Katalog CVE (hal. 863)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.336 (Critical 36.667 · High 106.392 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 2 Nov 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 43.101–43.150 dari 266.336 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-34496 Cwe-269 vulnerability in Johnson Controls victor Web on Windows allows capec-233. This issue affects victor Web: before 7.1.	7.1 High	—	0,33%	23 Jul 2026
CVE-2026-21655 Deserialization of untrusted data vulnerability in Johnson Control victor on Windows, Johnson Controls CCure 9000, and Johnson Controls Victor Application Server allows c...	8.7 High	—	0,49%	23 Jul 2026
CVE-2026-21653 Victor SSRF vulnerability in Johnson Controls CCure 9000 and victor application server allows Server Side Request Forgery. This issue affects CCure 9000 and victor appli...	7.2 High	—	0,39%	23 Jul 2026
CVE-2026-16796 Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock AgentCore Python SDK before 1.18.1 might allow a remote authenticated user...	7.3 High	—	0,73%	23 Jul 2026
CVE-2026-16002 The affected product is vulnerable to an Out-of-bounds read, which may allow an attacker to crash the parsing process and cause a denial of service.	8.2 High	—	0,43%	23 Jul 2026
CVE-2026-15981 The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. This is due to the mo_saml_va...	9.8 Critical	—	1,3%	23 Jul 2026
CVE-2026-15968 progress moveit transfer Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: befor...	5.4 Medium	—	0,33%	23 Jul 2026
CVE-2026-15967 progress moveit transfer Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.	9.8 Critical	—	0,37%	23 Jul 2026
CVE-2026-15966 progress moveit transfer Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026....	9.8 Critical	—	0,37%	23 Jul 2026
CVE-2026-15630 A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between aut...	9.9 Critical	—	0,47%	23 Jul 2026
CVE-2026-10697 progress moveit transfer Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.	9.8 Critical	—	0,60%	23 Jul 2026
CVE-2026-65706 ffmpeg FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a...	7.8 High	—	0,19%	23 Jul 2026
CVE-2026-65705 ffmpeg FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying...	7.8 High	—	0,19%	23 Jul 2026
CVE-2026-65704 ffmpeg FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the...	7.8 High	—	0,18%	23 Jul 2026
CVE-2026-65703 ffmpeg FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplyin...	7.8 High	—	0,33%	23 Jul 2026
CVE-2026-64785 apple swiftnio http/2 SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2...	5.3 Medium	—	0,29%	23 Jul 2026
CVE-2026-63359 equifax victim information notification exchange The Appriss Insights (Equifax) Victim Information Notification Exchange (VINE) applications allow an unauthenticated attacker to send a specially-crafted request to bypas...	9.8 Critical	—	0,75%	23 Jul 2026
CVE-2026-60122 gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data t...	7.8 High	—	0,27%	23 Jul 2026
CVE-2026-48013 Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the `/api/_action/media/external-link` endpoint allows authenticated admin users to make server-si...	4.1 Medium	—	0,37%	23 Jul 2026
CVE-2026-48012 Shopware is an open commerce platform. Versions 6.7.3.0 through 6.7.10.0 have an open redirect in Shopware's public SSO entry point at `GET /api/oauth/sso/auth`. When the...	4.3 Medium	—	0,28%	23 Jul 2026
CVE-2026-47722 nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, `internal/configgen/generator.go:86,108,119` interpolate...	8.7 High	—	0,47%	23 Jul 2026
CVE-2026-47670 DbGate is cross-platform database manager. Versions 7.1.8 and prior are vulnerable to authenticated Remote Code Execution (RCE). Any user with valid DbGate credentials ca...	9.4 Critical	—	1,8%	23 Jul 2026
CVE-2026-47669 DbGate is cross-platform database manager. In versions 7.1.8 and prior, the `unzipDirectory()` function in `packages/api/src/shell/unzipDirectory.js` (line 27) does not v...	9.3 Critical	—	0,52%	23 Jul 2026
CVE-2026-25800 Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the `Assembler` compone...	7.5 High	—	0,84%	23 Jul 2026
CVE-2026-15212 The WPO365 \| Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43.2. This is due to the Ajax_Service::verify_ajax_r...	8.8 High	—	0,25%	23 Jul 2026
CVE-2026-12353 An unauthenticated attacker could trigger an Out of Memory condition to crash the Java process for RHCS by repeatedly sending HTTP requests to the TLS endpoint. Depending...	5.3 Medium	—	0,44%	23 Jul 2026
