Katalog CVE (hal. 917)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.988 (Critical 36.707 · High 106.683 · KEV 1.766 · sejak 2020) · Pembaruan terakhir: 4 Nov 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 45.801–45.850 dari 266.988 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-64651 The `@ai-sdk/harness-opencode` tool connects HarnessAgent to OpenCode through a sandboxed bridge. Prior to version 1.0.28, the tool relay authorizes requests from any pro...	6.3 Medium	—	0,17%	20 Jul 2026
CVE-2026-64650 The `@ai-sdk/harness-opencode` tool is an HarnessV1 adapter backed by @openai/codex-sdk, which drives the codex command line interface. Prior to version 1.0.29, the tool...	6.3 Medium	—	0,17%	20 Jul 2026
CVE-2026-58624 apache mina sshd Improper input validation in sshd-git in Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git...	5.4 Medium	—	0,64%	20 Jul 2026
CVE-2026-56624 apache mina sshd Improper certificate validation in Apache MINA SSHD (server-side). Apache MINA SSHD is a Java library for client-side and server-side SSH. Server-side OpenSSH user ce...	7.3 High	—	0,29%	20 Jul 2026
CVE-2026-56623 apache mina sshd Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and server-side SSH. A git server implemented wit...	7.1 High	—	0,87%	20 Jul 2026
CVE-2026-56452 apache mina sshd Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. The implementation of receiving...	7.5 High	—	0,77%	20 Jul 2026
CVE-2026-55219 Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.5, the credit payment implementation in app/Livewire/Inv...	5.3 Medium	—	0,21%	20 Jul 2026
CVE-2026-53596 FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the FreeScout helpdesk application does not enforce rate limi...	5.3 Medium	—	0,29%	20 Jul 2026
CVE-2026-53595 FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint `POST /user-setup/{hash}/{invite_sent_at}...	9.4 Critical	—	1,9%	20 Jul 2026
CVE-2026-53594 FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout's `Manage -> Logs -> App Logs` feature uses the bundled `rap2hpoutre/laravel-...	4.9 Medium	—	0,42%	20 Jul 2026
CVE-2026-47198 Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.1, the checkout component improperly filters URL-writabl...	8.5 High	—	0,40%	20 Jul 2026
CVE-2026-47130 NextCRM is open-source customer relationship management (CRM) software. Versions prior to 0.12.0 have a Broken Object Level Authorization (BOLA/IDOR) vulnerability exists...	7.1 High	—	0,20%	20 Jul 2026
CVE-2026-47129 NextCRM is open-source customer relationship management (CRM) software. Versions prior to 0.12.0 have a Broken Access Control (BAC) vulnerability in the `activateUser` an...	8.1 High	—	0,27%	20 Jul 2026
CVE-2026-44585 Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the ticket creation endpoint accepts a user-supplied...	5.4 Medium	—	0,29%	20 Jul 2026
CVE-2026-44584 Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the email update functionality fails to invalidate th...	4.3 Medium	—	0,16%	20 Jul 2026
CVE-2026-44583 Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the PayPal webhook endpoint /extensions/paypal/webhoo...	5.3 Medium	—	0,42%	20 Jul 2026
CVE-2026-13381 vsee clinic, vsee clinic api VSee Clinic 7.1.26 and API 1.3.0 contain an Insecure Direct Object Reference (IDOR) vulnerability in the /v1.3.0/api/files endpoint. An authenticated attacker can manipul...	8.1 High	—	0,37%	20 Jul 2026
CVE-2026-13380 vsee clinic, vsee clinic api VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in t...	7.5 High	—	0,39%	20 Jul 2026
CVE-2024-51313 The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_42EA38 function of the file /goform/SetVirtualServerCfg.	9.8 Critical	—	0,51%	20 Jul 2026
CVE-2024-51311 The Tenda TX9 V22.03.02.05 firmware has a stack overflow vulnerability in the sub_4418CC function of the file /goform/SetNetControlList.	9.8 Critical	—	0,51%	20 Jul 2026
CVE-2026-63767 ktransformers through 0.6.3, fixed in commit def0f93, contains an unauthenticated pickle deserialization vulnerability that allows remote attackers to execute arbitrary c...	9.8 Critical	—	1,1%	20 Jul 2026
CVE-2026-63766 GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where ASR, slice, denoise, and uvr5 functions interpolate unsanitized Gradio t...	9.8 Critical	—	2,1%	20 Jul 2026
CVE-2026-53593 FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the denylist that neutralizes dangerous file uploads (`Helper...	8.8 High	—	0,35%	20 Jul 2026
CVE-2026-53592 FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A Prototype Pollution condition in the `getQueryParam` function `/public/js/main.js` an...	4.6 Medium	—	0,15%	20 Jul 2026
CVE-2026-53591 FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.223, an unauthenticated attacker can inject messages into any exis...	8.6 High	—	0,27%	20 Jul 2026
