Katalog CVE (hal. 235)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 259.544 (Critical 35.992 · High 103.748 · KEV 1.747 · sejak 2020) · Pembaruan terakhir: 19 Okt 2026, 12:28 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 11.701–11.750 dari 259.544 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-6935 ibm concert IBM Concert 1.0.0 through 3.0.0 invokes operating system commands without fully qualifying executable paths or adequately restricting search path resolution. As a result,...	7.8 High	—	0,12%	23 Sep 2026
CVE-2026-6928 ibm concert IBM Concert 1.0.0 through 3.0.0 references or accesses memory after it has been freed. This allows an attacker who can influence program execution or input may exploit th...	9.8 Critical	—	0,45%	23 Sep 2026
CVE-2026-6925 ibm concert IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "do...	5.3 Medium	—	0,33%	23 Sep 2026
CVE-2026-6794 ibm concert IBM Concert 1.0.0 through 3.0.0 has a double free vulnerability that exists due to incorrect memory management. A local attacker can exploit this flaw to corrupt heap mem...	7.8 High	—	0,11%	23 Sep 2026
CVE-2026-6730 ibm concert IBM Concert 1.0.0 through 3.0.0 is vulnerable to a buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code...	7.8 High	—	0,30%	23 Sep 2026
CVE-2026-67405 RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, Neither the Web-MQTT handler (deps/rabbitmq_web_mqtt/src/rabbit...	5.3 Medium	—	0,13%	23 Sep 2026
CVE-2026-67404 RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, When no CA bundle is available, ssl_options/1 falls back to [{v...	9.2 Critical	—	0,24%	23 Sep 2026
CVE-2026-67240 RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, pattern_to_regex maps % -> .*? and _ -> ., then compiles ^...$ with only [unicode]; re:ru...	2.3 Low	—	0,26%	23 Sep 2026
CVE-2026-67235 RabbitMQ is a messaging and streaming broker. Prior to versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15, The content-header BodySize (a uint64) was stored without valid...	7.1 High	—	0,26%	23 Sep 2026
CVE-2026-67232 RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress => true,...	8.2 High	—	0,37%	23 Sep 2026
CVE-2026-6721 ibm concert IBM Concert 1.0.0 through 3.0.0 allows an unauthenticated remote attacker can supply specially crafted input that is incorporated into OS commands, resulting in arbitrary...	9.8 Critical	—	1,4%	23 Sep 2026
CVE-2026-6718 ibm concert IBM Concert 1.0.0 through 3.0.0 is vulnerable to improper access control which allows unauthorized modification of application files.	6.2 Medium	—	0,10%	23 Sep 2026
CVE-2026-67231 RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The trust-store plugin installs a verify_fun that overrides {ba...	9.1 Critical	—	0,25%	23 Sep 2026
CVE-2026-67229 RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, add_vhost/2 calls rabbit_data_coercion:atomize_keys/1 (the unsa...	6.9 Medium	—	0,28%	23 Sep 2026
CVE-2026-67228 RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The runtime-parameters lookup path coerces the URL :component segment to an atom with rab...	6.9 Medium	—	0,28%	23 Sep 2026
CVE-2026-67224 RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The trace consumer constructs the output path as filename:join(...	2.1 Low	—	0,38%	23 Sep 2026
CVE-2026-67221 RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqp_uri:remove_credentials before...	5.9 Medium	—	0,20%	23 Sep 2026
CVE-2026-67220 RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, 4.3.0, When a binding is created on an x-jms-topic exchange, add_binding/3...	6.0 Medium	—	0,29%	23 Sep 2026
CVE-2026-67219 RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, add_binding/3 parses the routing key as an integer weight N and...	6.0 Medium	—	0,26%	23 Sep 2026
CVE-2026-67218 RabbitMQ is a messaging and streaming broker. Prior to versions 4.0.22, 4.1.11, 4.2.6, and 4.3.0, accept_content/2 at line 56 calls rabbit_stream_manager:create_super_str...	2.1 Low	—	0,34%	23 Sep 2026
CVE-2026-66080 RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.11, 4.2.6, and 4.3.0, validate_partitions only checks that the requested partition count is at least 1...	5.9 Medium	—	0,28%	23 Sep 2026
CVE-2026-66077 RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, The management UI uses EJS 1.0 in which <%= ... %> does NOT HTML-escap...	7.3 High	—	0,30%	23 Sep 2026
CVE-2026-66075 RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, is_authorized/2 for the /federation-links/.../restart route use...	2.3 Low	—	0,24%	23 Sep 2026
