Katalog CVE (hal. 921)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 267.428 (Critical 36.758 · High 106.883 · KEV 1.767 · sejak 2020) · Pembaruan terakhir: 4 Nov 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 46.001–46.050 dari 267.428 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-47419 PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an* Insecure Direct Object Reference. The agent CRUD end...	8.3 High	—	0,35%	21 Jul 2026
CVE-2026-47418 PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The project CRUD en...	8.1 High	—	0,41%	21 Jul 2026
CVE-2026-47417 PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The comment endpoin...	8.1 High	—	0,36%	21 Jul 2026
CVE-2026-47416 PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 are vulnerable to vertical privilege escalation. The `PATCH /...	9.6 Critical	—	0,26%	21 Jul 2026
CVE-2026-47415 PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The issue CRUD endp...	8.3 High	—	0,39%	21 Jul 2026
CVE-2026-47414 PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. Five label endpoint...	7.6 High	—	0,38%	21 Jul 2026
CVE-2026-47413 PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have aprivilege escalation / cross-tenant member injection. T...	9.6 Critical	—	0,26%	21 Jul 2026
CVE-2026-47412 PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling destructive action. The...	8.1 High	—	0,53%	21 Jul 2026
CVE-2026-47411 PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling workspace metadata + se...	6.5 Medium	—	0,34%	21 Jul 2026
CVE-2026-44880 hpe arubaos-cx A buffer overflow vulnerability was found in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities could allow an remote low-privileged u...	8.8 High	—	0,75%	21 Jul 2026
CVE-2026-21579 atlassian confluence data center This High severity Information Disclosure vulnerability was introduced in versions 7.17.0, 7.19.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 10.0.2, 10.1.0, and 10.2.0 of Conflu...	7.5 High	—	0,44%	21 Jul 2026
CVE-2026-21577 atlassian confluence data center This High severity DoS (Denial of Service) vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data...	6.5 Medium	—	0,43%	21 Jul 2026
CVE-2026-21575 atlassian sourcetree This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.11 of Sourcetree for Mac and Sourcetree for Windows. This RCE (Remote Code...	8.0 High	—	0,59%	21 Jul 2026
CVE-2026-16493 A flaw was found in ansible-core. The _extract_collection_from_git() function in ansible-core's concrete_artifact_manager.py constructs git clone commands without a '--'...	7.8 High	—	0,27%	21 Jul 2026
CVE-2026-16439 eclipse openj9 In Eclipse OpenJ9 versions up to 0.60, using -Xtrace to trace method arguments can lead to buffer underflow.	9.1 Critical	—	0,43%	21 Jul 2026
CVE-2026-16243 eclipse omr In Eclipse OMR versions up to 0.11, the arraycmp SIMD implementation for Z and P does not check if the number of bytes to compare is zero.	7.5 High	—	0,52%	21 Jul 2026
CVE-2026-47410 PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an insecure default cryptographic key. The JWT signing s...	9.8 Critical	—	0,45%	21 Jul 2026
CVE-2026-47409 PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling owner lockout. The `DEL...	8.1 High	—	0,35%	21 Jul 2026
CVE-2026-47408 PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The `GET /workspace...	6.5 Medium	—	0,29%	21 Jul 2026
CVE-2026-47407 PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the Platform server exposes resources under `/api/v1/workspac...	9.4 Critical	—	0,30%	21 Jul 2026
CVE-2026-47406 PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The dependency endp...	8.1 High	—	0,41%	21 Jul 2026
CVE-2026-47405 PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have a broken workspace authorization check that allows any a...	8.8 High	—	0,36%	21 Jul 2026
CVE-2026-47399 PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the workspace-scoped REST routes contain a systemic object-le...	8.8 High	—	0,36%	21 Jul 2026
CVE-2026-47398 PraisonAI is a multi-agent teams system. The v4.6.32 chokepoint refactor (which patched CVE-2026-44334 / GHSA-xcmw-grxf-wjhj) added the PRAISONAI_ALLOW_LOCAL_TOOLS env-va...	8.1 High	—	0,50%	21 Jul 2026
CVE-2026-47397 PraisonAI is a multi-agent teams system. Prior to version 4.6.40, hidden metadata in a webpage causes PraisonAI agents to write attacker-controlled content to arbitrary p...	7.1 High	—	0,46%	21 Jul 2026
CVE-2026-44907 A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affe...	7.5 High	—	0,60%	21 Jul 2026
CVE-2026-24232 NVIDIA Tranformers4Rec contains a vulnerability where an attacker could cause improper deserialization of untrusted data. A successful exploit of this vulnerability might...	4.3 Medium	—	0,38%	21 Jul 2026
