Katalog CVE (hal. 946)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 267.555 (Critical 36.782 · High 106.936 · KEV 1.767 · sejak 2020) · Pembaruan terakhir: 4 Nov 2026, 12:27 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 47.251–47.300 dari 267.555 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-63308 helm Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to...	6.5 Medium	—	0,49%	17 Jul 2026
CVE-2026-63307 Chat2DB before 5.3.0 contains an insecure direct object reference vulnerability in the GET /api/connection/datasource/{id} endpoint. The handler calls dataSourceService.q...	6.5 Medium	—	0,40%	17 Jul 2026
CVE-2026-63101 Open Event Server through 1.19.1 contains a missing authentication vulnerability that allows unauthenticated attackers to export the complete member roster of any group,...	7.5 High	—	0,52%	17 Jul 2026
CVE-2026-57860 ForgeCode (tailcallhq/forgecode), an AI pair-programming CLI, automatically loads and executes the MCP servers defined in a repository's .mcp.json file on startup without...	7.8 High	—	0,21%	17 Jul 2026
CVE-2026-54496 ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad 5.0.0, halo2_gadgets 0.5.0, orchard 0.14.0, zcash_primitives 0.28.0, and zcashd 6.20.0, the variable-base...	9.3 Critical	—	0,32%	17 Jul 2026
CVE-2026-49216 symfony ux Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, the Stimulus controller in symfony/ux-autocomplete renders AJAX response items in _cr...	5.4 Medium	—	0,31%	17 Jul 2026
CVE-2026-49215 symfony ux Symfony UX is a JavaScript ecosystem for Symfony. From 2.22.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\EventListener\LiveComponentSubscriber::isLiveComponentReque...	5.4 Medium	—	0,18%	17 Jul 2026
CVE-2026-49212 symfony ux Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, the HMAC computed by Symfony\UX\LiveComponent\LiveComponentHydrator covered only sort...	7.5 High	—	0,24%	17 Jul 2026
CVE-2026-49211 symfony ux Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, Symfony\UX\Autocomplete\Doctrine\EntitySearchUtil::addSearchClause() builds the LIKE...	7.5 High	—	0,53%	17 Jul 2026
CVE-2026-49210 symfony ux Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Util\ChildComponentPartialRenderer::createHtml() interpolate...	6.1 Medium	—	0,34%	17 Jul 2026
CVE-2026-49209 symfony ux Symfony UX is a JavaScript ecosystem for Symfony. From 2.5.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Controller\BatchActionController::__invoke() iterates over t...	6.5 Medium	—	0,56%	17 Jul 2026
CVE-2026-49208 symfony ux Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, when a #[LiveProp] is typed as DateTimeInterface and no explicit format is configured...	5.3 Medium	—	0,41%	17 Jul 2026
CVE-2026-44722 pyzipper is a replacement for Python's zipfile that can read and write AES encrypted zip files. Prior to 0.4.0, a Python operator precedence bug in pyzipper/zipfile_aes.p...	6.2 Medium	—	0,12%	17 Jul 2026
CVE-2026-21764 hcltech devops loop HCL DevOps Loop is affected by insufficient input validation that allows special characters where they should be restricted. This may result in unintended application beh...	4.3 Medium	—	0,22%	17 Jul 2026
CVE-2026-21762 hcltech devops loop HCL DevOps Loop is affected by missing HTTP security headers. Missing security headers may reduce browser protections against common web-based attacks such as clickjackin...	5.3 Medium	—	0,29%	17 Jul 2026
CVE-2026-21761 hcltech devops loop HCL DevOps Loop is affected by a Cross-Origin Resource Sharing (CORS) misconfiguration. Improper CORS configuration may allow unauthorized cross-origin requests, potentia...	5.4 Medium	—	0,20%	17 Jul 2026
CVE-2026-21760 hcltech devops loop HCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality (Forced Browsing) vulnerability. Improper authorization checks may allow unauthorized users t...	4.6 Medium	—	0,21%	17 Jul 2026
CVE-2026-16108 redhat build of keycloak A flaw was found in the default-groups REST endpoint and realm representation of Keycloak. This component is responsible for managing groups that are automatically assign...	6.5 Medium	—	0,37%	17 Jul 2026
CVE-2026-16106 redhat build of keycloak A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated administrator attempts to remove a ch...	4.9 Medium	—	0,42%	17 Jul 2026
CVE-2026-16104 redhat build of keycloak A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identity and acce...	6.5 Medium	—	0,46%	17 Jul 2026
CVE-2026-16103 redhat build of keycloak A flaw was found in the keycloak-services component of Keycloak. This issue is an incomplete fix for CVE-2026-9798, where brute-force protection checks were added to the...	4.3 Medium	—	0,35%	17 Jul 2026
CVE-2026-16093 redhat build of keycloak, redhat data grid +2 lainnya Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, such as requiring them to use signed JWTs for authentication. A flaw was...	5.4 Medium	—	0,39%	17 Jul 2026
CVE-2026-12694 Missing Authorization vulnerability in Vimesoft Inc. Enterprise Video Platform allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Enterp...	9.1 Critical	—	0,44%	17 Jul 2026
CVE-2026-12693 Authorization bypass through User-Controlled key vulnerability in Vimesoft Inc. Enterprise Video Platform allows Accessing Functionality Not Properly Constrained by ACLs....	9.4 Critical	—	0,46%	17 Jul 2026
