Katalog CVE (hal. 928)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 267.428 (Critical 36.758 · High 106.883 · KEV 1.767 · sejak 2020) · Pembaruan terakhir: 4 Nov 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 46.351–46.400 dari 267.428 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-32824 dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing a...	7.3 High	—	0,34%	20 Jul 2026
CVE-2026-32823 dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing a...	4.3 Medium	—	0,14%	20 Jul 2026
CVE-2026-32821 dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing a...	8.1 High	—	0,35%	20 Jul 2026
CVE-2026-32820 dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing a...	7.5 High	—	0,89%	20 Jul 2026
CVE-2026-32819 dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing a...	4.3 Medium	—	0,27%	20 Jul 2026
CVE-2026-32806 dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing a...	7.5 High	—	0,39%	20 Jul 2026
CVE-2026-6793 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Bifra Engineering Consulting Ltd. Q-smart NexT Poll allows Stored XS...	5.4 Medium	—	0,23%	20 Jul 2026
CVE-2026-63429 HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `POST /api/upload` has no authentication guard, no global guard, no form-context validation, no `open...	8.6 High	—	0,51%	20 Jul 2026
CVE-2026-63428 HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `completeSubmission` accepts a `hiddenFields: [{id, name, value}]` array from the submitter and store...	5.8 Medium	—	0,34%	20 Jul 2026
CVE-2026-63102 rconfig rConfig Core before 8.2.8 contains a privilege escalation vulnerability that allows authenticated users to assign arbitrary roles to any account by submitting an unvalida...	5.4 Medium	—	0,33%	20 Jul 2026
CVE-2026-51027 An issue in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via the ft2.php component.	9.9 Critical	—	0,62%	20 Jul 2026
CVE-2026-51026 Directory Traversal vulnerability in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via a crafted request.	6.5 Medium	—	1,3%	20 Jul 2026
CVE-2026-48824 axllent mailpit Mailpit is an email testing tool and API for developers. Prior to version 1.30.1, the fix for GHSA-fpxj-m5q8-fphw (CVE-2026-45710, "Mailpit: Set a default 50MB p/m limit...	5.3 Medium	—	0,54%	20 Jul 2026
CVE-2026-46671 msiemens rust onenote file parser Rust OneNote File Parser is a parser for Microsoft OneNote files implemented in Rust. Prior to version 1.1.1, a maliciously crafted `.onetoc2` table-of-contents file can...	4.4 Medium	—	0,15%	20 Jul 2026
CVE-2026-46428 lettre is a a mailer library for Rust. Starting in version 0.10.1 and prior to version 0.11.22, an inverted-boolean bug in lettre's `boring-tls` integration silently disa...	9.1 Critical	—	0,32%	20 Jul 2026
CVE-2026-46415 The Caddy Defender plugin is a middleware for Caddy that allows users to block or manipulate requests based on the client's IP address. Prior to version 0.10.1, Caddy Def...	8.2 High	—	0,23%	20 Jul 2026
CVE-2026-46412 @beproduct/nestjs-auth is a NestJS authentication module for BeProduct IDS (Identity Server) with OpenID Connect support. Between 2026-05-11 20:19 UTC and 22:56 UTC, an a...	10.0 Critical	—	0,77%	20 Jul 2026
CVE-2026-45797 HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, the `/api/upload` endpoint allows unauthenticated file uploads including SVG files. Uploaded SVGs are...	6.4 Medium	—	0,57%	20 Jul 2026
CVE-2026-45713 axllent mailpit Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the Mailpit SMTP server has a Server.MaxSize int field that controls the maximum allowed...	7.5 High	—	0,61%	20 Jul 2026
CVE-2026-45712 axllent mailpit Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the screenshot/print proxy (/proxy?data=…) maintains a package-level assets map[string]M...	5.9 Medium	—	0,34%	20 Jul 2026
CVE-2026-45711 axllent mailpit Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the mailpit dump --http <base-url> <out-dir> sub-command downloads every message from a...	8.2 High	—	0,39%	20 Jul 2026
CVE-2026-45709 axllent mailpit Mailpit is an email testing tool and API for developers. The fix for GHSA-6jxm-fv7w-rw5j (CVE-2026-23845, "Server-Side Request Forgery (SSRF) via HTML Check API"), shippe...	5.8 Medium	—	0,32%	20 Jul 2026
CVE-2026-35198 HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting (XSS) vulnerability in the form builder allows a low-privileged team me...	9.0 Critical	—	0,49%	20 Jul 2026
CVE-2026-32822 dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing a...	6.1 Medium	—	0,28%	20 Jul 2026
CVE-2026-32807 dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing a...	7.5 High	—	0,39%	20 Jul 2026
