Katalog CVE (hal. 115)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 258.897 (Critical 35.936 · High 103.540 · KEV 1.746 · sejak 2020) · Pembaruan terakhir: 16 Okt 2026, 12:28 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 5.701–5.750 dari 258.897 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-87681 broadcom fabric operating system An Access Control Bypass vulnerability exists in the Role-Based Access Control (RBAC) validation engine of Brocade Fabric OS versions before 10.0.1. When processing certa...	6.3 Medium	—	0,20%	8 Okt 2026
CVE-2026-87680 broadcom fabric operating system A command injection vulnerability in the REST API management interface of Brocade Fabric OS versions before 10.0.1 allows an authenticated user to execute arbitrary syste...	8.8 High	—	1,9%	8 Okt 2026
CVE-2026-87679 broadcom fabric operating system When Brocade Fabric OS versions before 10.0.1 processes trunk configuration operations, the application parses user-supplied list strings into dynamically allocated heap...	7.2 High	—	0,36%	8 Okt 2026
CVE-2024-8122 The WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords (OTPs) used in multi-factor authentication (MFA). This allows unused OTPs to re...	5.9 Medium	—	0,25%	8 Okt 2026
CVE-2026-94154 The Aurora Heatmap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 1.7.2 due to insufficie...	6.1 Medium	—	0,17%	8 Okt 2026
CVE-2026-17538 The LatePoint - Appointment Booking & Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.6.9. This is...	5.4 Medium	—	0,15%	8 Okt 2026
CVE-2026-107315 pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pads a value that is shorter than its declared length with bytes left in its send buffer instead of ze...	5.3 Medium	—	0,12%	8 Okt 2026
CVE-2026-89322 Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names. This may allow an authenticated user with d...	7.2 High	—	0,30%	7 Okt 2026
CVE-2026-107314 pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 enforce no restriction when the requireAuth connection property excludes all six authentication metho...	5.9 Medium	—	0,26%	7 Okt 2026
CVE-2026-107285 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, a proxie...	5.9 Medium	—	0,21%	7 Okt 2026
CVE-2026-107284 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, WebSocke...	3.7 Low	—	0,14%	7 Okt 2026
CVE-2026-107283 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, Realm.B...	3.7 Low	—	0,26%	7 Okt 2026
CVE-2026-107282 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, cross-h...	9.4 Critical	—	0,19%	7 Okt 2026
CVE-2026-107281 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, the HTTP...	7.6 High	—	0,17%	7 Okt 2026
CVE-2026-107280 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, ThreadS...	6.9 Medium	—	0,26%	7 Okt 2026
CVE-2026-107279 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Dige...	8.8 High	—	0,36%	7 Okt 2026
CVE-2026-107232 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 on 3.x and 2.16.1 on...	7.5 High	—	0,21%	7 Okt 2026
CVE-2026-107231 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, Realm.Bu...	8.7 High	—	0,24%	7 Okt 2026
CVE-2026-107230 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 3.0.14, connection-...	7.4 High	—	0,19%	7 Okt 2026
CVE-2026-105820 Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially crafted policy names...	5.4 Medium	—	0,25%	7 Okt 2026
CVE-2026-105818 Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory...	5.9 Medium	—	0,08%	7 Okt 2026
CVE-2026-105816 Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within the configured plugin directory. When Vault uses Shami...	8.0 High	—	0,34%	7 Okt 2026
CVE-2026-76285 splunk Improper Adherence to Coding Standards. Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15....	9.8 Critical	—	0,29%	7 Okt 2026
CVE-2026-76284 splunk Improper Neutralization. Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. The vulnerabil...	9.8 Critical	—	0,33%	7 Okt 2026
CVE-2026-76286 In Splunk MCP Server versions below 1.2.1, Splunk MCP Server could send the Splunk platform authentication token of a user who runs a custom Application Programming Inter...	5.3 Medium	—	0,17%	7 Okt 2026
CVE-2026-76281 splunk Improper Access Control. Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. The vulnerabil...	5.3 Medium	—	0,21%	7 Okt 2026
CVE-2026-76283 splunk Protection Mechanism Failure. Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. The vulne...	7.6 High	—	0,20%	7 Okt 2026
CVE-2026-76282 splunk Improper Control of a Resource Through its Lifetime. Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10...	8.8 High	—	0,31%	7 Okt 2026
CVE-2026-76280 splunk, splunk secure gateway In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, an authenticated user who d...	6.3 Medium	—	0,17%	7 Okt 2026
CVE-2026-76279 splunk In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the run_collect capability could use the collect Search Processing...	4.3 Medium	—	0,17%	7 Okt 2026
CVE-2026-76278 splunk In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the edit_spl2_module_permissions capability could use the affected Represen...	4.3 Medium	—	0,16%	7 Okt 2026
CVE-2026-76277 splunk In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the edit_user capability could create a native Splunk username that...	4.1 Medium	—	0,18%	7 Okt 2026
CVE-2026-76276 splunk In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could retrieve original sour...	4.3 Medium	—	0,18%	7 Okt 2026
CVE-2026-76275 splunk In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could access search query text and j...	4.3 Medium	—	0,20%	7 Okt 2026
CVE-2026-76274 splunk In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the read_o11y_content capability could redirect an outbound request from Sp...	6.5 Medium	—	0,27%	7 Okt 2026
CVE-2026-76273 splunk In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the run_collect capability could use the collect Search Processing...	4.3 Medium	—	0,17%	7 Okt 2026
CVE-2026-76272 splunk, splunk secure gateway In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could cause Splunk Secure Gateway to...	4.3 Medium	—	0,17%	7 Okt 2026
CVE-2026-76271 splunk In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could cause a denial of serv...	6.5 Medium	—	0,27%	7 Okt 2026
CVE-2026-76270 splunk In Splunk Enterprise versions below 10.4.3, a user that holds a role with the list_spl2_modules capability could use SQL injection in SPL2 module filtering to access all...	6.5 Medium	—	0,25%	7 Okt 2026
CVE-2026-76269 splunk In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could use a user-controlled job iden...	6.5 Medium	—	0,22%	7 Okt 2026
CVE-2026-76268 splunk In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Progr...	9.8 Critical	—	0,40%	7 Okt 2026
CVE-2026-76267 splunk In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the read_o11y_content capability could inject forged entries into the app l...	4.3 Medium	—	0,17%	7 Okt 2026
CVE-2026-76266 splunk In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15 on Linux, a local user who can run commands as the user account running Splunk Enterprise could ca...	7.7 High	—	0,12%	7 Okt 2026
CVE-2026-76265 splunk, splunk secure gateway In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, a user who does not hold th...	6.5 Medium	—	0,23%	7 Okt 2026
CVE-2026-76264 splunk In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could create or edit scripted lookup...	4.3 Medium	—	0,17%	7 Okt 2026
CVE-2026-1403 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that when importing CSV files...	6.5 Medium	—	0,33%	7 Okt 2026
CVE-2026-107363 In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token....	6.1 Medium	—	0,46%	7 Okt 2026
CVE-2026-107352 Missing authorization checks in Amazon Athena engine version 3 request handling could have allowed an authenticated user to read limited query metadata (AWS account ident...	7.7 High	—	0,20%	7 Okt 2026
CVE-2026-107229 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.16.0 until 3.0.14, ThreadSafe...	4.0 Medium	—	0,26%	7 Okt 2026
CVE-2026-107228 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the enabled...	6.8 Medium	—	0,30%	7 Okt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.