Katalog CVE (hal. 109)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 258.834 (Critical 35.935 · High 103.510 · KEV 1.746 · sejak 2020) · Pembaruan terakhir: 16 Okt 2026, 06:27 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 5.401–5.450 dari 258.834 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-14509 ibm datapower gateway IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause...	5.9 Medium	—	0,27%	8 Okt 2026
CVE-2026-14508 ibm datapower gateway IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause...	9.1 Critical	—	0,27%	8 Okt 2026
CVE-2026-14507 ibm datapower gateway IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to cause a denial of service due to improper memory allocation during key deri...	7.7 High	—	0,29%	8 Okt 2026
CVE-2026-14502 ibm datapower gateway IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obtain...	9.8 Critical	—	0,39%	8 Okt 2026
CVE-2026-14497 ibm datapower gateway IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated atta...	8.1 High	—	0,56%	8 Okt 2026
CVE-2026-14496 ibm datapower gateway IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause...	8.2 High	—	0,30%	8 Okt 2026
CVE-2026-14273 ibm datapower gateway IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a local attacker to obtain...	6.5 Medium	—	0,09%	8 Okt 2026
CVE-2026-14269 ibm datapower gateway IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a heap-based buffer ov...	9.8 Critical	—	0,48%	8 Okt 2026
CVE-2026-13258 ibm datapower gateway IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to cross-site scripting....	5.4 Medium	—	0,17%	8 Okt 2026
CVE-2026-13257 ibm datapower gateway IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an authenticated user to fo...	6.5 Medium	—	0,14%	8 Okt 2026
CVE-2026-12859 Missing Authorization vulnerability in Caz Informatics Services Trade Inc. Advancity ALMS Cloud allows Accessing Functionality Not Properly Constrained by ACLs. This iss...	6.5 Medium	—	0,20%	8 Okt 2026
CVE-2026-107640 Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows unauthenticated attackers to change acc...	9.1 Critical	—	0,36%	8 Okt 2026
CVE-2026-107639 ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 contains an argument injection vulnerability in assImagemapQuestionGUI that allows question authors to inject Im...	8.8 High	—	0,68%	8 Okt 2026
CVE-2026-107638 pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper restriction of authentication attempts vulnerability that allows attackers to bypass two-factor auth...	6.8 Medium	—	0,37%	8 Okt 2026
CVE-2026-107637 pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper authorization vulnerability in the note module delete() action that allows authenticated members to...	4.3 Medium	—	0,25%	8 Okt 2026
CVE-2026-107636 pH7Builder (pH7 Social Dating CMS) before 18.5.1 contains a payment validation vulnerability that allows registered low-privileged members to obtain any membership tier b...	6.5 Medium	—	0,31%	8 Okt 2026
CVE-2026-107635 Dislocker through 0.7.3 contains an integer underflow vulnerability in get_vmk() and get_fvek() that allows attackers to trigger out-of-bounds heap reads via crafted datu...	5.5 Medium	—	0,13%	8 Okt 2026
CVE-2026-107634 Dislocker through 0.7.3 contains a heap out-of-bounds read vulnerability in get_dataset() and get_next_datum() that never validate dataset and datum sizes against the met...	6.1 Medium	—	0,13%	8 Okt 2026
CVE-2026-107623 A flaw was found in the OIDC Dynamic Client Registration (DCR) component of Keycloak. A bug in the response serialization causes the backchannel logout offline token revo...	4.3 Medium	—	0,16%	8 Okt 2026
CVE-2026-107604 A flaw was found in the installation provider and client registration endpoints of the Keycloak identity management service. A realm administrator with only the read-only...	4.9 Medium	—	0,24%	8 Okt 2026
CVE-2026-107589 Insufficient job validation for service accounts in Jacamar CI prior to v0.30.0 allows authenticated CI users to generate arbitrary account names.	7.5 High	—	0,11%	8 Okt 2026
CVE-2026-107586 Uncontrolled eviction in the browser session table of the REST API in Progressive Robot hMailServer 6.2.28 through 6.3.5 allows a remote authenticated user to end other u...	4.3 Medium	—	0,34%	8 Okt 2026
CVE-2026-107585 Uncontrolled eviction in the pending sign-in tables of the REST API in Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to make othe...	5.3 Medium	—	0,45%	8 Okt 2026
