Katalog CVE (hal. 960)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 267.603 (Critical 36.783 · High 106.969 · KEV 1.767 · sejak 2020) · Pembaruan terakhir: 4 Nov 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 47.951–48.000 dari 267.603 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-57833 Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.2 - The Joomla extension 4Analytics is vulnerable to an unauthenticated stored XSS in relat...	8.6 High	—	0,44%	15 Jul 2026
CVE-2026-57821 apache fineract A SQL Injection vulnerability exists in Apache Fineract's Office Search API (GET /api/v1/offices) in versions up to and including 1.14.0. The orderBy request parameter is...	8.1 High	—	0,74%	15 Jul 2026
CVE-2026-56287 apache fineract A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API (GET /api/v1/clients) in versions up to and including 1.14.0. The orderBy and so...	8.1 High	—	0,65%	15 Jul 2026
CVE-2026-49501 dell powerscale onefs Dell PowerScale OneFS versions 9.5.0.0 through 9.10.1.7, and versions 9.11.0.0 through 9.13.0.2 contains an Improper Privilege Management vulnerability. A high privileged...	6.7 Medium	—	0,15%	15 Jul 2026
CVE-2026-35152 apache fineract A SQL Injection vulnerability exists in Apache Fineract's Report Execution API (runreports endpoint) in versions up to and including 1.14.0. Report parameter values are i...	8.8 High	—	3,3%	15 Jul 2026
CVE-2026-57832 Joomla Extension - joomdonation.com - Unauthenticated blind SQL injection in EDocman < 3.9 - The Joomla extension EDocman is vulnerable to an unauthenticated SQL injectio...	8.7 High	—	0,40%	15 Jul 2026
CVE-2026-57831 Joomla Extension - digital-peak.com - Unauthenticated blind SQL injection in DP Calendar 8.18.0 - 10.11.2 - The Joomla extension DP Calendar is vulnerable to an unauthent...	8.7 High	—	0,40%	15 Jul 2026
CVE-2026-15804 The HCM developed by MetaGuru has a SQL Injection vulnerability. Authenticated remote attackers can inject SQL commands via specific parameters, thereby compromising the...	8.8 High	—	0,54%	15 Jul 2026
CVE-2026-15583 A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by...	8.6 High	—	0,53%	15 Jul 2026
CVE-2026-14251 A flaw was found in the OpenShift GitOps operator. The ClusterRole reconciler does not validate resource ownership when reconciling ClusterRole objects. A namespace-scope...	7.7 High	—	0,39%	15 Jul 2026
CVE-2026-42936 The installer of HYPER SBI 2 insecurely loads Dynamic Link Libraries. If there is a crafted DLL at the same directory when invoking the affected installer, arbitrary code...	8.4 High	—	0,18%	15 Jul 2026
CVE-2026-12512 The Quotes llama WordPress plugin before 3.1.6 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated at...	8.6 High	—	0,45%	15 Jul 2026
CVE-2026-12281 The Shibboleth WordPress plugin before 2.5.4 does not fail closed when its HTTP header identity mode is enabled without an anti-spoofing key, treating any request that ca...	8.1 High	—	0,38%	15 Jul 2026
CVE-2026-11580 The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not perform a per-object capability check in its post-duplication AJAX action, a...	5.5 Medium	—	0,32%	15 Jul 2026
CVE-2026-11579 The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not verify that a file upload is made against an existing form configured with a...	5.3 Medium	—	0,39%	15 Jul 2026
CVE-2026-8920 Improper Restriction of Communication Channel to Intended Endpoints and External Control of File Name or Path in Aura Wallpaper Service allow a local user to perform file...	8.5 High	—	0,11%	15 Jul 2026
CVE-2026-8919 Permissive Cross-domain Security Policy with Untrusted Domains in ASUS GameSDK allows a remote user to obtain a local user’s NTLM hash by convincing the user to visit a c...	7.2 High	—	0,45%	15 Jul 2026
CVE-2026-15030 Out-of-bounds Read in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager allows a local administrator to read memory regions beyon...	5.6 Medium	—	0,14%	15 Jul 2026
CVE-2026-15029 Untrusted Pointer Dereference in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager allows a local administrator to perform arbitr...	8.4 High	—	0,17%	15 Jul 2026
CVE-2026-13585 Allocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not Removed Before Reuse in the ASUS System Control Interface driver and ASUS...	8.2 High	—	0,16%	15 Jul 2026
CVE-2026-13385 An Improper Validation of Integrity Check Value and Improper Certificate Validation in certain ASUS router models allows a remote man-in-the-middle(MITM) user to make the...	9.5 Critical	—	0,14%	15 Jul 2026
CVE-2026-11851 Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") in the web management interface of certain ASUS router models allows a remote authent...	5.9 Medium	—	0,50%	15 Jul 2026
CVE-2026-9770 tp-link kasa ec71 firmware, tp-link kasa ec70 firmware Kasa EC71 v4 and EC70 v4 firmware contains a static cryptographic private key stored in a read-only filesystem that is shared across devices. An attacker with access to...	5.3 Medium	—	0,31%	15 Jul 2026
CVE-2026-13230 tp-link kasa ec70 firmware, tp-link kasa ec71 firmware An information disclosure vulnerability was identified in TP-Link Kasa EC70 v4 and EC71 v4 in the local discovery mechanism, which exposes sensitive geolocation informati...	6.5 Medium	—	0,40%	15 Jul 2026
