Katalog CVE (hal. 98) — KUTIM-CSIRT

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 258.834 (Critical 35.935 · High 103.510 · KEV 1.746 · sejak 2020) · Pembaruan terakhir: 16 Okt 2026, 06:27 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 4.851–4.900 dari 258.834 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-108267 Privasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls. Prior to privasys-v0.5.1-go1.26.5, challenge-mode RA-TLS certifica...	9.1 Critical	—	0,12%	9 Okt 2026
CVE-2026-92705 Aegisub is a cross-platform advanced subtitle editor. From 3.2.0 to 3.4.2, Aegisub automatically loads Automation scripts referenced by `Automation Scripts` metadata in `...	7.8 High	—	0,13%	9 Okt 2026
CVE-2026-62376 Vikunja is an open-source self-hosted task management platform. Versions prior to 2.4.0 store password-reset, email-confirmation, and account-deletion tokens in the `user...	8.1 High	—	0,22%	9 Okt 2026
CVE-2026-62367 Vikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an administrator enables the per-provider `emailfallback` option on...	7.5 High	—	0,09%	9 Okt 2026
CVE-2026-57458 Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the `oauth.authorize` permission can call `POST /api/v1/oa...	8.1 High	—	0,27%	9 Okt 2026
CVE-2026-108266 Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support. Prior to privasys-v0.8.1, the fork emitted RA-TLS c...	9.1 Critical	—	0,12%	9 Okt 2026
CVE-2026-108265 Enclave OS Mini is a Rust-based runtime for confidential applications inside Intel SGX enclaves. Prior to wasm-v0.40.0, the SGX runtime's RA-TLS challenge certificate pat...	9.1 Critical	—	0,12%	9 Okt 2026
CVE-2026-108264 Wizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other media servers. Prior to 2026.9.1, wizard step Markdown supplied through th...	9.1 Critical	—	0,38%	9 Okt 2026
CVE-2026-108263 Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/ru...	9.9 Critical	—	0,43%	9 Okt 2026
CVE-2026-108261 Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can tu...	9.3 Critical	—	0,16%	9 Okt 2026
CVE-2026-108260 Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js assigns a rich-text node....	7.6 High	—	0,21%	9 Okt 2026
CVE-2026-108259 Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD, incorporates the ra...	8.2 High	—	0,25%	9 Okt 2026
CVE-2026-108258 Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied state_id and joins...	6.9 Medium	—	0,36%	9 Okt 2026
CVE-2026-107857 Mindwtr is a free offline-first task management application for desktop and mobile. Prior to 1.1.5, the mobile application writes the Cloud sync bearer token and WebDAV p...	4.4 Medium	—	0,09%	9 Okt 2026
CVE-2026-107856 CiviForm simplifies applications for government benefits programs by reusing applicant data across multiple benefit applications. Prior to 3.33.0, GET /admin/tiDash/editC...	4.5 Medium	—	0,23%	9 Okt 2026
CVE-2026-107854 Jexactyl is a customisable game management panel and billing system. From 4.0.0 until 4.0.5, the POST /api/client/billing/free/process endpoint accepts a client-controlle...	5.4 Medium	—	0,21%	9 Okt 2026
CVE-2026-107852 Jexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/client/billing/stripe/process endpoint accepts a client-supplied Stripe...	7.1 High	—	0,16%	9 Okt 2026
CVE-2026-107851 Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule() in core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php...	4.3 Medium	—	0,19%	9 Okt 2026
CVE-2026-107850 Contao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bundle/config/services.yaml registers the preview access voter as Contao\CoreBundle\Security\Voter\Dat...	4.3 Medium	—	0,19%	9 Okt 2026
CVE-2026-107848 Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUEST_TOKEN only for POST requests, while the declarative GET g...	3.5 Low	—	0,11%	9 Okt 2026
CVE-2026-78797 An issue in iStoreOS istoreos-24.10.7 and before allows a remote attacker to execute arbitrary code via the task_id in tasks-lib.lua.	9.8 Critical	—	0,62%	9 Okt 2026
CVE-2026-107845 Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered with...	9.3 Critical	—	0,27%	9 Okt 2026
