Katalog CVE (hal. 269)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 259.784 (Critical 36.003 · High 103.813 · KEV 1.747 · sejak 2020) · Pembaruan terakhir: 20 Okt 2026, 00:28 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 13.401–13.450 dari 259.784 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-82340 ibm guardium data protection IBM Guardium Data Protection 12.2 is vulnerable to unauthenticated insecure deserialization and attacker-controlled reflective method dispatch in the Change Audit System...	9.8 Critical	—	0,70%	18 Sep 2026
CVE-2026-81937 ibm guardium data protection IBM Guardium Data Protection 12.2 is vulnerable to a command injection vulnerability in the import remotelog_config file CLI command. A highly privileged authenticated us...	7.2 High	—	1,5%	18 Sep 2026
CVE-2026-81933 ibm guardium data protection IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Analytic Grid Service Handler. A low-privileged authenticated user can inject SQL...	8.8 High	—	0,44%	18 Sep 2026
CVE-2026-81669 ibm guardium data protection IBM Guardium Data Protection 12.2 is vulnerable to a command injection vulnerability in the create csr wildcard CLI command. An authenticated privileged CLI user can inje...	7.2 High	—	1,3%	18 Sep 2026
CVE-2026-81657 ibm guardium data protection IBM Guardium Data Protection 12.2 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.	9.8 Critical	—	0,85%	18 Sep 2026
CVE-2026-81656 ibm guardium data protection IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the New Query Builder REST Processor. A low-privileged authenticated user can inject S...	8.8 High	—	0,44%	18 Sep 2026
CVE-2026-81626 ibm guardium data protection IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Load Balancer Groups component. An unauthenticated user can inject SQL statements...	8.6 High	—	0,37%	18 Sep 2026
CVE-2026-81623 ibm guardium data protection IBM Guardium Data Protection 12.2 could allow an authenticated user to execute arbitrary commands with low user privileges on the system due to improper validation of use...	8.8 High	—	0,34%	18 Sep 2026
CVE-2026-80442 ibm guardium data protection IBM Guardium Data Protection 12.2 is vulnerable to an authenticated OS command injection vulnerability in the exportCertificate functionality. Successful exploitation cou...	8.8 High	—	0,65%	18 Sep 2026
CVE-2026-80441 ibm guardium data protection IBM Guardium Data Protection 12.2 is vulnerable to an unauthenticated second-order SQL injection vulnerability in the generateInsertQuery functionality of change-tracker-...	9.8 Critical	—	0,56%	18 Sep 2026
CVE-2026-77528 Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate a...	5.3 Medium	—	0,52%	18 Sep 2026
CVE-2026-76902 CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, ShiroFilter configures /attachment/previe...	5.0 Medium	—	0,27%	18 Sep 2026
CVE-2026-76901 CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, GET /pool/lead/get/{id} in PoolClueContro...	5.8 Medium	—	0,40%	18 Sep 2026
CVE-2026-76900 CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. In version 1.7.3, ApprovalResourceService.sendWebHook rea...	6.8 Medium	—	0,50%	18 Sep 2026
CVE-2026-76899 CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. From 1.7.0 until 1.7.4, POST /account-pool/page allows an...	5.7 Medium	—	0,40%	18 Sep 2026
CVE-2026-75895 In libsmpp35 from 0.1.0 through 1.8.0 out of bound read issue was found in the at smpp34_unpack() function via attacker controlled SMPP PDUs, leading to memory corruption...	7.5 High	—	0,43%	18 Sep 2026
CVE-2026-75878 IBM Sterling File Gateway could allow a remote attacker to bypass authentication and obtain a fully authenticated session due to improper authentication via an unvalidate...	9.1 Critical	—	0,64%	18 Sep 2026
CVE-2026-63647 CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, SseController exposes the anonymous /sse/...	9.3 Critical	—	0,50%	18 Sep 2026
CVE-2026-63646 CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, GET /mcp/form/config/{formKey} calls McpC...	6.9 Medium	—	0,66%	18 Sep 2026
CVE-2026-61822 pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, run_maintenance() handles exceptions outside the loop that processes r...	6.5 Medium	—	0,53%	18 Sep 2026
CVE-2026-61821 pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, drop_partition_id() and drop_partition_time() use part_config.retentio...	8.5 High	—	0,38%	18 Sep 2026
CVE-2026-61820 pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, inherit_template_properties() manually surrounds primary-key column na...	8.5 High	—	0,73%	18 Sep 2026
