Katalog CVE (hal. 952)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 267.603 (Critical 36.783 · High 106.969 · KEV 1.767 · sejak 2020) · Pembaruan terakhir: 4 Nov 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 47.551–47.600 dari 267.603 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-46377 Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the escape sequence handler in (*Tokenizer).p...	6.2 Medium	—	0,19%	16 Jul 2026
CVE-2026-46353 BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web checksum validation could be bypassed when a presentationUploadExternalUrl parameter was suppl...	8.1 High	—	0,48%	16 Jul 2026
CVE-2026-46351 BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web generated conference sessionToken values with insufficiently secure randomness in bbb-common-w...	8.1 High	—	0,46%	16 Jul 2026
CVE-2026-46338 facelessuser pymdown extensions PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in...	4.3 Medium	—	0,40%	16 Jul 2026
CVE-2026-46687 Emlog is an open source website building system. In 2.6.13 and earlier, the article publishing interface stores a path-traversal template parameter from api_controller.ph...	7.7 High	—	0,44%	16 Jul 2026
CVE-2026-46686 Emlog is an open source website building system. In 2.6.13 and earlier, the admin backend user search module's keyword parameter from admin/user.php is processed with add...	8.5 High	—	0,44%	16 Jul 2026
CVE-2026-46341 The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.9....	6.1 Medium	—	0,23%	16 Jul 2026
CVE-2026-46336 Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. From 0.96.0 until 0.140.0, authentica...	7.1 High	—	0,39%	16 Jul 2026
CVE-2026-45336 HireFlow is a web-based interview management system for managing candidates, scheduling interviews, and tracking hiring progress. In 1.2 and earlier, app.py assigns a har...	10.0 Critical	—	0,56%	16 Jul 2026
CVE-2026-44970 getdbt dbt mcp server dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DefaultUsageTracker.emit_tool_called_event() in src/dbt_mcp/tracking/tracking.py ser...	4.3 Medium	—	0,37%	16 Jul 2026
CVE-2026-44969 getdbt dbt mcp server dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DbtMCP.call_tool() in src/dbt_mcp/mcp/server.py logged the raw arguments dictionary...	3.3 Low	—	0,17%	16 Jul 2026
CVE-2026-44968 getdbt dbt mcp server dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, _run_dbt_command() in src/dbt_mcp/dbt_cli/tools.py appended unsanitized node_selecti...	6.3 Medium	—	0,21%	16 Jul 2026
CVE-2026-15945 redhat build of keycloak, redhat data grid +2 lainnya A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions (FGAP) v2 is enabled, a delegated admi...	2.7 Low	—	0,35%	16 Jul 2026
CVE-2026-15737 AWS Bedrock AgentCore Python SDK is an open-source Python library that provides client tools for building AI agents on the Amazon Bedrock AgentCore platform. Unintende...	5.7 Medium	—	0,38%	16 Jul 2026
CVE-2021-27137 dd-wrt An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to...	8.1 High	KEV	4,0%	16 Jul 2026
CVE-2026-9046 A potential insecure permissions vulnerability was reported in Legion Zone and the Lenovo App Store Windows applications, distributed exclusively in the Chinese market, t...	7.0 High	—	0,13%	16 Jul 2026
CVE-2026-6511 During an internal security assessment, a potential improper access control vulnerability was discovered in Lenovo Smart Connect for Windows that could allow a local auth...	5.5 Medium	—	0,13%	16 Jul 2026
CVE-2026-63088 stoatchat before 0.14.0 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated network-accessible attackers to bypass the DNS-based IP bl...	8.6 High	—	0,47%	16 Jul 2026
CVE-2026-63087 Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote attackers to obtain a valid PluginAuthToken by sending a POST request t...	9.8 Critical	—	0,71%	16 Jul 2026
CVE-2026-63086 text-generation-inference through 3.3.7 contains a server-side request forgery (SSRF) vulnerability in the OpenAI-compatible multimodal chat completions endpoint that all...	8.6 High	—	0,43%	16 Jul 2026
CVE-2026-63085 Axelor Open Platform versions 8.x prior to 8.2.2 contains an authorization bypass vulnerability that allows authenticated non-admin users to escalate privileges by exploi...	8.8 High	—	0,54%	16 Jul 2026
CVE-2026-57074 XML::Bare versions through 0.53 for Perl have an unbounded character lookahead. The parserc_parse function attempts to check for multicharacter strings such as "<![CDATA...	9.1 Critical	—	0,63%	16 Jul 2026
CVE-2026-57073 HTML::Bare versions through 0.04 for Perl have an unbounded character lookahead. The parserc_parse function attempts to check for multicharacter strings such as "<![CDAT...	9.1 Critical	—	0,65%	16 Jul 2026
CVE-2026-55548 spaceapplications yamcs Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, the PacketsApi.exportPackets endpoint in yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java fai...	4.3 Medium	—	0,36%	16 Jul 2026
CVE-2026-55407 Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.8.0, the decode_unknown_field function in buffa's protobuf dec...	6.3 Medium	—	0,76%	16 Jul 2026
