Katalog CVE (hal. 944)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 267.555 (Critical 36.782 · High 106.936 · KEV 1.767 · sejak 2020) · Pembaruan terakhir: 4 Nov 2026, 12:27 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 47.151–47.200 dari 267.555 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-45785 OpenMcdf is a fully .NET / C# library to manipulate Compound File Binary File Format files, also known as Structured Storage. In 3.1.3 and earlier, the BST name-lookup lo...	6.2 Medium	—	0,18%	17 Jul 2026
CVE-2026-45784 sfackler openssl rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.50 until 0.10.80, CipherCtxRef::cipher_update_inplace in openssl/src/cipher_ctx.rs inc...	7.1 High	—	0,13%	17 Jul 2026
CVE-2026-44891 netty Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubfr...	7.5 High	—	0,73%	17 Jul 2026
CVE-2026-16074 A vulnerability was detected in AstrBotDevs AstrBot up to 4.25.2. This affects the function update_plugin/update_all_plugins of the file astrbot/dashboard/routes/plugin.p...	6.3 Medium	—	0,35%	17 Jul 2026
CVE-2026-13446 langflow IBM Langflow OSS 1.0.0 through 1.10.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound...	9.8 Critical	—	0,38%	17 Jul 2026
CVE-2026-13445 langflow IBM Langflow OSS 1.0.0 through 1.10.1 can allow an authenticated attacker to exploit the SaveToFile component to read and modify another user's uploaded files by specifyi...	8.1 High	—	0,35%	17 Jul 2026
CVE-2026-8861 ibm security verify access, ibm security verify access container +2 lainnya IBM Security Verify could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information co...	5.3 Medium	—	0,40%	17 Jul 2026
CVE-2026-8859 langflow IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow an attacker to write arbitrary files to unintended locations due to improper input validation in the APIRequest...	9.9 Critical	—	0,56%	17 Jul 2026
CVE-2026-8635 langflow IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to escalate privileges to superuser by directly manipulating the database, execute arbitrary system comma...	9.9 Critical	—	0,59%	17 Jul 2026
CVE-2026-8505 langflow IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. Th...	9.8 Critical	—	0,87%	17 Jul 2026
CVE-2026-8481 langflow IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the code validation API endpoint. The POST /api/v1/validate/code endpoint...	9.9 Critical	—	0,88%	17 Jul 2026
CVE-2026-8476 langflow IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the disk-based caching mechanism. The AsyncDiskCache class uses Python's u...	9.9 Critical	—	0,97%	17 Jul 2026
CVE-2026-8056 langflow IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to override component parameters at runtime via the API. A critical security flaw exists in the parameter...	8.8 High	—	0,53%	17 Jul 2026
CVE-2026-7872 langflow IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to read arbitrary files including the JWT signing key and forge authentication tokens for any user.	8.1 High	—	0,62%	17 Jul 2026
CVE-2026-7771 ibm db2 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a trap when compiling a specially crafted statements containing subqueries could lead to a denia...	5.5 Medium	—	0,15%	17 Jul 2026
CVE-2026-7755 langflow IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow remote code execution due to incomplete validation enforcement on MCP server configuration files.	8.8 High	—	0,75%	17 Jul 2026
CVE-2026-7754 langflow IBM Langflow OSS 1.0.0 through 1.10.0 Langflow 1.9.0 could allow server-side request forgery (SSRF) due to insecure default configuration and incomplete enforcement of th...	6.5 Medium	—	0,34%	17 Jul 2026
CVE-2026-7667 langflow IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to create a malicious flow pointing to an attacker-controlled URL that returns a specially crafted...	8.8 High	—	0,56%	17 Jul 2026
CVE-2026-7364 ibm security verify access, ibm security verify access container +2 lainnya IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 and IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM S...	6.1 Medium	—	0,36%	17 Jul 2026
CVE-2026-63030 Advisory wordpress WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL In...	9.8 Critical	KEV	10,6%	17 Jul 2026
CVE-2026-60137 Advisory wordpress WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Inject...	5.9 Medium	KEV	5,3%	17 Jul 2026
CVE-2026-55254 ncalc NCalc is a fast, lightweight expression evaluator for .NET. Prior to 6.1.1, the factorial operator implementation in src/NCalc.Core/Helpers/MathHelper.cs permits speciall...	6.5 Medium	—	0,29%	17 Jul 2026
CVE-2026-54465 faye websocket-driver websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.1, when websocket-driver is used to implement a WebSocket server on top of a TCP server...	7.5 High	—	0,49%	17 Jul 2026
CVE-2026-54464 ### Impact If this library is used in tandem with the `permessage-deflate` extension, a WebSocket server or client can be made to accept messages that are larger than th...	6.3 Medium	—	0,45%	17 Jul 2026
