Katalog CVE (hal. 981)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 267.603 (Critical 36.783 · High 106.969 · KEV 1.767 · sejak 2020) · Pembaruan terakhir: 4 Nov 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 49.001–49.050 dari 267.603 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-62195 openclaw OpenClaw versions 2026.5.20 before 2026.6.6 contain an authorization bypass vulnerability in the MCP loopback feature that allows lower-trust callers to execute owner-onl...	8.3 High	—	0,40%	13 Jul 2026
CVE-2026-62194 openclaw OpenClaw versions 2026.5.20 before 2026.6.9 contain a privilege escalation vulnerability in plugin install commands that allows lower-trust callers to execute or persist...	8.8 High	—	0,45%	13 Jul 2026
CVE-2026-62193 openclaw OpenClaw versions 2026.6.5 before 2026.6.9 contain a vulnerability in the plugin install wrappers that could skip the install policy (authorization) check. When the affec...	6.5 Medium	—	0,32%	13 Jul 2026
CVE-2026-62192 openclaw OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in Discord guild actions that allows lower-trust callers to perform actions requi...	8.1 High	—	0,42%	13 Jul 2026
CVE-2026-62191 openclaw OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in message mutation handling that allows lower-trust callers to perform actions r...	7.1 High	—	0,36%	13 Jul 2026
CVE-2026-62190 openclaw OpenClaw versions before 2026.6.9 contain an authorization bypass vulnerability in the flock wrapper that allows lower-trust callers to execute or persist actions beyond...	8.8 High	—	0,51%	13 Jul 2026
CVE-2026-62189 openclaw OpenClaw versions before 2026.6.9 contain a symlink following vulnerability in the mirror sync feature that allows lower-trust callers to perform actions requiring strong...	7.1 High	—	0,38%	13 Jul 2026
CVE-2026-62188 openclaw/feishu OpenClaw @openclaw/feishu versions 2026.6.6 and earlier contain an incorrect authorization vulnerability in which the Feishu permission tools could ignore per-account dis...	8.1 High	—	0,37%	13 Jul 2026
CVE-2026-62187 openclaw/feishu OpenClaw Feishu tools (npm package @openclaw/feishu) in versions <= 2026.6.6 could ignore per-account disablement. A lower-trust caller or a configured input path could p...	8.1 High	—	0,37%	13 Jul 2026
CVE-2026-62186 openclaw OpenClaw versions before 2026.6.8 contain an authorization bypass vulnerability in OpenAI-compatible HTTP model overrides that allows lower-trust callers to perform actio...	7.6 High	—	0,33%	13 Jul 2026
CVE-2026-62185 Argo CD Helm Chart before 10.0.0 fails to install network policies by default, allowing any pod on a cluster to access repo-server and other Argo APIs. Attackers can expl...	7.6 High	—	0,46%	13 Jul 2026
CVE-2026-62184 luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first IPv4 address from log lines regardless of field position, allowing attac...	7.5 High	—	0,56%	13 Jul 2026
CVE-2026-61458 PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoint that lacks route-specific rate limiting and per-push lockout mechan...	7.5 High	—	0,38%	13 Jul 2026
CVE-2026-59801 9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending...	9.8 Critical	—	2,6%	13 Jul 2026
CVE-2026-58500 appium-mcp MCP Appium is an MCP server that provides AI assistants with tools to automate mobile app testing on Android and iOS. In versions prior to 1.85.10, the createLocatorGener...	8.2 High	—	0,40%	13 Jul 2026
CVE-2026-58488 HedgeDoc is an open source, real-time, collaborative, markdown notes application. Versions prior to 1.11.0 allowed attackers to circumvent the rate-limiting of the /login...	6.9 Medium	—	0,41%	13 Jul 2026
CVE-2026-58487 HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to version 1.11.0, due to unsafe handling of the local-part of registered email ad...	5.1 Medium	—	0,49%	13 Jul 2026
CVE-2026-58411 ChurchCRM is an open-source church management system. Prior to version 7.4.0, Cross-Site Scripting (XSS) vulnerabilities were identified due to insufficient output encodi...	7.0 High	—	0,43%	13 Jul 2026
CVE-2026-56877 The SCORM lab launch endpoint in Skillable (scorm.skillable.com) through 2026-07-13 does not validate the client-supplied userId parameter against the authenticated SCORM...	6.3 Medium	—	0,39%	13 Jul 2026
CVE-2026-52533 An issue in D-Link DIR-1253 v.1.0.1.250923.142435 allows an attacker to escalate privileges via the etc/shadow component file	9.8 Critical	—	0,60%	13 Jul 2026
CVE-2026-51821 SQL Injection vulnerability in Shenzhou Shihan Video Conference System v.1.0 allows a remote attacker to execute arbitrary code via the /user/getUserLogin endpoint	9.8 Critical	—	0,69%	13 Jul 2026
CVE-2026-51541 opener project opener OpENer 2.3.0 (commit 76b95cf) has an out-of-bounds read issue in CIP message parsing when handling malformed explicit requests with a forged EPath size. An attacker can s...	9.1 Critical	—	0,55%	13 Jul 2026
CVE-2026-51540 opener project opener OpENer 2.3.0 (master branch up to commit 76b95cf) is vulnerable to a severe memory corruption issue caused by an integer underflow in the processing of connected explicit...	9.8 Critical	—	0,57%	13 Jul 2026
