Katalog CVE (hal. 246)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 259.612 (Critical 35.994 · High 103.761 · KEV 1.747 · sejak 2020) · Pembaruan terakhir: 19 Okt 2026, 18:29 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 12.251–12.300 dari 259.612 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-17472 IBM Concert 1.0.0 through 3.0.0 could allow a remote authenticated attacker to access or modify unauthorized resources due to the use of wildcards in RBAC permission defi...	9.6 Critical	—	0,30%	22 Sep 2026
CVE-2026-17465 IBM Concert 1.0.0 through 3.0.0 could allow a remote authenticated attacker to cause a denial of service due to improper enforcement of storage limits.	6.5 Medium	—	0,28%	22 Sep 2026
CVE-2026-17102 ibm datastage on cloud pak for data IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements u...	8.8 High	—	0,58%	22 Sep 2026
CVE-2026-16672 ibm datastage on cloud pak for data IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used...	8.8 High	—	0,55%	22 Sep 2026
CVE-2026-16469 ibm datastage on cloud pak for data IBM DataStage on Cloud Pak for Data 5.4.0.0 px-runtime could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special...	8.8 High	—	0,96%	22 Sep 2026
CVE-2026-16468 ibm datastage on cloud pak for data IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection.	8.8 High	—	1,7%	22 Sep 2026
CVE-2026-16426 IBM Concert 1.0.0 through 3.0.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the syste...	6.5 Medium	—	0,19%	22 Sep 2026
CVE-2026-16346 ibm datastage on cloud pak for data IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements u...	9.9 Critical	—	0,45%	22 Sep 2026
CVE-2026-15915 IBM Concert 1.0.0 through 3.0.0 could allow a local attacker to obtain sensitive information due to recursive copying of build context directories into container images.	6.2 Medium	—	0,12%	22 Sep 2026
CVE-2025-36084 IBM Concert 1.0.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.	5.9 Medium	—	0,16%	22 Sep 2026
CVE-2025-12767 IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to cause a denial of service using a specially crafted regular expression that would cause excessive resourc...	5.3 Medium	—	0,36%	22 Sep 2026
CVE-2026-96269 GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and unintern func...	7.5 High	—	0,15%	22 Sep 2026
CVE-2026-96260 mattermost server Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin r...	6.5 Medium	—	0,42%	22 Sep 2026
CVE-2026-96259 mattermost server Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to apply the internal-connection filter to OAuth endpoint requests, whi...	5.5 Medium	—	0,26%	22 Sep 2026
CVE-2026-95815 OpenClaw iOS before 2026.8.11 logs complete agent deep-link URLs including persistent bearer keys to unified logs as public diagnostic data. Attackers who obtain diagnost...	6.3 Medium	—	0,16%	22 Sep 2026
CVE-2026-95814 Vaultwarden through 1.37.3 omits organization membership status validation from three cipher access-restriction queries, allowing revoked and not-yet-confirmed members to...	8.1 High	—	0,43%	22 Sep 2026
CVE-2026-95813 e621ng versions before 26.09.16 pass untrusted request parameters directly to Rails url_for in PaginatorComponent and controller navigation links, allowing attackers to r...	6.1 Medium	—	0,34%	22 Sep 2026
CVE-2026-95812 ClipBucket v5 before 5.5.3-#182 contains a reflected cross-site scripting vulnerability in the sort_link() helper function that fails to sanitize cat, sort, and time quer...	6.1 Medium	—	0,35%	22 Sep 2026
CVE-2026-94450 Improper validation of the Destination Connection ID length in s2n-quic 1.88.0 and earlier may allow an unauthenticated remote user to cause a denial of service by shutti...	7.5 High	—	1,9%	22 Sep 2026
CVE-2026-91018 lwIP (Lightweight IP) has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution on the victim system.	8.8 High	—	0,24%	22 Sep 2026
CVE-2026-88020 Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input during web page generation vulnerability when the web interface attempts to route the progr...	6.1 Medium	—	0,27%	22 Sep 2026
CVE-2026-77987 github enterprise server A server-side request forgery (SSRF) vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of...	9.8 Critical	—	0,88%	22 Sep 2026
CVE-2026-77912 github enterprise server A stored cross-site scripting (XSS) vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to inject arbitrary HTML attributes in...	5.4 Medium	—	0,21%	22 Sep 2026
CVE-2026-77426 Unleash is an open-source feature management platform. Prior to 8.0.3, the Unleash admin API contains five authorization vulnerabilities. POST /api/admin/segments/strateg...	7.1 High	—	0,48%	22 Sep 2026
CVE-2026-77425 Unleash is an open-source feature management platform. Prior to 8.0.3, POST /api/admin/projects/:projectId/features/:featureName/environments/:environment/strategies/set-...	4.3 Medium	—	0,23%	22 Sep 2026