CVE-2026-5270 An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite (NCS), Manage Control Plan (MCP), and Blue Planet products. The...	9.8 Critical	—	0,66%	14 Jul 2026
CVE-2026-5269 In Ciena's Navigator Network Control Suite (NCS) and Manage Control Plan (MCP), there are hidden system accounts used for internal software operations. Some of these acco...	9.8 Critical	—	0,48%	14 Jul 2026
CVE-2026-51808 Buffer Overflow vulnerability in OpenHTJ2K v.0.18.4 and before allows an attacker to execute arbitrary code via the openhtj2k_decoder_impl::invoke, invoke_line_based, inv...	9.8 Critical	—	0,85%	14 Jul 2026
CVE-2026-51807 Heap-based out-of-bounds write in j2k_precinct_subband::parse_packet_header() in OpenHTJ2K versions 0.18.3 and earlier (fixed in v0.18.4) caused by missing bounds validat...	9.8 Critical	—	0,67%	14 Jul 2026
CVE-2026-36035 Incorrect access control in the /api/License/deactivateOffline endpoint of CAXPerts UniversalPlantViewer WebServices Server v2.7.6 allows authenticated attackers with low...	6.5 Medium	—	0,52%	14 Jul 2026
CVE-2026-15753 A vulnerability was determined in zhinianboke xianyu-auto-reply on Server. Affected by this vulnerability is an unknown functionality of the file /api/v1/payment/withdraw...	5.4 Medium	—	0,45%	14 Jul 2026
CVE-2026-15752 A vulnerability was found in zhinianboke xianyu-auto-reply up to dcb445ad97816ad65299a7580ee0c8c8f929da84. Affected is an unknown function of the file /api/v1/users/ of t...	7.3 High	—	0,50%	14 Jul 2026
CVE-2026-15751 A security vulnerability has been detected in mastergo-design mastergo-magic-mcp up to 0.2.0. The affected element is the function execute of the file mastergo/component-...	5.3 Medium	—	0,17%	14 Jul 2026
CVE-2025-56365 csa-iot matter A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, in the interaction model command processing logic. When an InvokeCommandReque...	5.7 Medium	—	0,28%	14 Jul 2026
CVE-2025-56364 csa-iot matter A use of uninitialized value vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, where the `GetDestinationGroupId().Value()` method is called without f...	5.7 Medium	—	0,20%	14 Jul 2026
CVE-2025-56363 csa-iot matter A null pointer dereference vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, affecting the ReadRevisionAttribute function used in multiple clusters (...	5.7 Medium	—	0,37%	14 Jul 2026
CVE-2025-56362 csa-iot matter A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.2, specifically within the Level Control cluster's periodic server tick logic. W...	5.7 Medium	—	0,28%	14 Jul 2026
CVE-2026-59733 rclone Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --private-repos enforce...	8.8 High	—	0,55%	14 Jul 2026
CVE-2026-59732 rclone Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone archive extract can write extracted...	5.0 Medium	—	0,26%	14 Jul 2026
CVE-2026-54684 jadx is a Dex to Java decompiler. From 1.5.2 to 1.5.5, a malicious .xapk file can cause jadx to write attacker-controlled archive entry contents outside the intended XAPK...	7.0 High	—	0,20%	14 Jul 2026
CVE-2026-54572 rclone Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks...	8.8 High	—	0,40%	14 Jul 2026
CVE-2026-50130 pi-hole Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.0 to 6.4.2, a user with code execution as the un...	8.8 High	—	0,26%	14 Jul 2026
CVE-2026-49981 symfony twig Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function allow-list verdict is computed when a Template instance is constructed an...	8.2 High	—	0,36%	14 Jul 2026
CVE-2026-48808 symfony twig Twig is a template language for PHP. Prior to 3.27.0, the column filter passes the active sandbox state as a boolean but does not forward the current Source to SandboxExt...	7.5 High	—	0,41%	14 Jul 2026
CVE-2026-48807 symfony twig Twig is a template language for PHP. Prior to 3.27.0, the sandbox __toString() checks do not fully cover Traversable values passed to join and replace filters or operands...	9.1 Critical	—	0,37%	14 Jul 2026
CVE-2026-48806 symfony twig Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping keys that are coerced to strings, allowing PHP to invoke __toString()...	9.1 Critical	—	0,42%	14 Jul 2026
CVE-2026-48805 symfony twig Twig is a template language for PHP. Prior to 3.27.0, deprecated internal wrappers in src/Resources/core.php do not forward the current sandbox state to CoreExtension::ch...	9.1 Critical	—	0,48%	14 Jul 2026
CVE-2026-48357 adobe c2pa, adobe c2pa-web +1 lainnya CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this...	6.2 Medium	—	0,26%	14 Jul 2026
CVE-2026-48354 adobe c2pa, adobe c2pa-web +1 lainnya CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit th...	6.2 Medium	—	0,29%	14 Jul 2026
CVE-2026-48353 adobe c2pa, adobe c2pa-web +1 lainnya CAI Content Credentials is affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerabil...	5.5 Medium	—	0,26%	14 Jul 2026
CVE-2026-48352 adobe c2pa, adobe c2pa-web +1 lainnya CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vu...	7.5 High	—	0,93%	14 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.