Katalog CVE (hal. 942)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 267.555 (Critical 36.782 · High 106.936 · KEV 1.767 · sejak 2020) · Pembaruan terakhir: 4 Nov 2026, 12:27 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 47.051–47.100 dari 267.555 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-16154 A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0/1.php. Affected by this vulnerability is an unknown functionality of the file /edit...	7.3 High	—	0,43%	18 Jul 2026
CVE-2026-16152 A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /edit_rooma.php. Performing a manipulation...	7.3 High	—	0,43%	18 Jul 2026
CVE-2026-12228 lollms A stored cross-site scripting (XSS) vulnerability exists in the `POST /api/prompts/share` endpoint of parisneo/lollms (latest version). The endpoint stores attacker-contr...	5.4 Medium	—	0,33%	18 Jul 2026
CVE-2026-57848 Stoat for Android exports the chat.stoat.activities.ShareTargetActivity component (reachable to any process on the device via the android.intent.action.SEND intent) and a...	5.5 Medium	—	0,20%	18 Jul 2026
CVE-2026-53994 proftpd ProFTPD mod_sftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The fxp_packet_read() function accepts the attacker-supplied 32-bit big-en...	6.5 Medium	—	0,45%	18 Jul 2026
CVE-2026-16151 A vulnerability has been found in CartoDB carto-api-client 0.5.29. This impacts the function addFilter of the file src/filters.ts. Such manipulation of the argument colum...	6.3 Medium	—	0,45%	18 Jul 2026
CVE-2026-16150 A vulnerability was found in RobinHerbots Inputmask up to 5.0.9. Affected by this issue is the function extendDefaults/extendDefinitions/extendAliases in the library lib/...	6.3 Medium	—	0,45%	18 Jul 2026
CVE-2026-16133 A flaw has been found in LiuMengxuan04 MiniCode 0.1.0. Affected by this vulnerability is the function child_process.spawn of the file mcp.ts. Executing a manipulation can...	5.0 Medium	—	1,2%	18 Jul 2026
CVE-2026-16131 A weakness has been identified in itsourcecode Hospital Management System 1.0. This affects an unknown function of the file /prescriptionrecord.php. This manipulation of...	6.3 Medium	—	0,33%	18 Jul 2026
CVE-2026-16130 A vulnerability was identified in nearai ironclaw up to 0.29.1. The affected element is the function validate_path of the file src/tools/builtin/path_utils.rs of the comp...	4.4 Medium	—	0,17%	18 Jul 2026
CVE-2026-16129 A vulnerability has been found in princezuda SafestClaw up to 4.2.4. This vulnerability affects the function ShellAction._validate_command of the file src/safestclaw/acti...	5.3 Medium	—	0,32%	18 Jul 2026
CVE-2026-16128 A security flaw has been discovered in zevorn rt-claw up to 0.2.0. This impacts the function receiver_thread of the file claw/services/swarm/swarm.c of the component http...	7.3 High	—	0,50%	18 Jul 2026
CVE-2026-16127 A vulnerability was identified in zevorn rt-claw up to 0.2.0. This affects the function claw_net_get/claw_net_post of the file claw/tools/tool_net.c of the component http...	7.3 High	—	0,50%	18 Jul 2026
CVE-2026-16126 A vulnerability was determined in zevorn rt-claw up to 0.2.0. The impacted element is the function handle_rpc_request of the file claw/services/swarm/swarm.c of the compo...	7.3 High	—	0,51%	18 Jul 2026
CVE-2026-16125 A vulnerability was found in zevorn rt-claw up to 0.2.0. The affected element is the function claw_net_get/claw_net_post of the file claw/services/tools/net.c of the comp...	7.3 High	—	0,50%	18 Jul 2026
CVE-2026-16124 A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.15.0-beta.32. This affects the function CheckSSRF/isPrivateIP of the file internal/tools/web...	6.3 Medium	—	0,47%	18 Jul 2026
