Katalog CVE (hal. 912)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.988 (Critical 36.707 · High 106.683 · KEV 1.766 · sejak 2020) · Pembaruan terakhir: 4 Nov 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 45.551–45.600 dari 266.988 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-56583 hcltech dryice mycloud HCL MyCloud was affected with Concurrent Login Vulnerability. It may increase the risk of unauthorized access, session hijacking, and account misuse.	3.1 Low	—	0,22%	21 Jul 2026
CVE-2026-56582 hcltech dryice mycloud HCL MyCloud was affected by the SSL/TLS LUCKY13 Vulnerability. An attacker may exploit this vulnerability to decrypt sensitive information through a TLS/SSL padding oracl...	3.1 Low	—	0,16%	21 Jul 2026
CVE-2026-56581 hcltech dryice mycloud HCL MyCloud was affected with Cookie Attribute Path Not Set. It may increase the risk of unauthorized access to session data or authentication tokens.	2.6 Low	—	0,15%	21 Jul 2026
CVE-2026-56580 hcltech dryice mycloud HCL MyCloud was affected by Using Components with Known Vulnerability ( IIS Server ). It may allow attackers to exploit publicly disclosed weaknesses and compromise the s...	2.2 Low	—	0,28%	21 Jul 2026
CVE-2026-56579 hcltech dryice mycloud HCL MyCloud was affected with License Key Revealed in HTTP Response. It may enable attackers to misuse the exposed information and compromise the application's security.	3.1 Low	—	0,25%	21 Jul 2026
CVE-2026-56578 hcltech dryice mycloud HCL MyCloud was affected by Server Version Disclosure. It may help attackers identify and exploit known vulnerabilities affecting the disclosed software versions.	2.2 Low	—	0,26%	21 Jul 2026
CVE-2026-56577 hcltech dryice mycloud HCL MyCloud was affected with Weak Password Policy. It may increase the risk of account compromise through brute-force or credential-based attacks.	6.5 Medium	—	0,28%	21 Jul 2026
CVE-2026-47657 HumHub is an Open Source Enterprise Social Network. In versions 1.13.0 through 1.18.2, a missing authorization check in the Space member management controller allowed any...	7.1 High	—	0,36%	21 Jul 2026
CVE-2026-47425 Rattler is a library that provides common functionality used within the conda ecosystem. Prior to version 0.43.2, `EntryPoint::FromStr` in `rattler_conda_types` performs...	6.9 Medium	—	0,20%	21 Jul 2026
CVE-2026-47419 PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an* Insecure Direct Object Reference. The agent CRUD end...	8.3 High	—	0,35%	21 Jul 2026
CVE-2026-47418 PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The project CRUD en...	8.1 High	—	0,41%	21 Jul 2026
CVE-2026-47417 PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The comment endpoin...	8.1 High	—	0,36%	21 Jul 2026
CVE-2026-47416 PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 are vulnerable to vertical privilege escalation. The `PATCH /...	9.6 Critical	—	0,26%	21 Jul 2026
CVE-2026-47415 PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The issue CRUD endp...	8.3 High	—	0,39%	21 Jul 2026
CVE-2026-47414 PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. Five label endpoint...	7.6 High	—	0,38%	21 Jul 2026
CVE-2026-47413 PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have aprivilege escalation / cross-tenant member injection. T...	9.6 Critical	—	0,26%	21 Jul 2026
CVE-2026-47412 PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling destructive action. The...	8.1 High	—	0,53%	21 Jul 2026
CVE-2026-47411 PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling workspace metadata + se...	6.5 Medium	—	0,34%	21 Jul 2026
CVE-2026-44880 hpe arubaos-cx A buffer overflow vulnerability was found in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities could allow an remote low-privileged u...	8.8 High	—	0,75%	21 Jul 2026
CVE-2026-21579 atlassian confluence data center This High severity Information Disclosure vulnerability was introduced in versions 7.17.0, 7.19.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 10.0.2, 10.1.0, and 10.2.0 of Conflu...	7.5 High	—	0,44%	21 Jul 2026
CVE-2026-21577 atlassian confluence data center This High severity DoS (Denial of Service) vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data...	6.5 Medium	—	0,43%	21 Jul 2026
CVE-2026-21575 atlassian sourcetree This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.11 of Sourcetree for Mac and Sourcetree for Windows. This RCE (Remote Code...	8.0 High	—	0,59%	21 Jul 2026
CVE-2026-16493 A flaw was found in ansible-core. The _extract_collection_from_git() function in ansible-core's concrete_artifact_manager.py constructs git clone commands without a '--'...	7.8 High	—	0,27%	21 Jul 2026
CVE-2026-16439 eclipse openj9 In Eclipse OpenJ9 versions up to 0.60, using -Xtrace to trace method arguments can lead to buffer underflow.	9.1 Critical	—	0,43%	21 Jul 2026
