Katalog CVE (hal. 987)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 267.603 (Critical 36.783 · High 106.969 · KEV 1.767 · sejak 2020) · Pembaruan terakhir: 4 Nov 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 49.301–49.350 dari 267.603 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-15529 A vulnerability was detected in yzhao062 pyod up to 3.6.1. Affected is the function pyod.utils.persistence.load of the file pyod/utils/persistence.py. Performing a manipu...	6.3 Medium	—	0,44%	13 Jul 2026
CVE-2026-15528 A vulnerability was found in lamaalrajih kicad-mcp up to 3.3.1. This issue affects some unknown processing of the file kicad_mcp/utils/path_validator.py. Performing a man...	3.3 Low	—	0,16%	13 Jul 2026
CVE-2026-15527 A vulnerability has been found in better-auth better-icons up to 1.0.5. This vulnerability affects unknown code of the component scan_project_icons/sync_icon. Such manipu...	5.3 Medium	—	0,17%	13 Jul 2026
CVE-2026-15526 A flaw has been found in augmnt augments-mcp-server 7.1.0. This issue affects the function scanProjectDeps of the file src/tools/v4/scan-project-deps.ts of the component...	3.3 Low	—	0,17%	13 Jul 2026
CVE-2026-15525 A vulnerability was detected in kLOsk adloop up to 0.9.0. This vulnerability affects the function _validate_urls of the file src/adloop/ads/write.py. Performing a manipul...	6.3 Medium	—	0,37%	13 Jul 2026
CVE-2026-15524 A security vulnerability has been detected in alioshr memory-bank-mcp up to 0.2.1/3.1. This affects an unknown part of the file list-project-files-validation-factory.ts....	3.3 Low	—	0,17%	13 Jul 2026
CVE-2026-15523 A weakness has been identified in CodeAstro Simple Online Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /SimpleOnlineLeave...	6.3 Medium	—	0,33%	13 Jul 2026
CVE-2026-15522 A security flaw has been discovered in tugcantopaloglu godot-mcp 2.0.0. Affected by this vulnerability is the function validatePath of the file build/index.js of the comp...	5.3 Medium	—	0,17%	13 Jul 2026
CVE-2026-15521 A vulnerability was identified in makafeli n8n-workflow-builder up to 0.11.0. Affected is an unknown function of the file build/server.cjs of the component update_node_fr...	5.3 Medium	—	0,17%	13 Jul 2026
CVE-2026-15520 A vulnerability was determined in GNU LibreDWG 0.13.4-154-g0b573035. This impacts the function decompress_R2004_section of the file src/decode.c of the component R2004 Se...	5.3 Medium	—	0,20%	13 Jul 2026
CVE-2026-15519 A vulnerability was found in usestrix strix up to 1.0.2. This affects an unknown function of the file system_prompt.jinja of the component PyPI Handler. Performing a mani...	5.0 Medium	—	0,35%	13 Jul 2026
CVE-2026-15551 samsung rlottie Integer overflow or wraparound vulnerability in Samsung Open Source rlottie allows Overflow Buffers. This issue affects .	5.5 Medium	—	0,11%	13 Jul 2026
CVE-2026-15518 A vulnerability has been found in AREA 17 Twill CMS up to 3.6.0. The impacted element is the function FileLibraryController::storeFile of the file src/Http/Controllers/Ad...	4.7 Medium	—	0,38%	13 Jul 2026
CVE-2026-15517 A flaw has been found in Jinher OA 1.0. The affected element is an unknown function of the file /C6/JHSoft.Web.PlanSummarize/PlanGiveOut.aspx. This manipulation of the ar...	7.3 High	—	0,41%	13 Jul 2026
CVE-2026-15516 A vulnerability was detected in MacCMS Pro up to 2022.1000.3005. Impacted is the function step5 of the file application/install/controller/Index.php of the component Inst...	5.6 Medium	—	0,44%	13 Jul 2026
CVE-2026-15515 A security vulnerability has been detected in Tencent PC Manager 18.1.30242.301. This issue affects some unknown processing in the library qmudisk64.sys of the component...	7.0 High	—	0,16%	13 Jul 2026
