Katalog CVE (hal. 222)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 259.512 (Critical 35.989 · High 103.744 · KEV 1.747 · sejak 2020) · Pembaruan terakhir: 19 Okt 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 11.051–11.100 dari 259.512 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-85750 Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validatio...	7.2 High	—	1,2%	25 Sep 2026
CVE-2026-85542 IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the GIM bundle import functionality. An authenticated attacker can provide a crafted...	8.8 High	—	2,4%	25 Sep 2026
CVE-2026-85029 IBM Guardium Data Protection 12.2 could allow a remote attacker to obtain sensitive information, delete arbitrary files, or execute arbitrary code due to improper limitat...	7.5 High	—	0,54%	25 Sep 2026
CVE-2026-84893 IBM Guardium Data Protection 12.2 is vulnerable to SQL injection in the PESI service. An authenticated attacker could exploit this vulnerability to access sensitive infor...	7.6 High	—	0,18%	25 Sep 2026
CVE-2026-84884 IBM Guardium Data Protection 12.2 stores internal REST service-account passwords in a reversible plaintext-equivalent format. An authenticated attacker who gains access t...	7.5 High	—	0,24%	25 Sep 2026
CVE-2026-80431 Out-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 before 0.49.0 allows a program writing to the terminal to write past the...	6.8 Medium	—	0,14%	25 Sep 2026
CVE-2026-80430 Improper Link Resolution Before File Access in the drag source staging path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to t...	4.6 Medium	—	0,16%	25 Sep 2026
CVE-2026-100190 The AIL Framework crawler splash domain page (showDomain.html) is vulnerable to stored cross-site script injection (XSS). User-supplied data originating from imported cra...	6.3 Medium	—	0,32%	25 Sep 2026
CVE-2026-100187 The Onion module in AIL Framework contained a performance shortcut in its URL extraction logic that accepted URLs as valid .onion targets based solely on a length check (...	6.9 Medium	—	0,43%	25 Sep 2026
CVE-2026-100177 The AIL Framework crawler task creation API (api_add_crawler_task) contained an insufficient authorization check when a user supplied a cookiejar UUID to attach to a one-...	6.3 Medium	—	0,34%	25 Sep 2026
CVE-2026-100176 The AIL Framework's username timeline feature is vulnerable to stored cross-site scripting (XSS). Usernames imported from chats and crawled forums are stored without char...	8.5 High	—	0,35%	25 Sep 2026
CVE-2026-100174 The AIL Framework tag selector component (var/www/static/js/tags.js) is vulnerable to stored cross-site scripting (XSS). A user with the ability to create a custom tag co...	5.1 Medium	—	0,40%	25 Sep 2026
CVE-2026-100172 The AIL Framework (ail-project/ail-framework) contains a stored cross-site scripting (XSS) vulnerability in two Jinja2 templates that render popovers for matched, tracked...	8.5 High	—	0,27%	25 Sep 2026
CVE-2026-100079 linux kernel In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: unregister debugfs entries on teardown ucsi_register() creates per-instance debugf...	5.5 Medium	—	0,11%	25 Sep 2026
CVE-2026-100078 linux kernel In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mei: pass correct argument to function The first argument to iwl_mei_write_cyclic_buf...	5.5 Medium	—	0,11%	25 Sep 2026
CVE-2026-100077 linux kernel In the Linux kernel, the following vulnerability has been resolved: drm/msm: Recover HW before retire hung submit During recovery, it is not safe to retire the hung sub...	5.5 Medium	—	0,11%	25 Sep 2026
CVE-2026-100076 linux kernel In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths issue_beacon(), issue_pr...	5.5 Medium	—	0,11%	25 Sep 2026
CVE-2026-100075 linux kernel In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters When srpt_alloc_rw_ctxs() fails partway through...	9.8 Critical	—	0,42%	25 Sep 2026
CVE-2026-100074 linux kernel In the Linux kernel, the following vulnerability has been resolved: bpf: Mark bpf_refcount field as unique BPF_REFCOUNT is not marked as a unique field, while it should...	5.5 Medium	—	0,11%	25 Sep 2026
CVE-2026-95832 Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49.0 allows a...	9.3 Critical	—	0,16%	25 Sep 2026
CVE-2026-88421 Incorrect access control in the BlogPage.get_entries() component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to view restricted blog entries via...	7.5 High	—	0,30%	25 Sep 2026
CVE-2026-88420 A reflected cross-site scripting (XSS) vulnerability in the EntryAbstract.save() component of APSL puput v1.2.1 through v2.2.0 allows authenticated attackers with Wagtail...	5.4 Medium	—	0,16%	25 Sep 2026
CVE-2026-79153 Seclore FileSecure Desktop Client before 3.25.1.0 contains improper access control vulnerability in the kernel-mode driver component that allows an authenticated local us...	7.8 High	—	0,09%	25 Sep 2026
CVE-2026-78902 Cross Site Scripting vulnerability in Netgate pfSense 26.03.1-RELEASE allows an attacker to execute arbitrary code via the pfBlockerNG package	6.1 Medium	—	0,30%	25 Sep 2026
CVE-2026-52622 An issue in Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal WES100, WES270, WES280, and WES290 before 08-08-2023 allows a remote attacker to obtain s...	7.5 High	—	0,30%	25 Sep 2026
