Katalog CVE (hal. 956)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 267.603 (Critical 36.783 · High 106.969 · KEV 1.767 · sejak 2020) · Pembaruan terakhir: 4 Nov 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 47.751–47.800 dari 267.603 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-52887 NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.0.61, NocoBase @nocobase/plugin-notification-i...	10.0 Critical	—	0,89%	15 Jul 2026
CVE-2026-51380 Buffer Overflow vulnerability in Tenda AC10 v3 (firmware V03.03.16.09) allows attackers to cause a permanent Denial of Service (DoS) or potentially execute remote code vi...	9.8 Critical	—	0,50%	15 Jul 2026
CVE-2026-49353 9Router is an AI router & token saver. In 0.4.45 and earlier, 9Router's src/dashboardGuard.js local-only access gate used Host and Origin headers in isLocalRequest() to p...	7.5 High	—	0,34%	15 Jul 2026
CVE-2026-49352 9Router is an AI router & token saver. From 0.2.21 until 0.4.44, 9Router used the hardcoded fallback JWT secret 9router-default-secret-change-me in src/app/api/auth/login...	9.8 Critical	—	0,60%	15 Jul 2026
CVE-2026-46339 9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect /api/cli-tools/* and /api/mcp/*, allowing unauthenticat...	10.0 Critical	—	2,8%	15 Jul 2026
CVE-2026-38753 busybox A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.	4.9 Medium	—	0,15%	15 Jul 2026
CVE-2026-33684 WWBN AVideo is an open source video platform. Prior to version 29.0, Privilege Escalation is possible through unguarded permission parameters in signUp API, which allows...	5.3 Medium	—	0,25%	15 Jul 2026
CVE-2026-33445 absolute secure access CVE-2026-33445 is a memory management vulnerability in Secure Access servers prior to 14.55. Attackers with an intimate knowledge of and total control over the tunnel pro...	5.9 Medium	—	0,41%	15 Jul 2026
CVE-2026-33444 absolute secure access CVE-2026-33444 is a memory management vulnerability in Secure Access servers prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protoc...	3.7 Low	—	0,35%	15 Jul 2026
CVE-2026-56743 cilium Cilium is a networking, observability, and security solution. From 1.19.0 to 1.19.4, standard Kubernetes NetworkPolicy specifications using CIDR-based ipBlock rules witho...	5.4 Medium	—	0,25%	15 Jul 2026
CVE-2026-56742 cilium Cilium is a networking, observability, and security solution. Prior to 1.17.17, 1.18.11, and 1.19.5, Cilium clusters using Gateway API allow users with permissions to cre...	8.9 High	—	0,18%	15 Jul 2026
CVE-2026-52870 lfprojects mcp python sdk The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.23.0 until 1.27.2, default handlers installed by server.exp...	7.6 High	—	0,39%	15 Jul 2026
CVE-2026-52869 lfprojects mcp python sdk The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.27.2, the SSE and stateful Streamable HTTP transports m...	7.1 High	—	0,54%	15 Jul 2026
CVE-2026-50144 ncnn is a high-performance neural network inference framework optimized for the mobile platform. In commit e54f7b1f88434e1d844ea0551b880a1cfb079ce1 and earlier, ncnn allo...	7.1 High	—	0,16%	15 Jul 2026
CVE-2026-50124 DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase can be exploited by uploading payload.zip through the Excel upload API /dataso...	7.1 High	—	0,56%	15 Jul 2026
CVE-2026-50030 DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase SQL preview exposes DatasetDataApi.previewSql/previewSqlCheck through /de2api/...	7.1 High	—	0,47%	15 Jul 2026
CVE-2026-49867 DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase template static resources let authenticated users submit TemplateManageRequest...	6.3 Medium	—	0,47%	15 Jul 2026
CVE-2026-49445 cilium Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 functionality is enabled, the embedded or standalone En...	8.8 High	—	0,17%	15 Jul 2026
CVE-2026-46684 DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase enterprise token handling can let TokenFilter#doFilter() pass X-DE-TOKEN value...	9.5 Critical	—	0,32%	15 Jul 2026
CVE-2026-45738 argoproj argo cd Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, and 3.4.2, Argo CD users with application write access can set link.arg...	8.7 High	—	0,61%	15 Jul 2026
CVE-2026-45737 argoproj argo cd Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 3.2.0 until 3.2.12, 3.3.10, and 3.4.2, Argo CD ServerSideDiff can expose Kubernetes Secret...	6.5 Medium	—	0,52%	15 Jul 2026
CVE-2026-45535 DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase SQL-type datasets store attacker-controlled SQL variable defaultValue entries...	8.7 High	—	0,38%	15 Jul 2026
CVE-2026-45534 DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase Redshift datasource connections can load attacker-controlled rsjdbc.ini config...	9.0 Critical	—	0,64%	15 Jul 2026
CVE-2026-45533 DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase export-center deletion can accept path traversal sequences such as ../ in the...	8.3 High	—	0,46%	15 Jul 2026
CVE-2026-45419 DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase template saves call TemplateManageService#save, StaticResourceServer#saveFiles...	8.5 High	—	0,46%	15 Jul 2026