CVE-2026-76910 Unleash is an open-source feature management platform. Prior to 8.0.3, cloneFeatureToggle and POST /api/admin/projects/:projectId/features/:featureName/clone authorize cr...	5.3 Medium	—	0,30%	22 Sep 2026
CVE-2026-76909 Unleash is an open-source feature management platform. Prior to 8.0.3, the change-request approval email template at src/mailtemplates/requested-cr-approval/requested-cr-...	2.1 Low	—	0,27%	22 Sep 2026
CVE-2026-75101 github enterprise server An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed any authenticated user of the instance to read the raw diff or patch of pull...	6.5 Medium	—	0,29%	22 Sep 2026
CVE-2026-67615 openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploi...	8.8 High	—	0,54%	22 Sep 2026
CVE-2026-62364 wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can sele...	2.3 Low	—	0,08%	22 Sep 2026
CVE-2026-94574 A local cross-user code execution vulnerability exists in GNU wget (Windows builds from eternallybored.org) due to a hardcoded configuration file path (C:\msys64) that is...	7.8 High	—	0,12%	22 Sep 2026
CVE-2026-89282 The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability through its default install direc...	9.1 Critical	—	0,27%	22 Sep 2026
CVE-2026-89281 The Apache Lounge Windows distribution of Apache HTTP Server build contains a hardcoded configuration path vulnerability within openssl.cnf path that can allow local code...	8.4 High	—	0,13%	22 Sep 2026
CVE-2026-88624 Missing path validation in the Worktree.remove component of openCode v1.18.26 allows attackers to execute arbitrary recursive directory deletion via a crafted payload.	9.1 Critical	—	0,35%	22 Sep 2026
CVE-2026-88419 An unrestricted upload of files with a dangerous type in the thumbnail-upload endpoint (/index.php?m=member&f=article&v=thumbUpload) of WuzhiCMS 5.0.0 allows an authentic...	8.8 High	—	0,48%	22 Sep 2026
CVE-2026-88416 MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form import feature.	9.8 Critical	—	0,32%	22 Sep 2026
CVE-2026-88418 CMSimple 5.24 ships with CSRF protection disabled by default, which turns csrfProtection() into a no-op on every state-changing admin request, and it does not send the cs...	8.8 High	—	0,25%	22 Sep 2026
CVE-2026-88350 An integer overflow vulnerability exists in MPack 1.1.1 in mpack_node_cstr_alloc() and mpack_node_utf8_cstr_alloc().	6.2 Medium	—	0,12%	22 Sep 2026
CVE-2026-88345 An out-of-bounds read vulnerability exists in the schema lexer of flatcc 4c3b999e. When an exact-length FlatBuffers schema ends with an unterminated quotation mark, the C...	7.5 High	—	0,42%	22 Sep 2026
CVE-2026-88344 An out-of-bounds read vulnerability exists in the schema lexer of flatcc 4c3b999e. When an exact-length FlatBuffers schema buffer ends with a digit, the integer digit-sca...	7.5 High	—	0,40%	22 Sep 2026
CVE-2026-88341 A reachable assertion vulnerability exists in YARA 4.5.8 when loading crafted .yrc compiled rule files. An attacker can provide a malicious file with an invalid arena con...	5.5 Medium	—	0,17%	22 Sep 2026
CVE-2026-88340 An invalid pointer release vulnerability exists in YARA 4.5.8 during deserialization of compiled .yrc rule files. The vulnerability is caused by insufficient validation o...	7.6 High	—	0,25%	22 Sep 2026
CVE-2026-88339 A NULL pointer dereference vulnerability exists in the gf_sg_vrml_field_clone() function of GPAC 2d7da22e (26.08-DEV). The vulnerability occurs when cloning a PROTO defau...	5.5 Medium	—	0,17%	22 Sep 2026
CVE-2026-87121 lwIP TCP/IP Stack MQTT is vulnerable to an out-of-bounds write, which may allow an attacker to gain full code execution on the device.	9.8 Critical	—	0,53%	22 Sep 2026
CVE-2026-83805 Nautobot is a Network Source of Truth and Network Automation Platform. From 3.0.0 until 3.1.8, the generic ApprovalWorkflowStageResponse create endpoint does not enforce...	6.4 Medium	—	0,22%	22 Sep 2026
CVE-2026-83801 Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.37 and 3.1.8, a user with extras.add_relationship or extras.change_relationship permis...	5.4 Medium	—	0,22%	22 Sep 2026
CVE-2026-79767 Gardener implements the automated management and operation of Kubernetes clusters as a service. Prior to 1.142.6, 1.143.3, 1.144.2, and 1.145.0, the customverbauthorizer...	5.5 Medium	—	0,39%	22 Sep 2026
CVE-2026-77322 SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.3, WSConnection.Read in sip/transport_ws.go creates a wsutil.Reader without setting MaxFrameS...	7.5 High	—	0,52%	22 Sep 2026
CVE-2026-76717 arubanetworks analytics and location engine A vulnerability exists in the Analytics and Location Engine (ALE) API that may allow for the disclosure of sensitive information. An unauthenticated remote attacker could...	5.3 Medium	—	0,42%	22 Sep 2026
CVE-2026-76716 arubanetworks analytics and location engine Multiple vulnerabilities exist in the Analytics and Location Engine (ALE) that may allow for unauthorized access or denial of service. An unauthenticated remote attacker...	5.3 Medium	—	0,51%	22 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.