CVE-2026-44231 bestpractical request tracker RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6.0.0 and above, prior to 6.0.3 contain an information disclosure and p...	9.1 Critical	—	0,25%	20 Jul 2026
CVE-2026-44230 bestpractical request tracker RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.4 up to (but not including) 5.0.10, and 6.0.0 up to (but not including) 6.0.3 contai...	6.1 Medium	—	0,16%	20 Jul 2026
CVE-2026-44229 bestpractical request tracker RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3 contain a Cross-Site Scripting...	5.4 Medium	—	0,14%	20 Jul 2026
CVE-2026-16337 Improper authorization in the ToolGroupResource and RoleAjax REST/DWR endpoints in dotCMS dotCMS 21.02 through 26.06.22-03 on all platforms allows a low-privileged authen...	9.4 Critical	—	0,58%	20 Jul 2026
CVE-2026-15788 mobyproject buildkit BuildKit's cache mount source= selector on Windows Container on Windows (WCOW) workers does not detect NTFS directory junctions placed inside the cache root. A build auth...	7.5 High	—	0,41%	20 Jul 2026
CVE-2026-64619 FileCodeBox before 2.4 contains a rate-limit bypass vulnerability in the IPRateLimit class that allows unauthenticated attackers to circumvent request throttling by suppl...	7.5 High	—	0,30%	20 Jul 2026
CVE-2026-64194 Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains. Net::DNS::DomainName::decode follows RFC 1035 compression pointe...	7.5 High	—	0,68%	20 Jul 2026
CVE-2026-64193 Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT fie...	9.8 Critical	—	1,4%	20 Jul 2026
CVE-2026-63771 Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by injecting arbitrary values through the unsanitized...	7.1 High	—	0,43%	20 Jul 2026
CVE-2026-63770 Glance through 0.8.5 contains an IP address spoofing vulnerability in the authentication handler that allows unauthenticated attackers to bypass brute-force lockout prote...	7.5 High	—	0,30%	20 Jul 2026
CVE-2026-63769 Huginn before 2026.09.09 contains a server-side request forgery vulnerability in the fetch_url method of ScenarioImport that allows authenticated users to make arbitrary...	7.7 High	—	0,42%	20 Jul 2026
CVE-2026-63768 cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary URLs by cra...	4.3 Medium	—	0,34%	20 Jul 2026
CVE-2026-63731 HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to arbitrary internal destinations...	7.7 High	—	0,30%	20 Jul 2026
CVE-2026-63730 HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to make requests to arbitrary inter...	5.0 Medium	—	0,40%	20 Jul 2026
CVE-2026-63108 Roo Code through 3.54.0 contains a command injection vulnerability in the auto-approve execute feature that allows attackers to bypass allowlist/denylist enforcement by n...	8.8 High	—	1,8%	20 Jul 2026
CVE-2026-63107 LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey template endpoint that allows authenticated users to caus...	7.7 High	—	0,35%	20 Jul 2026
CVE-2026-62414 Joomla Extension - joomlack.fr - Improper access control in Page Builder CK < 3.6.2 - The Joomla extension Page Builder CK does not properly apply access control to front...	9.1 Critical	—	0,40%	20 Jul 2026
CVE-2026-61901 Joomla Extension - hikashop.com - Open redirect in Hikashop < 6.5.2 - The Joomla extension Hikashop is vulnerable to an open redirect.	6.1 Medium	—	0,24%	20 Jul 2026
CVE-2026-61900 Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-jDownloads < 4.1.6 - The Joomla extension JDownloads is vulnerable to an unauthenticate...	10.0 Critical	—	0,45%	20 Jul 2026
CVE-2026-61425 Joomla Extension - balbooa.com - Authentication bypass in Gridbox < 1.6.0 - The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially leading to ful...	9.4 Critical	—	0,57%	20 Jul 2026
CVE-2026-61424 Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2 - The Joomla extension DJ-Classifieds is vulnerable to an unauthen...	10.0 Critical	—	0,45%	20 Jul 2026
CVE-2026-60034 Joomla Extension - themexpert.com - Authenticated stored XSS in JMedia Extension < 1.6.0 - The Joomla extension JMedia is vulnerable to a stored XSS vulnerability. Unsani...	9.4 Critical	—	0,42%	20 Jul 2026
CVE-2026-60033 Joomla Extension - themexpert.com - SSRF via remote download in JMedia Extension < 1.6.0 - The Joomla extension JMedia is vulnerable to an SSRF vulnerability. Remote-URL...	5.1 Medium	—	0,39%	20 Jul 2026
CVE-2026-60032 Joomla Extension - themexpert.com - Authenticated arbitrary file upload in JMedia < 1.6.0 - The Joomla extension JMedia is vulnerable to an authenticated arbitrary file u...	9.4 Critical	—	0,41%	20 Jul 2026
CVE-2026-60031 Joomla Extension - themexpert.com - Information disclosure in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an information discl...	6.9 Medium	—	0,43%	20 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.