Katalog CVE (hal. 93) — KUTIM-CSIRT

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 258.538 (Critical 35.913 · High 103.408 · KEV 1.745 · sejak 2020) · Pembaruan terakhir: 16 Okt 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 4.601–4.650 dari 258.538 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-107837 RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, _receive() in sys/net/...	8.2 High	—	0,38%	9 Okt 2026
CVE-2026-107836 RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, the nanoCoAP client fu...	7.1 High	—	0,29%	9 Okt 2026
CVE-2026-107835 OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.8.1, internal/cookies.ParseCookies in internal/cookies/cookies.go handles...	4.0 Medium	—	0,30%	9 Okt 2026
CVE-2026-107834 OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multipart loop in internal/bodyprocessors/multipart.go e...	5.3 Medium	—	0,32%	9 Okt 2026
CVE-2026-107833 OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes th...	5.9 Medium	—	0,39%	9 Okt 2026
CVE-2026-107826 OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON in internal/bodyprocessors/json.go can stop its bou...	7.5 High	—	0,46%	9 Okt 2026
CVE-2026-107825 OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessURI in internal/corazawaf/transaction.go handles a ur...	4.0 Medium	—	0,25%	9 Okt 2026
CVE-2026-107824 x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.1, x64dbg-MCP Server exp...	9.3 Critical	—	0,40%	9 Okt 2026
CVE-2026-107823 mariadb MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did no...	7.2 High	—	0,71%	9 Okt 2026
CVE-2026-107822 mariadb MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate...	6.4 Medium	—	0,48%	9 Okt 2026
CVE-2026-107821 mariadb MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated c...	8.0 High	—	0,76%	9 Okt 2026
CVE-2026-107820 x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.2, src/core/mcp_server.z...	5.3 Medium	—	0,41%	9 Okt 2026
CVE-2026-107819 MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb...	5.9 Medium	—	0,24%	9 Okt 2026
CVE-2026-107818 mariadb MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run...	8.4 High	—	0,34%	9 Okt 2026
CVE-2026-107817 mariadb MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql_json plugin assumed that...	4.4 Medium	—	0,14%	9 Okt 2026
CVE-2026-107816 mariadb MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confus...	6.4 Medium	—	0,31%	9 Okt 2026
CVE-2026-75597 pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the `/web/<path:filename>` route in `src/pyload/webui/app/blueprints/app_blu...	5.3 Medium	—	0,30%	9 Okt 2026
CVE-2026-75347 EIPStackGroup OpENer v2.3 and master up to commit 76b95cf contain an expired pointer dereference vulnerability in the EtherNet/IP Common Packet Format (CPF) handling logi...	7.5 High	—	0,42%	9 Okt 2026
CVE-2026-55797 Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to...	8.8 High	—	1,5%	9 Okt 2026
CVE-2026-48484 pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API `rpc` function in `api_blueprint.py` handles `multipart/form-data` u...	6.5 Medium	—	0,31%	9 Okt 2026
CVE-2026-42695 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allow...	6.5 Medium	—	0,13%	9 Okt 2026
CVE-2026-108160 AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers to deliver malicious updates by abusing the deskto...	7.5 High	—	0,15%	9 Okt 2026
CVE-2026-108159 AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat that allows remote attackers to execute OS commands by...	7.5 High	—	0,33%	9 Okt 2026
CVE-2026-108158 plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the whiteboard conversion endpoint that allows any meeting participant to read server files via...	6.5 Medium	—	0,33%	9 Okt 2026
CVE-2026-108157 Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to take over accounts by abusing...	8.1 High	—	0,53%	9 Okt 2026
CVE-2026-108156 LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skills:delete IPC handler that trusts the openclawSourceDir value fro...	7.1 High	—	0,12%	9 Okt 2026
CVE-2026-108119 A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets does not validate that the reso...	6.3 Medium	—	0,14%	9 Okt 2026
