Katalog CVE (hal. 841)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.301 (Critical 36.664 · High 106.384 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 2 Nov 2026, 12:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 42.001–42.050 dari 266.301 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-48058 nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/web/session.go and internal/web/oidc.go set Htt...	4.6 Medium	—	0,25%	28 Jul 2026
CVE-2026-47768 nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, newly-minted operator API key exposed in redirect URL (R...	5.5 Medium	—	0,15%	28 Jul 2026
CVE-2026-47726 nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/api/audit.go:12 — handleGetAuditLog does no adm...	7.1 High	—	0,30%	28 Jul 2026
CVE-2026-47725 nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.3, every /ui/* POST / PUT / PATCH / DELETE route processes...	6.9 Medium	—	0,19%	28 Jul 2026
CVE-2026-18107 A flaw was found in CRIU's handling of restartable sequences (rseq) during checkpoint/restore. A malicious process inside a container can register an rseq critical sectio...	7.8 High	—	0,15%	28 Jul 2026
CVE-2026-16771 In firmware versions 2.7.7 and earlier, the Arris BGW210‑700 gateway fails to enforce any server‑side authentication on its /cgi-bin/*.ha management endpoints, relying so...	8.8 High	—	0,43%	28 Jul 2026
CVE-2026-16498 The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one us...	10.0 Critical	—	0,46%	28 Jul 2026
CVE-2026-16496 The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful transport mode that may allow a user who obtains an...	8.9 High	—	0,36%	28 Jul 2026
CVE-2026-15992 The WP Password Policy plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 3.7.1. This is due to missing authorization checks a...	8.8 High	—	0,51%	28 Jul 2026
CVE-2026-15304 The Plugin Organizer plugin for WordPress is vulnerable to SQL Injection via the 'PO_plugin_path' parameter in versions up to, and including, 10.2.4. This is due to insuf...	6.5 Medium	—	0,41%	28 Jul 2026
CVE-2026-14869 The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the streamable-HTTP transport that may allow an unauthenticated remo...	8.6 High	—	0,39%	28 Jul 2026
CVE-2026-59933 PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through...	7.5 High	—	0,46%	28 Jul 2026
CVE-2026-59931 PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through...	7.7 High	—	0,47%	28 Jul 2026
CVE-2026-54635 pytonapi is a Python SDK for TONAPI that provides REST API, streaming, and webhook access to the TON blockchain. From 2.0.0 to 2.2.0, TonapiWebhookDispatcher fails to val...	7.5 High	—	0,51%	28 Jul 2026
CVE-2026-48388 adobe photoshop installer Adobe Photoshop Installer was affected by an Uncontrolled Search Path Element vulnerability that could have resulted in arbitrary code execution in the context of the cur...	8.6 High	—	0,31%	28 Jul 2026
CVE-2026-48372 adobe format plugins Format Plugins is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of...	7.8 High	—	0,34%	28 Jul 2026
CVE-2026-48025 nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.7, internal/pki/resolver.go:36-64 constructs a CAManager wi...	6.9 Medium	—	0,51%	28 Jul 2026
CVE-2026-67185 TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by submitting ../ sequences in the URL path, w...	7.5 High	—	0,55%	28 Jul 2026
CVE-2026-67184 TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attackers to crash worker processes by sending a malformed HTTP...	7.5 High	—	0,61%	28 Jul 2026
CVE-2026-67183 TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests...	7.5 High	—	0,51%	28 Jul 2026
CVE-2026-67182 Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to bypass access controls by injecting bare line feed characters...	7.5 High	—	0,63%	28 Jul 2026
CVE-2026-54620 sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while still referenc...	2.0 Low	—	0,14%	28 Jul 2026
CVE-2026-54619 sqlite3 provides Ruby bindings for the SQLite3 embedded database. In version 2.9.4 and earlier, redefining a SQLite function with a different arity frees the previously r...	2.0 Low	—	0,14%	28 Jul 2026
CVE-2026-54609 QTI Neon is a minimal, game-agnostic, relay-based UDP multiplayer protocol library. In version 1.0.0, the relay's handleReconnectRequest forwards RECONNECT_REQUEST packet...	8.6 High	—	0,46%	28 Jul 2026
CVE-2026-54605 OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumer#token_request parses the raw Location he...	7.2 High	—	0,19%	28 Jul 2026
CVE-2026-54603 OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, including OpenID Connect (OIDC). From 0.4.0 to 2.0.21, a protocol-relative redirect Location...	8.6 High	—	0,45%	28 Jul 2026