CVE-2026-16123 A weakness has been identified in nextlevelbuilder GoClaw up to 3.13.2. Affected by this issue is the function ToolsInvokeHandler.ServeHTTP of the file internal/http/tool...	6.3 Medium	—	0,37%	18 Jul 2026
CVE-2026-16122 A security flaw has been discovered in nextlevelbuilder GoClaw up to 3.13.2. Affected by this vulnerability is the function extractBin/RequestApproval/matchesAllowlist of...	4.3 Medium	—	0,31%	18 Jul 2026
CVE-2026-16121 A vulnerability was identified in nextlevelbuilder GoClaw up to 3.13.2. Affected is the function isSafeBin of the file internal/tools/exec_approval.go. The manipulation l...	6.3 Medium	—	0,37%	18 Jul 2026
CVE-2026-9323 The urwid web display backend (urwid/display/web.py) generates web session identifiers (urwid_id) in Screen.start() by concatenating two random.randrange(10**9) calls tha...	8.1 High	—	0,72%	18 Jul 2026
CVE-2026-16120 A vulnerability was determined in nextlevelbuilder GoClaw up to 3.13.3-beta.3. This impacts the function matchesAllowlist/extractBin of the file internal/tools/exec_appro...	6.3 Medium	—	0,40%	18 Jul 2026
CVE-2026-16119 A vulnerability was found in nextlevelbuilder GoClaw up to 3.13.2. This affects the function RequestApproval of the file internal/tools/exec_approval.go of the component...	6.3 Medium	—	0,40%	18 Jul 2026
CVE-2026-16117 fastify/http-proxy Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes pa...	10.0 Critical	—	0,44%	18 Jul 2026
CVE-2026-11826 OpenPLC_v3 contains a heap-based buffer overflow in the getData() function in webserver/core/modbus_master.cpp. getData() reads characters between two delimiters into a c...	8.8 High	—	0,75%	18 Jul 2026
CVE-2025-71398 surrealdb SurrealDB before 2.2.2 fails to validate HTTP redirects in http functions, allowing authenticated users to bypass deny-net restrictions by redirecting to blocked IP addre...	7.6 High	—	0,33%	18 Jul 2026
CVE-2025-71397 surrealdb SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 allows authenticated users with OWNER or EDITOR permissions (at the root, namespace, or database level)...	6.5 Medium	—	0,55%	18 Jul 2026
CVE-2025-71396 surrealdb SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 does not enforce a default execution-time limit on embedded JavaScript scripting functions when the scr...	6.5 Medium	—	0,55%	18 Jul 2026
CVE-2025-71395 surrealdb SurrealDB versions before 2.2.2 contain a memory exhaustion vulnerability in the string::replace function that fails to restrict resulting string length when using regex...	6.5 Medium	—	0,45%	18 Jul 2026
CVE-2025-71394 surrealdb SurrealDB versions before 2.2.2 contain a local file read vulnerability in the DEFINE ANALYZER statement that allows authenticated users to read arbitrary files on the fi...	4.3 Medium	—	0,37%	18 Jul 2026
CVE-2025-71393 surrealdb SurrealDB before 2.2.2 with scripting enabled fails to properly enforce recursion limits when native functions contain embedded JavaScript that issues new queries. Authen...	6.5 Medium	—	0,46%	18 Jul 2026
CVE-2025-71392 surrealdb SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. An authenticated Sys...	8.0 High	—	0,44%	18 Jul 2026
CVE-2025-71391 surrealdb SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module that allows authenticated users to crash the database. Attackers can send cr...	6.5 Medium	—	0,56%	18 Jul 2026
CVE-2025-71390 surrealdb SurrealDB before 2.2.6, 2.3.6, and 2.1.8 (and 3.0.0-alpha.7 and earlier) fails to validate DNS-resolved hostnames against --deny-net network access restrictions in its ht...	8.8 High	—	0,45%	18 Jul 2026
