Katalog CVE (hal. 961)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 267.603 (Critical 36.783 · High 106.969 · KEV 1.767 · sejak 2020) · Pembaruan terakhir: 4 Nov 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 48.001–48.050 dari 267.603 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-48351 adobe c2pa, adobe c2pa-web +1 lainnya CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vu...	7.5 High	—	0,93%	14 Jul 2026
CVE-2026-48337 adobe illustrator Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this iss...	7.8 High	—	0,26%	14 Jul 2026
CVE-2026-48336 adobe illustrator Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this iss...	7.8 High	—	0,26%	14 Jul 2026
CVE-2026-48335 adobe illustrator Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this iss...	7.8 High	—	0,26%	14 Jul 2026
CVE-2026-48334 adobe illustrator Illustrator is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user, potentially gainin...	9.3 Critical	—	1,0%	14 Jul 2026
CVE-2026-48312 adobe c2pa, adobe c2pa-web +1 lainnya CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerab...	6.8 Medium	—	0,28%	14 Jul 2026
CVE-2026-48302 adobe c2pa, adobe c2pa-web +1 lainnya CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vu...	6.2 Medium	—	0,27%	14 Jul 2026
CVE-2026-48298 adobe c2pa, adobe c2pa-web +1 lainnya CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could ex...	6.2 Medium	—	0,26%	14 Jul 2026
CVE-2026-48296 adobe c2pa, adobe c2pa-web +1 lainnya CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could ex...	6.2 Medium	—	0,26%	14 Jul 2026
CVE-2026-48295 adobe c2pa, adobe c2pa-web +1 lainnya CAI Content Credentials is affected by an Insufficiently Protected Credentials vulnerability that could result in disclosure of sensitive information. An attacker could l...	7.5 High	—	0,83%	14 Jul 2026
CVE-2026-48290 adobe c2pa, adobe c2pa-web +1 lainnya CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the current user...	8.2 High	—	0,30%	14 Jul 2026
CVE-2026-48287 adobe c2pa, adobe c2pa-web +1 lainnya CAI Content Credentials is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. Exploit de...	7.4 High	—	0,23%	14 Jul 2026
CVE-2026-48275 adobe illustrator Illustrator is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this i...	8.6 High	—	0,29%	14 Jul 2026
CVE-2026-47732 symfony twig Twig is a template language for PHP. Prior to 3.26.0, several Twig language constructs trigger PHP string coercion on a Stringable operand without consulting SecurityPoli...	6.5 Medium	—	0,40%	14 Jul 2026
CVE-2026-47730 symfony twig Twig is a template language for PHP. From 3.0.0 until 3.26.0, Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplate() and Profile::getName() into HTML output withou...	5.4 Medium	—	0,30%	14 Jul 2026
CVE-2026-46640 symfony twig Twig is a template language for PHP. From 3.15.0 until 3.26.0, _self.(<string>) and import-alias dynamic attribute syntax can concatenate an attacker-controlled string in...	8.8 High	—	0,64%	14 Jul 2026
CVE-2026-46639 symfony twig Twig is a template language for PHP. From 3.24.0 until 3.26.0, object-destructuring assignment compiles CoreExtension::getAttribute() with the sandbox argument hardcoded...	6.5 Medium	—	0,39%	14 Jul 2026
CVE-2026-46638 symfony twig Twig is a template language for PHP. Prior to 3.26.0, {% sandbox %}{% include %} can include a template that was previously loaded outside the sandbox without re-invoking...	8.1 High	—	0,47%	14 Jul 2026
CVE-2026-46637 symfony twig Twig is a template language for PHP. Prior to 3.26.0, several filters in twig/markdown-extra and twig/cssinliner-extra are registered with is_safe => [all], causing Twig...	5.4 Medium	—	0,31%	14 Jul 2026
CVE-2026-46635 symfony twig Twig is a template language for PHP. Prior to 3.26.0, the column filter passes object arrays to PHP array_column(), which reads public and magic properties without reachi...	4.3 Medium	—	0,33%	14 Jul 2026
CVE-2026-46634 symfony twig Twig is a template language for PHP. From 3.9.0 until 3.26.0, template_from_string() compiles an inner template under a synthesized __string_template__<hash> name that ca...	9.8 Critical	—	0,62%	14 Jul 2026
CVE-2026-46633 symfony twig Twig is a template language for PHP. Starting in 1.15.1 and prior to 3.26.0, Compiler::string() does not escape single quotes when a template name from a {% use %} tag is...	9.8 Critical	—	0,69%	14 Jul 2026
CVE-2026-46629 symfony twig Twig is a template language for PHP. Prior to 3.26.0, twig/intl-extra memoises IntlDateFormatter and NumberFormatter instances in arrays keyed by template-controlled filt...	6.5 Medium	—	0,54%	14 Jul 2026
