Katalog CVE (hal. 982)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 267.603 (Critical 36.783 · High 106.969 · KEV 1.767 · sejak 2020) · Pembaruan terakhir: 4 Nov 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 49.051–49.100 dari 267.603 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-55772 CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0,...	8.8 High	—	0,48%	13 Jul 2026
CVE-2026-49972 Laravel-Mediable before 7.0.0 contains a file upload vulnerability that allows unauthenticated attackers to achieve remote code execution by uploading a file with an embe...	8.8 High	—	1,1%	13 Jul 2026
CVE-2026-49971 Laravel-Mediable before 7.0.0 contains a stored cross-site scripting vulnerability that allows authenticated or anonymous users to execute arbitrary JavaScript by uploadi...	6.1 Medium	—	0,36%	13 Jul 2026
CVE-2026-49970 Laravel-Mediable before 7.0.0 contains a path traversal vulnerability in the File::sanitizePath() function that allows attackers to write uploaded files to arbitrary loca...	8.8 High	—	1,0%	13 Jul 2026
CVE-2026-49969 Laravel-Mediable before 7.0.0 contains a server-side request forgery vulnerability that allows remote attackers to issue arbitrary HTTP requests from the server by supply...	7.4 High	—	0,42%	13 Jul 2026
CVE-2026-26396 OpenBMB XAgent v1.0.0 and before is vulnerable to path traversal in the file() function in XAgent/XAgentServer/application/routers/workspace.py. The input parameter “file...	7.5 High	—	1,1%	13 Jul 2026
CVE-2026-14906 mozilla firefox mobile Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within the Firefox for iOS application sandbox. This vulne...	5.3 Medium	—	0,29%	13 Jul 2026
CVE-2025-45869 LogicalDOC Enterprise Version up to and before v9.1.1 is vulnerable to Server-Side Request Forgery (SSRF). An unauthenticated attacker can exploit the ShareFileCallback s...	7.3 High	—	0,34%	13 Jul 2026
CVE-2026-61505 Rejetto HFS 3.0.0 through 3.2.0 allows path traversal through the lang query parameter, permitting a remote unauthenticated attacker to read certain JSON files outside th...	5.3 Medium	—	0,52%	13 Jul 2026
CVE-2026-61504 Rejetto HFS 3.0.0 through 3.2.0 does not escape file names in its fallback "basic" web listing, and this listing can be forced by any browser via the ?get=basic parameter...	5.4 Medium	—	0,24%	13 Jul 2026
CVE-2026-61503 Rejetto HFS 3.0.0 through 3.2.0 returns observably different responses from its login endpoint depending on whether the submitted username exists. A remote unauthenticate...	5.3 Medium	—	0,44%	13 Jul 2026
CVE-2026-61502 Rejetto HFS 3.0.0 through 3.2.0 accepts state-changing API requests via the GET method and exempts GET requests from its anti-CSRF header check. A remote attacker can per...	4.3 Medium	—	0,22%	13 Jul 2026
CVE-2026-61501 Rejetto HFS 3.0.0 through 3.2.0 renders log entries in the administration panel as HTML without sanitization. A remote unauthenticated attacker can submit a failed login...	6.1 Medium	—	0,42%	13 Jul 2026
CVE-2026-61500 Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generator and discloses outputs of the same generator to u...	9.8 Critical	—	1,9%	13 Jul 2026
CVE-2026-61463 Shiori contains a privilege escalation vulnerability in the account update endpoint that allows authenticated users to modify the owner field without authorization checks...	8.8 High	—	0,47%	13 Jul 2026
CVE-2026-61462 mcp-gitlab contains a path traversal vulnerability in the job_id parameter of build/index.js that allows attackers to redirect GitLab API requests to arbitrary endpoints....	8.6 High	—	0,48%	13 Jul 2026
CVE-2026-60103 Blender 3.0.0 through 5.1.2 contains an out-of-bounds read vulnerability that allows attackers to trigger a crash or read adjacent heap memory by supplying a crafted .ble...	6.1 Medium	—	0,17%	13 Jul 2026
CVE-2026-53365 linux kernel In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix zerocopy completion for multi-skb sends When a large message is fragmented into mu...	5.5 Medium	—	0,20%	13 Jul 2026
CVE-2026-53364 linux kernel In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate() hci_le_big_terminate() allocates iso_...	5.5 Medium	—	0,12%	13 Jul 2026
CVE-2026-57433 nwclark storable Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count...	9.8 Critical	—	0,48%	13 Jul 2026
CVE-2026-57432 perl Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap r...	8.4 High	—	0,21%	13 Jul 2026
CVE-2026-13221 perl Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of mo...	9.1 Critical	—	0,49%	13 Jul 2026
CVE-2026-59245 apache-airflow-providers-fab In the Apache Airflow FAB auth manager, a DAG whose `dag_id` is `DAGs` collided with the global all-DAGs permission resource name produced by `resource_name()`, so a user...	8.1 High	—	0,60%	13 Jul 2026
CVE-2026-58065 apache-airflow-providers-git The Apache Airflow Git provider runs its git-over-SSH operations with `StrictHostKeyChecking=no` by default, disabling SSH host-key verification. An attacker who can inte...	8.1 High	—	0,74%	13 Jul 2026
CVE-2026-6847 Remote Code Execution vulnerability exists in ThemisNETPanel due to missing authentication for a critical file upload function. The application exposes an endpoint that a...	9.3 Critical	—	0,88%	13 Jul 2026