CVE-2026-15514 A weakness has been identified in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. This vulnerability affects the function RPCService.query of the file /customizemt/xkq/rpc.jsp...	7.3 High	—	0,41%	13 Jul 2026
CVE-2026-15513 A security flaw has been discovered in Wavlink WL-NU516U1 260515. This affects the function wlink_uci_set_value of the file /cgi-bin/adm.cgi. Performing a manipulation of...	6.3 Medium	—	1,8%	13 Jul 2026
CVE-2026-15512 A vulnerability was identified in pig-mesh Pig up to 3.9.2. Affected by this issue is some unknown functionality of the file \pig-master\pig-visual\pig-codegen\src\main\j...	6.3 Medium	—	0,39%	13 Jul 2026
CVE-2026-15511 A vulnerability was determined in Comfast CF-WR631AX V3 up to 2.7.0.8. Affected by this vulnerability is the function system_wl_upload_pic_file of the file /usr/bin/webmg...	9.8 Critical	—	4,7%	12 Jul 2026
CVE-2026-15510 A vulnerability was found in Leantime up to 3.8.0. Affected is the function Setting::saveSetting of the component API. The manipulation results in improper authorization....	6.3 Medium	—	0,35%	12 Jul 2026
CVE-2026-15509 A vulnerability has been found in Leantime up to 3.8.0. This impacts the function editUser/addUser of the component JSON-RPC Endpoint. The manipulation of the argument ro...	6.3 Medium	—	0,35%	12 Jul 2026
CVE-2026-15508 A flaw has been found in Helicone ai-gateway up to 0.2.0-beta.30. This affects the function build_target_url of the file ai-gateway/src/dispatcher/service.rs of the compo...	6.3 Medium	—	0,35%	12 Jul 2026
CVE-2026-15507 A vulnerability was detected in coollabsio Coolify up to 4.1.1. The impacted element is an unknown function of the file /app/Policies/ of the component Policy Handler. Pe...	6.3 Medium	—	0,35%	12 Jul 2026
CVE-2026-15506 A security vulnerability has been detected in SecureAge CatchPulse up to 10.9.3. The affected element is an unknown function in the library saappctl.sys of the component...	7.8 High	—	0,20%	12 Jul 2026
CVE-2026-15505 A weakness has been identified in vnotex vnote up to 3.20.1. Impacted is an unknown function of the file /src/data/extra/web/js/markdownit.js of the component YAML Frontm...	3.5 Low	—	0,33%	12 Jul 2026
CVE-2026-10668 zephyrproject zephyr The Nuvoton NuMaker HSUSBD USB device-controller driver (drivers/usb/udc/udc_numaker.c) armed the control Data IN stage unconditionally (base->CEPTXCNT = len in numaker_h...	4.6 Medium	—	0,23%	12 Jul 2026
CVE-2026-10667 zephyrproject zephyr Zephyr's dynamic kernel-object tracking (kernel/userspace/userspace.c, formerly kernel/userspace.c) maintains a doubly-linked list (obj_list) of dynamically allocated ker...	7.8 High	—	0,15%	12 Jul 2026
CVE-2026-10666 zephyrproject zephyr parse_ipv4() in subsys/net/ip/utils.c (reached via net_ipaddr_parse() for strings of the form "a.b.c.d:port") copies the port substring into a fixed 17-byte stack buffer...	9.8 Critical	—	0,65%	12 Jul 2026
CVE-2026-10665 zephyrproject zephyr In Zephyr's WireGuard subsystem (subsys/net/lib/wireguard), wg_process_data_message() in wg_crypto.c linearizes an inbound transport-data payload into a fixed pool buffer...	7.4 High	—	0,60%	12 Jul 2026
CVE-2026-10664 zephyrproject zephyr The nRF70 Wi-Fi driver's power-save event handler nrf_wifi_event_proc_get_power_save_info() in drivers/wifi/nrf_wifi/src/wifi_mgmt.c copied TWT (Target Wake Time) flow en...	5.0 Medium	—	0,22%	12 Jul 2026
CVE-2026-10663 zephyrproject zephyr In Zephyr's experimental USB host stack (CONFIG_USB_HOST_STACK), usbh_device_disconnect() (subsys/usb/host/usbh_device.c) freed the root usb_device slab object without cl...	6.1 Medium	—	0,24%	12 Jul 2026
