Katalog CVE (hal. 910)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.988 (Critical 36.707 · High 106.683 · KEV 1.766 · sejak 2020) · Pembaruan terakhir: 4 Nov 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 45.451–45.500 dari 266.988 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-10674 zephyrproject zephyr The NXP LPUART serial driver (drivers/serial/uart_mcux_lpuart.c), when CONFIG_UART_USE_RUNTIME_CONFIGURE is enabled, called LPUART_Deinit() at the start of mcux_lpuart_co...	5.5 Medium	—	0,14%	21 Jul 2026
CVE-2026-8983 autel maxicharger single charger firmware Autel Maxi Charger Single firmware through V1.03.51 contains a hard-coded authentication token that bypasses authorization checks for multiple management endpoints. An at...	9.8 Critical	—	0,69%	21 Jul 2026
CVE-2026-8982 autel maxicharger single charger firmware Two undocumented privileged accounts exist in Autel Maxi Charger Single firmware through V1.03.51. The accounts use vendor-defined password derivation mechanisms based on...	8.1 High	—	0,48%	21 Jul 2026
CVE-2026-65058 Trezor Safe 3, Safe 5, and Safe 7 firmware contains a confirmation-binding flaw in the Ethereum sign_tx / sign_tx_eip1559 flow. For contract interactions, the device conf...	5.3 Medium	—	0,40%	21 Jul 2026
CVE-2026-65057 Keep (commit 91c75e0) contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the backend issue arbitrary HTTP requests by supp...	9.3 Critical	—	0,31%	21 Jul 2026
CVE-2026-65056 mcp-webresearch 0.1.7 contains a server-side request forgery vulnerability that allows attackers to access internal network services by supplying loopback, link-local, or...	8.2 High	—	0,29%	21 Jul 2026
CVE-2026-65055 Taiga 6.10.1 contains a missing authorization vulnerability that allows unauthenticated attackers to disclose the full member roster and internal workflow configuration o...	5.3 Medium	—	0,33%	21 Jul 2026
CVE-2026-65054 MediaCMS 8.2.0 contains an information disclosure vulnerability that allows authenticated users to expose private media metadata belonging to other users by adding arbitr...	3.1 Low	—	0,32%	21 Jul 2026
CVE-2026-64881 tenable security center The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables comm...	8.8 High	—	2,2%	21 Jul 2026
CVE-2026-64822 djangoSIGE through 1.10 (commit a6fe7e8) contains a user enumeration vulnerability in ForgotPasswordView within djangosige/apps/login/views.py that allows unauthenticated...	5.3 Medium	—	0,42%	21 Jul 2026
CVE-2026-64821 djangoSIGE through 1.10 (commit a6fe7e8) contains a cross-site request forgery vulnerability that allows unauthenticated attackers to cancel sales or purchase orders on b...	4.3 Medium	—	0,22%	21 Jul 2026
CVE-2026-63764 internlm lmdeploy LMDeploy through 0.14.0, fixed in commit 03c3130, contains a server-side request forgery (SSRF) vulnerability in the _load_http_url function within the connection.py medi...	8.6 High	—	0,51%	21 Jul 2026
CVE-2026-63358 filegator FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()' function through 'octdec()'...	7.3 High	—	0,51%	21 Jul 2026
CVE-2026-63140 elasticsearch Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted search request containing a null...	6.5 Medium	—	0,42%	21 Jul 2026
CVE-2026-63139 elastic kibana Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can exploit...	6.5 Medium	—	0,47%	21 Jul 2026
CVE-2026-63136 elasticsearch Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges can submit...	6.5 Medium	—	0,42%	21 Jul 2026
CVE-2026-63092 kirby-modules through 5.5.7, fixed in commit 315417e, contains an information disclosure vulnerability that allows any authenticated Kirby Panel user to retrieve the full...	4.3 Medium	—	0,28%	21 Jul 2026
CVE-2026-63080 Aptabase through commit 5a89368 contains a SQL injection vulnerability in the ClickHouse query backend that allows authenticated attackers to read event data across all t...	6.5 Medium	—	0,40%	21 Jul 2026
CVE-2026-56147 elastic kibana Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privileg...	7.1 High	—	0,35%	21 Jul 2026
CVE-2026-52476 SQL Injection vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the getPageData method in the DatacenterQuery.java file	7.5 High	—	0,51%	21 Jul 2026
CVE-2026-52475 Cross Site Scripting vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the UploadController.java file	6.1 Medium	—	0,30%	21 Jul 2026
CVE-2026-52474 An issue in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the JobUtil.java file.	7.5 High	—	0,52%	21 Jul 2026
CVE-2026-52472 SQL injection vulnerability in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the PortInfoMapper.xml file	9.8 Critical	—	0,56%	21 Jul 2026
CVE-2026-52470 SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the RecordStateMapper.xml file	9.8 Critical	—	0,56%	21 Jul 2026