CVE-2026-54463 faye websocket-driver websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.1, draft versions of the WebSocket protocol in websocket-driver include a length header...	7.5 High	—	0,49%	17 Jul 2026
CVE-2026-54171 excon project excon Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects...	6.5 Medium	—	0,43%	17 Jul 2026
CVE-2026-52199 An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the sbin/adbd component	9.1 Critical	—	0,66%	17 Jul 2026
CVE-2026-51833 Xenforo 2.3.8 is vulnerable to SSRF. Attackers that have administrator privileges or are able to add/save RSS feeds can enumerate internal services (ports) or expose the...	7.5 High	—	0,41%	17 Jul 2026
CVE-2026-50289 systeminformation systeminformation is a System and OS information library for node.js. Prior to 5.31.7, networkInterfaces() on Linux is vulnerable to OS command injection through the Debi...	8.8 High	—	2,2%	17 Jul 2026
CVE-2026-50197 Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.10, zalando/skipper's OpenPolicyAgent integration silently bypasses request-body inspec...	7.8 High	—	0,51%	17 Jul 2026
CVE-2026-50163 oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract ba...	7.1 High	—	0,40%	17 Jul 2026
CVE-2026-50162 oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, resolveWritePath() in content/file/file.go uses a lexical filepath.Rel check for workingDir and does n...	6.9 Medium	—	0,44%	17 Jul 2026
CVE-2026-50151 linuxfoundation oras oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled...	7.5 High	—	0,38%	17 Jul 2026
CVE-2026-49852 joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.6.8, joserfc.jwt.decode accepts att...	8.7 High	—	0,17%	17 Jul 2026
CVE-2026-4942 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to send a specifically crafted message and downgrade the Transport Layer Security (TLS) protocol to a version d...	7.5 High	—	0,43%	17 Jul 2026
CVE-2026-4938 ibm security verify access, ibm security verify access container +2 lainnya IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 and IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM S...	6.5 Medium	—	0,30%	17 Jul 2026
CVE-2026-49834 sigstore-go sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.0, a verifier configured with WithTransparencyLog(N>1) or WithSignedCertificateTimestamps(...	7.5 High	—	0,18%	17 Jul 2026
CVE-2026-49284 simplesamlphp SimpleSAMLphp versions before 1.18.6 contain an information disclosure vulnerability. Prior to 2.4.7 and 2.5.2, SimpleSAMLphp's SAML SP ACS path does not enforce the IdP...	7.1 High	—	0,22%	17 Jul 2026
CVE-2026-48978 oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validat...	2.1 Low	—	0,21%	17 Jul 2026
CVE-2026-48819 Hey API is an ecosystem for turning API specifications into production-ready code. Prior to 0.97.3, dist/clients/core/params.ts ships a runtime template copied into gener...	4.8 Medium	—	0,27%	17 Jul 2026
CVE-2026-48504 OpenTelemetry Rust is the Rust OpenTelemetry implementation. In 0.32.0 and earlier, BaggagePropagator::extract_with_context in opentelemetry_sdk did not enforce W3C Bagga...	5.3 Medium	—	0,42%	17 Jul 2026
CVE-2026-48373 adobe acrobat, adobe acrobat dc +1 lainnya Acrobat Reader is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of...	7.8 High	—	0,34%	17 Jul 2026
CVE-2026-46420 shivammathur setup php setup-php is a GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and tools. From 2.25.0 prior to 2.37.1, shivammathur/setup-php resolv...	9.8 Critical	—	2,0%	17 Jul 2026
CVE-2026-45799 squareup wire Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.3.0 and 7.0.0-alpha03, ByteArrayProtoReader32.skipGroup() and ProtoReader.skipGro...	7.5 High	—	0,73%	17 Jul 2026
CVE-2026-45704 Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.6, CustomReports uses inconsistent authorization between the report listi...	7.1 High	—	0,43%	17 Jul 2026
CVE-2026-45260 Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, Pimcore's WebDAV asset endpoint exposes a MOVE operation through /asse...	8.1 High	—	0,64%	17 Jul 2026
CVE-2026-44974 @hapi/content provided HTTP Content-* headers parsing. Prior to 6.0.2, Content.disposition() retained the last occurrence of each duplicate parameter while Content.type()...	7.7 High	—	0,47%	17 Jul 2026
CVE-2026-44739 Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.6, the columnConfigAction endpoint in bundles/CustomReportsBundle/src/Con...	8.7 High	—	0,39%	17 Jul 2026
CVE-2026-42168 django-pyas2 through 1.2.3 is vulnerable to OS command injection via the cmd_receive and cmd_send fields on the Partner model. These fields are passed directly to os.syst...	9.1 Critical	—	2,1%	17 Jul 2026
CVE-2026-36669 An unauthenticated arbitrary file upload vulnerability in ck_upload_handler.php in Feng Office 3.11.13.11 allows remote attackers to upload malicious files (such as .html...	9.8 Critical	—	0,66%	17 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.