CVE-2026-58596 microsoft edge chromium Untrusted pointer dereference in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.	8.3 High	—	0,61%	12 Jul 2026
CVE-2026-15502 A vulnerability was detected in AojiaoZero Antaris 1.0. This affects the function _rewardPurchase of the file /ipn.php of the component PayPal IPN Payment Handler. The ma...	6.3 Medium	—	0,32%	12 Jul 2026
CVE-2026-15501 A security vulnerability has been detected in AstrBotDevs AstrBot up to 4.25.2. Affected by this issue is the function ToolsRoute.test_mcp_connection of the file astrbot/...	6.3 Medium	—	0,35%	12 Jul 2026
CVE-2026-61876 LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent network attackers to inject HTML markup. Attackers can s...	8.8 High	—	1,6%	12 Jul 2026
CVE-2026-61875 luci-app-upnp contains a stored cross-site scripting vulnerability that allows unauthenticated LAN clients to inject JavaScript via UPnP IGD AddPortMapping SOAP requests....	8.8 High	—	0,36%	12 Jul 2026
CVE-2026-61874 filebrowser versions before 2.63.17 fail to normalize paths before querying the share index in DeleteWithPathPrefix, allowing authenticated users to leave stale public sh...	3.1 Low	—	0,32%	12 Jul 2026
CVE-2026-59260 OpenWrt luci-app-samba4 read ACL grants file.exec permission on /usr/sbin/smbd, allowing authenticated delegated users to execute the Samba daemon with caller-controlled...	8.8 High	—	0,88%	12 Jul 2026
CVE-2026-56336 Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /private/sso/check-domain endpoint that returns internal org_id and provider...	5.3 Medium	—	0,34%	12 Jul 2026
CVE-2026-56313 Capgo before 12.128.2 contains a cross-organization account disruption vulnerability in the SSO prelink endpoint that allows enterprise administrators to delete password...	8.1 High	—	0,50%	12 Jul 2026
CVE-2026-56308 Capgo before 12.128.2 allows email address changes without requiring current password re-authentication or verification of the existing email address. An attacker with ac...	7.3 High	—	0,31%	12 Jul 2026
CVE-2026-56281 Capgo before 12.128.2 contains a sql injection vulnerability in the POST /private/admin_stats endpoint where the limit parameter is destructured from unvalidated request...	3.8 Low	—	0,33%	12 Jul 2026
CVE-2026-56271 flowiseai flowise Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audience and issuer values...	9.8 Critical	—	0,66%	12 Jul 2026
CVE-2026-56260 kidocode crawl4ai Crawl4AI before 0.8.7 contains an arbitrary file write vulnerability in the Docker API server's /screenshot and /pdf endpoints. The output_path parameter accepts arbitrar...	9.1 Critical	—	0,65%	12 Jul 2026
CVE-2026-56259 kidocode crawl4ai Crawl4AI before 0.8.8 contains credential exfiltration vulnerabilities in the Docker API server that allow attackers to redirect LLM API calls to attacker-controlled endp...	8.2 High	—	0,43%	12 Jul 2026
CVE-2026-56252 Capgo before 12.128.2 contains a scope isolation vulnerability in the POST /webhooks/test endpoint that allows app-scoped API keys to invoke org-scoped webhook operations...	5.4 Medium	—	0,21%	12 Jul 2026
CVE-2026-56241 Capgo before 12.128.2 contains a privilege escalation vulnerability where demoted super_admin users retain access to delete_non_compliant_bundles and count_non_compliant_...	8.3 High	—	0,26%	12 Jul 2026
CVE-2026-56238 Capgo before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST global_stats endpoint that allows unauthenticated attackers to read sensi...	7.5 High	—	0,47%	12 Jul 2026
CVE-2026-15500 A weakness has been identified in AstrBotDevs AstrBot up to 4.25.2. Affected by this vulnerability is the function get_online_plugins of the file astrbot/dashboard/routes...	6.3 Medium	—	0,37%	12 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.