CVE-2026-52469 SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the DeviceInfoMapper.xml file	9.8 Critical	—	0,56%	21 Jul 2026
CVE-2026-47714 struktur libheif libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, the inline mask parsing code in `libheif/region.cc` contains an integer overflow...	6.1 Medium	—	0,15%	21 Jul 2026
CVE-2026-47708 MCP-for-Stata is an MCP server for Stata to integrate Stata into an agent. Prior to version 1.17.3, the `log_file_name` parameter in the `stata_do` API and CLI is directl...	9.3 Critical	—	0,38%	21 Jul 2026
CVE-2026-47697 Shelf is a platform for tracking physical assets. Shelf is multi-tenant; data is isolated per organization (workspace). Prior to version 1.20.2, several endpoints accepte...	7.1 High	—	0,31%	21 Jul 2026
CVE-2026-47695 CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to version 1.119.0, CC-Tweaked's HTTP API (`http.request`, `htt...	7.1 High	—	0,47%	21 Jul 2026
CVE-2026-47690 MeltanoHub is the source code for hub.meltano.com, the central place for Meltano plugins. Versions of the repo prior to commit 923820de8f64d753951fbbd54f7282a3d5f75173 we...	7.5 High	—	0,52%	21 Jul 2026
CVE-2026-47689 fogproject FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `buildRow()` method in `fogpage...	5.2 Medium	—	0,27%	21 Jul 2026
CVE-2026-47688 fogproject FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `clearAES` and `clearPMTasks` m...	8.2 High	—	0,27%	21 Jul 2026
CVE-2026-47687 fogproject FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `selectForm()` helper in `fogpa...	8.7 High	—	0,41%	21 Jul 2026
CVE-2026-47685 fogproject FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the unauthenticated inventory servi...	8.7 High	—	0,37%	21 Jul 2026
CVE-2026-47237 Kubeflow Community Distribution helps users to install Kubeflow Platform in popular Kubernetes clusters. Prior to version 26.03-rc.1, a Kubeflow setup based on the offici...	8.0 High	—	0,39%	21 Jul 2026
CVE-2026-47143 capstone-engine capstone Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8 have a NULL pointer dereference in `modRMRequired()` and `decode()` when disassembling 3DNow...	5.9 Medium	—	0,47%	21 Jul 2026
CVE-2026-46556 FlaskBB is a Forum Software written in Python using the micro framework Flask. Prior to version 2.2.1, a Server-Side Request Forgery (SSRF) vulnerability in get_image_inf...	6.5 Medium	—	0,35%	21 Jul 2026
CVE-2026-45383 libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.0.19 have a heap buffer overflow (out-of-bounds READ) exists in `decoder_context::...	6.9 Medium	—	0,43%	21 Jul 2026
CVE-2026-45382 libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.19, `decoder_context::decode_slice_unit_tiles` (libde265/decctx.cc:920) reads `pp...	6.9 Medium	—	0,43%	21 Jul 2026
CVE-2026-44879 A vulnerability in the command line interface of ECOS devices could allow a highly privileged, authenticated remote attacker to perform command injection on certain CLI c...	7.2 High	—	1,5%	21 Jul 2026
CVE-2026-44878 A vulnerability in the web-based management interface of an ECOS device could allow a highly privileged, authenticated remote attacker to access the device's filesystem....	7.2 High	—	0,60%	21 Jul 2026
CVE-2026-30633 Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted path value to the get_doc and update_doc tools.	7.5 High	—	0,89%	21 Jul 2026
CVE-2026-30631 An issue was discovered in bytebot-ai in commit 3d37894ce07ef8d8b40adc7fd309ad96c2a71313 (2025-09-11) allowing attackers to execute arbitrary code via crafted path to `co...	9.8 Critical	—	0,73%	21 Jul 2026
CVE-2026-16318 The QUIC transport parameters extension handler in s2n-tls incorrectly uses s2n_alloc instead of s2n_realloc to store the peer's transport parameters. When a TLS 1.3 conn...	5.3 Medium	—	0,53%	21 Jul 2026
CVE-2026-16317 Missing validation of the outer content_type byte on TLS 1.3 encrypted records in s2n-tls allows an active man-in-the-middle to silently discard individual application da...	6.5 Medium	—	0,25%	21 Jul 2026
CVE-2026-12139 tanium connect Tanium addressed an information disclosure vulnerability in Connect.	5.5 Medium	—	0,16%	21 Jul 2026
CVE-2026-11925 tanium server Tanium addressed a User Interface (UI) Misrepresentation of Critical Information vulnerability in Tanium Server.	2.7 Low	—	0,30%	21 Jul 2026
CVE-2026-65069 Data::DisjointSet::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is created in dsu...	4.0 Medium	—	0,17%	21 Jul 2026
CVE-2026-65068 Data::SpatialHash::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is created in sph...	3.8 Low	—	0,14%	21 Jul 2026
CVE-2026-65067 Data::Intern::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is created in intern.h...	3.8 Low	—	0,14%	21 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.