Katalog CVE (hal. 864)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.336 (Critical 36.667 · High 106.392 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 2 Nov 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 43.151–43.200 dari 266.336 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-65697 Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a java...	6.1 Medium	—	0,27%	23 Jul 2026
CVE-2026-65696 Overseerr through 1.35.0 contains an authorization bypass through user-controlled key vulnerability in the push subscription API that allows authenticated users to list,...	5.4 Medium	—	0,26%	23 Jul 2026
CVE-2026-65695 Office-Word-MCP-Server through 1.1.11 contains a path traversal vulnerability in its document tools that allows attackers who can influence the filename argument to read...	6.8 Medium	—	0,48%	23 Jul 2026
CVE-2026-44909 Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by se...	7.5 High	—	0,57%	23 Jul 2026
CVE-2026-16768 A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can occur due to...	5.3 Medium	—	0,41%	23 Jul 2026
CVE-2026-65917 CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference (IDOR) vulnerability in the IncBackups application's incremental-backup ha...	8.8 High	—	0,51%	23 Jul 2026
CVE-2026-65916 CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in the cancelBackupCreation handler that allows authenticated users to k...	8.1 High	—	0,49%	23 Jul 2026
CVE-2026-48539 GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to i...	5.4 Medium	—	0,24%	23 Jul 2026
CVE-2026-48538 GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the default import settings configuration that allows authenticated attackers to inject...	5.4 Medium	—	0,24%	23 Jul 2026
CVE-2026-48537 GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File Archive Assistant configuration that allows authenticated attackers to inject a...	5.4 Medium	—	0,24%	23 Jul 2026
CVE-2026-48536 GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the General Settings SMTP configuration that allows authenticated attackers to inject ar...	5.4 Medium	—	0,24%	23 Jul 2026
CVE-2026-48535 GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configuration that allows authenticated attackers to inject a...	5.4 Medium	—	0,24%	23 Jul 2026
CVE-2026-48534 GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the IMAP Server configuration that allows authenticated attackers to inject arbitrary we...	5.4 Medium	—	0,24%	23 Jul 2026
CVE-2026-48532 GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File History Retention Policy configuration that allows authenticated attackers to i...	5.4 Medium	—	0,24%	23 Jul 2026
CVE-2026-48531 GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Retention Policy configuration that allows authenticated attackers to inject arbitra...	5.4 Medium	—	0,24%	23 Jul 2026
CVE-2026-48530 GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the Classification Rules configuration that allows authenticated attackers to inject arb...	5.4 Medium	—	0,24%	23 Jul 2026
CVE-2026-16584 Improper handling of an initialization failure in AWS API MCP Server from 0.2.13 through 1.3.46 might allow an actor to bypass the user-configured security policy and exe...	7.0 High	—	0,23%	23 Jul 2026
CVE-2026-15617 Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-differ...	9.1 Critical	—	0,43%	23 Jul 2026
CVE-2026-15616 Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access.	9.1 Critical	—	0,53%	23 Jul 2026
CVE-2026-15615 Logto omits validation of the SAML <Conditions> element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely.	7.5 High	—	0,19%	23 Jul 2026
CVE-2026-15614 Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window.	7.5 High	—	0,35%	23 Jul 2026
CVE-2026-15612 Logto bypasses OIDC nonce validation when the nonce claim is absent from the id_token, enabling replay of authentication tokens and weakening session-binding.	9.1 Critical	—	0,24%	23 Jul 2026
CVE-2026-15611 Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s email and gain unauthorized acc...	9.1 Critical	—	0,48%	23 Jul 2026
CVE-2026-11804 Improper handling of insufficient permissions or privileges vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Wind...	5.2 Medium	—	0,24%	23 Jul 2026
CVE-2026-43823 apple swift-crypto When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-freed: first in the catch block, then in the deinit. This can lead to a...	7.5 High	—	0,43%	23 Jul 2026
CVE-2026-43820 apple swiftnio ssl NIOSSLCertificate._subjectAlternativeNames provides access to the raw bytes for a cert's SANs. NIOSSL provides access to a buffer assumed to be backed by an ASN1_STRING,...	7.7 High	—	0,11%	23 Jul 2026
CVE-2026-8287 Allocation of resources without limits or throttling vulnerability in BizimHesap Information Systems Industry and Trade Inc. Online Pre-Accounting Software allows Excessi...	4.3 Medium	—	0,36%	23 Jul 2026
CVE-2026-65914 cure53 dompurify DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xm...	6.1 Medium	—	0,31%	23 Jul 2026
CVE-2026-65913 cure53 dompurify DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype...	6.1 Medium	—	0,32%	23 Jul 2026
CVE-2026-65912 cure53 dompurify DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck. Attacke...	6.1 Medium	—	0,30%	23 Jul 2026
CVE-2026-65911 cure53 dompurify In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subseq...	6.1 Medium	—	0,33%	23 Jul 2026
CVE-2026-65904 cure53 dompurify DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocume...	4.7 Medium	—	0,27%	23 Jul 2026
CVE-2026-65903 cure53 dompurify DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions. Attackers...	6.1 Medium	—	0,33%	23 Jul 2026
CVE-2026-65902 cure53 dompurify DOMPurify before 3.4.7 passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeElement and uponSanitizeAttribut...	6.1 Medium	—	0,36%	23 Jul 2026
CVE-2026-65901 cure53 dompurify DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supp...	6.1 Medium	—	0,29%	23 Jul 2026
CVE-2026-65900 cure53 dompurify DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail...	6.1 Medium	—	0,31%	23 Jul 2026
CVE-2026-65899 cure53 dompurify DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundaries stays b...	6.1 Medium	—	0,41%	23 Jul 2026
CVE-2026-65898 cure53 dompurify DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the...	7.2 High	—	0,21%	23 Jul 2026
CVE-2026-65690 syncfusion standalone report designer Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its file upload functionality that allows authenticated att...	8.8 High	—	0,90%	23 Jul 2026
CVE-2026-65689 syncfusion standalone report designer Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its database download feature that allows unauthenticated a...	9.8 Critical	—	0,87%	23 Jul 2026
CVE-2026-65688 syncfusion standalone report designer Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its font processing feature that allows unauthenticated att...	9.8 Critical	—	0,87%	23 Jul 2026
CVE-2026-65687 syncfusion standalone report designer Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its SVG processing feature that allows unauthenticated atta...	9.8 Critical	—	0,87%	23 Jul 2026
CVE-2026-16735 A security vulnerability has been detected in release-it conventional-changelog up to 11.0.1. This affects the function writeChangelog of the file index.js of the compone...	5.3 Medium	—	1,1%	23 Jul 2026
CVE-2026-16733 A weakness has been identified in bahmutov find-cypress-specs up to 1.54.12. The impacted element is the function shell.exec of the file src/index.js of the component Bra...	5.3 Medium	—	1,1%	23 Jul 2026
CVE-2026-14257 juliangruber brace-expansion brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,...	7.5 High	—	0,64%	23 Jul 2026
CVE-2026-65908 jetbrains pycharm In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on untrusted project open	8.6 High	—	0,19%	23 Jul 2026
CVE-2026-65907 In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible	9.1 Critical	—	0,67%	23 Jul 2026
CVE-2026-65906 jetbrains teamcity In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible	10.0 Critical	—	0,66%	23 Jul 2026
CVE-2026-15037 Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text se...	2.9 Low	—	0,44%	23 Jul 2026
CVE-2026-65897 Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create(), allowing authenticated api.users.write callers to assign invi...	8.8 High	—	0,46%	23 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.