CVE-2026-16454 eclipse hawkbit In Eclipse hawkBit versions 1.0.3 and prior, a privilege escalation vulnerability (CWE-284 / CWE-862) has been identified in the Direct Device Integration (DDI) Controlle...	4.3 Medium	—	0,36%	21 Jul 2026
CVE-2026-16451 A security flaw has been discovered in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. This impacts an unknown function of the file /api/system/file/...	6.3 Medium	—	0,35%	21 Jul 2026
CVE-2026-15829 google mcp toolbox for databases A SQL injection (CWE-89) and security boundary bypass (CWE-863) vulnerability exists in the prebuilt BigQuery forecasting tool (bigquery-forecast) of googleapis/mcp-toolb...	8.1 High	—	0,20%	21 Jul 2026
CVE-2026-15793 mobyproject buildkit BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could...	7.5 High	—	0,20%	21 Jul 2026
CVE-2026-15792 mobyproject buildkit A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic.	7.5 High	—	0,24%	21 Jul 2026
CVE-2026-15791 mobyproject buildkit A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory. The action that can normally be used to delete files insid...	7.5 High	—	0,25%	21 Jul 2026
CVE-2026-15789 mobyproject buildkit A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have val...	7.5 High	—	0,31%	21 Jul 2026
CVE-2026-15724 progress sharefile storage zones controller In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated administrative user can exploit a path traversal vulnerability to read...	8.7 High	—	0,52%	21 Jul 2026
CVE-2026-15432 google tink java When verifying a mac with a ChunkedMacVerification object, Tink compares the resulting tag with non constant time comparison. This potentially allows an attacker to use t...	5.9 Medium	—	0,18%	21 Jul 2026
CVE-2026-15342 Plane contains a multi‑tenant authorization flaw in its asset‑management API that allows authenticated users from one workspace to access, delete, or duplicate assets bel...	6.5 Medium	—	0,38%	21 Jul 2026
CVE-2025-68640 The Apple Find My backend service through 2025-12-17 allows an attacker in possession of a valid PET (Private Endpoint Token) to enumerate devices and remove offline devi...	5.3 Medium	—	0,35%	21 Jul 2026
CVE-2026-64825 Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthenticated attackers to write arbitrary files to any directory on the host fi...	9.3 Critical	—	0,58%	21 Jul 2026
CVE-2026-64824 Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function that allows attackers to write files to arbitrary absolute file...	8.4 High	—	0,71%	21 Jul 2026
CVE-2026-64823 Home Assistant Core before 2026.5.4 contains a cross-site scripting vulnerability in the Shelly integration's async_get_media_image() method that allows attackers control...	4.7 Medium	—	0,30%	21 Jul 2026
CVE-2026-56586 hcltech intelliops event management HCL IEM was affected with X-Content-Type-Options Header Missing. It may enable attackers to perform SSL stripping or man-in-the-middle attacks and intercept sensitive dat...	4.2 Medium	—	0,20%	21 Jul 2026
CVE-2026-56585 hcltech intelliops event management HCL IEM was affected with the Anti Clickjacking XFrame Options Header Missing. It may allow attackers to embed the application in malicious pages and induce unauthorized...	4.3 Medium	—	0,25%	21 Jul 2026
CVE-2026-47396 PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's call server exposes a network-facing agent control API without authentication when `CALL_SER...	9.8 Critical	—	0,44%	21 Jul 2026
CVE-2026-47395 PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, PraisonAI's direct-prompt CLI automatic...	5.5 Medium	—	0,18%	21 Jul 2026
CVE-2026-47394 PraisonAI is a multi-agent teams system. Prior to version 4.6.40, the fix for GHSA-9mqq-jqxf-grvw / CVE-2026-44336 is incomplete. The original advisory description named...	8.7 High	—	0,50%	21 Jul 2026
CVE-2026-47393 PraisonAI is a multi-agent teams system. CVE-2026-44338 (GHSA-6rmh-7xcm-cpxj) documents that PraisonAI ships a code-generator (`praisonai.deploy.api.generate_api_server_c...	9.8 Critical	—	0,58%	21 Jul 2026
CVE-2026-47392 PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, `execute_code()` in `praisonaiagents/to...	9.9 Critical	—	0,88%	21 Jul 2026
CVE-2026-47391 PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's first-party A2A server example exposes an unauthenticated A2A JSON-RPC endpoint and register...	9.8 Critical	—	1,5%	21 Jul 2026
CVE-2026-47390 PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, `spider_tools` URL validation can be by...	5.5 Medium	—	0,18%	21 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.