Katalog CVE (hal. 867)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.527 (Critical 36.676 · High 106.475 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 3 Nov 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 43.301–43.350 dari 266.527 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-15630 A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between aut...	9.9 Critical	—	0,47%	23 Jul 2026
CVE-2026-10697 progress moveit transfer Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.	9.8 Critical	—	0,60%	23 Jul 2026
CVE-2026-65706 ffmpeg FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a...	7.8 High	—	0,19%	23 Jul 2026
CVE-2026-65705 ffmpeg FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying...	7.8 High	—	0,19%	23 Jul 2026
CVE-2026-65704 ffmpeg FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the...	7.8 High	—	0,18%	23 Jul 2026
CVE-2026-65703 ffmpeg FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplyin...	7.8 High	—	0,33%	23 Jul 2026
CVE-2026-64785 apple swiftnio http/2 SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2...	5.3 Medium	—	0,29%	23 Jul 2026
CVE-2026-63359 equifax victim information notification exchange The Appriss Insights (Equifax) Victim Information Notification Exchange (VINE) applications allow an unauthenticated attacker to send a specially-crafted request to bypas...	9.8 Critical	—	0,75%	23 Jul 2026
CVE-2026-60122 gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data t...	7.8 High	—	0,27%	23 Jul 2026
CVE-2026-48013 Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the `/api/_action/media/external-link` endpoint allows authenticated admin users to make server-si...	4.1 Medium	—	0,37%	23 Jul 2026
CVE-2026-48012 Shopware is an open commerce platform. Versions 6.7.3.0 through 6.7.10.0 have an open redirect in Shopware's public SSO entry point at `GET /api/oauth/sso/auth`. When the...	4.3 Medium	—	0,28%	23 Jul 2026
CVE-2026-47722 nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, `internal/configgen/generator.go:86,108,119` interpolate...	8.7 High	—	0,47%	23 Jul 2026
CVE-2026-47670 DbGate is cross-platform database manager. Versions 7.1.8 and prior are vulnerable to authenticated Remote Code Execution (RCE). Any user with valid DbGate credentials ca...	9.4 Critical	—	1,8%	23 Jul 2026
CVE-2026-47669 DbGate is cross-platform database manager. In versions 7.1.8 and prior, the `unzipDirectory()` function in `packages/api/src/shell/unzipDirectory.js` (line 27) does not v...	9.3 Critical	—	0,52%	23 Jul 2026
CVE-2026-25800 Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the `Assembler` compone...	7.5 High	—	0,84%	23 Jul 2026
CVE-2026-15212 The WPO365 \| Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43.2. This is due to the Ajax_Service::verify_ajax_r...	8.8 High	—	0,25%	23 Jul 2026
CVE-2026-12353 An unauthenticated attacker could trigger an Out of Memory condition to crash the Java process for RHCS by repeatedly sending HTTP requests to the TLS endpoint. Depending...	5.3 Medium	—	0,44%	23 Jul 2026
CVE-2026-65010 Datasets through 5.00, fixed in commit ad2d853, contains a symlink-following vulnerability in Extractor.extract() that allows local attackers to write arbitrary files by...	6.6 Medium	—	0,17%	23 Jul 2026
CVE-2026-63765 Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allows unauthenticated attackers to create arbitrary ActiveSt...	8.2 High	—	0,70%	23 Jul 2026
CVE-2026-16756 Missing connection and header-read timeouts and the absence of a concurrent-connection cap in the default serve() path of Amazon aws-smithy-http-server might allow remote...	7.5 High	—	0,75%	23 Jul 2026
CVE-2026-15687 A security issue was discovered in the Kubernetes Java client library where a compromised pod may be able to create new files in arbitrary locations on the client machine...	2.4 Low	—	0,38%	23 Jul 2026
CVE-2026-65920 Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the _get_checkpoint_shard_files function that allows attackers to read arbit...	4.3 Medium	—	0,40%	23 Jul 2026
CVE-2026-65919 Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api/system/fileDownload endpoints that pass user-supp...	7.5 High	—	2,1%	23 Jul 2026
CVE-2026-65918 linuxfoundation torchvision PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds heap read vulnerability in the GIF decoder's read_from_tensor callback that passes...	7.1 High	—	0,45%	23 Jul 2026
