Katalog CVE (hal. 988)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 267.603 (Critical 36.783 · High 106.969 · KEV 1.767 · sejak 2020) · Pembaruan terakhir: 4 Nov 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 49.351–49.400 dari 267.603 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-15499 A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.2. Affected is the function FutureTaskTool.call of the file astrbot/core/tools/cron_tools.py of the...	6.3 Medium	—	0,35%	12 Jul 2026
CVE-2026-15498 A vulnerability was identified in sergomanov SmartHomeAdatum up to cf495353d81b680675eb8d9aa14a318aa45ce12c. This impacts an unknown function of the file users.php of the...	7.3 High	—	0,41%	12 Jul 2026
CVE-2026-15497 A vulnerability was determined in SonicCloudOrg sonic-agent up to 2.7.2. This affects an unknown function of the file sonic-server-controller/src/main/java/org/cloud/soni...	7.3 High	—	0,67%	12 Jul 2026
CVE-2026-15496 A vulnerability was found in SonicCloudOrg sonic-agent up to 2.7.2. The impacted element is the function evalIsFailed of the file sonic-agent/src/main/java/org/cloud/soni...	6.3 Medium	—	2,0%	12 Jul 2026
CVE-2026-15495 A vulnerability has been found in SonicCloudOrg sonic-agent up to 2.7.2. The affected element is an unknown function of the file AndroidWSServer.java of the component And...	6.3 Medium	—	1,9%	12 Jul 2026
CVE-2026-15494 A flaw has been found in AMTT Hotel Broadband Operation System 1.0. Impacted is an unknown function of the file manager/network/switch_status.php. Executing a manipulatio...	4.7 Medium	—	0,33%	12 Jul 2026
CVE-2026-15493 A vulnerability was detected in Akpali9 Attendance-Management-System up to 70b91fe38f4195b701a45f0edcd4f42d5f64aeee. This issue affects some unknown processing of the fil...	3.5 Low	—	0,33%	12 Jul 2026
CVE-2026-15492 A security vulnerability has been detected in igweze wizgrade up to b1d55f22b90cd7e7a6e5002f006d7c649e8086d6. This vulnerability affects unknown code of the file dashboar...	4.3 Medium	—	0,45%	12 Jul 2026
CVE-2026-15491 A weakness has been identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. This affects an unknown part. This manipulation causes missing...	7.3 High	—	0,65%	12 Jul 2026
CVE-2026-15490 A security flaw has been discovered in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. Affected by this issue is some unknown functionality of th...	7.3 High	—	0,41%	12 Jul 2026
CVE-2026-15489 A vulnerability was identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. Affected by this vulnerability is an unknown functionality of t...	7.3 High	—	0,41%	12 Jul 2026
CVE-2026-15488 A vulnerability was determined in hcr707305003 shiroiAdmin 1.1/1.3. Affected is the function FileController::upload of the file app/common/controller/FileController.php....	7.3 High	—	0,50%	12 Jul 2026
CVE-2026-15487 A vulnerability was found in TRENDnet TEW-821DAP 1.11B03. This impacts the function sub_41FBD0 of the file /goform/system_ntp of the component Firmware Update Handler. Pe...	6.3 Medium	—	1,8%	12 Jul 2026
CVE-2026-15486 A vulnerability has been found in TRENDnet TEW-821DAP 1.11B03. This affects the function sub_42026C of the file /goform/tools_ddns of the component Firmware Update Handle...	6.3 Medium	—	1,8%	12 Jul 2026
CVE-2026-15485 A flaw has been found in TRENDnet TEW-821DAP 1.11B03. The impacted element is the function sub_43F2C4 of the file /goform/tools_nslookup of the component DNS Lookup Handl...	6.3 Medium	—	1,8%	12 Jul 2026
CVE-2026-15484 A vulnerability was detected in TRENDnet TEW-821DAP 1.12B01. The affected element is the function sub_41EC14 of the file /goform/tools_nslookup of the component ssi. The...	8.8 High	—	0,79%	12 Jul 2026
