Katalog CVE (hal. 122)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 258.897 (Critical 35.936 · High 103.540 · KEV 1.746 · sejak 2020) · Pembaruan terakhir: 16 Okt 2026, 12:28 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 6.051–6.100 dari 258.897 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-65122 NVIDIA TensorRT contains a vulnerability where an attacker can cause an out of bounds read. A successful exploit of this vulnerability may lead to denial of service.	5.5 Medium	—	0,12%	6 Okt 2026
CVE-2026-106589 In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges. This is related to the Ga...	2.9 Low	—	0,08%	6 Okt 2026
CVE-2026-106588 In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpected.	3.1 Low	—	0,13%	6 Okt 2026
CVE-2026-106587 openbsd openssh In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.	3.3 Low	—	0,08%	6 Okt 2026
CVE-2026-106509 linuxfoundation backstage plugin-techdocs-node, linuxfoundation backstage Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs t...	8.8 High	—	0,37%	6 Okt 2026
CVE-2026-106508 linuxfoundation backstage plugin-techdocs-node, linuxfoundation backstage Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by potential file exposure through...	6.5 Medium	—	0,31%	6 Okt 2026
CVE-2026-106507 linuxfoundation backstage plugin-techdocs-node, linuxfoundation backstage Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by techdocs arbitrary file read vi...	6.5 Medium	—	0,31%	6 Okt 2026
CVE-2026-106506 linuxfoundation backstage/plugin-scaffolder-backend, linuxfoundation backstage Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper input validation i...	5.3 Medium	—	0,22%	6 Okt 2026
CVE-2026-106505 linuxfoundation backstage plugin-techdocs-node, linuxfoundation backstage Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package is affected by bypass of mkdocs con...	8.5 High	—	0,31%	6 Okt 2026
CVE-2026-106504 linuxfoundation backstage/plugin-scaffolder-backend, linuxfoundation backstage Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information expos...	6.5 Medium	—	0,26%	6 Okt 2026
CVE-2026-106503 linuxfoundation backstage/plugin-scaffolder-backend, linuxfoundation backstage Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sca...	8.1 High	—	0,38%	6 Okt 2026
CVE-2026-106502 linuxfoundation backstage/plugin-scaffolder-backend, linuxfoundation backstage Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose sensitive information in Scaf...	5.3 Medium	—	0,29%	6 Okt 2026
CVE-2026-106501 linuxfoundation backstage/plugin-scaffolder-backend, linuxfoundation backstage Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sen...	9.6 Critical	—	0,48%	6 Okt 2026
CVE-2026-106500 linuxfoundation backstage/plugin-scaffolder-backend, linuxfoundation backstage Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by imp...	8.5 High	—	0,34%	6 Okt 2026
CVE-2026-106499 linuxfoundation backstage/plugin-scaffolder-backend, linuxfoundation backstage Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose secret-derived values in Scaf...	4.9 Medium	—	0,27%	6 Okt 2026
CVE-2026-106498 Backstage is an open framework for building developer portals. Prior to 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1, the @backstage/plugin-catalog-backend package is affected by...	7.7 High	—	0,31%	6 Okt 2026
CVE-2026-106497 Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent catalog property...	4.3 Medium	—	0,19%	6 Okt 2026
CVE-2026-106496 Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent enforcement of al...	3.1 Low	—	0,21%	6 Okt 2026
CVE-2026-105268 gitea The Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}`) also accepted attachments that belong to comments on the...	4.3 Medium	—	0,20%	6 Okt 2026
CVE-2026-105267 gitea The Gitea web route for deleting tags (`POST /{owner}/{repo}/tags/delete`) requires only write access to the Code unit, but shares its handler with release deletion and d...	8.1 High	—	0,38%	6 Okt 2026
CVE-2026-104633 gitea When migrating a repository from another Gitea instance, Gitea used the page size reported in the source server's API settings to end its paginated downloads. A source th...	6.5 Medium	—	0,40%	6 Okt 2026
CVE-2026-101023 gitea Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant type, but not that the token was a refresh token. An un...	9.1 Critical	—	0,35%	6 Okt 2026
CVE-2026-43598 Improper input validation in the AMD ROCm Communication Collectives Library (RCCL) could allow a compromised peer rank or network-adjacent attacker to dereference an atta...	7.7 High	—	0,46%	6 Okt 2026