CVE-2026-28220 wazuh Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.14.5, issues in the Cluster Distributed API (DAPI) handli...	9.1 Critical	—	0,66%	20 Jul 2026
CVE-2026-27823 A vulnerability has been identified in EGroupware that may lead to Remote Code Execution (RCE). The issue allows an authenticated attacker to execute arbitrary commands o...	8.7 High	—	0,98%	20 Jul 2026
CVE-2026-26199 hdfgroup hdf5 HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If `H5Iget_name` is invoked on a group id with `0` for the size pa...	6.5 Medium	—	0,35%	20 Jul 2026
CVE-2026-26197 hdfgroup hdf5 HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If a file is corrupted such that an array datatype's size, the num...	7.5 High	—	0,37%	20 Jul 2026
CVE-2026-26081 haproxy, haproxy aloha +1 lainnya HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.	4.8 Medium	—	0,48%	20 Jul 2026
CVE-2026-26080 haproxy, haproxy aloha +1 lainnya HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affected.	3.7 Low	—	0,55%	20 Jul 2026
CVE-2026-25039 Parsec is a cloud-based application for simple and cryptographically secure file sharing. The application does not sanitize the workspace name, creating a vulnerability i...	8.8 High	—	0,42%	20 Jul 2026
CVE-2026-21824 HCL Commerce contains an privilege escalation vulnerability that could allow denial of service, disclosure of user personal data, and performing of unauthorized administr...	8.8 High	—	0,42%	20 Jul 2026
CVE-2026-13724 Client-Side Enforcement of Server-Side Security vulnerability in Gobito Informatics Technologies Engineering Industry and Trade Ltd. Co. Corporate Training Management Sys...	4.3 Medium	—	0,28%	20 Jul 2026
CVE-2026-63091 proftpd ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the mod_sftp module's SCP size-record parser that allows authenticated low-privile...	6.5 Medium	—	0,53%	20 Jul 2026
CVE-2026-63090 proftpd ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp module that allows authenticated low-privilege attackers to achiev...	8.8 High	—	0,93%	20 Jul 2026
CVE-2026-63071 apache syncope Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy...	9.8 Critical	—	0,75%	20 Jul 2026
CVE-2026-62418 apache syncope Low-privileged authenticated Server-Side Request Forgery (SSRF) vulnerability in Apache Syncope via Connectors and Resources check. This issue affects Apache Syncope:...	8.1 High	—	0,47%	20 Jul 2026
CVE-2026-62183 apache syncope Improper Privilege Management vulnerability in Apache Syncope. When: * the all-Java user workflow adapter is configured, or * the Flowable user workflow adapter is conf...	9.8 Critical	—	0,69%	20 Jul 2026
CVE-2026-59238 Stored Cross-site Scripting (CWE-79) in the client-side report rendering functions (renderPreview, renderEditor, renderAuditData in js/app.js) in maalfer Pentestify befor...	6.9 Medium	—	0,56%	20 Jul 2026
CVE-2026-57308 apache syncope Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements can ach...	9.8 Critical	—	0,83%	20 Jul 2026
CVE-2026-54910 FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, the `subtitlesHandler` endpoint (`GET /api/media/subtitles`) accepts two...	7.7 High	—	0,38%	20 Jul 2026
CVE-2026-54685 FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.3.2-beta, the `/api/auth/login` authentication endpoint does not execute in constan...	5.3 Medium	—	0,34%	20 Jul 2026
CVE-2026-53421 apache syncope Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve remote code execution through the c...	9.8 Critical	—	1,1%	20 Jul 2026
CVE-2026-53405 apache syncope Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via...	9.8 Critical	—	0,75%	20 Jul 2026
CVE-2026-52349 Directory Traversal vulnerability in Menyoo 2.0 Versions before commit 729aa48: fixed in commit 729aa48 allows a local attacker to execute arbitrary code via the Spooner...	7.8 High	—	0,38%	20 Jul 2026
CVE-2026-46516 Frogman provides headless FreePBX control. Prior to version 1.6.6, Frogman's chat-console markdown formatter (`assets/js/chat.js`'s `formatMarkdown`) inserted regex captu...	4.8 Medium	—	0,44%	20 Jul 2026
CVE-2026-46410 FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable and 1.4.1-beta may leak some sensitive info, such as source and path. V...	8.7 High	—	0,45%	20 Jul 2026
CVE-2026-45270 CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the `Pages` backend module registers the `html_purify` validation rule on la...	8.7 High	—	0,26%	20 Jul 2026
CVE-2026-45139 CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Fileeditor module enforces an extension allowlist (`['css','js','html','...	6.5 Medium	—	0,32%	20 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.