Katalog CVE (hal. 171)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 259.396 (Critical 35.986 · High 103.714 · KEV 1.747 · sejak 2020) · Pembaruan terakhir: 18 Okt 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 8.501–8.550 dari 259.396 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-73636 apache http server Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attac...	8.1 High	—	0,41%	1 Okt 2026
CVE-2026-67172 hcltech bigfix service management HCL BigFix Service Management is affected by an Information Disclosure vulnerability the application returns sensitive information in error messages when invalid inputs a...	3.7 Low	—	0,21%	1 Okt 2026
CVE-2026-67171 hcltech bigfix service management HCL BigFix Service Management is affected by an Information Disclosure vulnerability because an exposed API endpoint exposes sensitive internal database information. This...	5.3 Medium	—	0,24%	1 Okt 2026
CVE-2026-63718 apache http server Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi and a crafted...	7.5 High	—	0,50%	1 Okt 2026
CVE-2026-63686 apache http server A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a de...	7.5 High	—	0,48%	1 Okt 2026
CVE-2026-63292 apache http server Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial o...	7.5 High	—	0,88%	1 Okt 2026
CVE-2026-63045 Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy c...	7.5 High	—	0,47%	1 Okt 2026
CVE-2026-59797 Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-related expressions. This issue affects Apache HTTP Server: from 2....	9.8 Critical	—	0,52%	1 Okt 2026
CVE-2026-59685 Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while processing paths with 8.3 names that may grow when expanded. This issue affects Apache HTTP Se...	7.5 High	—	0,50%	1 Okt 2026
CVE-2026-58415 Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client t...	5.3 Medium	—	0,53%	1 Okt 2026
CVE-2026-57941 Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.	9.8 Critical	—	0,60%	1 Okt 2026
CVE-2026-56449 Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies. This issue affects Apache HTTP Server: from 2.4.0 through 2...	7.5 High	—	0,61%	1 Okt 2026
CVE-2026-56154 Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...}) This issue affects Apache HTTP Server: from 2.4.0 through 2.4....	9.8 Critical	—	0,56%	1 Okt 2026
CVE-2026-56153 apache http server Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.	7.5 High	—	0,50%	1 Okt 2026
CVE-2026-48005 apache http server Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client t...	7.5 High	—	0,61%	1 Okt 2026
CVE-2026-21833 HCL AION is affected by a vulnerability in which the Content-Security-Policy (CSP) HTTP response header is not configured. CSP helps prevent attacks such as Cross-Site Sc...	3.7 Low	—	0,21%	1 Okt 2026
CVE-2026-14316 The revoked-key error path builds a human-readable failure reason using sprintf() into a heap buffer. The allocated buffer is too small for the final formatted message. W...	8.1 High	—	0,22%	1 Okt 2026
CVE-2026-13043 watchguard endpoint security A missing authentication vulnerability in the Kernel Memory Access Driver (PSKMAD) used by WatchGuard endpoint security products allows a local, authenticated attacker to...	8.8 High	—	0,13%	1 Okt 2026
CVE-2026-12544 redhat satellite, theforeman foreman A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is...	7.7 High	—	0,21%	1 Okt 2026
CVE-2026-12541 redhat satellite, theforeman foreman A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:import_dump tasks. The application fails to properly sanitize u...	8.2 High	—	1,2%	1 Okt 2026
CVE-2026-12540 redhat satellite, theforeman foreman A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetch_log task. The request_id parameter is passed to an underlying syste...	8.2 High	—	1,2%	1 Okt 2026
CVE-2026-12423 redhat satellite, theforeman foreman A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic logic flaw in host_verif...	7.5 High	—	0,36%	1 Okt 2026
CVE-2026-12405 A flaw was found in rubygem-foreman_remote_execution. A command injection vulnerability exists in the Red Hat Satellite API (/api/v2/job_invocations). When a job template...	8.8 High	—	1,5%	1 Okt 2026