CVE-2026-54345 gopacket gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the Diameter AVP decoder computes an AVP data length by subtracting a fixed header...	7.5 High	—	0,79%	28 Jul 2026
CVE-2026-54332 gopacket gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the sFlow ExtendedGatewayFlow decoder in layers/sflow.go reads an attacker-controll...	7.5 High	—	0,79%	28 Jul 2026
CVE-2026-18085 blackberry unified endpoint manager An Improper Input Validation in the BlackBerry UEM Management Console of BlackBerry UEM 12.23.0 QF8 and earlier allows Arbitrary File Download and Potential Denial of Ser...	6.9 Medium	—	0,26%	28 Jul 2026
CVE-2026-18084 blackberry unified endpoint manager Improper Neutralization of Input During Web Page Generation vulnerability in BlackBerry UEM Management Console of BlackBerry UEM allows Cross-Site Scripting (XSS). This...	6.1 Medium	—	0,25%	28 Jul 2026
CVE-2026-16313 A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI...	7.6 High	—	0,35%	28 Jul 2026
CVE-2026-8058 ibm power system s1122 (9824-22a) firmware, ibm power system s1124 (9824-42a) firmware +13 lainnya IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows a user to supply a password with a resource dump request stores that password into the BMC...	4.9 Medium	—	0,36%	28 Jul 2026
CVE-2026-7868 ibm power system s1122 (9824-22a) firmware, ibm power system s1124 (9824-42a) firmware +13 lainnya IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows ReadOnly users to escalate privileges and give themselves administrator privileges.	8.8 High	—	0,37%	28 Jul 2026
CVE-2026-7775 ibm sterling b2b integrator, ibm sterling file gateway IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.6, 6.2.1...	4.8 Medium	—	0,24%	28 Jul 2026
CVE-2026-67181 Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize HTTP message boundaries by exploiting improper...	5.4 Medium	—	0,41%	28 Jul 2026
CVE-2026-66754 Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::remove_prefix function that allows remote unauthenticated attackers to crash the...	5.9 Medium	—	0,57%	28 Jul 2026
CVE-2026-66753 tiny-http through 0.12.0 contains an HTTP header injection vulnerability that allows attackers to inject carriage return (0x0D) and line feed (0x0A) bytes into HTTP heade...	3.7 Low	—	0,30%	28 Jul 2026
CVE-2026-66752 tiny-http through 0.12.0 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize request framing by sending a Transfer-Encoding hea...	5.4 Medium	—	0,33%	28 Jul 2026
CVE-2026-66751 Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending a DELETE r...	5.4 Medium	—	0,30%	28 Jul 2026
CVE-2026-66750 Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-p...	4.3 Medium	—	0,35%	28 Jul 2026
CVE-2026-66749 Let's Chat 0.4.0 through 0.4.8 contains a null dereference vulnerability that allows authenticated attackers to crash the server by supplying a valid 24-character hex str...	6.5 Medium	—	0,44%	28 Jul 2026
CVE-2026-66748 Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution vulnerability that allows users with custom_fields manage permission to execute...	8.8 High	—	1,1%	28 Jul 2026
CVE-2026-66746 Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage retu...	5.4 Medium	—	0,34%	28 Jul 2026
CVE-2026-62828 microsoft edge Improper input validation in Microsoft Edge for Android allows an unauthorized attacker to perform tampering over a network.	5.4 Medium	—	0,41%	28 Jul 2026
CVE-2026-61609 Pterodactyl is a free, open-source game server management panel. From 1.7.0 until 1.13.0, the authentication rate limiter defined in RouteServiceProvider::configureRateLi...	7.5 High	—	0,50%	28 Jul 2026
CVE-2026-54593 Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any vali...	8.1 High	—	0,68%	28 Jul 2026
CVE-2026-54545 wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlled module filenames only once before writing extrac...	7.1 High	—	0,20%	28 Jul 2026
CVE-2026-47483 NVIDIA DCGM Exporter for all platforms contains a vulnerability in the /debug/pprof endpoints, where an attacker could cause uncontrolled resource consumption by submitti...	8.2 High	—	0,39%	28 Jul 2026
CVE-2026-47427 github mcp server GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whet...	7.5 High	—	0,77%	28 Jul 2026
CVE-2026-45293 WordPress Coding Standards is a set of PHP_CodeSniffer rules (sniffs) that enforce WordPress coding conventions. From 0.14.1 until 3.4.1, the WordPress.WP.EnqueuedResourc...	8.6 High	—	0,25%	28 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.