CVE-2026-61498 vitec flamingo Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/gen_graphs.php endpoint that allows remote unauthenticated attacker...	9.8 Critical	—	4,0%	13 Jul 2026
CVE-2026-60121 vitec flamingo Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/ping.php endpoint that allows remote attackers to execute arbitrary...	9.8 Critical	—	3,3%	13 Jul 2026
CVE-2026-40553 fossies gawk Buffer overflow vulnerability has been found in "extension/readdir.c" program file of gawk (ftype() routine). This issue could be used to crash the program and potentiall...	7.5 High	—	0,29%	13 Jul 2026
CVE-2026-40469 fossies gawk Integer overflow vulnerability has been found in "builtin.c" program file of gawk (do_sub() routine). This issue could be used to overwrite gawk heap metadata and objects...	9.1 Critical	—	0,21%	13 Jul 2026
CVE-2026-40468 fossies gawk Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This issue may lead to memory exhaustion on the hosting operating system and could be u...	9.1 Critical	—	0,20%	13 Jul 2026
CVE-2026-40467 fossies gawk Use After Free vulnerability has been found in "io.c" program file of gawk (do_getline_redir() routine). This issue may lead to a crash. It affects gawk in versions 5.4.0...	7.5 High	—	0,21%	13 Jul 2026
CVE-2026-15584 A privilege escalation vulnerability was found in the incluster-checks tool for OpenShift. The tool creates privileged debug pods with host filesystem access in the share...	7.5 High	—	0,42%	13 Jul 2026
CVE-2026-15559 A vulnerability was detected in CodeAstro Simple Online Leave Management System 1.0. This affects an unknown part of the file /SimpleOnlineLeave/admin/accept.php of the c...	6.3 Medium	—	0,33%	13 Jul 2026
CVE-2026-62147 The Tempo Operator's gateway component failed to consistently apply namespace-scoped redaction on some query API response paths when query RBAC was enabled, allowing an a...	6.5 Medium	—	0,40%	13 Jul 2026
CVE-2026-15558 A security vulnerability has been detected in CodeAstro Simple Online Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /Simpl...	6.3 Medium	—	0,33%	13 Jul 2026
CVE-2026-12257 Versions of Mura CMS prior to 10.0.712 contain a critical remote code execution (RCE) vulnerability. The flaw is located in the endpoint “/index.cfm/_api/json/v1/default”...	9.3 Critical	—	0,70%	13 Jul 2026
CVE-2026-9824 mattermost server Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to check the manage_shared_channels permission in the /share-channel autocomplete handler...	4.3 Medium	—	0,27%	13 Jul 2026
CVE-2026-9820 mattermost server Mattermost versions 11.7.x <= 11.7.2, 10.11.x <= 10.11.19 fail to sanitize team objects returned by the scheme teams endpoint, which allows a user with the User Manager r...	3.8 Low	—	0,26%	13 Jul 2026
CVE-2026-6541 mattermost server Mattermost versions 11.7.x <= 11.7.1, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to restrict metric configuration changes to the playbook being saved, which allows an aut...	4.3 Medium	—	0,25%	13 Jul 2026
CVE-2026-14934 A Missing Authorization vulnerability in the repository creation functionality in Google Cloud BigQuery, Dataform and Colab Enterprise, in the versions between October 20...	9.4 Critical	—	0,35%	13 Jul 2026
CVE-2026-61985 Missing Authorization vulnerability in magepeopleteam Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This i...	5.3 Medium	—	0,29%	13 Jul 2026
CVE-2026-61983 Missing Authorization vulnerability in andy_moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chu...	5.3 Medium	—	0,29%	13 Jul 2026
CVE-2026-61977 Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetSearch jet-search allows Retrieve Embedded Sensitive Data.This i...	5.3 Medium	—	0,33%	13 Jul 2026
CVE-2026-61976 Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Retrieve Embedded Sensiti...	5.3 Medium	—	0,33%	13 Jul 2026
CVE-2026-61975 Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetReviews jet-reviews allows Retrieve Embedded Sensitive Data.This...	5.3 Medium	—	0,33%	13 Jul 2026
CVE-2026-61971 Authorization Bypass Through User-Controlled Key vulnerability in Cozmoslabs User Profile Picture metronet-profile-picture allows Exploiting Incorrectly Configured Access...	2.7 Low	—	0,31%	13 Jul 2026
CVE-2026-61970 Server-Side Request Forgery (SSRF) vulnerability in Themeisle Auto Featured Image (Auto Post Thumbnail) auto-post-thumbnail allows Server Side Request Forgery.This issue...	4.9 Medium	—	0,19%	13 Jul 2026
CVE-2026-61968 Missing Authorization vulnerability in Saad Iqbal myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/...	5.4 Medium	—	0,29%	13 Jul 2026
CVE-2026-61958 Missing Authorization vulnerability in Saad Iqbal License Manager for WooCommerce license-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control...	5.4 Medium	—	0,29%	13 Jul 2026
CVE-2026-61956 Cross-Site Request Forgery (CSRF) vulnerability in hamsalam ووسلام – همگام سازی ووکامرس و باسلام sync-basalam allows Cross Site Request Forgery.This issue affects و...	7.1 High	—	0,16%	13 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.