Katalog CVE (hal. 849)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.301 (Critical 36.664 · High 106.384 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 2 Nov 2026, 12:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 42.401–42.450 dari 266.301 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-10682 zephyrproject zephyr The userspace verifier z_vrfy_log_filter_set() for the log_filter_set syscall in subsys/logging/log_mgmt.c performed a signed comparison against the int16_t src_id parame...	7.8 High	—	0,17%	27 Jul 2026
CVE-2026-66030 Ekushey Project Manager CRM through version 5.0 ccontains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and...	5.4 Medium	—	0,29%	27 Jul 2026
CVE-2026-66029 Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and J...	5.4 Medium	—	0,29%	27 Jul 2026
CVE-2026-66028 Ekushey Project Manager CRM through version 5.0 contains a missing uniqueness constraint vulnerability that allows authenticated administrators to create duplicate client...	6.7 Medium	—	0,61%	27 Jul 2026
CVE-2026-64645 vercel next.js Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a rewrites() or redirects() rule th...	6.1 Medium	—	0,41%	27 Jul 2026
CVE-2026-64644 vercel next.js Next.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10, when self-hosting Next.js with the d...	5.3 Medium	—	0,67%	27 Jul 2026
CVE-2026-64643 vercel next.js Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, Next.js applications using App Route...	5.3 Medium	—	0,51%	27 Jul 2026
CVE-2026-64642 vercel next.js Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Route...	8.2 High	—	0,64%	27 Jul 2026
CVE-2026-64641 vercel next.js Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js a...	7.5 High	—	0,86%	27 Jul 2026
CVE-2026-59239 Stored Cross-site Scripting (CWE-79) in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user to execute arbitrary...	8.6 High	—	0,67%	27 Jul 2026
CVE-2026-55579 Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin (SHA-...	9.8 Critical	—	0,79%	27 Jul 2026
CVE-2026-55578 Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the terminal feature in Pheditor uses an incomplete characte...	8.8 High	—	0,67%	27 Jul 2026
CVE-2026-54540 Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The terminal featur...	8.8 High	—	0,73%	27 Jul 2026
CVE-2026-54272 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through misclassificatio...	6.9 Medium	—	0,40%	27 Jul 2026
CVE-2026-48052 Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, an authenticated user who is a member of any organization can delete or renam...	5.4 Medium	—	0,37%	27 Jul 2026
CVE-2026-48051 Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, Papra's webhook delivery system contains an SSRF protection bypass that allow...	3.5 Low	—	0,26%	27 Jul 2026
CVE-2026-48030 Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action...	9.9 Critical	—	7,5%	27 Jul 2026
CVE-2026-45623 postcss PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the Pre...	9.1 Critical	—	0,61%	27 Jul 2026
CVE-2026-17570 devolutions server Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext credential secrets v...	4.3 Medium	—	0,25%	27 Jul 2026
CVE-2026-17569 devolutions server Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored API token v...	4.3 Medium	—	0,27%	27 Jul 2026
CVE-2026-17568 devolutions server Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group membership...	8.8 High	—	0,42%	27 Jul 2026
CVE-2026-17552 Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concatenation in call. When the rewrite base is a plain s...	9.1 Critical	—	0,54%	27 Jul 2026
CVE-2026-66731 facil.io 0.7.5 through 0.7.6 contains a denial-of-service vulnerability in the HTTP/1.1 chunked transfer encoding parser that allows unauthenticated remote attackers to c...	7.5 High	—	0,78%	27 Jul 2026
CVE-2026-66730 facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser that allows an unauthenticated remote attacker to permanently freeze...	7.5 High	—	0,78%	27 Jul 2026
CVE-2026-66729 facil.io 0.6.0 through 0.7.6 contains an integer underflow vulnerability in the multipart MIME body parser that allows unauthenticated remote attackers to crash the serve...	7.5 High	—	0,78%	27 Jul 2026