CVE-2026-66074 RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, match_value/3 passes the user-supplied ?name= regular expressio...	6.0 Medium	—	0,33%	23 Sep 2026
CVE-2026-66072 RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, get_chunk_selector/1 calls binary_to_atom on the raw client-sup...	6.0 Medium	—	0,33%	23 Sep 2026
CVE-2026-66069 RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.13, 4.2.7, and 4.3.0, is_authorized/2 uses is_authorized_monitor for all methods. DELETE resets rabbit...	2.3 Low	—	0,40%	23 Sep 2026
CVE-2026-66068 RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, ?LOG_DEBUG("shutting down Shovel '~ts', ... Shovel state: ~tp",...	5.6 Medium	—	0,12%	23 Sep 2026
CVE-2026-66067 RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The stream open handler calls only check_vhost_access; it omits the node/vhost/user conne...	6.0 Medium	—	0,35%	23 Sep 2026
CVE-2026-96889 A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can o...	7.8 High	—	0,15%	23 Sep 2026
CVE-2026-96826 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shazzad Hossain Khan W4 Post List allows Blind SQL Injection. This...	7.6 High	—	0,23%	23 Sep 2026
CVE-2026-96552 A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. The affected element is the function MD5.getMD5 of the file ssm_pro/...	3.1 Low	—	0,15%	23 Sep 2026
CVE-2026-96551 A vulnerability was determined in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. Impacted is an unknown function of the file ssm_pro/src/main/java/cn...	4.3 Medium	—	0,16%	23 Sep 2026
CVE-2026-96550 A vulnerability was found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This issue affects the function getProperties of the file ssm_pro/src/mai...	3.7 Low	—	0,21%	23 Sep 2026
CVE-2026-94183 Arc Search for Android before version 1.12.10 does not display a fullscreen notification when a page enters fullscreen mode while the app is running in the background. A...	7.4 High	—	0,20%	23 Sep 2026
CVE-2026-87900 Advisory Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer...	9.4 Critical	—	0,61%	23 Sep 2026
CVE-2026-87899 Advisory Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges.	9.4 Critical	—	0,58%	23 Sep 2026
CVE-2026-87898 OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.	9.4 Critical	—	1,0%	23 Sep 2026
CVE-2026-86065 Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /subscribe endpoint in network/api/websocket/routes.go accepts...	7.5 High	—	0,35%	23 Sep 2026
CVE-2026-86064 Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSocket route configured in config/node/api.yaml and re...	8.6 High	—	0,40%	23 Sep 2026
CVE-2026-85475 A flaw was found in the Ansible Automation Platform automation controller. The external logging (rsyslog) configuration is generated by interpolating user-controlled sett...	7.2 High	—	0,43%	23 Sep 2026
CVE-2026-84724 An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-...	6.6 Medium	—	0,29%	23 Sep 2026
CVE-2026-84721 A server-side request forgery flaw was found in the Ansible Automation Platform automation-controller email notification backend. The email backend passes the user-suppli...	6.4 Medium	—	0,17%	23 Sep 2026
CVE-2026-84720 A flaw was found in the Ansible Automation Platform automation-controller. The WorkflowJobNode.ancestor_artifacts database column, which stores the raw merged set_stats a...	6.5 Medium	—	0,27%	23 Sep 2026
CVE-2026-84719 A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inv...	9.9 Critical	—	0,43%	23 Sep 2026
CVE-2026-84718 A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-...	4.3 Medium	—	0,14%	23 Sep 2026
CVE-2026-84717 A flaw was found in the Ansible Automation Platform automation-controller. The unauthenticated Bitbucket Data Center webhook receiver skips HMAC signature verification fo...	5.3 Medium	—	0,34%	23 Sep 2026
CVE-2026-84716 A flaw was found in the automation-controller instance install-bundle endpoint. When a System Administrator downloads an execution/hop...	6.6 Medium	—	0,18%	23 Sep 2026
CVE-2026-84714 A flaw was found in the automation-controller input-validation guard sanitize_jinja(). The function uses two regular expressions to re...	7.1 High	—	0,29%	23 Sep 2026
CVE-2026-84713 A flaw was found in the automation-controller notification subsystem. Although NotificationTemplate.notification_ configuration is pro...	6.5 Medium	—	0,31%	23 Sep 2026
CVE-2026-84712 A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ (ApiV2PingView, AllowAny) o...	5.3 Medium	—	0,34%	23 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.