Katalog CVE (hal. 955)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 267.603 (Critical 36.783 · High 106.969 · KEV 1.767 · sejak 2020) · Pembaruan terakhir: 4 Nov 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 47.701–47.750 dari 267.603 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-12434 The List category posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.95.0 via the sanitize_status. This ma...	4.3 Medium	—	0,41%	16 Jul 2026
CVE-2026-12409 The Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all...	4.3 Medium	—	0,19%	16 Jul 2026
CVE-2026-48863 A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect length handling when copying EdDSA 's'...	7.5 High	—	0,82%	16 Jul 2026
CVE-2026-3842 A flaw was found in QEMU. This vulnerability allows a local attacker within a guest virtual machine to write data beyond its allocated memory. This occurs when cpu_physic...	7.8 High	—	0,17%	16 Jul 2026
CVE-2026-23538 A vulnerability was identified in the Feast Feature Server's `/ws/chat` endpoint that allows remote attackers to establish persistent WebSocket connections without any au...	7.5 High	—	0,89%	16 Jul 2026
CVE-2026-1609 redhat build of keycloak A flaw was found in Keycloak. When the JSON Web Token (JWT) authorization grant preview feature is enabled and a user account is disabled, Keycloak fails to validate the...	8.1 High	—	0,56%	16 Jul 2026
CVE-2026-15909 A vulnerability has been found in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. Affected is an unknown function of the file proses/add.php. The...	6.3 Medium	—	0,37%	16 Jul 2026
CVE-2026-15907 A flaw has been found in H3C SecPath F1000-C8300 up to 20260522. This impacts an unknown function of the file /webui/?g=log_fw_nbc_mail_jsondata. Executing a manipulation...	7.3 High	—	0,41%	16 Jul 2026
CVE-2026-63175 PlaywrightCapture stored capture-specific configuration and runtime data as mutable class-level variables rather than instance-level variables. Consequently, multiple Cap...	7.1 High	—	0,47%	15 Jul 2026
CVE-2026-62314 Anubis is a Web AI Firewall Utility that challenges users' connections in order to protect upstream resources from scraper bots. From 1.22.0 until 1.26.0-pre1, lib/policy...	5.8 Medium	—	0,34%	15 Jul 2026
CVE-2026-55652 Wekan is open source kanban built with Meteor. Prior to 9.46, header-login with HEADER_LOGIN_TRUSTED_IPS uses getRequestIp() in server/lib/headerLoginAuth.js to trust the...	9.8 Critical	—	0,62%	15 Jul 2026
CVE-2026-55576 MaaAssistantArknights is a one-click tool for daily Arknights tasks. In the current dev-v2 workflow, .github/workflows/release-preparation.yml inlined attacker-controlled...	8.8 High	—	0,46%	15 Jul 2026
CVE-2026-55445 Qinglong is a timed task management platform supporting Python3, JavaScript, Shell, and Typescript. Prior to 2.20.1, the init guard middleware in back/loaders/express.ts...	9.3 Critical	—	0,53%	15 Jul 2026
CVE-2026-55234 Wekan is open source kanban built with Meteor. Prior to 9.37, Wekan DDP update allow rules in server/permissions/cards.js, server/permissions/lists.js, and server/permiss...	8.5 High	—	0,43%	15 Jul 2026
CVE-2026-54458 WWBN AVideo is an open source video platform. Versions prior to 29.0 contain a stored DOM Cross-Site Scripting vulnerability in the YPTSocket plugin. Any unauthenticated...	9.6 Critical	—	0,38%	15 Jul 2026
CVE-2026-53447 Wekan is open source kanban built with Meteor. Prior to 9.35, the Wekan cloneBoard Meteor method in models/import.js uses caller-supplied sourceBoardId to build a board e...	6.5 Medium	—	0,40%	15 Jul 2026
CVE-2026-53446 Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan webhook integration URLs in models/integrations.js are stored from user input and later fetched by ser...	6.2 Medium	—	0,50%	15 Jul 2026
CVE-2026-53445 Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan copyBoard Meteor DDP method in server/publications/boards.js copies a board by caller-supplied boa...	7.1 High	—	0,41%	15 Jul 2026
CVE-2026-53444 Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan OIDC-related Meteor methods in packages/wekan-oidc/oidc_server.js, server/models/org.js, and server/mo...	7.6 High	—	0,41%	15 Jul 2026
CVE-2026-52893 Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan Accounts.onCreateUser hook in server/models/users.js merges OIDC logins into existing accounts whe...	9.2 Critical	—	0,48%	15 Jul 2026
CVE-2026-52892 Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan REST handlers in server/models/customFields.js use read-level Authentication.checkBoardAccess instead...	6.5 Medium	—	0,46%	15 Jul 2026
CVE-2026-52891 Wekan is open source kanban built with Meteor. Prior to 9.07, Wekan avatar upload functionality embeds user-supplied filenames into paths later passed to child_process.ex...	9.9 Critical	—	0,79%	15 Jul 2026
CVE-2026-52890 Wekan is open source kanban built with Meteor. Prior to 9.31, Wekan allows a logged-in board member to insert an attachment document through the /attachments/insert DDP m...	7.1 High	—	0,48%	15 Jul 2026