CVE-2026-107844 Contao is an Open Source CMS. From version 5.0.0 until 5.3.50 and 5.7.12, ImagesController joins the user-controlled {path} parameter to the configured image target direc...	5.3 Medium	—	0,31%	9 Okt 2026
CVE-2026-107843 Contao is an Open Source CMS. From version 4.1.0 until 5.3.50 and 5.7.12, ModuleRegistration::compile() enters its follow-up registration branch on any POST to a page con...	5.3 Medium	—	0,26%	9 Okt 2026
CVE-2026-107842 Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, ModuleSearch can disclose protected page titles, URLs, and indexed context snippets to unauthent...	5.3 Medium	—	0,26%	9 Okt 2026
CVE-2026-78835 Rocket Software Rocket Remote Desktop 18.0.8583.1 is vulnerable to Insufficiently Protected Credentials.	9.8 Critical	—	0,28%	9 Okt 2026
CVE-2026-75352 OpENer v2.3/commit 76b95cf, contains an integer underflow in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote attacker to cause a deni...	7.5 High	—	0,33%	9 Okt 2026
CVE-2026-75351 OpENer v2.3/commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote attacker to cause a den...	7.5 High	—	0,40%	9 Okt 2026
CVE-2026-75350 EIPStackGroup OpENer v2.3 / master commit 76b95cf contains a buffer overflow in the GetAttributeList() implementation for the EtherNet/IP Get_Attribute_List service. This...	7.5 High	—	0,48%	9 Okt 2026
CVE-2026-108096 Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated re...	6.5 Medium	—	0,30%	9 Okt 2026
CVE-2026-107841 pacioli provides least-privilege governance and a governed agent broker for ERPNext. From version 0.9.6 until version 0.10.0, the pacioli-guard document-layer consent gat...	5.7 Medium	—	0,23%	9 Okt 2026
CVE-2026-107840 yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attack...	7.5 High	—	0,44%	9 Okt 2026
CVE-2026-107839 ageLANServer provides a cross-platform web server and launcher for offline multiplayer in several Age of Empires and Age of Mythology games. Prior to version 1.15.2, the...	7.5 High	—	0,34%	9 Okt 2026
CVE-2026-107838 RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. From version 2023.07 through version 2026.07,...	7.5 High	—	0,34%	9 Okt 2026
CVE-2026-107837 RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, _receive() in sys/net/...	8.2 High	—	0,38%	9 Okt 2026
CVE-2026-107836 RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, the nanoCoAP client fu...	7.1 High	—	0,29%	9 Okt 2026
CVE-2026-107835 OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.8.1, internal/cookies.ParseCookies in internal/cookies/cookies.go handles...	4.0 Medium	—	0,30%	9 Okt 2026
CVE-2026-107834 OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multipart loop in internal/bodyprocessors/multipart.go e...	5.3 Medium	—	0,32%	9 Okt 2026
CVE-2026-107833 OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes th...	5.9 Medium	—	0,39%	9 Okt 2026
CVE-2026-107826 OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON in internal/bodyprocessors/json.go can stop its bou...	7.5 High	—	0,46%	9 Okt 2026
CVE-2026-107825 OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessURI in internal/corazawaf/transaction.go handles a ur...	4.0 Medium	—	0,25%	9 Okt 2026
CVE-2026-107824 x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.1, x64dbg-MCP Server exp...	9.3 Critical	—	0,40%	9 Okt 2026
CVE-2026-107823 mariadb MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did no...	7.2 High	—	0,71%	9 Okt 2026
CVE-2026-107822 mariadb MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate...	6.4 Medium	—	0,48%	9 Okt 2026
CVE-2026-107821 mariadb MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated c...	8.0 High	—	0,76%	9 Okt 2026
CVE-2026-107820 x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.2, src/core/mcp_server.z...	5.3 Medium	—	0,41%	9 Okt 2026
CVE-2026-107819 MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb...	5.9 Medium	—	0,24%	9 Okt 2026
CVE-2026-107818 mariadb MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run...	8.4 High	—	0,34%	9 Okt 2026
CVE-2026-107817 mariadb MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql_json plugin assumed that...	4.4 Medium	—	0,14%	9 Okt 2026
CVE-2026-107816 mariadb MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confus...	6.4 Medium	—	0,31%	9 Okt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.