Katalog CVE (hal. 117)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 258.897 (Critical 35.936 · High 103.540 · KEV 1.746 · sejak 2020) · Pembaruan terakhir: 16 Okt 2026, 12:28 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 5.801–5.850 dari 258.897 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-76472 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security rev...	8.8 High	—	0,13%	7 Okt 2026
CVE-2026-76471 A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a de...	9.8 Critical	—	0,52%	7 Okt 2026
CVE-2026-76470 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security rev...	8.8 High	—	0,18%	7 Okt 2026
CVE-2026-76469 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security rev...	7.4 High	—	0,15%	7 Okt 2026
CVE-2026-76468 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security rev...	8.2 High	—	0,23%	7 Okt 2026
CVE-2026-76467 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security rev...	7.5 High	—	0,25%	7 Okt 2026
CVE-2026-76465 A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Ser...	9.8 Critical	—	0,45%	7 Okt 2026
CVE-2026-76464 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security rev...	9.6 Critical	—	0,19%	7 Okt 2026
CVE-2026-76463 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security rev...	8.8 High	—	0,14%	7 Okt 2026
CVE-2026-76459 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review....	9.8 Critical	—	0,31%	7 Okt 2026
CVE-2026-76458 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review....	8.6 High	—	0,28%	7 Okt 2026
CVE-2026-76457 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review....	8.6 High	—	0,28%	7 Okt 2026
CVE-2026-76456 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review....	8.6 High	—	0,28%	7 Okt 2026
CVE-2026-76455 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review....	9.8 Critical	—	0,28%	7 Okt 2026
CVE-2026-76454 A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthentic...	9.1 Critical	—	0,58%	7 Okt 2026
CVE-2026-76453 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review....	8.8 High	—	0,34%	7 Okt 2026
CVE-2026-76452 A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an authenticated,...	4.9 Medium	—	0,37%	7 Okt 2026
CVE-2026-76437 A vulnerability in the web-based user interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an authenticated, remot...	4.9 Medium	—	0,52%	7 Okt 2026
CVE-2026-62253 Homer is open source telecom observability software. Prior to version 11.0.283, both JWT middleware functions (`JWTMiddleware` and `JWTMiddlewareV4`) immediately return `...	9.8 Critical	—	0,42%	7 Okt 2026
CVE-2026-62252 Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the bootstrap process autom...	9.8 Critical	—	0,65%	7 Okt 2026
CVE-2026-62251 Homer is open source telecom observability software. Prior to version 11.0.283, the `V4StatisticsQuery` handler passes the user-supplied `rawquery` field directly to Duck...	8.1 High	—	0,34%	7 Okt 2026
CVE-2026-62176 PraisonAI is a multi-agent teams system. Prior to version 4.6.78, the `deploy/api.py` module generates Python server code by directly interpolating the `agents_file` para...	9.1 Critical	—	0,46%	7 Okt 2026
CVE-2026-20362 A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attac...	7.2 High	—	0,47%	7 Okt 2026
CVE-2026-20328 A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthenticate...	9.1 Critical	—	0,52%	7 Okt 2026
CVE-2026-20321 A vulnerability in the web-based management API for Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to execute arb...	6.5 Medium	—	0,43%	7 Okt 2026
CVE-2026-20173 A vulnerability in Cisco NX-OS Software could allow an unauthenticated, remote attacker to exhaust system resources, causing a denial of service (DoS) condition. This...	5.8 Medium	—	0,37%	7 Okt 2026
CVE-2026-20038 A vulnerability in the endpoint group (EPG) contract functionality of Cisco Nexus 9000 Series Fabric Switches in ACI Mode could allow an unauthenticated, remote attacker...	5.8 Medium	—	0,30%	7 Okt 2026
CVE-2026-20032 A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, local attacker with low privileges to escape the Python sandbox and gain u...	4.4 Medium	—	0,11%	7 Okt 2026
CVE-2026-106557 Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package did not sufficiently validate TechD...	7.7 High	—	0,30%	7 Okt 2026
CVE-2026-106065 A heap-based buffer overflow was found in GIMP’s PCX export plug-in. For images with extremely large width and height, buffer allocation uses overflowing 32-bit width * h...	6.3 Medium	—	0,12%	7 Okt 2026
CVE-2026-101886 Cisco Jabber for Android (com.cisco.im) before 15.3.1.311364 contains a path traversal vulnerability that allows a malicious app with no permissions to write attacker-con...	4.0 Medium	—	0,14%	7 Okt 2026
CVE-2026-92415 apache jackrabbit — Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker...	5.3 Medium	—	0,55%	7 Okt 2026
CVE-2026-92414 apache jackrabbit : Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/...	9.1 Critical	—	0,73%	7 Okt 2026
CVE-2026-33586 Authenticated users are able to manipulate both the SMTP envelope “Envelope-from” and “From” fields when sending emails through OVH mail servers. Due to OVH's default...	6.3 Medium	—	0,14%	7 Okt 2026
CVE-2026-107278 MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the originating instan...	5.3 Medium	—	0,25%	7 Okt 2026
CVE-2026-107276 MISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests carrying the same valid OTP are submitted concurrently, both...	6.3 Medium	—	0,21%	7 Okt 2026
CVE-2026-107273 Gophish 0.11.0 through 0.12.1 contains a server-side request forgery vulnerability that allows authenticated low-privileged users to reach loopback and private hosts via...	4.3 Medium	—	0,20%	7 Okt 2026
CVE-2026-107272 Gophish through 0.12.1 contains stored and reflected cross-site scripting vulnerabilities that allow attackers to inject script by returning malicious SMTP server error m...	4.7 Medium	—	0,19%	7 Okt 2026
CVE-2026-107271 Gophish through 0.12.1 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade /login throttling by spoofing X-Forwarded-For or X-Real-I...	5.3 Medium	—	0,17%	7 Okt 2026
CVE-2026-107270 Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups, templates, landing pag...	7.1 High	—	0,20%	7 Okt 2026
CVE-2026-107269 Gophish through 0.12.1 contains a timing discrepancy vulnerability in AdminServer.Login that allows unauthenticated attackers to enumerate valid usernames by measuring lo...	3.7 Low	—	0,24%	7 Okt 2026
CVE-2026-107210 ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted highly compressed MAT image can...	5.3 Medium	—	0,32%	7 Okt 2026
CVE-2026-107209 ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, when ImageMagick is built without Cairo su...	5.9 Medium	—	0,32%	7 Okt 2026
CVE-2026-107208 ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted XMP profile can reach a recursio...	5.3 Medium	—	0,30%	7 Okt 2026
CVE-2026-107207 LMCache through 0.5.5 contains a server-side request forgery vulnerability in its frontend monitoring service that allows unauthenticated attackers to bypass the proxy al...	7.2 High	—	0,29%	7 Okt 2026
CVE-2026-107206 LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticated attackers to access manageme...	9.4 Critical	—	0,58%	7 Okt 2026
CVE-2026-107205 LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers to access its HTTP flee...	8.6 High	—	0,39%	7 Okt 2026
CVE-2026-107204 LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by posting scripts to the /run_s...	9.8 Critical	—	0,77%	7 Okt 2026
CVE-2026-107166 A weakness has been identified in Open5GS up to 2.7.7. This vulnerability affects the function ogs_pfcp_xact_local_create of the file src/upf/gtp-path.c of the component...	5.3 Medium	—	0,55%	7 Okt 2026
CVE-2026-106580 ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing security-policy check in the CUT...	4.0 Medium	—	0,12%	7 Okt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.