Katalog CVE (hal. 851)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.301 (Critical 36.664 · High 106.384 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 2 Nov 2026, 12:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 42.501–42.550 dari 266.301 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-59530 Unauthenticated Broken Access Control in Stripe For WooCommerce <= 4.0.7 versions.	7.5 High	—	0,35%	27 Jul 2026
CVE-2026-59529 Unauthenticated Sensitive Data Exposure in Ebook Store <= 6.19 versions.	7.5 High	—	0,39%	27 Jul 2026
CVE-2026-59528 Subscriber Sensitive Data Exposure in ShipTime: Discounted Shipping Rates <= 1.1.1 versions.	7.5 High	—	0,42%	27 Jul 2026
CVE-2026-59527 Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions.	9.3 Critical	—	0,40%	27 Jul 2026
CVE-2026-10819 mattermost server Mattermost versions 11.6.x <= 11.6.5, 10.11.x <= 10.11.20, 11.8.x <= 11.8.1, 11.7.x <= 11.7.4 fail to limit the number of frames and enforce the file size cap on animated...	6.5 Medium	—	0,42%	27 Jul 2026
CVE-2026-10600 mattermost server Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 fail to bound the time and resource consumption of server-side document cont...	4.3 Medium	—	0,37%	27 Jul 2026
CVE-2025-59181 Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a directory traversal vulnerability in Configuration Management that could allow an attacker to chang...	4.8 Medium	—	0,43%	27 Jul 2026
CVE-2025-59180 Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain a hardcoded credential vulnerability in the alarm system. An attacker with access to the cluster with...	5.1 Medium	—	0,16%	27 Jul 2026
CVE-2025-59178 Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain an Exposure of Sensitive System Information vulnerability in Configuration Management allowing an att...	4.8 Medium	—	0,23%	27 Jul 2026
CVE-2025-59177 Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a vulnerability in Configuration Management, allowing an attacker to execute specifically crafted com...	6.8 Medium	—	0,23%	27 Jul 2026
CVE-2025-59172 Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain an Improper Neutralization of Special Elements vulnerability allowing an attacker to execute arbitrar...	8.5 High	—	0,28%	27 Jul 2026
CVE-2026-65879 Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1 - A hardcoded secret allowed attackers to f...	9.8 Critical	—	0,51%	27 Jul 2026
CVE-2026-65878 Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder < 6.7.1- Improper path validation and ACL checks lead to a file deletion vector...	8.3 High	—	0,49%	27 Jul 2026
CVE-2026-65877 Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder < 6.7.1 - Improper validation of various parameters in the media manager search and da...	8.2 High	—	0,38%	27 Jul 2026
CVE-2026-65876 Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.8.0 - Improper validation of catid parameters in the loadMoreArticles endpoint l...	9.2 Critical	—	0,39%	27 Jul 2026
CVE-2026-65766 Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1 - Improper validation of order parameters in the Dynamic Content endpoint le...	9.2 Critical	—	0,40%	27 Jul 2026
CVE-2026-61511 vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template runtime that...	9.8 Critical	—	5,6%	27 Jul 2026
CVE-2026-17514 A vulnerability was determined in ZJONSSON node-unzipper up to 0.12.3. Affected by this vulnerability is the function Extract of the file lib/extract.js. This manipulatio...	5.3 Medium	—	0,17%	27 Jul 2026
CVE-2026-17513 A vulnerability was found in ggml-org whisper.cpp 95ea8f9b. Affected is the function ggml_ftype_to_ggml_type of the file ggml/src/ggml.c. The manipulation of the argument...	3.3 Low	—	0,16%	27 Jul 2026
CVE-2026-15003 A flaw was found in the GNU Binutils (Binary Utilities) linker. This vulnerability, a heap-buffer-overflow read (CWE-125), occurs when the linker processes a specially cr...	5.6 Medium	—	0,15%	27 Jul 2026
CVE-2026-59690 progress connection manager for objectscale, progress ecs connection manager +3 lainnya A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an aut...	8.0 High	—	0,26%	27 Jul 2026
CVE-2026-59689 progress connection manager for objectscale, progress ecs connection manager +2 lainnya An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated...	8.0 High	—	0,26%	27 Jul 2026
CVE-2026-59688 progress connection manager for objectscale, progress ecs connection manager +2 lainnya An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated att...	8.4 High	—	1,7%	27 Jul 2026