CVE-2026-65010 Datasets through 5.00, fixed in commit ad2d853, contains a symlink-following vulnerability in Extractor.extract() that allows local attackers to write arbitrary files by...	6.6 Medium	—	0,17%	23 Jul 2026
CVE-2026-63765 Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allows unauthenticated attackers to create arbitrary ActiveSt...	8.2 High	—	0,70%	23 Jul 2026
CVE-2026-16756 Missing connection and header-read timeouts and the absence of a concurrent-connection cap in the default serve() path of Amazon aws-smithy-http-server might allow remote...	7.5 High	—	0,75%	23 Jul 2026
CVE-2026-15687 A security issue was discovered in the Kubernetes Java client library where a compromised pod may be able to create new files in arbitrary locations on the client machine...	2.4 Low	—	0,38%	23 Jul 2026
CVE-2026-65920 Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the _get_checkpoint_shard_files function that allows attackers to read arbit...	4.3 Medium	—	0,40%	23 Jul 2026
CVE-2026-65919 Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api/system/fileDownload endpoints that pass user-supp...	7.5 High	—	2,1%	23 Jul 2026
CVE-2026-65918 linuxfoundation torchvision PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds heap read vulnerability in the GIF decoder's read_from_tensor callback that passes...	7.1 High	—	0,45%	23 Jul 2026
CVE-2026-65763 Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.0.4 - Improper validation of user inputs lead to a reflective XSS vulnerability.	5.1 Medium	—	0,44%	23 Jul 2026
CVE-2026-6516 Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to the vulnerable agent API.	10.0 Critical	—	4,7%	23 Jul 2026
CVE-2026-65762 Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Guestbook 5.0.0-6.1.0 - Improper validation of user inputs lead to a reflective XSS vulnerability.	5.1 Medium	—	0,44%	23 Jul 2026
CVE-2026-65702 Vanna through 2.0.2 contains a path traversal vulnerability in the FileSystemConversationStore persistence integration that allows unauthenticated remote attackers to wri...	8.6 High	—	0,58%	23 Jul 2026
CVE-2026-65701 SoftVC VITS Singing Voice Conversion through commit 730930d contains a path traversal vulnerability in the full-song inference server that allows unauthenticated remote a...	9.1 Critical	—	0,70%	23 Jul 2026
CVE-2026-65700 h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that allows unauthenticated remote attackers to read, write, and delete ar...	9.8 Critical	—	1,5%	23 Jul 2026
CVE-2026-65699 AgentGPT through 1.0.0 contains an authorization bypass through user-controlled key vulnerability that allows authenticated users to attach tasks to another user's agent...	4.2 Medium	—	0,28%	23 Jul 2026
CVE-2026-47769 APIFold reads an OpenAPI 3.x or Swagger 2.x specification and generates a live, production-ready MCP server endpoint. Prior to commit 7f19b52280f414f57af2b79a95333d1c8fbe...	5.3 Medium	—	0,47%	23 Jul 2026
CVE-2026-47755 ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.05, low-privileged authenticated agent can r...	6.5 Medium	—	0,35%	23 Jul 2026
CVE-2026-47752 Tugtainer is a self-hosted app for automating updates of Docker containers. Versions prior to 1.30.2 are vulnerable to Server-Side Template Injection (SSTI) in the notifi...	9.9 Critical	—	0,44%	23 Jul 2026
CVE-2026-47743 Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and st...	8.7 High	—	0,38%	23 Jul 2026
CVE-2026-47668 DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner (`POST /runners/start`) allows remote code execution via code injectio...	10.0 Critical	—	3,9%	23 Jul 2026
CVE-2026-44210 katacontainers kata containers Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Versions prior to 3.31...	9.9 Critical	—	0,59%	23 Jul 2026
CVE-2026-65761 Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improper validation of order parameters lead to an unauthenticated...	9.3 Critical	—	1,0%	23 Jul 2026
CVE-2026-65760 Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1 - Improper access checks allow logged in...	9.2 Critical	—	0,42%	23 Jul 2026
CVE-2026-65759 Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1 - Critical order and payment information, including states,...	8.7 High	—	0,44%	23 Jul 2026
CVE-2026-65698 Void through 1.3.4 contains a path traversal vulnerability in the AI agent file-reading tools that allows network-adjacent attackers to read arbitrary host files outside...	5.3 Medium	—	0,47%	23 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.