CVE-2026-50183 WWBN AVideo is an open source video platform. Versions 29.0 and below contain a stored Cross-Site Scripting vulnerability in the YouTubeAPI plugin. The plugin renders the...	4.7 Medium	—	0,20%	15 Jul 2026
CVE-2026-50182 WWBN AVideo is an open source video platform. Versions prior to 29.0 contain an unauthenticated Reflected XSS vulnerability through AVideo YouTubeAPI Gallery Pagination....	6.1 Medium	—	0,22%	15 Jul 2026
CVE-2026-49279 WWBN AVideo is an open source video platform. Versions 29.0 and below contain a Stored XSS vulnerability through the autoEvalCodeOnHTML parameter in the MessageSQLite Web...	7.7 High	—	0,40%	15 Jul 2026
CVE-2026-48795 AdonisJS is a TypeScript-first web framework. From 10.1.3 until 10.1.5 and 11.0.3, AdonisJS @adonisjs/bodyparser incompletely fixed CVE-2026-25754 because nested multipar...	8.6 High	—	0,55%	15 Jul 2026
CVE-2026-45313 Sandboxie-Plus is an open source sandbox-based isolation software for Windows. Prior to 1.17.6, GuiServer::WndHookRegisterSlave in Sandboxie/core/svc/GuiServer.cpp stores...	7.7 High	—	0,15%	15 Jul 2026
CVE-2026-38974 Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko_vendor.py.	5.3 Medium	—	0,33%	15 Jul 2026
CVE-2026-38755 busybox A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.	2.9 Low	—	0,21%	15 Jul 2026
CVE-2026-38754 busybox A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.	5.1 Medium	—	0,24%	15 Jul 2026
CVE-2026-38752 busybox A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK scrip...	2.9 Low	—	0,21%	15 Jul 2026
CVE-2026-36590 emqx nanomq An issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of service via the nni_qos_db_set function in broker_tcp.c component	7.5 High	—	0,59%	15 Jul 2026
CVE-2026-30623 LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality. The application allows users to add MCP servers via a JSON config...	9.8 Critical	—	6,0%	15 Jul 2026
CVE-2026-30618 xszyou Fay 4.3.1 contains a remote code execution vulnerability in its MCP STDIO server management and command execution handling. A remote attacker can access the public...	9.8 Critical	—	1,2%	15 Jul 2026
CVE-2026-26719 Cross Site Scripting vulnerability in xxl-job-admin v.3.0.0 allows a remote attacker to execute arbitrary code via a crafted HTTP GET request containing a malicious scrip...	6.1 Medium	—	0,42%	15 Jul 2026
CVE-2026-26718 A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an attacker to perform unauthorized modifications to Glu...	9.1 Critical	—	0,22%	15 Jul 2026
CVE-2026-15921 Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.32.1 through 0.40.5, `nvm ls-remote` (and other comma...	3.1 Low	—	0,26%	15 Jul 2026
CVE-2025-65720 An issue in Open Source GPT Researcher v3.3.7 allows attackers to execute arbitrary commands on a victim system via user interaction with a crafted HTML page.	9.8 Critical	—	0,72%	15 Jul 2026
CVE-2026-62361 listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled qu...	5.5 Medium	—	0,30%	15 Jul 2026
CVE-2026-62312 9Router is an AI router & token saver. Prior to 0.5.2, 9Router allows a remote authenticated attacker to achieve arbitrary code execution on the host operating system by...	8.8 High	—	0,92%	15 Jul 2026
CVE-2026-59950 lfprojects mcp python sdk The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.28.1, the deprecated mcp.server.websocket.websocket_ser...	8.1 High	—	0,23%	15 Jul 2026
CVE-2026-56679 9Router is an AI router & token saver. Prior to 0.5.4, the PATCH /api/settings endpoint writes the entire request body to persistent settings without a field whitelist, a...	8.7 High	—	0,40%	15 Jul 2026
CVE-2026-56678 9Router is an AI router & token saver. Prior to 0.5.6, the Kiro API-key validation endpoint POST /api/oauth/kiro/api-key builds an upstream URL using a user-controlled re...	6.4 Medium	—	0,21%	15 Jul 2026
CVE-2026-55608 n8n-mcp n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.57.4, multi-tenant HTTP mode with ENABLE_MUL...	5.4 Medium	—	0,28%	15 Jul 2026
CVE-2026-55410 NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.1.19, NocoBase @nocobase/plugin-backups restor...	6.7 Medium	—	0,72%	15 Jul 2026
CVE-2026-55399 absolute secure access CVE-2026-55399 is a resource exhaustion vulnerability in the Secure Access publisher prior to 14.55. Attackers with valid credentials to the Secure Access tunnel can crea...	4.3 Medium	—	0,37%	15 Jul 2026
CVE-2026-55398 absolute secure access CVE-2026-55398 is a memory management vulnerability in Secure Access clients and servers prior to 14.55. Attackers with intimate knowledge of and total control over the t...	3.7 Low	—	0,35%	15 Jul 2026
CVE-2026-54052 n8n-mcp n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.56.1, in HTTP mode with multi-tenancy enable...	9.9 Critical	—	0,39%	15 Jul 2026
CVE-2026-52888 NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. In 2.0.59 and earlier, NocoBase @nocobase/plugin-collecti...	6.8 Medium	—	0,47%	15 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.