CVE-2026-12692 Unverified password change vulnerability in Vimesoft Inc. Enterprise Video Platform allows Authentication Bypass. This issue affects Enterprise Video Platform: from 3.11...	9.8 Critical	—	0,64%	17 Jul 2026
CVE-2026-12691 Missing authentication for critical function vulnerability in Vimesoft Inc. Enterprise Video Platform allows Authentication Bypass. This issue affects Enterprise Video P...	7.5 High	—	0,52%	17 Jul 2026
CVE-2026-11763 Authorization bypass through User-Controlled key vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. GisLab Laboratory Manag...	6.5 Medium	—	0,36%	17 Jul 2026
CVE-2026-9537 Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison. The decode() method compares the supplied signature to the rec...	5.3 Medium	—	0,32%	17 Jul 2026
CVE-2026-63100 Maybe through 0.6.0 contains a missing authorization vulnerability that allows authenticated low-privilege member-role users to access and modify global hosting settings...	6.5 Medium	—	0,35%	17 Jul 2026
CVE-2026-63099 TheHive through 4.1.24 contains a broken object-level authorization vulnerability in the attachment download endpoints that allows any authenticated user to access attach...	6.5 Medium	—	0,35%	17 Jul 2026
CVE-2026-63098 strangebee thehive TheHive through 4.1.24 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive configuration data by...	5.3 Medium	—	0,45%	17 Jul 2026
CVE-2026-63097 Dendrite through 0.13.8 contains an improper access control vulnerability in the syncapi /context endpoint (syncapi/routing/context.go) that allows authenticated local us...	4.3 Medium	—	0,27%	17 Jul 2026
CVE-2026-63096 Dendrite through 0.13.8 contains a server-side request forgery vulnerability that allows unauthenticated attackers to cause the server to open outbound TLS connections to...	5.8 Medium	—	0,34%	17 Jul 2026
CVE-2026-63095 Dendrite through 0.13.8 contains an improper authorization vulnerability in the Matrix Client-Server API that allows any authenticated local user to delete third-party id...	6.5 Medium	—	0,30%	17 Jul 2026
CVE-2026-60025 Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0 - The Joomla extension Events Booking prior version 5.8.0 had an frontend file upload end...	8.8 High	—	0,20%	17 Jul 2026
CVE-2026-60024 Joomla Extension - joomdonation.com - Insecure default configuration Events Booking < 5.8.0 - The Joomla extension Events Booking prior version 5.8.0 did by default allow...	9.8 Critical	—	0,55%	17 Jul 2026
CVE-2026-58149 Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0 - The Joomla extension Events Booking is vulnerable to an unauthenticated user enumeratio...	5.3 Medium	—	0,35%	17 Jul 2026
CVE-2026-58148 Joomla Extension - chronoengine.com - Stored XSS in ChronoForms extension for Joomla 8.0 - 8.0.52 - The Joomla extension ChronoForms is vulnerable to an unauthenticated s...	8.7 High	—	0,44%	17 Jul 2026
CVE-2026-15783 A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with write access to any repository to read metadata f...	5.3 Medium	—	0,45%	17 Jul 2026
CVE-2026-15343 A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker with code execution inside a Dependabot updater container to write file...	8.6 High	—	0,75%	17 Jul 2026
CVE-2026-15007 A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user to cause service disruption by supplying a repository rele...	5.7 Medium	—	0,64%	17 Jul 2026
CVE-2026-14871 osTicket versions v1.18.3 and v1.17.7 contain a Broken Object Level Authorization (BOLA) leading to Insecure Direct Object Reference (IDOR) in the AJAX ticket-management...	7.1 High	—	0,43%	17 Jul 2026
CVE-2026-14741 HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date. parse_date() matches the date string against a chain of al...	7.5 High	—	0,63%	17 Jul 2026
CVE-2026-12715 Missing Authorization in Google Cloud Firebase Studio versions prior to 2026-04-15 on Google Cloud Platform allows an attacker to download other users' deployed source co...	8.5 High	—	0,35%	17 Jul 2026
CVE-2026-63094 SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from any user o...	8.1 High	—	0,26%	17 Jul 2026
CVE-2026-63093 anysphere cursor Cursor for Windows version 3.2.16 contains a binary planting vulnerability that allows remote attackers to achieve arbitrary code execution by placing a malicious git.exe...	8.8 High	—	0,85%	17 Jul 2026
CVE-2026-51083 Incorrect access control in Proxmox Virtual Environment (PVE) 9.x qemu-server before 9.1.8 and 8.x before 8.4.8 allows users within limited privileges to obtain hashed pa...	6.5 Medium	—	0,34%	17 Jul 2026
CVE-2026-51082 A race condition between the vncproxy and vncwebsocket API calls in Proxmox Virtual Environment (PVE) 9.x pve-manager before 9.1.9 and 8.x before 8.4.19; qemu-server 9.x...	7.2 High	—	0,39%	17 Jul 2026
CVE-2026-51081 A cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment (PVE) 9.x 5.1.8 and Proxmox Virtual Environment (PVE) 8.x 4.3.16 allows attackers to execute arb...	6.1 Medium	—	0,25%	17 Jul 2026
CVE-2026-16089 redhat build of keycloak A flaw was found in the keycloak-services component of Red Hat Build of Keycloak. The issue occurs because OAuth 2.0 authorization codes are not properly bound to the cli...	5.9 Medium	—	0,30%	17 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.