Katalog CVE (hal. 953)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 267.603 (Critical 36.783 · High 106.969 · KEV 1.767 · sejak 2020) · Pembaruan terakhir: 4 Nov 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 47.601–47.650 dari 267.603 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2025-45870 LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to Local File Inclusion (LFI) in the OnlyOfficeEditor servlet class, allowing authenticated user to exploit path...	6.5 Medium	—	0,49%	16 Jul 2026
CVE-2026-63082 Perfect Support Ticketing & Document Management System through 1.7 contains a broken access control vulnerability that allows authenticated attackers with Agent-level pri...	5.4 Medium	—	0,26%	16 Jul 2026
CVE-2026-63081 Perfect Support Ticketing & Document Management System through 1.7 contains a stored cross-site scripting vulnerability that allows authenticated attackers with Agent-lev...	5.4 Medium	—	0,17%	16 Jul 2026
CVE-2026-59867 Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota resolved OpenAPI $ref values by fetching remote http(s) URLs and reading local abs...	7.1 High	—	2,4%	16 Jul 2026
CVE-2026-59866 Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota emitted x-ms-kiota-info clientClassName and clientNamespaceName values without ide...	9.3 Critical	—	1,4%	16 Jul 2026
CVE-2026-59865 Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota info` read x-ms-kiota-info.languagesInformation.<language>.dependencyInstallComma...	9.3 Critical	—	4,4%	16 Jul 2026
CVE-2026-59864 Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota plugin add` and `kiota plugin generate` (with `-t APIPlugin`) emitted attacker-co...	9.3 Critical	—	1,3%	16 Jul 2026
CVE-2026-57206 SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.206, several plugin validation ro...	8.6 High	—	0,96%	16 Jul 2026
CVE-2026-57205 SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.203, the authenticated GET /api/u...	4.3 Medium	—	0,91%	16 Jul 2026
CVE-2026-55440 Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.7, the COMMAND_RESULTS handler in ufo/server/ws/handler.py calle...	6.5 Medium	—	0,72%	16 Jul 2026
CVE-2026-54733 The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 and Azure Active Directory integration for Moodle. Prior to 4.5.6, 5.0.5, and 5.1.1, the Mi...	9.3 Critical	—	0,88%	16 Jul 2026
CVE-2026-54568 Microsoft UFO open-source framework for intelligent automation across devices and platforms. From 3.0.0 until 3.0.6, a client connected to the UFO WebSocket server as a D...	4.3 Medium	—	0,59%	16 Jul 2026
CVE-2026-53598 Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 2.0.0-beta.2, Prompty loaders expanded ${file:...} references in .prompty frontmatter without enfor...	7.5 High	—	1,3%	16 Jul 2026
CVE-2026-53597 Prompty is a markdown file format (.prompty) for LLM prompts. From 2.0.0-alpha.1 until 2.0.0-beta.3, the @prompty/core TypeScript loader in runtime/typescript/packages/co...	8.7 High	—	0,97%	16 Jul 2026
CVE-2026-45695 Kopia is a cross-platform backup tool for Windows, macOS, and Linux with fast incremental backups, client-side end-to-end encryption, compression, and data deduplication....	9.8 Critical	—	1,6%	16 Jul 2026
CVE-2026-14890 lmsys sglang SGLang uses an expert-parallel backup subsystem that exposes a ZeroMQ PULL socket on a routable network interface that does not contain authentication or deserialization...	9.1 Critical	—	1,00%	16 Jul 2026
CVE-2026-12379 An Open Redirect vulnerability (CWE-601) exists in the OAuth/OIDC authentication implementation of the Axivion Dashboard. The login flow did not properly restrict the pos...	6.8 Medium	—	0,21%	16 Jul 2026
CVE-2025-45868 LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to blind SQL injection in the ComparisonServlet component, allowing authenticated user to manipulate SQL queries...	8.8 High	—	0,51%	16 Jul 2026
CVE-2026-59863 Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota honored a poisoned .kiota/workspace.json workspace configuration without validatin...	7.0 High	—	1,4%	16 Jul 2026
CVE-2026-59862 Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0, Kiota's Python generator let attacker-controlled enum value descriptions from x-ms-enum....	7.5 High	—	1,4%	16 Jul 2026
CVE-2026-59861 Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0, Kiota's Ruby generator embedded OpenAPI default fields, property names, and other schema...	7.5 High	—	2,0%	16 Jul 2026
CVE-2026-59860 Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.3, Kiota is affected by a code-generation injection vulnerability in the C# XML documentati...	8.7 High	—	1,4%	16 Jul 2026
CVE-2026-59859 Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.4, Kiota's PHP generator embedded OpenAPI description, default fields, property names, and...	8.7 High	—	1,4%	16 Jul 2026
CVE-2026-59237 Authorization Bypass Through User-Controlled Key (CWE-639) in the Order and OrderItem REST API controllers in Roskus Prospero Flow CRM before 5.5.3 allows a remote, authe...	6.9 Medium	—	0,64%	16 Jul 2026
CVE-2026-14254 A race condition in the account lockout mechanism in Delphix Continous Data allowed the lockout threshold to be bypassed through concurrent authentication requests. Paral...	8.3 High	—	0,58%	16 Jul 2026
