulnerability in the Space Link Extension (SLE) interface...	9.8 Critical	—	0,83%	29 Jul 2026
CVE-2026-60112 nasa ait gui AMMOS Instrument Toolkit (AIT) GUI before 2.5.1 contains a missing authentication vulnerability that allows any unauthenticated network attacker to obtain a valid session...	9.8 Critical	—	0,79%	29 Jul 2026
CVE-2026-54735 prebid server Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpo...	10.0 Critical	—	0,61%	29 Jul 2026
CVE-2026-54082 veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity v...	6.5 Medium	—	0,40%	29 Jul 2026
CVE-2026-54081 veraPDF PDF parser is a PDF parser for veraPDF. Prior to 1.30.2 and 1.31.23, veraPDF-parser contains a denial-of-service vulnerability in veraPDF-parser/src/main/java/org...	6.9 Medium	—	0,52%	29 Jul 2026
CVE-2026-54080 veraPDF PDF parser is a PDF parser for veraPDF. Prior to 1.30.2 and 1.31.23, veraPDF-parser contains a denial-of-service vulnerability in veraPDF-parser/src/main/java/org...	6.9 Medium	—	0,52%	29 Jul 2026
CVE-2026-54079 veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML...	8.7 High	—	0,56%	29 Jul 2026
CVE-2026-54078 veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity (...	8.7 High	—	0,56%	29 Jul 2026
CVE-2026-50558 Penelope Shell Handler is a post-exploitation shell handler for authorized security testing. Prior to 0.20.0, the Unix download() implementation in penelope.py used tar.e...	5.9 Medium	—	0,37%	29 Jul 2026
CVE-2026-17550 autodesk advance steel, autodesk autocad +9 lainnya A maliciously crafted DWG or DXF file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerabil...	5.5 Medium	—	0,25%	29 Jul 2026
CVE-2026-16543 Kong Operator's embedded Kong Kubernetes Ingress Controller (KIC) allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configura...	7.1 High	—	0,23%	29 Jul 2026
CVE-2026-16465 autodesk advance steel, autodesk autocad +9 lainnya A maliciously crafted DWG or DXF file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerabil...	7.1 High	—	0,26%	29 Jul 2026
CVE-2026-16463 autodesk advance steel, autodesk autocad +9 lainnya A maliciously crafted DXF file, when parsed through Autodesk AutoCAD, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to...	7.8 High	—	0,28%	29 Jul 2026
CVE-2026-15228 Kong Kubernetes Ingress Controller (KIC) allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. K...	7.1 High	—	0,23%	29 Jul 2026
CVE-2026-66724 MWDB Core versions >=2.0.0 and <2.19.0 contain a missing authorization vulnerability in the deprecated config and blob upload endpoints. These endpoints accept the undocu...	5.3 Medium	—	0,44%	29 Jul 2026
CVE-2026-66723 MWDB Core versions >=2.2.0 and <2.19.0 contain a missing authorization vulnerability in the Remote Instances proxy API. The proxy API does not verify authentication for i...	7.0 High	—	0,84%	29 Jul 2026
CVE-2026-65947 balbooa gridbox Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2	7.3 High	—	0,19%	29 Jul 2026
CVE-2026-65888 balbooa gridbox Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The socialLogin method allows actors to login as any given user on the target site.	9.8 Critical	—	0,52%	29 Jul 2026
CVE-2026-65887 balbooa gridbox Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2 - The resetPassword method allows actors to reset any user password, allowin...	9.8 Critical	—	0,52%	29 Jul 2026
CVE-2026-65886 balbooa gridbox Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2 - The photo viewer allows unauthenticated attackers to view arbitrary files.	7.5 High	—	0,55%	29 Jul 2026
CVE-2026-59247 Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the middle to substitute forged Hex package contents during dependency resolu...	7.6 High	—	0,18%	29 Jul 2026
CVE-2026-54666 swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-routes/schema-routes.ts passes OpenAPI path ke...	8.3 High	—	0,36%	29 Jul 2026
CVE-2026-54664 swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-parser/base-schema-parsers/enum.ts passes comp...	8.3 High	—	0,48%	29 Jul 2026
CVE-2026-54663 swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts warmUpRemoteSchemasCache res...	6.1 Medium	—	0,22%	29 Jul 2026
CVE-2026-54662 swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers[0].u...	8.3 High	—	0,35%	29 Jul 2026
CVE-2026-54661 swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpo...	8.3 High	—	0,48%	29 Jul 2026
CVE-2026-54660 swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts getRemoteRequestHeaders forw...	7.4 High	—	0,31%	29 Jul 2026
CVE-2026-12703 TeamViewer Full Client and Host for macOS before version 15.80 contain a business logic error that can allow an authenticated attacker to bypass a configured 2FA for Conn...	8.0 High	—	0,40%	29 Jul 2026
CVE-2026-9177 A Server-Side Template Injection (SSTI) vulnerability was identified in the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. Thi...	9.4 Critical	—	0,50%	29 Jul 2026
CVE-2026-67217 davegamble cjson cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in apply_patch() in cJSON_Utils.c. For a replace operation that is missing its value member, or...	5.3 Medium	—	0,43%	29 Jul 2026
CVE-2026-67216 davegamble cjson cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice,...	7.5 High	—	0,65%	29 Jul 2026
CVE-2026-67215 davegamble cjson cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtils_ApplyPatches() or...	7.5 High	—	0,70%	29 Jul 2026
CVE-2026-67214 nanoid project nanoid nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these fu...	7.5 High	—	0,33%	29 Jul 2026
CVE-2026-67213 nanoid project nanoid nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the intern...	7.5 High	—	0,33%	29 Jul 2026
CVE-2026-66490 balbooa gridbox Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2	6.1 Medium	—	0,27%	29 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.