CVE-2026-61819 pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, when pg_jobmon is installed and part_config.jobmon is true, exception...	8.5 High	—	0,73%	18 Sep 2026
CVE-2026-61818 pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, undo_partition() reads part_config.time_encoder as unrestricted text a...	8.5 High	—	0,51%	18 Sep 2026
CVE-2026-61817 pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, run_maintenance(), show_partitions(), show_partition_info(), undo_part...	8.5 High	—	0,73%	18 Sep 2026
CVE-2026-61781 pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, create_partition_time() reads the writable part_config.time_encoder te...	9.9 Critical	—	0,80%	18 Sep 2026
CVE-2026-61723 FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS parser validates ptbl chunks with the unsigned expres...	6.8 Medium	—	0,18%	18 Sep 2026
CVE-2026-61722 FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS parser validates articulation chunks using the unsign...	6.8 Medium	—	0,20%	18 Sep 2026
CVE-2026-61721 FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS loader assigns file-controlled wsmp.loop_start and ws...	8.0 High	—	0,19%	18 Sep 2026
CVE-2026-61720 FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the SF2 parser computes the DMOD modulator count as chunk.size / SF_...	6.2 Medium	—	0,18%	18 Sep 2026
CVE-2026-61714 FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.2.4 until 2.5.6, configuring synth.midi-channels above 16 allows the MIDI player to i...	7.8 High	—	0,14%	18 Sep 2026
CVE-2026-58264 FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 1.1.2 until 2.5.6, the FluidSynth command handler accepts a pitch_bend_range command wh...	9.8 Critical	—	0,59%	18 Sep 2026
CVE-2026-57226 oisf suricata Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, HTTP SWF decompression wi...	5.9 Medium	—	0,59%	18 Sep 2026
CVE-2026-57224 oisf suricata Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the DHCP parser in rust/src/...	6.5 Medium	—	0,41%	18 Sep 2026
CVE-2026-57222 oisf suricata Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, crafted IPv4 and IPv6 add...	5.3 Medium	—	0,44%	18 Sep 2026
CVE-2026-52745 CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.0, the POST /account-pool/page endpoint allo...	5.3 Medium	—	0,34%	18 Sep 2026
CVE-2026-18869 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions and access internal network services due to improper validation o...	6.4 Medium	—	0,22%	18 Sep 2026
CVE-2026-17619 IBM Platform RTM is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or de...	8.6 High	—	0,30%	18 Sep 2026
CVE-2026-17262 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to cause a denial of service due to improper validation of FTP authentication commands.	5.4 Medium	—	0,19%	18 Sep 2026
CVE-2026-11727 IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 IBM MQ C client could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to impr...	8.1 High	—	0,44%	18 Sep 2026
CVE-2026-11726 IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validatio...	8.1 High	—	0,33%	18 Sep 2026
CVE-2026-11725 IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in MQINQ request processing.	8.8 High	—	0,40%	18 Sep 2026
CVE-2026-11722 IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by an HTTP request smuggling vulnerability.	4.8 Medium	—	0,18%	18 Sep 2026
CVE-2026-11716 IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code during queue manage...	7.5 High	—	0,33%	18 Sep 2026
CVE-2026-11711 IBM WebSphere Application Server 9.0 and 8.5 is affected by a deserialization vulnerability in the Name Service component.	6.5 Medium	—	0,38%	18 Sep 2026
CVE-2026-11710 IBM WebSphere Application Server 8.5 is affected by an HTTP request smuggling vulnerability due to improper handling of Content-Length headers.	6.5 Medium	—	0,23%	18 Sep 2026
CVE-2026-11549 IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a virtual host bypass vulnerability.	6.5 Medium	—	0,23%	18 Sep 2026
CVE-2026-11548 IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by an HTTP request smuggling vulnerability.	4.8 Medium	—	0,18%	18 Sep 2026
CVE-2026-11545 IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to obtain sensitive information from the administrative console due to missing authorization ch...	3.7 Low	—	0,26%	18 Sep 2026
CVE-2026-11540 IBM WebSphere Application Server 9.0 and 8.5 could allow a remote attacker to obtain sensitive information about the file system through the FileTransfer servlet.	5.3 Medium	—	0,30%	18 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.