CVE-2026-45417 DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase datasource connection status checks concatenate configuration.getSchema() into...	8.7 High	—	0,38%	15 Jul 2026
CVE-2026-45320 DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase dashboard SQL variables such as ${deptId} are processed by SqlparserUtils.tran...	8.7 High	—	0,47%	15 Jul 2026
CVE-2026-40958 absolute secure access CVE-2026-40958 is a input validation error in Secure Access clients prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can cr...	3.7 Low	—	0,38%	15 Jul 2026
CVE-2026-40957 absolute secure access o CVE-2026-40957 is a frameable content vulnerability in the Secure Access server login page prior to 14.55. Attackers with control of a malicious web site could use it...	7.5 High	—	0,43%	15 Jul 2026
CVE-2026-40956 absolute secure access CVE-2026-40956 is a memory disclosure vulnerability in Secure Access client versions prior to 14.55. Attackers with intimate knowledge of and total control over the tunne...	3.7 Low	—	0,27%	15 Jul 2026
CVE-2026-40955 absolute secure access CVE-2026-40955 is an integer underflow vulnerability in the traffic parsing function of Secure Access clients prior to 14.55. Attackers with intimate knowledge of and tot...	3.7 Low	—	0,32%	15 Jul 2026
CVE-2026-40954 absolute secure access CVE-2026-40954 is an integer underflow vulnerability in the traffic parsing function of Secure Access clients prior to 14.55. Attackers with intimate knowledge of and tot...	3.7 Low	—	0,32%	15 Jul 2026
CVE-2026-40953 absolute secure access CVE-2026-40953 is a heap overflow in the certificate parsing function of Secure Access clients prior to 14.55. Attackers with local access and administrator permissions c...	4.4 Medium	—	0,10%	15 Jul 2026
CVE-2026-40952 absolute secure access CVE-2026-40952 is a privilege misconfiguration in the Secure Access installer for the Windows client and server prior to version 14.55. Attackers with local access to the...	7.8 High	—	0,14%	15 Jul 2026
CVE-2026-33443 absolute secure access CVE-2026-33443 is a memory management error in Secure Access servers prior to 14.55. Attackers with an intimate knowledge of and total control over the tunnel protocol ca...	5.9 Medium	—	0,37%	15 Jul 2026
CVE-2026-62947 openwrt OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, the cgi-download handler in cgi-io authorizes the requested path against the caller's ub...	4.9 Medium	—	0,52%	15 Jul 2026
CVE-2026-62355 TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, a Data Reader admin_user on a TDengine Cloud DB instance cou...	5.4 Medium	—	0,23%	15 Jul 2026
CVE-2026-62353 TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.14, source/libs/parser/src/parTokenizer.c tGetToken() incremented past a trail...	5.4 Medium	—	0,37%	15 Jul 2026
CVE-2026-62351 TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, source/libs/transport/src/transComm.c transDecompressMsg() read STransComp...	7.5 High	—	0,39%	15 Jul 2026
CVE-2026-62350 TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, a user with create udf privilege could upload a crafted shar...	7.2 High	—	0,46%	15 Jul 2026
CVE-2026-62349 TDengine is an open source, time-series database optimized for Internet of Things devices. In 3.4.1.6 and earlier, source/libs/parser/src/parUtil.c trimString() checks sp...	8.3 High	—	0,50%	15 Jul 2026
CVE-2026-62348 TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, TDengine Enterprise allowed an authenticated low-privilege SQL user to run...	5.4 Medium	—	0,25%	15 Jul 2026
CVE-2026-54443 Dashy is a self-hostable personal dashboard. From 1.9.4 until 3.2.0, the Dashy RSS Widget in src/components/Widgets/RssFeed.vue does not sanitize RSS item link values bef...	5.9 Medium	—	0,29%	15 Jul 2026
CVE-2026-49988 yamadashy repomix Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, the Repomix MCP server attach_packed_output and read_repomix_output flow can register a...	5.5 Medium	—	0,18%	15 Jul 2026
CVE-2026-49987 yamadashy repomix Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, src/core/git/gitCommand.ts execGitShallowClone passes the --remote-branch value directl...	8.8 High	—	0,70%	15 Jul 2026
CVE-2026-46485 Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can allow unauthenticated users or non-admin authenticated users to write change...	8.2 High	—	0,38%	15 Jul 2026
CVE-2026-46421 The SAP Cloud Application Programming Model is a tool for building enterprise-grade cloud applications, and cap-js/cds-dbs is the monorepo for SQL database services for t...	9.3 Critical	—	0,52%	15 Jul 2026
CVE-2026-26032 apache ivy The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package them in a format defined by a packager.xml file. This repackaging is done by an...	5.4 Medium	—	0,51%	15 Jul 2026
CVE-2026-15895 OS command injection in the npm package loading component in AWS jsii-diff before 1.131.0 might allow context-dependent attackers to execute arbitrary commands via crafte...	7.8 High	—	1,1%	15 Jul 2026
CVE-2026-15746 Strands Agents is an open-source Python SDK for building and running AI agents. The strands-agents-tools package provides pre-built tools for use with the SDK, including...	6.5 Medium	—	0,42%	15 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.