CVE-2026-108093 A flaw was found in GIMP. The XCF loader processes image-simulation-intent and image-simulation-bpc parasites without ensuring the parasite data is present before derefer...	5.5 Medium	—	0,11%	9 Okt 2026
CVE-2026-107815 mariadb MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table typ...	8.5 High	—	0,90%	9 Okt 2026
CVE-2016-20098 Moderator Toolbox (reddit-moderator-toolbox) before 4.0.14 contains a stored cross-site scripting vulnerability in the removalreasons module, which inserts subreddit tool...	5.4 Medium	—	0,17%	9 Okt 2026
CVE-2026-90983 Use of Client-Side authentication vulnerability in Hayat Health Facilities Inc. (Hayat Hospital) Hayat Mobile allows Authentication Bypass. This issue affects Hayat Mobi...	8.2 High	—	0,26%	9 Okt 2026
CVE-2026-75346 An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master through commit 76b95cf in the server-side CIP SetAttributeList service. This allows a r...	7.5 High	—	0,54%	9 Okt 2026
CVE-2026-75349 EIPStackGroup OpENer v2.3.0/master up to commit 76b95cf contains an out-of-bounds read vulnerability in Connection Manager request parsing. This allows a remote attacker...	7.5 High	—	0,45%	9 Okt 2026
CVE-2026-75348 An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master up to commit 76b95cf in the EtherNet/IP TCP SendRRData Common Packet Format parser. The...	7.5 High	—	0,51%	9 Okt 2026
CVE-2026-75345 OpENer v2.3.0 / commit 76b95cf contains an out-of-bounds read in the unconnected explicit messaging path. This allows a remote attacker to cause a denial of service.	7.5 High	—	0,45%	9 Okt 2026
CVE-2026-108113 ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerability in QTI question import image handling (ilQtiMatImageSecurity) that allows authentica...	8.8 High	—	0,64%	9 Okt 2026
CVE-2026-108112 ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' workflows via POST /workflow/del/{uuid}...	5.4 Medium	—	0,22%	9 Okt 2026
CVE-2026-108111 ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow/search endpoint that exposes other users' private workflows. Authenticate...	4.3 Medium	—	0,20%	9 Okt 2026
CVE-2026-108110 MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to access other users' stored objects...	6.8 Medium	—	0,24%	9 Okt 2026
CVE-2026-107814 mariadb MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the d...	8.4 High	—	0,28%	9 Okt 2026
CVE-2026-107813 Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node and namespace mutation operations and cluster-wide...	8.8 High	—	0,31%	9 Okt 2026
CVE-2026-107812 Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the self-upgrade mechanism validates a downloaded binary only with a same-origin digest...	7.5 High	—	0,17%	9 Okt 2026
CVE-2026-107811 Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose responses...	8.8 High	—	0,36%	9 Okt 2026
CVE-2026-107810 Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts inner archives before applying the restore_nginx an...	8.1 High	—	0,36%	9 Okt 2026
CVE-2026-107809 Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential after the fron...	8.8 High	—	0,19%	9 Okt 2026
CVE-2026-107808 Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a WebAuthn assertion when Enable...	8.1 High	—	0,41%	9 Okt 2026
CVE-2026-107807 Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the node_secret query parame...	8.8 High	—	0,31%	9 Okt 2026
CVE-2026-107783 Insertion of sensitive information into log file in AWS Tools for PowerShell before 5.0.306 might allow local users to recover an IAM user's cleartext AWS Management Cons...	5.9 Medium	—	0,10%	9 Okt 2026
CVE-2026-104084 SmarterMail before build 9777 contains a privilege escalation vulnerability where JWT access and refresh tokens embed a role claim at issuance that is not revalidated aga...	8.8 High	—	0,27%	9 Okt 2026
CVE-2026-104083 SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that allows remote attackers to inject executable script by placing payloads i...	6.1 Medium	—	0,29%	9 Okt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.