Katalog CVE (hal. 880)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.702 (Critical 36.692 · High 106.576 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 3 Nov 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 43.951–44.000 dari 266.702 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-13186 progress telerik ui for asp.net ajax In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnerability in the file-based persistence storage provider can be exploited when the storage ke...	8.1 High	—	0,73%	22 Jul 2026
CVE-2026-13185 progress telerik ui for asp.net ajax In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize attacker-controlled...	8.1 High	—	0,67%	22 Jul 2026
CVE-2026-13184 progress telerik ui for asp.net ajax In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured, upload metadata in...	7.5 High	—	0,31%	22 Jul 2026
CVE-2026-13183 progress telerik ui for asp.net ajax In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload metadata processing may leak cryptographic validity through measurable timing differences, e...	7.5 High	—	0,50%	22 Jul 2026
CVE-2026-13182 progress telerik ui for asp.net ajax In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failures, creating...	7.5 High	—	0,50%	22 Jul 2026
CVE-2026-13181 progress telerik ui for asp.net ajax In Progress® Telerik® UI for AJAX prior to v2026.2.708, forged upload metadata can influence AsyncUploadTypeName processing and trigger unsafe attacker-controlled type re...	8.1 High	—	0,73%	22 Jul 2026
CVE-2026-8152 Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack. When Unblu Spark is deployed with com.unblu....	9.3 Critical	—	0,41%	22 Jul 2026
CVE-2026-44191 A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vulnerability (CWE-78) arises from improper handling of the ansible.execut...	7.8 High	—	0,82%	22 Jul 2026
CVE-2026-16270 Open Mercato does not validate regex rules. An attacker with privileges to create the regex rule can add an unsafe regex to a field. When someone provide the proper strin...	6.9 Medium	—	0,48%	22 Jul 2026
CVE-2026-65603 The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler (processUserProfile(), t...	8.8 High	—	0,38%	22 Jul 2026
CVE-2026-65602 traefik Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references (the al...	8.8 High	—	0,33%	22 Jul 2026
CVE-2026-65601 traefik Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules[].backendRefs...	8.8 High	—	0,51%	22 Jul 2026
CVE-2026-65600 traefik Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When R...	5.3 Medium	—	0,62%	22 Jul 2026
CVE-2026-65599 n8n n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a credential exposure vulnerability: when configured with a Google Service Account key, the full PEM private key...	6.5 Medium	—	0,25%	22 Jul 2026
CVE-2026-65598 n8n n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restrictions by...	7.5 High	—	0,34%	22 Jul 2026
CVE-2026-65597 n8n n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution output into...	5.4 Medium	—	0,30%	22 Jul 2026
CVE-2026-65596 n8n n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials (Header Auth, Basic Auth, Query Auth, OA...	8.1 High	—	0,37%	22 Jul 2026
CVE-2026-65595 n8n n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exchange module regardless of the acting user's role. On instances where t...	8.8 High	—	0,69%	22 Jul 2026
CVE-2026-65594 n8n n8n before 2.29.8 and 2.30.x before 2.30.1 (affected from 2.27.0, when the OAuth 2.1 consent and token-issuance flow was introduced) does not verify that the authenticate...	6.5 Medium	—	0,44%	22 Jul 2026
CVE-2026-65593 n8n n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoints that lack authorization scop...	5.4 Medium	—	0,24%	22 Jul 2026
CVE-2026-65592 n8n n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted ca...	5.4 Medium	—	0,24%	22 Jul 2026
CVE-2026-65591 n8n n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissio...	8.8 High	—	0,69%	22 Jul 2026
CVE-2026-65590 n8n n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the @n8n/computer-use package (sandboxing was applied only...	9.8 Critical	—	0,58%	22 Jul 2026
CVE-2026-65589 n8n n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writing plaintext API keys and secrets to workflow execu...	6.5 Medium	—	0,48%	22 Jul 2026
CVE-2026-65016 n8n n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning path maps an...	8.8 High	—	0,45%	22 Jul 2026
CVE-2026-65015 n8n n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Projec...	8.8 High	—	0,61%	22 Jul 2026
CVE-2026-65014 n8n n8n before 2.28.0 (and before 2.27.4 on the 2.27.x branch) registers the DELETE /${restEndpoint}/test-webhook/:id endpoint before authentication middleware is applied, al...	5.3 Medium	—	0,59%	22 Jul 2026