CVE-2026-16243 eclipse omr In Eclipse OMR versions up to 0.11, the arraycmp SIMD implementation for Z and P does not check if the number of bytes to compare is zero.	7.5 High	—	0,52%	21 Jul 2026
CVE-2026-47410 PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an insecure default cryptographic key. The JWT signing s...	9.8 Critical	—	0,45%	21 Jul 2026
CVE-2026-47409 PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling owner lockout. The `DEL...	8.1 High	—	0,35%	21 Jul 2026
CVE-2026-47408 PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The `GET /workspace...	6.5 Medium	—	0,29%	21 Jul 2026
CVE-2026-47407 PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the Platform server exposes resources under `/api/v1/workspac...	9.4 Critical	—	0,30%	21 Jul 2026
CVE-2026-47406 PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The dependency endp...	8.1 High	—	0,41%	21 Jul 2026
CVE-2026-47405 PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have a broken workspace authorization check that allows any a...	8.8 High	—	0,36%	21 Jul 2026
CVE-2026-47399 PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the workspace-scoped REST routes contain a systemic object-le...	8.8 High	—	0,36%	21 Jul 2026
CVE-2026-47398 PraisonAI is a multi-agent teams system. The v4.6.32 chokepoint refactor (which patched CVE-2026-44334 / GHSA-xcmw-grxf-wjhj) added the PRAISONAI_ALLOW_LOCAL_TOOLS env-va...	8.1 High	—	0,50%	21 Jul 2026
CVE-2026-47397 PraisonAI is a multi-agent teams system. Prior to version 4.6.40, hidden metadata in a webpage causes PraisonAI agents to write attacker-controlled content to arbitrary p...	7.1 High	—	0,46%	21 Jul 2026
CVE-2026-44907 A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affe...	7.5 High	—	0,60%	21 Jul 2026
CVE-2026-24232 NVIDIA Tranformers4Rec contains a vulnerability where an attacker could cause improper deserialization of untrusted data. A successful exploit of this vulnerability might...	4.3 Medium	—	0,38%	21 Jul 2026
CVE-2026-16454 eclipse hawkbit In Eclipse hawkBit versions 1.0.3 and prior, a privilege escalation vulnerability (CWE-284 / CWE-862) has been identified in the Direct Device Integration (DDI) Controlle...	4.3 Medium	—	0,36%	21 Jul 2026
CVE-2026-16451 A security flaw has been discovered in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. This impacts an unknown function of the file /api/system/file/...	6.3 Medium	—	0,35%	21 Jul 2026
CVE-2026-15829 google mcp toolbox for databases A SQL injection (CWE-89) and security boundary bypass (CWE-863) vulnerability exists in the prebuilt BigQuery forecasting tool (bigquery-forecast) of googleapis/mcp-toolb...	8.1 High	—	0,20%	21 Jul 2026
CVE-2026-15793 mobyproject buildkit BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could...	7.5 High	—	0,20%	21 Jul 2026
CVE-2026-15792 mobyproject buildkit A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic.	7.5 High	—	0,24%	21 Jul 2026
CVE-2026-15791 mobyproject buildkit A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory. The action that can normally be used to delete files insid...	7.5 High	—	0,25%	21 Jul 2026
CVE-2026-15789 mobyproject buildkit A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have val...	7.5 High	—	0,31%	21 Jul 2026
CVE-2026-15724 progress sharefile storage zones controller In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated administrative user can exploit a path traversal vulnerability to read...	8.7 High	—	0,52%	21 Jul 2026
CVE-2026-15432 google tink java When verifying a mac with a ChunkedMacVerification object, Tink compares the resulting tag with non constant time comparison. This potentially allows an attacker to use t...	5.9 Medium	—	0,18%	21 Jul 2026
CVE-2026-15342 Plane contains a multi‑tenant authorization flaw in its asset‑management API that allows authenticated users from one workspace to access, delete, or duplicate assets bel...	6.5 Medium	—	0,38%	21 Jul 2026
CVE-2025-68640 The Apple Find My backend service through 2025-12-17 allows an attacker in possession of a valid PET (Private Endpoint Token) to enumerate devices and remove offline devi...	5.3 Medium	—	0,35%	21 Jul 2026
CVE-2026-64825 Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthenticated attackers to write arbitrary files to any directory on the host fi...	9.3 Critical	—	0,58%	21 Jul 2026
CVE-2026-64824 Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function that allows attackers to write files to arbitrary absolute file...	8.4 High	—	0,71%	21 Jul 2026
CVE-2026-64823 Home Assistant Core before 2026.5.4 contains a cross-site scripting vulnerability in the Shelly integration's async_get_media_image() method that allows attackers control...	4.7 Medium	—	0,30%	21 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.