Katalog CVE (hal. 842)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.301 (Critical 36.664 · High 106.384 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 2 Nov 2026, 12:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 42.051–42.100 dari 266.301 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-43910 appium java-client Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. From 8.2.1 until 10.1.1, when directConnect(true) is...	8.2 High	—	0,43%	28 Jul 2026
CVE-2026-8164 Uncontrolled Search Path Element vulnerability in ArkSigner Software and Hardware Industry and Trade Inc. ArkSigner Desktop Client allows Search Order Hijacking. This is...	7.3 High	—	0,16%	28 Jul 2026
CVE-2026-7521 mattermost server Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 fail to verify file deletion path which allows an admin with SAML system-con...	5.5 Medium	—	0,44%	28 Jul 2026
CVE-2026-6879 `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on X...	2.0 Low	—	0,36%	28 Jul 2026
CVE-2026-67178 MISP installation scripts generated an Apache HTTP virtual-host configuration containing an incorrectly formatted HTTP-to-HTTPS redirect: Redirect permanent / https://mi...	7.8 High	—	0,66%	28 Jul 2026
CVE-2026-67174 Pivotick contains a DOM-based cross-site scripting vulnerability in its generic UI element resolution and icon-rendering utilities. The tryResolveHTMLElement function tr...	9.2 Critical	—	0,62%	28 Jul 2026
CVE-2026-66713 apache axis2/java Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat...	9.8 Critical	—	1,7%	28 Jul 2026
CVE-2026-66299 apache tomcat Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.2...	5.3 Medium	—	0,55%	28 Jul 2026
CVE-2026-63727 Anchore Enterprise versions from 5.11.0 to 5.27.1 and 6.0.0 contain an improper privilege escalation vulnerability in the user management API. An authenticated attacker w...	8.8 High	—	0,44%	28 Jul 2026
CVE-2026-67173 Pivotick did not validate the URL scheme of node imagePath values derived from graph data before assigning them to SVG image resources. An attacker able to supply crafted...	5.1 Medium	—	0,44%	28 Jul 2026
CVE-2026-66922 Pivotick used plain JavaScript objects as lookup tables indexed by caller-controlled graph node identifiers in its tree-layout and cycle-detection components. Node ident...	5.1 Medium	—	0,48%	28 Jul 2026
CVE-2026-66921 Pivotick’s Markdown node-reference renderer failed to HTML-escape the attacker-controlled nodeName value before interpolating it into both the data-node-name attribute an...	6.3 Medium	—	0,44%	28 Jul 2026
CVE-2026-61487 apache activemq, apache activemq all +1 lainnya Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated low-privilege user can bypass a per-destination w...	6.5 Medium	—	0,46%	28 Jul 2026
CVE-2026-59878 apache activemq, apache activemq all +1 lainnya Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All. A remote unauthenticated peer that can reach an exposed AMQP NIO c...	7.5 High	—	0,79%	28 Jul 2026
CVE-2026-7187 Missing authentication for critical function vulnerability in Universal Software Inc. UKBS allows Accessing Functionality Not Properly Constrained by ACLs. This issue af...	8.8 High	—	0,37%	28 Jul 2026
CVE-2026-66920 Pivotick contains an uncontrolled-recursion vulnerability when processing caller-supplied graph and node data. The affected graph algorithms recursively traversed graph e...	8.2 High	—	0,43%	28 Jul 2026
CVE-2026-66919 Pivotick contains a cross-site scripting vulnerability in the inspect and edit node modals. Node labels and descriptions originating from graph data were interpolated dir...	6.9 Medium	—	0,44%	28 Jul 2026
CVE-2026-66918 Pivotick fails to sanitize attacker-controlled SVG markup supplied through the per-node style.svgIcon property before inserting it into the document. When rendering a gr...	8.2 High	—	0,44%	28 Jul 2026
CVE-2026-66913 Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files. An attacker could submit a specially crafted ZIP, gzip, o...	6.9 Medium	—	0,43%	28 Jul 2026
CVE-2026-65882 Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1 - The goto url parameter of the moodle wrapper endpoint allowed a reflected XSS vector.	6.1 Medium	—	0,25%	28 Jul 2026
CVE-2026-65881 Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle < 3.1.1 - The default configuration of the extension allo...	7.5 High	—	0,42%	28 Jul 2026
CVE-2026-62436 [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] With the introduction of Grant Table v2...	6.5 Medium	—	0,19%	28 Jul 2026
