Katalog CVE (hal. 874)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.527 (Critical 36.676 · High 106.475 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 3 Nov 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 43.651–43.700 dari 266.527 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-16628 A vulnerability was detected in oclif up to 4.23.16. Affected by this vulnerability is the function child_process.exec of the component JIT Plugin Entry Handler. Performi...	5.3 Medium	—	1,1%	22 Jul 2026
CVE-2026-64798 Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension - Persistent URL login keys were also generated using a non-cryptographic random genera...	9.1 Critical	—	0,43%	22 Jul 2026
CVE-2026-64797 Joomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension - IP Login trusted forwarded client-IP headers without requiring a configured trusted...	7.5 High	—	0,35%	22 Jul 2026
CVE-2026-64796 Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not require both the article creator and last modifier to be Super U...	9.8 Critical	—	0,51%	22 Jul 2026
CVE-2026-64795 Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions - Tag-provided custom HTML, module content/title overrides and...	5.4 Medium	—	0,23%	22 Jul 2026
CVE-2026-64794 Joomla Extension - regularlabs.com - restricted user-data exposure in Users Anywhere and Articles Anywhere extensions - User tags, filters and conditions allowed access t...	6.5 Medium	—	0,42%	22 Jul 2026
CVE-2026-64793 Joomla Extension - regularlabs.com - Content access and publication bypass in Articles Anywhere and Modules Anywhere extensions - Content tags could use ignore flags or p...	9.1 Critical	—	0,43%	22 Jul 2026
CVE-2026-64792 Joomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs extensions - Smart Search indexing could render generated c...	7.5 High	—	0,42%	22 Jul 2026
CVE-2026-64791 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs Extension Manager - Administrator routes and install/update/uninsta...	8.8 High	—	0,20%	22 Jul 2026
CVE-2026-63685 Joomla Extension - regularlabs.com - Authorization bypass in DB Replacer extension - Administrator routes and replacement requests did not consistently require Super User...	8.8 High	—	0,42%	22 Jul 2026
CVE-2026-63684 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various admin/import/export actions of multiple Regular Labs extension - Adminis...	8.8 High	—	0,20%	22 Jul 2026
CVE-2026-63683 Joomla Extension - regularlabs.com - Client IP spoofing vulnerability in Regular Labs conditions manager - IP and GeoIP conditions trusted spoofable forwarded headers, al...	7.5 High	—	0,39%	22 Jul 2026
CVE-2026-63281 Joomla Extension - regularlabs.com - XSS vulnerability in Regular Labs conditions manager - Stored condition values could also execute HTML/JavaScript in administrator su...	4.8 Medium	—	0,24%	22 Jul 2026
CVE-2026-63280 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs conditions manager - Conditions administration did not consistently...	8.8 High	—	0,20%	22 Jul 2026
CVE-2026-63265 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpoints - Privileged Regular Labs AJAX end...	8.0 High	—	0,18%	22 Jul 2026
CVE-2026-13089 OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorithm allowlist in verify. When the caller does not p...	7.5 High	—	0,37%	22 Jul 2026
CVE-2025-60835 An issue in the unrar.dll component of IZArc v4.6 allows attackers to execute a path traversal.	7.8 High	—	0,19%	22 Jul 2026
CVE-2025-50330 An issue in ZipGenius Team ZipGenius v.6.3.2.3116 and before allows a remote attacker to escalate privileges and execute arbitrary code via the zipgenius.exe.	8.8 High	—	0,67%	22 Jul 2026
CVE-2025-50329 An issue in ConeXware, Inc Power Archiver v.22.00.11 and before allows a remote attacker to escalate privileges and execute arbitrary code via the powerarc.exe.	9.8 Critical	—	1,1%	22 Jul 2026
CVE-2025-50327 An issue in Franco Corbelli ZPAQFRANZ v.61.3 and before allows a remote attacker to escalate privileges and execute arbitrary code via a bypass of the Mark-of-the-Web pro...	8.8 High	—	0,71%	22 Jul 2026