CVE-2026-65763 Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.0.4 - Improper validation of user inputs lead to a reflective XSS vulnerability.	5.1 Medium	—	0,44%	23 Jul 2026
CVE-2026-6516 Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to the vulnerable agent API.	10.0 Critical	—	4,7%	23 Jul 2026
CVE-2026-65762 Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Guestbook 5.0.0-6.1.0 - Improper validation of user inputs lead to a reflective XSS vulnerability.	5.1 Medium	—	0,44%	23 Jul 2026
CVE-2026-65702 Vanna through 2.0.2 contains a path traversal vulnerability in the FileSystemConversationStore persistence integration that allows unauthenticated remote attackers to wri...	8.6 High	—	0,58%	23 Jul 2026
CVE-2026-65701 SoftVC VITS Singing Voice Conversion through commit 730930d contains a path traversal vulnerability in the full-song inference server that allows unauthenticated remote a...	9.1 Critical	—	0,70%	23 Jul 2026
CVE-2026-65700 h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that allows unauthenticated remote attackers to read, write, and delete ar...	9.8 Critical	—	1,5%	23 Jul 2026
CVE-2026-65699 AgentGPT through 1.0.0 contains an authorization bypass through user-controlled key vulnerability that allows authenticated users to attach tasks to another user's agent...	4.2 Medium	—	0,28%	23 Jul 2026
CVE-2026-47769 APIFold reads an OpenAPI 3.x or Swagger 2.x specification and generates a live, production-ready MCP server endpoint. Prior to commit 7f19b52280f414f57af2b79a95333d1c8fbe...	5.3 Medium	—	0,47%	23 Jul 2026
CVE-2026-47755 ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.05, low-privileged authenticated agent can r...	6.5 Medium	—	0,35%	23 Jul 2026
CVE-2026-47752 Tugtainer is a self-hosted app for automating updates of Docker containers. Versions prior to 1.30.2 are vulnerable to Server-Side Template Injection (SSTI) in the notifi...	9.9 Critical	—	0,44%	23 Jul 2026
CVE-2026-47743 Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and st...	8.7 High	—	0,38%	23 Jul 2026
CVE-2026-47668 DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner (`POST /runners/start`) allows remote code execution via code injectio...	10.0 Critical	—	3,9%	23 Jul 2026
CVE-2026-44210 katacontainers kata containers Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Versions prior to 3.31...	9.9 Critical	—	0,59%	23 Jul 2026
CVE-2026-65761 Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improper validation of order parameters lead to an unauthenticated...	9.3 Critical	—	1,0%	23 Jul 2026
CVE-2026-65760 Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1 - Improper access checks allow logged in...	9.2 Critical	—	0,42%	23 Jul 2026
CVE-2026-65759 Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1 - Critical order and payment information, including states,...	8.7 High	—	0,44%	23 Jul 2026
CVE-2026-65698 Void through 1.3.4 contains a path traversal vulnerability in the AI agent file-reading tools that allows network-adjacent attackers to read arbitrary host files outside...	5.3 Medium	—	0,47%	23 Jul 2026
CVE-2026-65697 Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a java...	6.1 Medium	—	0,27%	23 Jul 2026
CVE-2026-65696 Overseerr through 1.35.0 contains an authorization bypass through user-controlled key vulnerability in the push subscription API that allows authenticated users to list,...	5.4 Medium	—	0,26%	23 Jul 2026
CVE-2026-65695 Office-Word-MCP-Server through 1.1.11 contains a path traversal vulnerability in its document tools that allows attackers who can influence the filename argument to read...	6.8 Medium	—	0,48%	23 Jul 2026
CVE-2026-44909 Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by se...	7.5 High	—	0,57%	23 Jul 2026
CVE-2026-16768 A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can occur due to...	5.3 Medium	—	0,41%	23 Jul 2026
CVE-2026-65917 CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference (IDOR) vulnerability in the IncBackups application's incremental-backup ha...	8.8 High	—	0,51%	23 Jul 2026
CVE-2026-65916 CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in the cancelBackupCreation handler that allows authenticated users to k...	8.1 High	—	0,49%	23 Jul 2026
CVE-2026-48539 GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to i...	5.4 Medium	—	0,24%	23 Jul 2026
CVE-2026-48538 GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the default import settings configuration that allows authenticated attackers to inject...	5.4 Medium	—	0,24%	23 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.