Katalog CVE (hal. 268)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 259.784 (Critical 36.003 · High 103.813 · KEV 1.747 · sejak 2020) · Pembaruan terakhir: 20 Okt 2026, 00:28 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 13.351–13.400 dari 259.784 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-57227 oisf suricata Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.0 until 7.0.17 and 8.0.6, the MQTT parser i...	7.5 High	—	0,70%	18 Sep 2026
CVE-2026-57225 oisf suricata Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, src/datasets-context-json.c...	5.5 Medium	—	0,17%	18 Sep 2026
CVE-2026-57223 oisf suricata Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the Windows service insta...	7.0 High	—	0,15%	18 Sep 2026
CVE-2026-93873 Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the contact plugin submission handler, allowing attackers to forge messages. Attackers can auto-submit contact...	4.3 Medium	—	0,19%	18 Sep 2026
CVE-2026-93872 Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize() without allowed_classes restriction in the comments plugin EditAction. Registered users with comment...	7.5 High	—	0,71%	18 Sep 2026
CVE-2026-93871 Cotonti through 1.0.0 fails to validate redirect destinations in page bodies prefixed with redir:, allowing authenticated users with page creation or edit permissions to...	5.4 Medium	—	0,27%	18 Sep 2026
CVE-2026-93870 Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the ratings plugin AJAX handler, allowing attackers to forge ratings on behalf of authenticated users. Attacke...	4.3 Medium	—	0,19%	18 Sep 2026
CVE-2026-93869 Cotonti through 1.0.0 contains an open redirect vulnerability in the cot_url_check() function that validates redirect destinations using a regular expression lacking an e...	6.1 Medium	—	0,36%	18 Sep 2026
CVE-2026-93868 Cotonti through 1.0.0 derives password recovery validation tokens from md5(microtime()) in users.passrecover.php, creating a predictable token space of approximately one...	8.1 High	—	0,73%	18 Sep 2026
CVE-2026-93841 vllm vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton _bincount_kernel where prompt token IDs index the penalty prompt-presence bitset without boun...	5.3 Medium	—	0,24%	18 Sep 2026
CVE-2026-93840 vllm vLLM before 0.29.0 validates allowed_token_ids against tokenizer length instead of model output logits width in SamplingParams._validate_allowed_token_ids(). Attackers ca...	5.3 Medium	—	0,25%	18 Sep 2026
CVE-2026-93839 LightLLM through 1.2.0 contains an authentication bypass vulnerability in the /pd_register WebSocket endpoint that allows unauthenticated attackers to register arbitrary...	9.8 Critical	—	0,76%	18 Sep 2026
CVE-2026-93838 SGLang versions through 0.5.20 contain an unbounded memory allocation vulnerability in handle_staging_req() that fails to validate chunk_idx from ZMQ STAGING_REQ frames i...	5.9 Medium	—	0,65%	18 Sep 2026
CVE-2026-93031 The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress are vulnerable to Arbitrary File Upload in all versions from 2.0...	8.8 High	—	0,58%	18 Sep 2026
CVE-2026-92708 Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify an...	7.5 High	—	0,73%	18 Sep 2026
CVE-2026-91205 A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable p...	6.0 Medium	—	0,11%	18 Sep 2026
CVE-2026-91203 A flaw was found in cockpit-files. This vulnerability allows a local attacker to exploit a timing issue, known as a symlink race condition, during privileged file operati...	6.0 Medium	—	0,11%	18 Sep 2026
CVE-2026-91202 A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link (symlink) and then using...	6.1 Medium	—	0,13%	18 Sep 2026
CVE-2026-84241 ibm guardium data protection IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to improper authorization.	8.1 High	—	0,45%	18 Sep 2026
CVE-2026-84239 ibm guardium data protection IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper neutralization of special elements used in a...	7.6 High	—	0,55%	18 Sep 2026
CVE-2026-84108 ibm guardium data protection IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of input during web page generation.	8.1 High	—	0,63%	18 Sep 2026
CVE-2026-84106 ibm guardium data protection IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation...	8.9 High	—	0,53%	18 Sep 2026
CVE-2026-84105 ibm guardium data protection IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper neutralization of special elements used in a...	7.7 High	—	0,47%	18 Sep 2026
CVE-2026-84089 ibm guardium data protection IBM Guardium Data Protection 12.2 could allow a local attacker to gain elevated privileges due to improper privilege management.	7.8 High	—	0,14%	18 Sep 2026