CVE-2026-103921 GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor() function hardcodes...	7.4 High	—	0,27%	1 Okt 2026
CVE-2026-101890 The Prime Mover plugin for WordPress before 2.2.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary JavaScript by injecting...	5.4 Medium	—	0,16%	1 Okt 2026
CVE-2026-101889 The Prime Mover plugin for WordPress before 2.2.1 contains a path traversal vulnerability that allows authenticated administrators to delete arbitrary directories by impo...	6.5 Medium	—	0,35%	1 Okt 2026
CVE-2026-101888 The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows authenticated administrators to write arbitrary files outsi...	7.2 High	—	0,59%	1 Okt 2026
CVE-2025-31980 hcltech bigfix service management HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to inject unvalidated, malformed data into the appl...	4.3 Medium	—	0,16%	1 Okt 2026
CVE-2026-9864 Fortra BoKS Server Agent contains a predictable password generation vulnerability in the adjoin utility. Machine-account passwords generated during Active Directory join...	4.8 Medium	—	0,15%	1 Okt 2026
CVE-2026-94620 Classroom 50 is a free and open-source tool for managing and grading programming assignments via GitHub. Prior to version 1.11.0, `gh teacher download` clones each studen...	9.4 Critical	—	0,42%	1 Okt 2026
CVE-2026-79896 Fortra BoKS Manager contains an out-of-bounds read vulnerability in the custom TLS ClientHello parser used by boks_portmux. A remote unauthenticated attacker can submit a...	7.5 High	—	0,33%	1 Okt 2026
CVE-2026-47360 apache http server Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module. When SessionCookieRemove changes across...	7.5 High	—	0,39%	1 Okt 2026
CVE-2026-46729 apache http server NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.	7.5 High	—	0,47%	1 Okt 2026
CVE-2026-42528 apache http server A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes. Users a...	4.3 Medium	—	0,42%	1 Okt 2026
CVE-2026-42356 apache http server Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The...	3.7 Low	—	0,47%	1 Okt 2026
CVE-2026-17053 The SMBus driver API exposed smbus_smbalert_remove_cb() and smbus_host_notify_remove_cb() as Zephyr syscalls. Their verifiers in drivers/smbus/smbus_handlers.c validated...	4.4 Medium	—	0,09%	1 Okt 2026
CVE-2026-12627 Fortra's Core Privileged Access Manager (BoKS) contains a stack-based buffer overflow vulnerability in boks_autoregisterd. A remote attacker with network access to the au...	9.8 Critical	—	0,44%	1 Okt 2026
CVE-2026-103690 A flaw has been found in itsourcecode Leave Management System 1.0. This vulnerability affects unknown code of the file /module/leave/controller.php. Executing a manipulat...	6.3 Medium	—	0,33%	1 Okt 2026
CVE-2026-103505 Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) v3.1.0 through v3.4.2 might allow remote authen...	6.5 Medium	—	0,43%	1 Okt 2026
CVE-2026-101322 In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's `Authorization` header...	8.3 High	—	0,31%	1 Okt 2026
CVE-2026-97297 Subscriber Broken Access Control in Gratisfaction <= 4.6.3 versions.	7.6 High	—	0,30%	1 Okt 2026
CVE-2026-97284 Contributor PHP Object Injection in Icegram <= 3.1.31 versions.	8.8 High	—	0,29%	1 Okt 2026
CVE-2026-97281 Subscriber Broken Access Control in WP Project Manager <= 4.0.7 versions.	6.3 Medium	—	0,25%	1 Okt 2026
CVE-2026-97280 Missing Authorization vulnerability in Mamunur Rashid Review Schema review-schema allows Exploiting Incorrectly Configured Access Control Security Levels. This issue aff...	6.5 Medium	—	0,24%	1 Okt 2026
CVE-2026-97277 Subscriber Broken Access Control in Social Boost <= 3.6.2 versions.	7.6 High	—	0,30%	1 Okt 2026
CVE-2026-97273 Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.	7.1 High	—	0,18%	1 Okt 2026
CVE-2026-97269 Unauthenticated Insecure Direct Object References (IDOR) in WPFunnels <= 3.13.1 versions.	6.5 Medium	—	0,19%	1 Okt 2026
CVE-2026-97268 Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.	7.1 High	—	0,18%	1 Okt 2026
CVE-2026-97260 Unauthenticated Cross Site Scripting (XSS) in MaxGalleria <= 6.5.3 versions.	7.1 High	—	0,18%	1 Okt 2026
CVE-2026-97258 Subscriber Broken Access Control in Aruba Migration Tool <= 1.0.4 versions.	6.5 Medium	—	0,33%	1 Okt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.