CVE-2026-15483 A security vulnerability has been detected in TRENDnet TEW-821DAP 1.12B01. Impacted is the function sub_41EC14 of the file /goform/tools_nslookup of the component ssi. Th...	8.8 High	—	0,57%	12 Jul 2026
CVE-2026-15482 A weakness has been identified in Aster Telecom Azcall 10/11. This issue affects some unknown processing of the file /azcall/adm/gestao_loja/sis.php?t=consultar of the co...	7.3 High	—	0,41%	12 Jul 2026
CVE-2026-15481 A security flaw has been discovered in Trendnet TEW-635BRM up to 1.00.03. This vulnerability affects the function ipoa_test of the file /sbin/rc of the component IPoA WAN...	8.8 High	—	2,9%	12 Jul 2026
CVE-2026-15480 A vulnerability was identified in Trendnet TEW-635BRM up to 1.00.03. This affects the function start_httpd of the file /sbin/rc of the component Web Service. Such manipul...	8.8 High	—	0,79%	12 Jul 2026
CVE-2026-15479 A vulnerability was found in H3C NX15 V100R017. Affected by this vulnerability is the function change_passwd of the file /api/login/modify of the component Administrator...	7.3 High	—	0,47%	12 Jul 2026
CVE-2026-15478 A flaw has been found in IceHRM up to 35.0.1. This impacts an unknown function of the file core/src/Reports/User/Reports/EmployeeAttendanceReport.php of the component Use...	6.3 Medium	—	0,32%	12 Jul 2026
CVE-2026-15477 A vulnerability was detected in Bahmni bahmnicore up to 0.93. This affects the function additionalParams of the file /openmrs/ws/rest/v1/bahmnicore/sql of the component S...	6.3 Medium	—	0,33%	12 Jul 2026
CVE-2026-15476 A security vulnerability has been detected in QILING Disk Master 6.0.0.0. The impacted element is an unknown function in the library diskbckp.sys of the component Kernel...	5.3 Medium	—	0,15%	12 Jul 2026
CVE-2026-15475 A weakness has been identified in MiniTool Partition Wizard up to 13.6. The affected element is an unknown function in the library pwdrvio.sys of the component Signed Ker...	5.3 Medium	—	0,15%	12 Jul 2026
CVE-2026-15474 A security flaw has been discovered in Eleveo Call Recording Software 9.7.0. Impacted is an unknown function of the file /callrec/audio.jsp of the component Call Recordin...	4.3 Medium	—	0,35%	12 Jul 2026
CVE-2026-15473 A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This issue affects some unknown processing of the file /callrec/restoreCallAction.do of the compon...	6.3 Medium	—	0,35%	12 Jul 2026
CVE-2026-15472 A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This vulnerability affects unknown code of the file /callrec/composeEmailAction.do. Executing a ma...	4.3 Medium	—	0,35%	12 Jul 2026
CVE-2026-15471 A vulnerability was found in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/pci_dss_status.jsp. Performing a manipulation results...	4.3 Medium	—	0,35%	12 Jul 2026
CVE-2026-15470 A vulnerability has been found in Eleveo Call Recording Software 9.7.0. Affected by this issue is some unknown functionality of the file /callrec/group.jsp. Such manipula...	4.3 Medium	—	0,35%	12 Jul 2026
CVE-2026-58281 microsoft edge chromium Deserialization of untrusted data in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.	8.3 High	—	0,96%	11 Jul 2026
CVE-2026-10660 The Bluetooth BAP Broadcast Assistant GATT client in subsys/bluetooth/audio/bap_broadcast_assistant.c reassembled remote Broadcast Receive State data into a single file-s...	6.4 Medium	—	0,25%	11 Jul 2026
CVE-2026-61870 imagemagick ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails. Attackers can trigger allocation failures by processing...	7.5 High	—	0,19%	11 Jul 2026
