Katalog CVE (hal. 106)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 258.834 (Critical 35.935 · High 103.510 · KEV 1.746 · sejak 2020) · Pembaruan terakhir: 16 Okt 2026, 06:27 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 5.251–5.300 dari 258.834 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-19482 ibm security verify access, ibm security verify access container +2 lainnya IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to execute arbitrary comma...	8.8 High	—	0,42%	8 Okt 2026
CVE-2026-18740 ibm security verify access, ibm security verify access container +2 lainnya IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to perform unauthorized ac...	8.8 High	—	0,35%	8 Okt 2026
CVE-2026-17189 ibm security verify access, ibm security verify access container +2 lainnya IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cross-site scripting. This vulnerability allows an un...	6.1 Medium	—	0,15%	8 Okt 2026
CVE-2026-16916 ibm security verify access, ibm security verify access container +2 lainnya IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to execute arbitrary code...	8.8 High	—	0,42%	8 Okt 2026
CVE-2026-16830 ibm security verify access, ibm security verify access container +2 lainnya IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to modify data and cause a...	5.4 Medium	—	0,21%	8 Okt 2026
CVE-2026-16823 ibm security verify access, ibm security verify access container +2 lainnya IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to bypass security restrictions due to i...	7.5 High	—	0,33%	8 Okt 2026
CVE-2026-12109 ibm security verify access, ibm security verify access container +2 lainnya IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow an attacker with administrative privileges and access to t...	7.2 High	—	0,21%	8 Okt 2026
CVE-2026-12091 ibm security verify access, ibm security verify access container +2 lainnya IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a denial of service due to a heap-based out-of-bounds read...	5.3 Medium	—	0,30%	8 Okt 2026
CVE-2026-11939 ibm security verify access, ibm security verify access container +2 lainnya IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 may be vulnerable to audit log forgery.	5.3 Medium	—	0,18%	8 Okt 2026
CVE-2026-11936 ibm security verify access, ibm security verify access container +2 lainnya IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 local management interface in certain configurations is vulnerable to...	5.4 Medium	—	0,12%	8 Okt 2026
CVE-2026-11930 ibm security verify access, ibm security verify access container +2 lainnya IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 may not enforce authorization correctly for some web servers.	7.5 High	—	0,19%	8 Okt 2026
CVE-2026-11888 ibm security verify access, ibm security verify access container +2 lainnya IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to an information disclosure attack.	7.5 High	—	0,17%	8 Okt 2026
CVE-2026-11318 Deskin through 3.3.4.3 contains a privilege escalation vulnerability in the com.deskin.service.installer XPC service that allows local unprivileged attackers to execute a...	7.8 High	—	0,19%	8 Okt 2026
CVE-2026-107782 System Informer before 4.0.26241.138 contains an incorrect authorization vulnerability in the phsvc helper that allows local attackers to reach privileged APIs by connect...	7.8 High	—	0,11%	8 Okt 2026
CVE-2026-107781 Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missing authorization vulnerability in the OnlyOffice sa...	7.4 High	—	0,34%	8 Okt 2026
CVE-2026-107780 Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains an OS command injection vulnerability in the unauthenticated /post/TtsController/textToSpe...	9.8 Critical	—	2,1%	8 Okt 2026
CVE-2026-107779 Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoController endpoint...	9.8 Critical	—	0,54%	8 Okt 2026
CVE-2026-107778 MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by...	6.5 Medium	—	0,42%	8 Okt 2026
CVE-2026-107708 MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal...	4.9 Medium	—	0,52%	8 Okt 2026
CVE-2026-107397 Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can create content, including...	4.4 Medium	—	0,23%	8 Okt 2026
CVE-2026-107318 @fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP or HTTPS server. In versions prior to 12.7.0, all of the built-in HTTPS transports over...	7.4 High	—	0,15%	8 Okt 2026
CVE-2026-106435 mongodb python driver The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element with...	4.7 Medium	—	0,10%	8 Okt 2026
CVE-2026-102368 Affected Tapo device firmware stores device-specific cryptographic material in plaintext within nonvolatile storage. An attacker with physical access to an affected devic...	5.4 Medium	—	0,10%	8 Okt 2026
CVE-2026-101024 Satel Netco Design versions prior to v2.1.7 contains a relative path traversal vulnerability in its data export functionality. An authenticated user with Viewer privilege...	8.8 High	—	0,44%	8 Okt 2026