CVE-2026-55406 Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.7.0, a soundness bug in the OwnedView<V> type allowed safe Rus...	5.9 Medium	—	0,19%	16 Jul 2026
CVE-2026-50012 squid-cache squid Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache digest reply handling (peerDigestSwapInMask in src/peer_digest.cc), S...	5.5 Medium	—	1,4%	16 Jul 2026
CVE-2026-47751 Claude Code Action is a general-purpose GitHub action that runs Claude Code on GitHub pull requests and issues. Prior to 1.0.74, because the action checked out attacker-c...	5.3 Medium	—	0,77%	16 Jul 2026
CVE-2026-47729 squid-cache squid Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of input in the FTP gateway (src/clients/FtpGateway.cc), Squid...	6.5 Medium	—	1,5%	16 Jul 2026
CVE-2026-46621 spaceapplications yamcs Yamcs is a mission control framework. Prior to 5.12.7, the Yamcs script evaluation engine for Python algorithms dynamically compiled and evaluated user-controlled algorit...	9.1 Critical	—	1,1%	16 Jul 2026
CVE-2026-46562 spaceapplications yamcs Yamcs is a mission control framework. Prior to 5.12.7, the Nashorn ScriptEngine used to evaluate user-supplied JavaScript algorithm text in yamcs-core/src/main/java/org/y...	9.8 Critical	—	0,98%	16 Jul 2026
CVE-2026-45795 The Janssen Project is an open-source identity and access management (IAM) platform. Prior to 2.0.0, jans-auth-server accepts unsigned JWE request objects because JwtAuth...	5.3 Medium	—	0,19%	16 Jul 2026
CVE-2026-45612 rz-libdemangle is a Rizin library for demangling symbols. Prior to 6bf56d3, the Rust demangler in src/rust/rust_v0.c can perform an out-of-bounds read when the demangler...	5.5 Medium	—	0,17%	16 Jul 2026
CVE-2026-45576 netfoundry zrok zrok is software for sharing web services, files, and network resources. From 0.4.23 until 2.0.3, `zrok2 copy` stores attacker-controlled WebDAV or zrok drive paths such...	7.5 High	—	0,50%	16 Jul 2026
CVE-2026-45568 netfoundry zrok zrok is software for sharing web services, files, and network resources. Prior to 2.0.3, zrok's Python SDK ProxyShare Flask proxy route accepts an absolute URL in the req...	9.1 Critical	—	0,54%	16 Jul 2026
CVE-2026-45367 HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.7, the FHIRPathEngine implementation passes user-con...	7.5 High	—	0,68%	16 Jul 2026
CVE-2026-45325 Gestor de Oferta is a web application for managing mobility service offerings. Prior to 20260509.0340.15, @tmlmobilidade/utils has a prototype pollution vulnerability in...	8.2 High	—	0,46%	16 Jul 2026
CVE-2026-44632 spaceapplications yamcs Yamcs is a mission control framework. Prior to 5.12.7, a server-side code injection vulnerability existed in the Yamcs algorithm evaluation engine org.yamcs.algorithms.Ja...	9.1 Critical	—	1,1%	16 Jul 2026
CVE-2026-44596 spaceapplications yamcs Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handled by yamcs-core/src/main/java/org/yamcs/http/auth...	9.8 Critical	—	2,1%	16 Jul 2026
CVE-2026-44595 spaceapplications yamcs Yamcs is a mission control framework. Prior to 5.12.7, the IAM API endpoints listUsers, getUser, listGroups, and getGroup in yamcs-core did not enforce the required Syste...	4.3 Medium	—	1,1%	16 Jul 2026
CVE-2026-3031 Image::EPEG versions through 0.15 for Perl embeds an unsupported version of the Epeg library. Image::EPEG includes Epeg 0.9.0 that was last updated in 2004. Epeg is a f...	9.8 Critical	—	0,70%	16 Jul 2026
CVE-2026-14371 The Lenovo XClarity Integrator for Windows Admin Center plugin version 5.1.1 and below running on the WAC Gateway is vulnerable to Powershell Command Injection when estab...	8.8 High	—	1,2%	16 Jul 2026
CVE-2026-13401 XML::Bare versions through 0.53 for Perl will hang in an infinite loop when parsing malformed attributes. The parserc_parse function never advances the attribute-parse s...	7.5 High	—	0,61%	16 Jul 2026
CVE-2026-13397 HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributes. The parserc_parse function never advances the attribute-parse...	7.5 High	—	0,61%	16 Jul 2026
CVE-2026-13104 A potential vulnerability was reported in Lenovo App Store, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute arbitrar...	7.3 High	—	0,17%	16 Jul 2026
CVE-2026-13103 A potential path traversal vulnerability was reported in Lenovo App Store, distributed exclusively in the Chinese market, that could allow a local authenticated user to e...	7.3 High	—	0,18%	16 Jul 2026
CVE-2026-10590 A potential missing authentication vulnerability could allow a local privileged attacker to use WMI commands to arbitrarily trigger a System Management Interrupt handler.	4.4 Medium	—	0,17%	16 Jul 2026
CVE-2026-10589 A potential out of bounds write vulnerability could allow a local privileged attacker to execute code in System Management Mode.	6.0 Medium	—	0,16%	16 Jul 2026
CVE-2026-10588 A potential vulnerability could allow a local privileged attacker to disclose the address of protected System Management Mode memory.	4.4 Medium	—	0,15%	16 Jul 2026
CVE-2026-10587 A potential out-of-bounds write vulnerability could allow a local privileged attacker to modify power management settings in System Management Mode.	6.0 Medium	—	0,15%	16 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.