CVE-2026-5674 A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's Pulse...	8.8 High	—	0,19%	16 Jul 2026
CVE-2026-56456 hcltech dfxanalytics HCL DFXAnalytics is affected by an Internal File Path Disclosure vulnerability. The application dashboard inadvertently leaks sensitive information regarding its internal...	5.3 Medium	—	0,40%	16 Jul 2026
CVE-2026-56455 hcltech dfxanalytics HCL DFXAnalytics is affected by a Buffer Overflow vulnerability that can lead to a Denial of Service (DoS). The application fails to properly validate input sizes, allowi...	7.5 High	—	0,46%	16 Jul 2026
CVE-2026-56454 hcltech dfxanalytics HCL DFXAnalytics is affected by a Deprecated Protocol vulnerability due to the use of TLS 1.0 and TLS 1.1. These legacy protocols contain numerous cryptographic design fl...	7.5 High	—	0,22%	16 Jul 2026
CVE-2026-56453 hcltech dfxanalytics HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability. A remote attacker can intercept and alter the contents of the server's HTTP r...	9.8 Critical	—	0,35%	16 Jul 2026
CVE-2026-35145 hcltech dfxanalytics HCL DFXAnalytics is affected by a Missing HTTP Strict-Transport-Security Header vulnerability. The application fails to implement the HTTP Strict Transport Security (HSTS...	3.1 Low	—	0,27%	16 Jul 2026
CVE-2026-35143 hcltech dfxanalytics HCL DFXAnalytics is affected by a Missing SameSite Attribute vulnerability. The application fails to set the "SameSite" attribute on session cookies generated during auth...	6.5 Medium	—	0,16%	16 Jul 2026
CVE-2026-35142 hcltech dfxanalytics HCL DFXAnalytics is affected by an Internal IP Address Disclosure vulnerability. The application includes internal IP address details within its generated server response...	8.2 High	—	0,32%	16 Jul 2026
CVE-2026-35141 hcltech dfxanalytics HCL DFXAnalytics is affected by a Login Replay Attack vulnerability. The application allows a remote attacker to intercept, delay, or fraudulently retransmit valid authen...	5.3 Medium	—	0,33%	16 Jul 2026
CVE-2026-35140 hcltech dfxanalytics HCL DFXAnalytics is affected by a Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability. The application fails to set the "secure" attribute on session...	7.2 High	—	0,28%	16 Jul 2026
CVE-2026-9494 An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credentials by execut...	5.5 Medium	—	0,15%	16 Jul 2026
CVE-2026-63306 stoatchat before 0.13.5 contains an unauthenticated server-side request forgery vulnerability in the /proxy and /embed endpoints that accept arbitrary URLs without DNS re...	8.6 High	—	0,31%	16 Jul 2026
CVE-2026-63305 AVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint where notifyCode and callback parameters are concatenated into a shell...	8.1 High	—	1,8%	16 Jul 2026
CVE-2026-63304 AVideo through 29.0 contains an OS command injection vulnerability in plugin/API/standAlone/functions.php where the listFFmpegProcesses() function interpolates unsanitize...	8.1 High	—	1,7%	16 Jul 2026
CVE-2026-12391 An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) within the pro collect-logs command framework. The uti...	5.0 Medium	—	0,21%	16 Jul 2026
CVE-2026-11386 An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs APT source files (such as /...	9.0 Critical	—	0,53%	16 Jul 2026
CVE-2025-71388 stoatchat (delta/Revolt) versions from 20241213-1 before 20250210-1 allow users with only ViewChannel (read) permission on a channel to fetch that channel's webhooks, inc...	7.6 High	—	0,48%	16 Jul 2026
CVE-2025-71377 stoatchat (delta) versions before 20250210-1 (0.8.2) contain a logic error in the query messages route. When fetching messages 'nearby' another message, the database quer...	8.7 High	—	0,67%	16 Jul 2026
CVE-2024-58360 stoatchat versions before 0.7.8 fail to enforce account creation restrictions including invite-only mode, email verification, captcha, and shield verification. Attackers...	6.5 Medium	—	0,45%	16 Jul 2026
CVE-2026-59249 Inconsistent interpretation of HTTP requests (HTTP response smuggling) vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict interm...	6.3 Medium	—	0,52%	16 Jul 2026
CVE-2026-35149 hcltech dfx server HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation. An unauthorized user without valid credentials can exploit this flaw...	8.2 High	—	0,42%	16 Jul 2026
CVE-2026-35148 hcltech dfx server HCL DFXServer is affected by a Missing Access Control vulnerability. This vulnerability states that certain endpoints are accessible without any form of authentication in...	6.3 Medium	—	0,30%	16 Jul 2026
CVE-2026-35147 hcltech dfx server HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access. The application fails to verify the user's authentication status when accessing...	8.2 High	—	0,43%	16 Jul 2026
CVE-2026-35146 hcltech dfx server HCL DFXServer is affected by an Unencrypted Communication vulnerability. The application permits users to establish connections over unencrypted channels via the HTTP pro...	6.3 Medium	—	0,19%	16 Jul 2026
CVE-2023-49900 An unauthenticated remote attacker is able to perform remote code execution due to incorrectly sanitized user input in the SetParameter command.	9.8 Critical	—	0,96%	16 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.