CVE-2026-46628 symfony twig Twig is a template language for PHP. Prior to 3.26.0, the deprecated spaceless filter is registered as safe for HTML, causing Twig autoescaping to emit attacker-controlle...	5.4 Medium	—	0,30%	14 Jul 2026
CVE-2026-46627 symfony twig Twig is a template language for PHP. Prior to 3.26.0, the Twig sandbox does not prevent a template from consuming CPU, memory, or wall-clock time, even under the strictes...	6.5 Medium	—	0,54%	14 Jul 2026
CVE-2026-45363 ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts an att...	9.1 Critical	—	0,36%	14 Jul 2026
CVE-2026-42447 jadx project jadx jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx-gui is affected by an HTML injection vulnerability in the Summary tab because SummaryNode.java appends arches and p...	5.0 Medium	—	0,22%	14 Jul 2026
CVE-2026-42049 jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template w...	8.4 High	—	0,20%	14 Jul 2026
CVE-2026-38450 An issue in Aetopia Digital Asset Management DAM v.1.0.0 allows a remote attacker to execute arbitrary code via the name and description parameter of the Add/Update Proje...	9.8 Critical	—	1,0%	14 Jul 2026
CVE-2026-21840 HCL BigFix Platform is affected by a user enumeration vulnerability which might allow an attacker, through careful system control and response time monitoring, to perform...	3.1 Low	—	0,24%	14 Jul 2026
CVE-2026-15750 A weakness has been identified in mastergo-design mastergo-magic-mcp up to 0.2.0. Impacted is the function z.string of the file src/tools/get-component-link.ts of the com...	6.3 Medium	—	0,40%	14 Jul 2026
CVE-2025-56361 csa-iot matter A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) 1.3 thru 1.4, specifically within the Level Control cluster's server tick logic (`emberAfLe...	5.7 Medium	—	0,29%	14 Jul 2026
CVE-2026-61520 Simple Machines Forum 2.1 prior to commit b4d23df (fixed in 2.1.8) and 3.0 prior to commit 4bf35cf contains a server-side request forgery vulnerability in the image proxy...	7.7 High	—	0,44%	14 Jul 2026
CVE-2026-59889 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3...	6.5 Medium	—	0,35%	14 Jul 2026
CVE-2026-53486 The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction can create files and links outside the target directory. When extract...	9.1 Critical	—	0,75%	14 Jul 2026
CVE-2026-52101 An issue in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to obtain sensitive information via the function uploadRemote function in upload.go	9.1 Critical	—	0,55%	14 Jul 2026
CVE-2026-52100 Cross Site Request Forgery vulnerability in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to execute arbitrary code via the uploadPutHandler fun...	7.5 High	—	0,31%	14 Jul 2026
CVE-2026-49978 cure53 dompurify DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DOMPurify IN_PLACE sanitization could skip shadow contents attached to a...	6.1 Medium	—	0,40%	14 Jul 2026
CVE-2026-49855 Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, Tornado gzip decompression routines processed limited-size chunks but did not enfor...	7.5 High	—	0,57%	14 Jul 2026
CVE-2026-49854 Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without v...	5.3 Medium	—	0,42%	14 Jul 2026
CVE-2026-49853 Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host...	7.7 High	—	0,45%	14 Jul 2026
CVE-2026-49477 facelessuser soup sieve Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve contains a regular expression vulnera...	7.5 High	—	0,64%	14 Jul 2026
CVE-2026-49476 facelessuser soup sieve Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve allocates unbounded memory when compi...	7.5 High	—	0,64%	14 Jul 2026
CVE-2026-49459 cure53 dompurify DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-handle...	6.1 Medium	—	0,37%	14 Jul 2026
CVE-2026-49458 cure53 dompurify DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(node, { IN_PLACE: true }) accepted same-origin foreig...	6.1 Medium	—	0,40%	14 Jul 2026
CVE-2026-48816 sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1, @sigstore/verify derives a transparency-log timestamp from tlogEntries[]...	6.5 Medium	—	0,14%	14 Jul 2026
CVE-2026-48815 sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted b...	7.5 High	—	0,17%	14 Jul 2026
CVE-2026-48801 markdown-it linkify-it linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) algorithmic co...	7.5 High	—	0,39%	14 Jul 2026
CVE-2026-48758 sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/core uses Node.js ascii encodi...	5.4 Medium	—	0,24%	14 Jul 2026
CVE-2026-48370 adobe media encoder Media Encoder is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this i...	7.8 High	—	0,26%	14 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.