CVE-2026-62435 [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] With the introduction of Grant Table v2...	6.5 Medium	—	0,19%	28 Jul 2026
CVE-2026-62434 A guest started with Populated on Demand enabled (PoD) can attempt to reclaim pages which aren't regular guest RAM. This can cause corruption of memory management state...	5.3 Medium	—	0,38%	28 Jul 2026
CVE-2026-62433 Parts of the DM_OP handling code assumes the caller has provided the required number of buffers for the given operation without any checking being done. As a result, cer...	7.3 High	—	0,25%	28 Jul 2026
CVE-2026-62432 The EVTCHNOP_expand_array hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOP_reset, resulting...	7.3 High	—	0,25%	28 Jul 2026
CVE-2026-62431 The logic to handle periodic Viridian STIMERs performs a division with an unchecked user-controlled divisor value, that can be set to zero to cause a #DE fault.	7.5 High	—	0,36%	28 Jul 2026
CVE-2026-62430 Accesses to the CMOS memory contents are done using an indirect IO port pair. Therefore Xen needs to cache the guest chosen index, and one of the usages of the index did...	7.5 High	—	0,24%	28 Jul 2026
CVE-2026-62429 Accessing the vNUMA configuration data of a guest is still possible when domain destruction has already started. The cleaning up of that configuration information is not...	6.5 Medium	—	0,22%	28 Jul 2026
CVE-2026-62428 When grant-copy operations are processed, the respective grant may or may not already be in use by another operation (a mapping or another copy). For all copy operations...	7.8 High	—	0,12%	28 Jul 2026
CVE-2026-62427 [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To manage the system, sysctl and platfor...	8.8 High	—	0,24%	28 Jul 2026
CVE-2026-62426 [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To manage the system, sysctl and platfor...	8.8 High	—	0,22%	28 Jul 2026
CVE-2026-62425 [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk...	5.5 Medium	—	0,20%	28 Jul 2026
CVE-2026-62424 [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk...	5.5 Medium	—	0,20%	28 Jul 2026
CVE-2026-62423 [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk...	5.5 Medium	—	0,20%	28 Jul 2026
CVE-2026-49332 A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys (X-Forwarded-User) but does not strip underscore-var...	8.5 High	—	0,53%	28 Jul 2026
CVE-2026-42495 [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk...	5.5 Medium	—	0,20%	28 Jul 2026
CVE-2026-42494 [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk...	6.1 Medium	—	0,11%	28 Jul 2026
CVE-2026-42493 Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costly. Since a...	7.5 High	—	0,45%	28 Jul 2026
CVE-2026-42492 Xenstore, to have an up-to-date picture of the entire system, wants to know of domains appearing and disappearing. To make this more robust, a new XEN_DOMCTL_get_domain_...	7.5 High	—	0,61%	28 Jul 2026
CVE-2026-41874 Quick.Cart stores hard-coded, plaintext admin credentials in a configuration file. This flaw allows attackers with access to the server file system to retrieve authentica...	6.8 Medium	—	0,18%	28 Jul 2026
CVE-2026-18047 A flaw was found in Dogtag PKI's ACME responder where the web.xml security constraints use exact URL pattern matching for admin-only enable/disable endpoints. By appendin...	6.5 Medium	—	0,49%	28 Jul 2026
CVE-2026-18038 A flaw has been found in nextlevelbuilder GoClaw up to 3.13.2. Affected by this vulnerability is the function ExecTool.Execute of the file goclaw/internal/http/tools_invo...	4.3 Medium	—	0,39%	28 Jul 2026
CVE-2026-15393 The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via...	6.4 Medium	—	0,44%	28 Jul 2026
CVE-2026-15016 The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Readonly Use...	6.4 Medium	—	0,26%	28 Jul 2026
CVE-2026-4648 Use of an insecure cryptographic algorithm in the cashless payment system using NFC wristbands from CasfID Servicios Tecnológicos S.L.U. (version used at Resurrection Fes...	6.8 Medium	—	0,16%	28 Jul 2026
CVE-2026-21047 Out-of-bounds write in ImsService prior to SMR Jul-2026 Release 1 allows remote attackers to potentially execute arbitrary code.	8.3 High	—	0,67%	28 Jul 2026
CVE-2026-16774 The Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.5.9 via the wpcs_send_email() AJAX handler. This is due to the...	5.3 Medium	—	0,40%	28 Jul 2026
CVE-2026-16773 The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and incl...	5.3 Medium	—	0,48%	28 Jul 2026
CVE-2026-15444 The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'coupon_code' parameter in all versions up to, an...	4.9 Medium	—	0,48%	28 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.