CVE-2026-107565 A flaw was found in luksmeta. A local attacker with administrative privileges can cause data corruption when saving metadata to a Linux Unified Key Setup (LUKS) device. D...	5.1 Medium	—	0,10%	8 Okt 2026
CVE-2026-107286 pydantic ai Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 2.10.0 until 2.53.0, streamed requests made through ConcurrencyLi...	7.5 High	—	0,45%	8 Okt 2026
CVE-2026-105833 EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccount\Service that allows users with Email Account scope access to retrieve...	7.7 High	—	0,22%	8 Okt 2026
CVE-2026-105832 EspoCRM before 10.0.6 contains an authentication bypass vulnerability that accepts a login stopped at the second factor on routes not requiring authentication. Attackers...	4.3 Medium	—	0,27%	8 Okt 2026
CVE-2026-105831 EspoCRM before 10.0.6 contains a stored HTML injection vulnerability that allows unauthenticated attackers to inject HTML by submitting crafted Lead Capture public form d...	4.3 Medium	—	0,27%	8 Okt 2026
CVE-2026-105830 league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table extension's TableStartParser::t...	7.5 High	—	0,37%	8 Okt 2026
CVE-2026-105829 League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scripting vulnerability that allows users posting Markdown to bypass the DisallowedRawHtml extension by e...	6.1 Medium	—	0,20%	8 Okt 2026
CVE-2026-105828 Parse Server 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 contains an information disclosure vulnerability in which GraphQL validation error messages reveal hidde...	6.3 Medium	—	0,33%	8 Okt 2026
CVE-2026-105331 Local privilege escalation in Checkmk 2.5.0 before 2.5.0p10 allows a user with access to edit the Oracle Instant Client referenced by the agent plugin 'mk-oracle' to esca...	5.2 Medium	—	0,08%	8 Okt 2026
CVE-2026-91844 Unrestricted upload of file with dangerous type vulnerability in İzometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip allows Using Malicious Files. This iss...	7.3 High	—	0,20%	8 Okt 2026
CVE-2026-89290 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in İzometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip allows St...	3.5 Low	—	0,16%	8 Okt 2026
CVE-2026-88257 Improper Input Validation vulnerability in BeamMCP.Schema in ScriptKittyOS beam_mcp allows an MCP client to reach a tool's dispatch function with arguments that violate t...	5.3 Medium	—	0,27%	8 Okt 2026
CVE-2026-42698 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Themeum Tutor LMS tutor allows Leveraging Race Conditions.Thi...	5.3 Medium	—	0,17%	8 Okt 2026
CVE-2026-27420 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Katie Seaborn Zotpress zotpress allows Stored XSS.This issue affects...	6.5 Medium	—	0,13%	8 Okt 2026
CVE-2026-16167 ibm datapower gateway IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause...	7.5 High	—	0,33%	8 Okt 2026
CVE-2026-16165 ibm datapower gateway IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause...	7.5 High	—	0,31%	8 Okt 2026
CVE-2026-16164 ibm datapower gateway IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause...	7.5 High	—	0,33%	8 Okt 2026
CVE-2026-16163 ibm datapower gateway IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause...	8.6 High	—	0,27%	8 Okt 2026
CVE-2026-16161 ibm datapower gateway IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause...	7.5 High	—	0,31%	8 Okt 2026
CVE-2026-16159 ibm datapower gateway IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obtain...	8.6 High	—	0,27%	8 Okt 2026
CVE-2026-16111 ibm datapower gateway IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a deni...	7.5 High	—	0,27%	8 Okt 2026
CVE-2026-15824 ibm datapower gateway IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause...	8.2 High	—	0,33%	8 Okt 2026
CVE-2026-15822 ibm datapower gateway IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause...	7.5 High	—	0,33%	8 Okt 2026
CVE-2026-15819 ibm datapower gateway IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause...	7.5 High	—	0,33%	8 Okt 2026
CVE-2026-15784 ibm datapower gateway IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execut...	8.1 High	—	0,39%	8 Okt 2026
CVE-2026-15781 ibm datapower gateway IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated atta...	8.0 High	—	0,38%	8 Okt 2026
CVE-2026-15762 ibm datapower gateway IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execut...	9.8 Critical	—	0,52%	8 Okt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.