Katalog CVE (hal. 123)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 258.897 (Critical 35.936 · High 103.540 · KEV 1.746 · sejak 2020) · Pembaruan terakhir: 16 Okt 2026, 12:28 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 6.101–6.150 dari 258.897 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-106455 linuxfoundation backstage plugin-techdocs-node, linuxfoundation backstage Backstage is an open framework for building developer portals. From 0.11.12 until 1.14.7 and 1.15.5, the @backstage/plugin-techdocs-node package is affected by improper v...	7.7 High	—	0,33%	6 Okt 2026
CVE-2026-106062 A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can...	7.8 High	—	0,15%	6 Okt 2026
CVE-2026-106032 Server-side request forgery in the OpenAPI schema processing of the agent import functionality in Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an au...	5.7 Medium	—	0,23%	6 Okt 2026
CVE-2026-105812 Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account...	9.0 Critical	—	0,28%	6 Okt 2026
CVE-2026-105811 Authorization bypass through a user-controlled key in the optional Amazon Q Business Lambda hook sample ( q-business-lambda-hook https://github.com/aws-solutions-library-...	6.5 Medium	—	0,33%	6 Okt 2026
CVE-2026-104046 fedoraproject sssd, redhat openshift container platform +1 lainnya A flaw was found in SSSD (System Security Services Daemon). When Identity Provider (IdP) authentication is enabled, pre-authentication requests retain state in memory wit...	6.2 Medium	—	0,13%	6 Okt 2026
CVE-2026-104045 fedoraproject sssd, redhat openshift container platform +1 lainnya A flaw was found in SSSD. A local user can trigger a Denial of Service (DoS) by exploiting a race condition in the autofs responder between asynchronous enumeration compl...	4.7 Medium	—	0,10%	6 Okt 2026
CVE-2026-101258 A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in...	7.8 High	—	0,18%	6 Okt 2026
CVE-2026-96580 gitea Gitea expanded a workflow's static `strategy.matrix` into its full Cartesian product without a size limit when creating a run, before the fork pull request approval gate...	7.5 High	—	0,35%	6 Okt 2026
CVE-2026-96399 gitea A repository's external issue tracker regular expression containing alternating capture groups could produce invalid slice indexes when Gitea rendered issue references, c...	7.5 High	—	0,35%	6 Okt 2026
CVE-2026-96589 gitea When a private repository is transferred to a user who lacks access, Gitea grants that recipient temporary read access as a collaborator so they can review the repository...	4.3 Medium	—	0,22%	6 Okt 2026
CVE-2026-96404 gitea When Gitea's web installer is reachable against a database that already contains users, such as after `INSTALL_LOCK` has been reset to `false`, submitting the install for...	8.1 High	—	0,44%	6 Okt 2026
CVE-2026-96400 gitea With `[migrations] ALLOWED_DOMAINS` set to a matching entry such as `*` or a hostname wildcard, Gitea's migration URL validation could permit reserved and link-local addr...	4.3 Medium	—	0,20%	6 Okt 2026
CVE-2026-95112 gitea When processing issue and comment bodies, Gitea scanned the entire preceding text for action keywords such as "closes" or "fixes" once per Markdown link, giving processin...	6.5 Medium	—	0,31%	6 Okt 2026
CVE-2026-95106 gitea Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject. Gitea's web views resolved such a path to the first...	9.1 Critical	—	0,29%	6 Okt 2026
CVE-2026-94205 gitea Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. For `pull_request` ac...	9.8 Critical	—	0,36%	6 Okt 2026
CVE-2026-89430 gitea Gitea validated a push mirror's remote address against the `[migrations]` allow and block lists only when the mirror was created. Each synchronization passed the stored a...	8.1 High	—	0,19%	6 Okt 2026
CVE-2026-94114 Symbolic name not mapping to correct class. BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing sub...	5.9 Medium	—	0,28%	6 Okt 2026
CVE-2026-79960 gitea When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner ins...	7.1 High	—	0,21%	6 Okt 2026
CVE-2026-79818 A vulnerability in an API interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful...	5.3 Medium	—	0,29%	6 Okt 2026
CVE-2026-79817 A sensitive information disclosure vulnerability exists in the client software of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an attacker...	5.5 Medium	—	0,10%	6 Okt 2026
CVE-2026-79816 A vulnerability in a client interface of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct a DOM-based cross-site scriptin...	6.3 Medium	—	0,19%	6 Okt 2026
CVE-2026-79815 A command injection vulnerability in the OnGuard agent of ClearPass Policy Manager could allow an authenticated remote attacker to inject arbitrary commands. Successful e...	6.5 Medium	—	0,63%	6 Okt 2026
CVE-2026-79814 An arbitrary file write vulnerability in the ClearPass Policy Manager OnGuard agent could allow malicious users on a local instance to elevate their user privileges if ce...	6.7 Medium	—	0,09%	6 Okt 2026
CVE-2026-79813 A local privilege escalation vulnerability exists in the ClearPass client software. Successful exploitation could allow a low-privileged local user to execute commands wi...	6.7 Medium	—	0,08%	6 Okt 2026