CVE-2026-66391 apache wicket Use of Insufficiently Random Values, Protection Mechanism Failure vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0....	6.5 Medium	—	0,64%	27 Jul 2026
CVE-2026-66390 apache wicket Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through...	6.1 Medium	—	0,57%	27 Jul 2026
CVE-2026-63077 jetbrains teamcity In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol	9.8 Critical	KEV · ransomware	93,6%	27 Jul 2026
CVE-2026-24252 nvidia nemo NVIDIA NeMo for Linux contains a vulnerability where an attacker may cause OS command injection. A successful exploit of this vulnerability may lead to code execution, da...	7.8 High	—	1,5%	27 Jul 2026
CVE-2026-17531 A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by this issue is some unknown functionality of the file server/src/routes/goals.ts of the com...	5.0 Medium	—	0,33%	27 Jul 2026
CVE-2026-17192 A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on behalf of authenticated tenant accounts to internal services that are...	8.5 High	—	0,29%	27 Jul 2026
CVE-2026-17191 An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, which may res...	9.1 Critical	—	0,35%	27 Jul 2026
CVE-2026-66399 phpMyFAQ before 4.1.6 contains a privilege escalation vulnerability in GroupController::updateMembers() that allows administrators with only group-management permissions...	6.5 Medium	—	0,29%	27 Jul 2026
CVE-2026-66398 phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATION_EDIT and ATTACH...	9.4 Critical	—	0,41%	27 Jul 2026
CVE-2026-66397 phpMyFAQ before 4.1.6 fails to validate path traversal sequences in the existing_image field during category updates, allowing authenticated attackers to delete arbitrary...	8.6 High	—	0,40%	27 Jul 2026
CVE-2026-66396 SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing stored cross-site scripting vi...	8.4 High	—	0,54%	27 Jul 2026
CVE-2026-66395 SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code b...	9.6 Critical	—	0,57%	27 Jul 2026
CVE-2026-66394 SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that allows authenticated attackers to execute scripts by bypa...	8.7 High	—	0,34%	27 Jul 2026
CVE-2026-59251 erlang/otp, erlang/public key Allocation of resources without limits in Erlang/OTP public_key certificate path validation allows a remote unauthenticated attacker to cause denial of service by sending...	7.5 High	—	0,32%	27 Jul 2026
CVE-2026-59250 Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a remote unauthenticated attacker to corrupt the driver's memory (and potentially achieve re...	8.3 High	—	0,78%	27 Jul 2026
CVE-2026-58227 erlang/otp, erlang/ssl The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In ssl_certificate:handle_i...	7.5 High	—	0,39%	27 Jul 2026
CVE-2026-55953 erlang/otp, erlang/ssl The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the c...	7.4 High	—	0,23%	27 Jul 2026
CVE-2026-55737 erlang/otp, erlang erts Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can supply a crafted Erlang external term format (ETF)...	7.5 High	—	0,29%	27 Jul 2026
CVE-2026-54890 erlang/otp, erlang erts Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive All...	7.5 High	—	0,42%	27 Jul 2026
CVE-2026-47078 Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside the intended extraction directory via a crafted zip archive. zip:unz...	4.8 Medium	—	0,15%	27 Jul 2026
CVE-2026-42792 erlang/otp, erlang erts Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated remote attacker to permanently terminate the Erlang Port Map...	7.5 High	—	0,44%	27 Jul 2026
CVE-2026-17574 hdfgroup hdf5 HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-length datatype type field may cau...	5.5 Medium	—	0,15%	27 Jul 2026
CVE-2026-17573 hdfgroup hdf5 A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause the applica...	5.5 Medium	—	0,15%	27 Jul 2026
CVE-2026-17572 hdfgroup hdf5 Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows attackers to cause a denial of service (crash) via a...	5.5 Medium	—	0,14%	27 Jul 2026
CVE-2026-17530 A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.5. Affected by this vulnerability is the function _build_handoff_toolset of the file AstrBot/astrbot...	6.3 Medium	—	0,37%	27 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.