CVE-2026-84275 ibm guardium data protection IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the GIM file-upload functionality. An unauthenticated attacker could exploit this vulnerability to wr...	7.5 High	—	0,33%	8 Okt 2026
CVE-2026-84274 ibm guardium data protection IBM Guardium Data Protection 12.2.2 is affected by a sensitive information exposure vulnerability. During SECRET and API_KEY rotation processing, sensitive credential mat...	6.5 Medium	—	0,22%	8 Okt 2026
CVE-2026-84272 ibm guardium data protection IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing authentication in the edge-controller component. An unauthenticated remote attacker could exploit t...	9.8 Critical	—	0,40%	8 Okt 2026
CVE-2026-84271 ibm guardium data protection IBM Guardium Data Protection 12.2 is vulnerable to a signature verification bypass in the patch installer. An attacker with local access could exploit this vulnerability...	7.8 High	—	0,07%	8 Okt 2026
CVE-2026-84250 ibm guardium data protection IBM Guardium Data Protection 12.2 is vulnerable due to weak cryptographic protection and a hard-coded recovery key in the pkcrypto passkey component. A local attacker cou...	7.8 High	—	0,09%	8 Okt 2026
CVE-2026-84245 ibm guardium data protection IBM Guardium Data Protection 12.2 is vulnerable to a local privilege escalation in the cp_wrapper component. A low-privileged local user could exploit this vulnerability...	7.8 High	—	0,09%	8 Okt 2026
CVE-2026-84244 ibm guardium data protection IBM Guardium Data Protection 12.2 IBM Security Guardium Data Protection is vulnerable to stored cross-site scripting (XSS) in the Quick Search results grid. An unauthenti...	6.1 Medium	—	0,18%	8 Okt 2026
CVE-2026-82344 ibm guardium data protection IBM Guardium Data Protection 12.0, 12.1 is vulnerable to a heap-based buffer overflow in the S-TAP TrafficTap TDS login reassembly functionality. An unauthenticated remot...	9.8 Critical	—	0,40%	8 Okt 2026
CVE-2026-82335 ibm guardium data protection IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buffer overflow in the MongoDB protocol parser. A remote attacker could send a specially craft...	9.8 Critical	—	0,38%	8 Okt 2026
CVE-2026-82334 ibm guardium data protection IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based out-of-bounds read in the TDS7 LOGIN7 protocol parser. A remote attacker could send a speciall...	9.1 Critical	—	0,30%	8 Okt 2026
CVE-2026-107707 Intego Antivirus for Windows through 3.0.0.1 contains a link following vulnerability in its optimization module that allows local unprivileged users to delete arbitrary f...	7.8 High	—	0,14%	8 Okt 2026
CVE-2026-107706 Dolibarr ERP CRM before 24.0.2 contains an incorrect authorization vulnerability in htdocs/core/ajax/updateextrafield.php that checks only read permission before writing...	4.3 Medium	—	0,20%	8 Okt 2026
CVE-2026-107705 Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the password to overwrite stack memory...	6.5 Medium	—	0,33%	8 Okt 2026
CVE-2026-107608 Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 might allow a context-dependent actor to cause files f...	5.5 Medium	—	0,14%	8 Okt 2026
CVE-2026-107396 Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can manage events or create co...	5.4 Medium	—	0,19%	8 Okt 2026
CVE-2026-107395 Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, an authenticated user can misuse the leg...	4.3 Medium	—	0,24%	8 Okt 2026
CVE-2026-107394 Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, the previous fix for CVE-2026-25738 did...	6.8 Medium	—	0,34%	8 Okt 2026
CVE-2026-107393 FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.235, when APP_CLOUDFLARE_IS_USED is enabled, FreeScout trusts an unvalidated CF-Connecting-IP header...	6.1 Medium	—	0,19%	8 Okt 2026
CVE-2026-107392 borewit music-metadata music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecognized chunk by calling tokenizer.ignore without aw...	7.5 High	—	0,36%	8 Okt 2026
CVE-2026-107391 borewit music-metadata music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the M...	7.5 High	—	0,27%	8 Okt 2026
CVE-2026-107390 borewit music-metadata music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the MP4 parser accepts an attacker-controlled 64-bit extended atom size, converts i...	7.5 High	—	0,29%	8 Okt 2026
CVE-2026-107389 music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the Matroska and WebM EBML parser decodes an attacker-controlled VINT element lengt...	6.2 Medium	—	0,12%	8 Okt 2026
CVE-2026-106436 mongodb php driver The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state...	6.5 Medium	—	0,26%	8 Okt 2026
CVE-2026-106432 mongodb php driver The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the al...	8.2 High	—	0,17%	8 Okt 2026
CVE-2026-106126 A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) allows an authenticated, low-privileged attacker to execute...	9.9 Critical	—	2,0%	8 Okt 2026
CVE-2026-104076 TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentication vulnerability that allows remote unauthenticated attackers...	9.1 Critical	—	0,35%	8 Okt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.