CVE-2026-61392 There is a information disclosure vulnerability in some Hikvision cameras, allowing unauthenticated attackers to obtain partial information from the device’s memory.	5.3 Medium	—	0,35%	22 Jul 2026
CVE-2026-61391 There is a stack-based buffer overflow vulnerability in some Hikvision cameras, which may allow authenticated attackers to cause device malfunction by sending specially c...	7.2 High	—	0,54%	22 Jul 2026
CVE-2026-61390 There is a heap buffer overflow vulnerability in some Hikvision cameras, which may allow unauthenticated attackers to cause device malfunction by sending specially crafte...	7.7 High	—	0,38%	22 Jul 2026
CVE-2026-57600 Insufficient validation of input parameters in the firmware of some Hikvision cameras allows unauthenticated attackers to retrieve partial sensitive data.	7.5 High	—	0,42%	22 Jul 2026
CVE-2026-57599 There is a privilege escalation vulnerability in some Hikvision cameras. Due to incorrect permission allocation in the device program, attackers can escalate privileges a...	6.6 Medium	—	0,36%	22 Jul 2026
CVE-2026-4773 Improper validation of specified type of input vulnerability in Magarsus Consulting Ltd. Co. IDM-MFA allows Authentication Bypass. This issue affects IDM-MFA: from 2025....	8.1 High	—	0,47%	22 Jul 2026
CVE-2026-44192 A flaw was found in the Ansible Lightspeed Model Context Protocol (MCP) server. This vulnerability, known as path traversal, allows an attacker to manipulate an AI agent...	6.6 Medium	—	0,20%	22 Jul 2026
CVE-2026-44190 A flaw was found in the Ansible Lightspeed Visual Studio Code extension. This Command Injection vulnerability (CWE-78) allows a remote attacker to execute unauthorized co...	7.8 High	—	0,75%	22 Jul 2026
CVE-2026-44189 A flaw was found in the Visual Studio Code Ansible Lightspeed extension's AnsiblePlaybookRunProvider. This command injection vulnerability allows an attacker to craft a m...	7.8 High	—	0,95%	22 Jul 2026
CVE-2026-44187 A flaw was found in the Ansible Lightspeed extension for Visual Studio Code. This vulnerability allows an attacker with local access to the workstation, or malware runnin...	3.3 Low	—	0,13%	22 Jul 2026
CVE-2026-16551 Denial-of-Service in Thinkst Applied Research OpenCanary (MongoDB module) allows Excessive Allocation. This issue affects OpenCanary 0.9.8 only.	6.9 Medium	—	0,43%	22 Jul 2026
CVE-2026-16544 A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumer_access() function (job_even...	6.5 Medium	—	0,39%	22 Jul 2026
CVE-2025-13146 The The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.7. This is d...	6.5 Medium	—	0,47%	22 Jul 2026
CVE-2026-16473 A flaw was found in the sbc library (BlueZ SBC codec). An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bound...	4.3 Medium	—	0,30%	22 Jul 2026
CVE-2026-14551 The servereye client (also known as sensorhub, technically ClientAgentContainerService) versions 20.15 and earlier are vulnerable to Local Privilege Escalation. The high-...	8.8 High	—	0,14%	22 Jul 2026
CVE-2026-63264 Joomla Extension - joomshopping.com - Reflective XSS in JoomShopping < 5.9.3 - The Joomla extension JoomShopping is vulnerable to an reflected XSS vulnerability in the pr...	5.3 Medium	—	0,44%	22 Jul 2026
CVE-2026-2406 Authorization bypass through User-Controlled key vulnerability in Universe Software Computer Marketing Trade and Industry Inc. Online Registration and Workflow Management...	6.5 Medium	—	0,36%	22 Jul 2026
CVE-2026-15787 The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes...	6.4 Medium	—	0,42%	22 Jul 2026
CVE-2026-63048 Joomla Extension - joomlack.fr - Improper access control in Page Builder CK 1.0.0-3.1.2, 3.4.0-3.4.11, 3.5.0-3.6.2 - The Joomla extension Page Builder CK is vulnerable to...	9.4 Critical	—	0,38%	22 Jul 2026
CVE-2026-63047 Joomla Extension - joomdonation.com - Invoice data exfiltration via incorrect ACL check in Events Booking 5.0.0-5.8.1 - The Joomla extension Events Booking prior version...	7.5 High	—	0,39%	22 Jul 2026
CVE-2026-45820 101arrowz fflate fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_siz...	7.5 High	—	0,28%	22 Jul 2026
CVE-2026-3821 Supermicro (SMC) SMASH services contain an Arbitrary code execution issue in X14DBG-DAP and X14DBI. An authorized attacker can exploit SMASH’s input capability to comprom...	8.8 High	—	0,64%	22 Jul 2026
CVE-2026-14322 The Timetics WordPress plugin before 1.0.57 does not enforce a pending or unpaid status for new bookings created through a payment method other than its recognised gatew...	5.3 Medium	—	0,30%	22 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.