CVE-2024-58370 surrealdb SurrealDB versions before 1.1.0 fail to enforce recursion depth limits when parsing nested SurrealQL statements including IF, RELATE, and attribute access idioms. Authori...	6.5 Medium	—	0,49%	18 Jul 2026
CVE-2024-58369 surrealdb SurrealDB versions before 1.1.1 fail to properly validate invocation of custom parameters and functions at root or namespace levels, causing server panic. Authorized clie...	6.5 Medium	—	0,45%	18 Jul 2026
CVE-2024-58368 surrealdb SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API requests containing special characters. Unauthenticated attackers can s...	7.5 High	—	0,65%	18 Jul 2026
CVE-2024-58367 surrealdb SurrealDB versions before 2.0.4 fail to properly enforce field permissions during SELECT, UPDATE, and DELETE operations, allowing authorized users to access unauthorized...	6.5 Medium	—	0,36%	18 Jul 2026
CVE-2024-58366 delskayn rquickjs, surrealdb SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privilege...	8.8 High	—	0,58%	18 Jul 2026
CVE-2024-58365 surrealdb SurrealDB versions before 1.2.0 contain an uncaught exception vulnerability in the query executor when processing calls to nonexistent built-in functions. Authorized clie...	6.5 Medium	—	0,45%	18 Jul 2026
CVE-2024-58364 surrealdb SurrealDB versions before 1.2.1 contain an uncaught exception handling vulnerability in span rendering when parsing queries with errors on line terminator characters. Aut...	6.5 Medium	—	0,45%	18 Jul 2026
CVE-2024-58363 surrealdb SurrealDB before 1.5.4 and 2.0.0-alpha.1 before 2.0.0-alpha.6 fails to properly validate authentication when a scope user switches databases using the USE clause or use m...	6.3 Medium	—	0,34%	18 Jul 2026
CVE-2024-58362 surrealdb SurrealDB before 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) accepts an arbitrary object in the signin and signup operations of the RPC API without recursively validating...	8.8 High	—	0,64%	18 Jul 2026
CVE-2024-58361 surrealdb SurrealDB versions before 2.0.4 contain an uncaught exception handling vulnerability in the parser error rendering code when processing empty strings. Authorized clients...	6.5 Medium	—	0,45%	18 Jul 2026
CVE-2024-58359 surrealdb SurrealDB versions before 2.1.0 contain a denial of service vulnerability in the sorting mechanism when using ORDER BY rand() clause. Authorized clients can execute queri...	6.5 Medium	—	0,45%	18 Jul 2026
CVE-2024-58358 surrealdb SurrealDB versions before 2.1.0 contain a denial of service vulnerability in role conversion that allows privileged owner users to define users with nonexistent roles. At...	4.9 Medium	—	0,47%	18 Jul 2026
CVE-2024-58357 surrealdb SurrealDB versions before 2.1.0 contain an uncaught exception vulnerability in the rand::time() function that panics when unwrap is called on a None result from timestamp...	6.5 Medium	—	0,45%	18 Jul 2026
CVE-2024-58356 surrealdb SurrealDB before 2.1.4 silently fails to overwrite table definitions when the DEFINE TABLE ... OVERWRITE clause is used on tables defined with TYPE RELATION. Because tabl...	6.3 Medium	—	0,27%	18 Jul 2026
CVE-2023-54366 surrealdb SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and DELETE operations on tables without explicit permissio...	8.8 High	—	0,46%	18 Jul 2026
CVE-2026-9147 uproot dynamically generates Python class source code from ROOT TStreamerInfo records in a file and compiles it at runtime. Some file-controlled streamer metadata fields...	7.8 High	—	0,22%	18 Jul 2026
CVE-2026-59173 apache traffic server Uncontrolled Resource Consumption vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.13, from 10.0.0 through 10.1.2...	7.5 High	—	0,74%	18 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.