CVE-2026-19029 A heap-based buffer over-read in H5Z__filter_scaleoffset() in src/H5Zscaleoffset.c in HDF5 through 2.2.0 lets an attacker cause a denial of service (application crash) wi...	6.8 Medium	—	0,12%	6 Okt 2026
CVE-2026-106586 openbsd openssh In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than C...	4.3 Medium	—	0,12%	6 Okt 2026
CVE-2026-106585 openbsd openssh In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.	6.5 Medium	—	0,19%	6 Okt 2026
CVE-2026-106584 openbsd openssh In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effec...	3.3 Low	—	0,06%	6 Okt 2026
CVE-2026-106582 openbsd openssh In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams" findings.	3.7 Low	—	0,18%	6 Okt 2026
CVE-2026-106555 openbsd openssh In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.	7.5 High	—	0,14%	6 Okt 2026
CVE-2026-106553 openbsd openssh In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.	7.5 High	—	0,14%	6 Okt 2026
CVE-2026-106550 Mozilla's Node-convict (version 6.2.2 and later) is vulnerable to a Denial of Service vulnerability caused by incomplete prototype‑pollution protections in config.set()....	7.5 High	—	0,28%	6 Okt 2026
CVE-2026-106552 openbsd openssh In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.	6.5 Medium	—	0,36%	6 Okt 2026
CVE-2026-106547 A heap-based buffer overflow in H5VM_array_fill() in src/H5VM.c in HDF5 before 2.2.0 lets a remote attacker cause an application crash and possibly execute arbitrary code...	8.5 High	—	0,16%	6 Okt 2026
CVE-2026-106494 Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper input validation in cloud...	4.4 Medium	—	0,29%	6 Okt 2026
CVE-2026-106493 Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalog providers did not sufficiently validate object paths. A principal ab...	3.0 Low	—	0,26%	6 Okt 2026
CVE-2026-106492 Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of...	7.6 High	—	0,24%	6 Okt 2026
CVE-2026-106491 Backstage is an open framework for building developer portals. Prior to 0.6.17, the @backstage/plugin-proxy-backend package is affected by improper input validation in pr...	6.4 Medium	—	0,27%	6 Okt 2026
CVE-2026-106490 Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper input validation in...	6.5 Medium	—	0,36%	6 Okt 2026
CVE-2026-106489 Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper authorization enforc...	6.5 Medium	—	0,29%	6 Okt 2026
CVE-2026-106488 Backstage is an open framework for building developer portals. Prior to 0.4.20, the @backstage/plugin-auth-backend-module-oidc-provider package is affected by improper au...	8.1 High	—	0,28%	6 Okt 2026
CVE-2026-106487 Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affected by unsupported catalog clust...	3.5 Low	—	0,26%	6 Okt 2026
CVE-2026-106486 Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plu...	8.5 High	—	0,33%	6 Okt 2026
CVE-2026-106463 Backstage is an open framework for building developer portals. Prior to 0.8.7, the @backstage/plugin-catalog-backend-module-gitlab package is affected by improper authori...	5.4 Medium	—	0,17%	6 Okt 2026
CVE-2026-106462 Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundar...	6.4 Medium	—	0,17%	6 Okt 2026
CVE-2026-106461 Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by incorrect authorization in...	4.3 Medium	—	0,19%	6 Okt 2026
CVE-2026-106460 Backstage is an open framework for building developer portals. From 0.3.0 until 0.6.15 and 0.7.5, the @backstage/plugin-auth-node package did not consistently honor expli...	6.8 Medium	—	0,31%	6 Okt 2026
CVE-2026-106459 linuxfoundation backstage/plugin-scaffolder-backend-module-sentry, linuxfoundation backstage Backstage is an open framework for building developer portals. From 0.3.0 until 0.3.8, the @backstage/plugin-scaffolder-backend-module-sentry package is affected by impro...	8.5 High	—	0,21%	6 Okt 2026
CVE-2026-106458 Backstage is an open framework for building developer portals. From 0.4.0 until 0.5.15, the @backstage/plugin-catalog-backend-module-bitbucket-server package is affected...	6.5 Medium	—	0,27%	6 Okt 2026
CVE-2026-106457 Backstage is an open framework for building developer portals. From 0.1.0 until 0.5.0, the @backstage/plugin-auth-backend-module-cloudflare-access-provider package is aff...	6.8 Medium	—	0,28%	6 Okt 2026
CVE-2026-106456 Backstage is an open framework for building developer portals. From 0.5.0 until 0.6.18, the @backstage/plugin-proxy-backend package is affected by inconsistent credential...	4.8 Medium	—	0,24%	6 Okt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.