CVE-2026-61861 imagemagick ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memory allocatio...	7.5 High	—	0,55%	11 Jul 2026
CVE-2026-61858 imagemagick ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and external delegates due to missing validation checks. Attackers can write files...	5.3 Medium	—	0,25%	11 Jul 2026
CVE-2026-61857 imagemagick ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files...	7.5 High	—	0,27%	11 Jul 2026
CVE-2026-61465 imagemagick ImageMagick before 7.1.2-26 and 6.9.13-51 is missing a check for the allowed memory allocation limit in matrix-backed operations such as -canny. An attacker can supply a...	6.5 Medium	—	0,17%	11 Jul 2026
CVE-2026-61454 The Grav Admin2 plugin (getgrav/grav-plugin-admin2) before 2.0.4 embeds a global JavaScript variable window.__GRAV_CONFIG__ in the Admin2 SPA bootstrap page at /grav/admi...	5.3 Medium	—	0,31%	11 Jul 2026
CVE-2026-61448 Parse Server is affected by a stored cross-site scripting (XSS) vulnerability in versions >= 9.0.0, < 9.10.0-alpha.2 and <= 8.6.83. When an uploaded file's extension is n...	2.1 Low	—	0,42%	11 Jul 2026
CVE-2026-61447 PraisonAI before 1.6.78 contains a remote code execution vulnerability in CodeAgent._execute_python() that executes LLM-generated Python code without AST validation, impo...	10.0 Critical	—	15,2%	11 Jul 2026
CVE-2026-61445 PraisonAI before 4.6.78 contains arbitrary file write and command execution vulnerabilities in the AICoder component due to missing path validation and command sanitizati...	9.9 Critical	—	0,64%	11 Jul 2026
CVE-2026-61442 PraisonAI Platform (praisonai-platform) before 0.1.9 fails to enforce owner/admin authorization on the PATCH routes for projects, issues, and agents, which only require w...	7.1 High	—	0,31%	11 Jul 2026
CVE-2026-61439 PraisonAI versions before 4.6.78 contain a prompt injection defense misconfiguration where the block threshold defaults to CRITICAL severity, allowing HIGH-level threats...	7.5 High	—	0,34%	11 Jul 2026
CVE-2026-61429 PraisonAI versions before 1.6.78 contain a server-side request forgery vulnerability in the Crawl4AI/Chromium backend that allows attackers to bypass SSRF validation by e...	8.5 High	—	0,27%	11 Jul 2026
CVE-2026-61428 PraisonAI AgentMail versions before 4.6.78 lack signature verification in webhook mode, allowing unauthenticated attackers to inject messages with spoofed sender addresse...	7.3 High	—	0,31%	11 Jul 2026
CVE-2026-61426 PraisonAI before 1.7.3 contains an insecure default configuration that binds to all interfaces with no API key requirement and wildcard CORS. Unauthenticated attackers ca...	8.6 High	—	0,40%	11 Jul 2026
CVE-2026-60090 PraisonAI before 4.6.78 fails to validate the caller-controlled dimension argument in the PGVector and Cassandra knowledge-store create_collection() backends. Although sc...	9.8 Critical	—	0,70%	11 Jul 2026
CVE-2026-60088 PraisonAI before 4.6.78 fails to validate file path references in custom command templates, allowing attackers to read files outside the workspace. Attackers can include...	5.5 Medium	—	0,22%	11 Jul 2026
CVE-2026-56763 Hono before 4.12.7 allows __proto__ key in parseBody with dot option enabled, permitting specially crafted form field names to create objects with __proto__ properties. W...	4.8 Medium	—	0,27%	11 Jul 2026
CVE-2026-56372 imagemagick ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the magnify operation that allows attackers to read out of bounds memory. An unrecognized mag...	9.1 Critical	—	0,33%	11 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.