CVE-2026-51773 An issue in the VMware datastore driver of OpenStack glance_store. When an authenticated attacker provides a maliciously crafted image location URI pointing to an externa...	8.1 High	—	0,32%	25 Sep 2026
CVE-2026-51772 A Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2) of OpenStack Glance. When the show_multiple_locations configuration option is enabled in g...	6.5 Medium	—	0,30%	25 Sep 2026
CVE-2025-51457 D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpoint. An attacker with authenti...	8.8 High	—	1,3%	25 Sep 2026
CVE-2026-98159 linux kernel In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: validate CLC firmware records The CLC region is supplied by firmware, but the lo...	5.5 Medium	—	0,11%	25 Sep 2026
CVE-2026-98156 linux kernel In the Linux kernel, the following vulnerability has been resolved: drm/virtio: use the DMA API for resource backing on Xen On a Xen PV domain page addresses bear no re...	7.8 High	—	0,13%	25 Sep 2026
CVE-2026-98154 In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix -EIO cleanup order in queue_rq On -EIO, the RDMA queue_rq path reports a host path er...	7.0 High	—	0,11%	25 Sep 2026
CVE-2026-98152 linux kernel In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: fix queue leak when connect backlog is exceeded When pending disconnecting queues exceed...	5.5 Medium	—	0,11%	25 Sep 2026
CVE-2026-98150 In the Linux kernel, the following vulnerability has been resolved: bpf: Fix BPF_F_CPU validation for sparse CPU IDs BPF_F_CPU stores the target CPU ID in the upper 32...	7.0 High	—	0,10%	25 Sep 2026
CVE-2026-98139 linux kernel In the Linux kernel, the following vulnerability has been resolved: ntfs: only count successfully cleared runs when freeing clusters ntfs_cluster_free_from_rl_nolock()...	5.5 Medium	—	0,13%	25 Sep 2026
CVE-2026-98138 linux kernel In the Linux kernel, the following vulnerability has been resolved: ntfs: do not mark the volume clean in sync_fs when errors were recorded ntfs_put_super() and the rem...	5.5 Medium	—	0,10%	25 Sep 2026
CVE-2026-98137 linux kernel In the Linux kernel, the following vulnerability has been resolved: ntfs: treat any nonzero dio zero-range return as an error ntfs_dio_zero_range() returns either 0 or...	5.5 Medium	—	0,10%	25 Sep 2026
CVE-2026-98136 linux kernel In the Linux kernel, the following vulnerability has been resolved: ntfs: bound $AttrDef table walk to the loaded table size ntfs_attr_find_in_attrdef() walks the in-me...	7.1 High	—	0,11%	25 Sep 2026
CVE-2026-98143 In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Don't read the U65 rounding mode as a storage mode Bits 15:14 of NPU_SET_{IFM,OFM}_PR...	7.8 High	—	0,11%	25 Sep 2026
CVE-2026-98135 linux kernel In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid sectors_per_cluster in the boot sector is_boot_sector_ntfs() checks the boot se...	5.5 Medium	—	0,10%	25 Sep 2026
CVE-2026-98134 linux kernel In the Linux kernel, the following vulnerability has been resolved: bpf: check_cond_jmp_op(): properly infer if register is null Nicholas Carlini reported a bug when ve...	5.5 Medium	—	0,12%	25 Sep 2026
CVE-2026-98133 linux kernel In the Linux kernel, the following vulnerability has been resolved: ntfs: leave HasEA flag untouched on setxattr failure In ntfs_set_ea(), the exit path unconditionally...	5.5 Medium	—	0,11%	25 Sep 2026
CVE-2026-98132 linux kernel In the Linux kernel, the following vulnerability has been resolved: bpf: don't downgrade half-dead scalar zero spills to STACK_ZERO states.c:__clean_func_state() can do...	5.5 Medium	—	0,11%	25 Sep 2026
CVE-2026-98131 linux kernel In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix dma mapping leak in stmmac_tso_xmit() In stmmac_tso_xmit(), if the DMA mapping of a...	5.5 Medium	—	0,12%	25 Sep 2026
CVE-2026-98130 In the Linux kernel, the following vulnerability has been resolved: sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START The SCTP_CMD_TIMER_START handler checks timer_pendin...	8.1 High	—	0,58%	25 Sep 2026
CVE-2026-98122 In the Linux kernel, the following vulnerability has been resolved: vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del() vxlan_mdb_is_valid_source(), which vali...	7.8 High	—	0,13%	25 Sep 2026
CVE-2026-98116 In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF snd_pcm_hw_params() and snd_p...	7.8 High	—	0,13%	25 Sep 2026
CVE-2026-98115 linux kernel In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely drain sessions during logoff SMB3 multichannel allows requests for one session to run...	8.8 High	—	0,27%	25 Sep 2026
CVE-2026-98112 In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix listener task lifetime on netdev events The listener thread exits when its listening sock...	7.8 High	—	0,12%	25 Sep 2026
CVE-2026-98109 linux kernel In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix race condition during device registration In hci_register_dev(), the power_...	4.7 Medium	—	0,09%	25 Sep 2026
CVE-2026-98108 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan l2cap_new_connection() sets defa...	7.5 High	—	0,25%	25 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.