CVE-2026-79812 A denial of service vulnerability exists in the OnGuard agent of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an authenticated local attac...	6.1 Medium	—	0,09%	6 Okt 2026
CVE-2026-79811 A SQL injection vulnerability in the API of ClearPass Policy Manager could allow a remote authenticated attacker with administrative privileges to conduct SQL injection a...	7.2 High	—	0,30%	6 Okt 2026
CVE-2026-79810 Remote code execution vulnerabilities exist in the affected interface of HPE Networking ClearPass Policy Manager that could allow an authenticated remote attacker with hi...	7.2 High	—	0,56%	6 Okt 2026
CVE-2026-79809 An unauthenticated path traversal vulnerability exists in an API endpoint of ClearPass Policy Manager. Successful exploitation of this vulnerability allows an unauthentic...	7.3 High	—	0,31%	6 Okt 2026
CVE-2026-79808 A buffer overflow vulnerability exists in the OnGuard agent of ClearPass Policy Manager. Successful exploitation could allow an authenticated local user to execute arbitr...	7.8 High	—	0,11%	6 Okt 2026
CVE-2026-79807 A missing integrity verification vulnerability in the Windows client software for ClearPass Policy Manager could allow malicious users on a local instance to elevate thei...	7.8 High	—	0,08%	6 Okt 2026
CVE-2026-79806 A privilege escalation vulnerability in the ClearPass Policy Manager OnGuard Linux agent could allow malicious users on a Linux instance to elevate their user privileges....	7.8 High	—	0,10%	6 Okt 2026
CVE-2026-79805 An authenticated path traversal vulnerability exists in ClearPass Policy Manager. Successful exploitation could allow an attacker to read and modify certain files on the...	9.8 Critical	—	0,43%	6 Okt 2026
CVE-2026-79803 A command injection vulnerability exists in the API of ClearPass Policy Manager. Successful exploitation could allow an authenticated remote attacker to escalate privileg...	8.8 High	—	0,80%	6 Okt 2026
CVE-2026-79802 A command injection vulnerability exists in the client software of ClearPass Policy Manager. Successful exploitation could allow an attacker who is able to supply crafted...	8.8 High	—	1,2%	6 Okt 2026
CVE-2026-79801 A missing integrity verification vulnerability in the client agent software of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to i...	9.8 Critical	—	0,32%	6 Okt 2026
CVE-2026-79800 An authenticated path traversal vulnerability exists in the command line interface of ClearPass Policy Manager. Successful exploitation could allow a low-privileged authe...	8.8 High	—	0,63%	6 Okt 2026
CVE-2026-79799 A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct a stored cross-site scripting...	8.8 High	—	0,33%	6 Okt 2026
CVE-2026-79798 SQL injection vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow a low-privileged authenticated remote attacker to conduct SQL...	9.9 Critical	—	0,34%	6 Okt 2026
CVE-2026-79797 An improper access control vulnerability exists in the Android client application for HPE Networking ClearPass Policy Manager, where application functionality may be invo...	8.8 High	—	0,27%	6 Okt 2026
CVE-2026-79796 Vulnerabilities have been identified in the affected interface of ClearPass Policy Manager that could potentially allow an unauthenticated remote attacker to circumvent e...	9.8 Critical	—	0,46%	6 Okt 2026
CVE-2026-79794 A SQL injection vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection atta...	9.1 Critical	—	0,30%	6 Okt 2026
CVE-2026-76754 A vulnerability in an affected interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct SQL injection attacks against the ClearPass...	9.8 Critical	—	0,38%	6 Okt 2026
CVE-2026-76753 A format string vulnerability in an affected service interface of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to corrupt proces...	9.8 Critical	—	0,53%	6 Okt 2026
CVE-2026-76752 Authentication bypass vulnerabilities exist in the web-based management and API interfaces of HPE Networking ClearPass Policy Manager. Successful exploitation could allow...	9.8 Critical	—	0,47%	6 Okt 2026
CVE-2026-76751 A missing integrity verification vulnerability exists in the OnGuard agent of ClearPass Policy Manager. Successful exploitation could allow an unauthenticated, remote att...	9.8 Critical	—	0,30%	6 Okt 2026
CVE-2026-76750 Deserialization of untrusted data vulnerabilities exist in the web interface of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an unauthenti...	9.8 Critical	—	0,54%	6 Okt 2026
CVE-2026-76749 A sensitive information disclosure vulnerability exists in AOS-S. Successful exploitation could allow an unauthenticated remote attacker to access sensitive information.	6.5 Medium	—	0,40%	6 Okt 2026
CVE-2026-76748 A privilege escalation vulnerability exists in the API of AOS-S. Successful exploitation could allow an authenticated read-only user to escalate their privileges and gain...	8.8 High	—	0,27%	6 Okt 2026
CVE-2026-76747 Buffer overflow vulnerabilities exist in the affected interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to expose sensitive memor...	9.1 Critical	—	0,45%	6 Okt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.