CVE-2026-59687 progress connection manager for objectscale, progress ecs connection manager +2 lainnya An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated att...	8.4 High	—	1,7%	27 Jul 2026
CVE-2026-59686 progress connection manager for objectscale, progress ecs connection manager +2 lainnya An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated att...	8.4 High	—	1,7%	27 Jul 2026
CVE-2026-56538 hcltech connections An endpoint in HCL Connections is vulnerable to information disclosure. In certain scenarios this might lead to disclosing sensitive information to unauthorized users.	3.5 Low	—	0,27%	27 Jul 2026
CVE-2026-56537 hcltech connections HCL Connections is vulnerable to information disclosure which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of...	3.5 Low	—	0,27%	27 Jul 2026
CVE-2026-17512 A vulnerability has been found in ggml-org whisper.cpp 1.8.4-58. This impacts the function log_mel_spectrogram of the file src/whisper.cpp. The manipulation leads to out-...	3.3 Low	—	0,16%	27 Jul 2026
CVE-2026-12991 The lack of cryptographic mechanisms to ensure the integrity and authenticity of communications in Ghost Robotics' Vision 60 robot (APK v5.5.0) exposes the system to man-...	8.7 High	—	0,22%	27 Jul 2026
CVE-2026-12990 An access control vulnerability in the mobile app (APK v5.5.0) for Ghost Robotics' Vision 60 robot allows multiple simultaneous sessions to run without proper client vali...	7.7 High	—	0,19%	27 Jul 2026
CVE-2026-12989 A lack of authentication in the mobile app (APK v5.5.0) for Ghost Robotics' Vision 60 robot allows an unauthenticated attacker connected to the device's internal Wi-Fi ne...	8.7 High	—	0,31%	27 Jul 2026
CVE-2026-66053 apache thrift Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users are recomme...	5.9 Medium	—	0,29%	27 Jul 2026
CVE-2026-58662 apache thrift Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Use...	9.1 Critical	—	1,1%	27 Jul 2026
CVE-2026-58389 apache thrift Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Rust bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommende...	7.5 High	—	1,0%	27 Jul 2026
CVE-2026-58023 apache thrift Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0,...	9.1 Critical	—	1,0%	27 Jul 2026
CVE-2026-57917 proCertum SmartSign parses external XML entities from arbitrary crafted signature files, enabling SSRF and potentially allowing the reading of local files, depending on t...	4.8 Medium	—	0,18%	27 Jul 2026
CVE-2026-57916 proCertum SmartSign opens Certificate Practice Statement (CPS) URI without schema validation. An attacker can prepare arbitrary certificate with CPS URI pointing to a loc...	4.6 Medium	—	0,11%	27 Jul 2026
CVE-2026-55971 apache thrift Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.2...	9.8 Critical	—	0,98%	27 Jul 2026
CVE-2026-55970 apache thrift Buffer Over-read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which...	6.5 Medium	—	0,78%	27 Jul 2026
CVE-2026-55969 apache thrift Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi and Haxe bindings. This issue affects Apache Thrift: before 0.24.0. Users...	7.5 High	—	1,0%	27 Jul 2026
CVE-2026-55968 apache thrift Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings. This issue affects Apache Thrif...	7.5 High	—	1,0%	27 Jul 2026
CVE-2026-49158 apache thrift Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.24.0. Users ar...	7.5 High	—	1,0%	27 Jul 2026
CVE-2026-48586 apache thrift Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings. This issue affects Apache Thri...	7.5 High	—	1,0%	27 Jul 2026
CVE-2026-48145 apache thrift Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommende...	7.5 High	—	0,42%	27 Jul 2026
CVE-2026-48144 apache thrift Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recomme...	9.1 Critical	—	0,40%	27 Jul 2026
CVE-2026-45112 apache thrift Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: from 0.19.0 before 0.24.0. Users ar...	7.5 High	—	1,0%	27 Jul 2026
CVE-2026-43871 apache thrift Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0....	7.5 High	—	1,0%	27 Jul 2026
CVE-2026-41608 apache thrift Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users...	7.5 High	—	1,0%	27 Jul 2026
CVE-2026-14856 A stored Cross-Site Scripting (XSS) vulnerability in the file upload functionality of the Media Manager in TastyIgniter v4.3.0, caused by insufficient validation and sani...	6.3 Medium	—	0,39%	27 Jul 2026
CVE-2026-12495 Denial-of-service (DoS) vulnerability due to a stack buffer overflow in the http_gdpr_decrypt function of the Mercusys MB115-4G device's web interface. An unauthenticated...	5.3 Medium	—	0,25%	27 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.