Katalog CVE (hal. 878)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.702 (Critical 36.692 · High 106.576 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 3 Nov 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 43.851–43.900 dari 266.702 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-64829 Question2Answer through 1.8.8 contains a session invalidation vulnerability that allows attackers with a previously obtained remember-me cookie to retain authenticated ac...	7.4 High	—	0,53%	22 Jul 2026
CVE-2026-14899 mozilla thunderbird The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to b...	7.5 High	—	0,47%	22 Jul 2026
CVE-2026-14881 mongodb compass When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is poss...	7.8 High	—	0,21%	22 Jul 2026
CVE-2026-13078 mongodb A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript cal...	7.7 High	—	0,38%	22 Jul 2026
CVE-2026-13077 mongodb A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerabi...	7.1 High	—	0,42%	22 Jul 2026
CVE-2026-13076 mongodb An authenticated user can cause a {{mongod}} process to be terminated by the operating system under memory pressure by performing a specific data type conversion operatio...	6.5 Medium	—	0,42%	22 Jul 2026
CVE-2026-13075 mongodb An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages....	6.5 Medium	—	0,42%	22 Jul 2026
CVE-2026-13074 mongodb An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in...	5.3 Medium	—	0,44%	22 Jul 2026
CVE-2026-13073 mongodb An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in denial of serv...	4.3 Medium	—	0,37%	22 Jul 2026
CVE-2026-13072 mongodb When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in...	8.1 High	—	0,40%	22 Jul 2026
CVE-2026-13071 mongodb An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issu...	6.5 Medium	—	0,42%	22 Jul 2026
CVE-2026-13070 mongodb A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCS...	5.3 Medium	—	0,13%	22 Jul 2026
CVE-2026-13069 mongodb An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containin...	6.5 Medium	—	0,29%	22 Jul 2026
CVE-2026-13068 mongodb An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting on...	4.3 Medium	—	0,25%	22 Jul 2026
CVE-2026-13067 mongodb When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-...	6.3 Medium	—	0,10%	22 Jul 2026
CVE-2026-13066 mongodb Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included...	6.5 Medium	—	0,37%	22 Jul 2026
CVE-2026-13065 mongodb A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause t...	6.5 Medium	—	0,50%	22 Jul 2026
CVE-2026-13064 mongodb Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading...	6.5 Medium	—	0,45%	22 Jul 2026
CVE-2026-13063 mongodb An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted aggregation com...	6.5 Medium	—	0,40%	22 Jul 2026
CVE-2026-13062 mongodb An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be...	6.5 Medium	—	0,19%	22 Jul 2026
CVE-2026-13061 mongodb An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normall...	4.3 Medium	—	0,28%	22 Jul 2026
CVE-2026-13060 mongodb An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $g...	6.5 Medium	—	0,43%	22 Jul 2026
CVE-2026-13059 mongodb An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insuffi...	8.1 High	—	0,38%	22 Jul 2026
CVE-2026-13058 mongodb An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomplete set of...	6.5 Medium	—	0,40%	22 Jul 2026
CVE-2026-13057 mongodb An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access controls. In sharded topologies, the $search and $searchMeta a...	6.5 Medium	—	0,35%	22 Jul 2026
CVE-2026-13056 mongodb Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate objects in memory, causing the server to crash with OOM...	6.5 Medium	—	0,40%	22 Jul 2026
CVE-2026-13055 mongodb The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compound wildcard...	6.5 Medium	—	0,40%	22 Jul 2026
CVE-2026-3482 ibm sterling b2b integrator, ibm sterling file gateway IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 could allow an unauthentic...	5.3 Medium	—	0,46%	22 Jul 2026
CVE-2026-22049 netapp ontap ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication (MFA) configured are susceptible to a vulnerability related to the Relying Party ID which when...	8.8 High	—	0,53%	22 Jul 2026
CVE-2026-16624 Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticated user to create a webhook on any team via unvalidated teamId injection, then s...	9.6 Critical	—	0,36%	22 Jul 2026
CVE-2026-65650 Elgg before 7.0.0 does not check image dimensions to prevent denial of service via a large avatar upload.	4.3 Medium	—	0,45%	22 Jul 2026
CVE-2026-64835 ffmpeg FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigge...	8.8 High	—	0,50%	22 Jul 2026
CVE-2026-64834 ffmpeg FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause de...	7.5 High	—	0,73%	22 Jul 2026
CVE-2026-64833 ffmpeg FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by sup...	7.1 High	—	0,40%	22 Jul 2026
CVE-2026-64832 ffmpeg FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memo...	8.8 High	—	0,34%	22 Jul 2026
CVE-2026-16157 Duplicati v2.3.0.1 backup software gives Authenticated Users MODIFY permissions that propagate to all subdirectories. Installing the software outside of the Program Files...	7.8 High	—	0,14%	22 Jul 2026
CVE-2026-7328 Missing authorization in Caliptra Core Runtime Firmware (INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, EXTERNAL_MAILBOX_CMD commands) in subsystem mode allows a privileged...	6.8 Medium	—	0,13%	22 Jul 2026
CVE-2026-65013 Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnerability that allows authenticated attackers to access and manipulate ot...	8.8 High	—	0,52%	22 Jul 2026
CVE-2026-65012 InvokeAI before 6.13.7 contains an unauthenticated directory enumeration vulnerability in the GET /api/v2/models/scan_folder endpoint that accepts attacker-controlled sca...	5.3 Medium	—	0,44%	22 Jul 2026
CVE-2026-65011 Graylog2 Server before commit 46a2eeb contains a missing per-entity permission check in the POST /events/definitions/{definitionId}/duplicate endpoint that allows authent...	4.3 Medium	—	0,38%	22 Jul 2026
CVE-2026-64831 ffmpeg FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addr...	8.8 High	—	0,85%	22 Jul 2026
CVE-2026-64830 ffmpeg FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by su...	8.8 High	—	0,65%	22 Jul 2026
CVE-2026-16615 A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-random number...	6.8 Medium	—	0,44%	22 Jul 2026
CVE-2026-64828 Froiden TableTrack through 1.3.10 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary HTML and JavaScript throu...	6.1 Medium	—	0,37%	22 Jul 2026
CVE-2026-49499 dell powerprotect data manager Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) a Generation of Incorrect Security Tokens vulnerability in the IAM. A low privileged attacker with...	8.8 High	—	0,42%	22 Jul 2026
CVE-2026-46738 dell powerprotect data manager Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote...	7.2 High	—	0,50%	22 Jul 2026
CVE-2026-46737 dell powerprotect data manager Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote...	7.2 High	—	0,63%	22 Jul 2026
CVE-2026-44276 dell powerprotect data manager Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the REST API. A high...	4.4 Medium	—	0,15%	22 Jul 2026
CVE-2026-40714 dell powerprotect data manager Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability. A high privileged attacker with remote access could pot...	7.2 High	—	0,50%	22 Jul 2026
CVE-2026-40712 dell powerprotect data manager Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote...	7.2 High	—	0,50%	22 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.