CVE-2026-51539 A Denial of Service (DoS) vulnerability exists in the receive loop of libmodbus 3.1.12 when running on Windows. The issue stems from improper timeout management during ne...	7.5 High	—	0,49%	13 Jul 2026
CVE-2026-51538 opener project opener EIPStackGroup OpENer 2.3.0 (commit 76b95cf) suffers from an Incorrect Access Control vulnerability in its handling of encapsulation sessions. When the server processes cr...	9.1 Critical	—	0,52%	13 Jul 2026
CVE-2026-51537 opener project opener EIPStackGroup OpENer 2.3.0 (commit 76b95cf) has an out-of-bounds read issue in Connection Manager handling of ForwardOpen requests when processing short malformed packets...	9.1 Critical	—	0,65%	13 Jul 2026
CVE-2026-51536 opener project opener In OpENer 2.3.0 (commit 76b95cf) when parsing incoming CIP (Common Industrial Protocol) network packets, the length parameter is inconsistently typed across the call stac...	9.1 Critical	—	0,63%	13 Jul 2026
CVE-2026-39042 An issue in MikroTIk (SIA Mikrotikls, Latvia) RouterOS 7.21.x before v.7.21.4 and 7.22.x before v.7.22.2 allows a remote attacker to cause a denial of service via the unf...	7.5 High	—	0,58%	13 Jul 2026
CVE-2026-15685 ollama Ollama downloadBlob Improper Validation of Array Index Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition...	7.5 High	—	0,72%	13 Jul 2026
CVE-2026-15684 Glarysoft Glary Utilities Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installati...	7.3 High	—	0,19%	13 Jul 2026
CVE-2026-15683 Lorex 2K Indoor Wi-Fi Security Camera Device Management Server Improper Certificate Validation Vulnerability. This vulnerability allows network-adjacent attackers to exec...	7.5 High	—	0,15%	13 Jul 2026
CVE-2026-15682 anydesk AnyDesk Support Information Link Following Denial-of-Service Vulnerability. This vulnerability allows local attackers to create a denial-of-service condition on affected...	5.5 Medium	—	0,14%	13 Jul 2026
CVE-2026-15681 anydesk AnyDesk Screen Recording Link Following Denial-of-Service Vulnerability. This vulnerability allows local attackers to create a denial-of-service condition on affected ins...	5.5 Medium	—	0,14%	13 Jul 2026
CVE-2026-15680 Lorex 2K Indoor Wi-Fi Security Camera CDeviceOperator Format String Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute a...	7.5 High	—	0,41%	13 Jul 2026
CVE-2026-15598 A weakness has been identified in antv layout 2.0.0. This impacts the function setNestedValue in the library lib/util/object.js. Executing a manipulation of the argument...	6.3 Medium	—	0,42%	13 Jul 2026
CVE-2026-15597 A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0/2.php. This affects an unknown function of the file /edit_exam2.php. Performin...	7.3 High	—	0,43%	13 Jul 2026
CVE-2026-15596 A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. The impacted element is an unknown function of the file /subject.php. Such manipul...	4.3 Medium	—	0,47%	13 Jul 2026
CVE-2026-58410 ChurchCRM is an open-source church management system. Prior to version 7.4.0, there was an authorization flaw in the family-scoped endpoints which allowed low-privileged...	7.1 High	—	0,21%	13 Jul 2026
CVE-2026-58409 ChurchCRM is an open-source church management system. Prior to version 7.4.0, an authenticated administrator can achieve Remote Code Execution (RCE) on the server by inst...	9.1 Critical	—	0,57%	13 Jul 2026
CVE-2026-48364 adobe coldfusion ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the con...	8.2 High	—	0,27%	13 Jul 2026
CVE-2026-48363 adobe coldfusion ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the con...	8.2 High	—	0,27%	13 Jul 2026
CVE-2026-15595 A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. The affected element is an unknown function of the file /forsubject.php. This mani...	4.3 Medium	—	0,47%	13 Jul 2026
CVE-2026-15594 A vulnerability was found in waooAI waoowaoo up to 0.4.1. Impacted is the function stablePublicIdFromStorageKey in the library src/lib/media/hash.ts of the component Medi...	3.7 Low	—	0,46%	13 Jul 2026
CVE-2026-58408 ChurchCRM is an open-source church management system. Prior to version 7.4.0, a low-privileged user can bypass the /admin/export UI and exfiltrate the entire member direc...	6.5 Medium	—	0,36%	13 Jul 2026
CVE-2026-55773 CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0,...	8.8 High	—	0,52%	13 Jul 2026
CVE-2026-55771 CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 4.9.0, the EntityIdentif...	8.8 High	—	0,58%	13 Jul 2026
CVE-2026-12536 The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Module Title’ parameter in all versions up to, and including, 3.15.5...	6.4 Medium	—	0,26%	13 Jul 2026
CVE-2026-12385 The Smart Slider 3 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.1.37 via the 'keyword' parameter. This m...	4.3 Medium	—	0,41%	13 Jul 2026
CVE-2026-6875 ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user,...	9.5 Critical	—	1,4%	13 Jul 2026
CVE-2026-58228 Cross-site scripting vulnerability in phoenixframework phoenix_live_view allows an attacker to bypass URL scheme validation and execute JavaScript in a victim's browser s...	5.1 Medium	—	0,48%	13 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.