CVE-2025-50325 BandiZip v.7.37 is affected by a Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on aff...	5.4 Medium	—	0,51%	22 Jul 2026
CVE-2025-50324 An issue in Milos Paripovic OneCommander v.3.96.0.0 allows a remote attacker to execute arbitrary code via the OneCommander.exe component.	8.8 High	—	0,67%	22 Jul 2026
CVE-2025-44090 An issue in OhSoft CoffeeZip v4.8.0.0 allows attackers to execute arbitrary code via downloading and executing a crafted archive file.	8.8 High	—	0,54%	22 Jul 2026
CVE-2025-44089 An issue in NCH Software ExpressZip v11.29 allows attackers to execute arbitrary code via downloading and executing a crafted archive file.	8.8 High	—	0,53%	22 Jul 2026
CVE-2026-9737 mongodb During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case. This may lead to incorrect tr...	6.5 Medium	—	0,42%	22 Jul 2026
CVE-2026-64829 Question2Answer through 1.8.8 contains a session invalidation vulnerability that allows attackers with a previously obtained remember-me cookie to retain authenticated ac...	7.4 High	—	0,53%	22 Jul 2026
CVE-2026-14899 mozilla thunderbird The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to b...	7.5 High	—	0,47%	22 Jul 2026
CVE-2026-14881 mongodb compass When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is poss...	7.8 High	—	0,21%	22 Jul 2026
CVE-2026-13078 mongodb A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript cal...	7.7 High	—	0,38%	22 Jul 2026
CVE-2026-13077 mongodb A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerabi...	7.1 High	—	0,42%	22 Jul 2026
CVE-2026-13076 mongodb An authenticated user can cause a {{mongod}} process to be terminated by the operating system under memory pressure by performing a specific data type conversion operatio...	6.5 Medium	—	0,42%	22 Jul 2026
CVE-2026-13075 mongodb An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages....	6.5 Medium	—	0,42%	22 Jul 2026
CVE-2026-13074 mongodb An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in...	5.3 Medium	—	0,44%	22 Jul 2026
CVE-2026-13073 mongodb An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in denial of serv...	4.3 Medium	—	0,37%	22 Jul 2026
CVE-2026-13072 mongodb When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in...	8.1 High	—	0,40%	22 Jul 2026
CVE-2026-13071 mongodb An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issu...	6.5 Medium	—	0,42%	22 Jul 2026
CVE-2026-13070 mongodb A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCS...	5.3 Medium	—	0,13%	22 Jul 2026
CVE-2026-13069 mongodb An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containin...	6.5 Medium	—	0,29%	22 Jul 2026
CVE-2026-13068 mongodb An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting on...	4.3 Medium	—	0,25%	22 Jul 2026
CVE-2026-13067 mongodb When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-...	6.3 Medium	—	0,10%	22 Jul 2026
CVE-2026-13066 mongodb Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included...	6.5 Medium	—	0,37%	22 Jul 2026
CVE-2026-13065 mongodb A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause t...	6.5 Medium	—	0,50%	22 Jul 2026
CVE-2026-13064 mongodb Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading...	6.5 Medium	—	0,45%	22 Jul 2026
CVE-2026-13063 mongodb An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted aggregation com...	6.5 Medium	—	0,40%	22 Jul 2026
CVE-2026-13062 mongodb An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be...	6.5 Medium	—	0,19%	22 Jul 2026
CVE-2026-13061 mongodb An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normall...	4.3 Medium	—	0,28%	22 Jul 2026
CVE-2026-13060 mongodb An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $g...	6.5 Medium	—	0,43%	22 Jul 2026
CVE-2026-13059 mongodb An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insuffi...	8.1 High	—	0,38%	22 Jul 2026
CVE-2026-13058 mongodb An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomplete set of...	6.5 Medium	—	0,40%	22 Jul 2026
CVE-2026-13057 mongodb An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access controls. In sharded topologies, the $search and $searchMeta a...	6.5 Medium	—	0,35%	22 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.