CVE-2026-84086 ibm guardium data protection IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory...	7.2 High	—	0,87%	18 Sep 2026
CVE-2026-84085 ibm guardium data protection IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command.	8.1 High	—	0,50%	18 Sep 2026
CVE-2026-84084 ibm guardium data protection IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to a cross-site request forgery (CSRF) vulnerability.	8.8 High	—	0,24%	18 Sep 2026
CVE-2026-84083 ibm guardium data protection IBM Guardium Data Protection 12.2 is vulnerable to local privilege escalation via the SUID-root nmap_wrapper binary on the Collector appliance. A local attacker with low-...	7.8 High	—	0,15%	18 Sep 2026
CVE-2026-84082 ibm guardium data protection IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL comman...	9.8 Critical	—	0,67%	18 Sep 2026
CVE-2026-84081 ibm guardium data protection IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to improper certificate validation.	8.1 High	—	0,29%	18 Sep 2026
CVE-2026-84078 ibm guardium data protection IBM Guardium Data Protection 12.2 is vulnerable to a missing authentication vulnerability in the LoadBalancerServlet. An unauthenticated user can access privileged load-b...	9.9 Critical	—	0,47%	18 Sep 2026
CVE-2026-84077 ibm guardium data protection IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to a cross-site request forgery vulnerability.	8.1 High	—	0,22%	18 Sep 2026
CVE-2026-84076 ibm guardium data protection IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization.	7.6 High	—	0,39%	18 Sep 2026
CVE-2026-84075 ibm guardium data protection IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to missing authentication for the ChangeTrackerServlet.	9.9 Critical	—	0,56%	18 Sep 2026
CVE-2026-84074 ibm guardium data protection IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation...	8.9 High	—	0,53%	18 Sep 2026
CVE-2026-84073 ibm guardium data protection IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in...	9.1 Critical	—	0,44%	18 Sep 2026
CVE-2026-84071 ibm guardium data protection IBM Guardium Data Protection 12.2 is vulnerable to OS command injection in the Universal Connector plugin upload functionality. A privileged authenticated attacker can pr...	7.2 High	—	1,5%	18 Sep 2026
CVE-2026-84070 ibm guardium data protection IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation...	8.9 High	—	0,53%	18 Sep 2026
CVE-2026-84064 ibm guardium data protection IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in...	9.9 Critical	—	0,63%	18 Sep 2026
CVE-2026-84036 ibm guardium data protection IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization.	7.4 High	—	0,32%	18 Sep 2026
CVE-2026-84034 ibm guardium data protection IBM Guardium Data Protection 12.2 is vulnerable to a hardcoded credentials vulnerability in the hardware_assess/obstore binaries. A low-privileged authenticated user can...	8.8 High	—	0,42%	18 Sep 2026
CVE-2026-84031 ibm guardium data protection IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation...	9.0 Critical	—	0,63%	18 Sep 2026
CVE-2026-82967 ibm guardium data protection IBM Guardium Data Protection 12.2 is vulnerable to an authentication bypass that allows an unauthenticated remote attacker to bypass IP-based access controls and access t...	9.8 Critical	—	0,75%	18 Sep 2026
CVE-2026-82896 ibm guardium data protection IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to traverse directories on the system due to a path traversal vulnerability.	7.6 High	—	0,51%	18 Sep 2026
CVE-2026-82893 ibm guardium data protection IBM Guardium Data Protection 12.2 could allow a local attacker to gain elevated privileges due to improper privilege management.	7.8 High	—	0,14%	18 Sep 2026
CVE-2026-82892 ibm guardium data protection IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.	8.1 High	—	0,62%	18 Sep 2026
CVE-2026-82890 ibm guardium data protection IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary JavaScript code due to improper neutralization of input during web page...	5.9 Medium	—	0,32%	18 Sep 2026
CVE-2026-82887 ibm guardium data protection IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an...	8.8 High	—	0,79%	18 Sep 2026
CVE-2026-82885 ibm guardium data protection IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to gain elevated privileges due to missing authorization in the REST API.	8.8 High	—	0,50%	18 Sep 2026
CVE-2026-82832 ibm guardium data protection IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation...	9.6 Critical	—	0,62%	18 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.