Katalog CVE (hal. 270)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 259.784 (Critical 36.003 · High 103.813 · KEV 1.747 · sejak 2020) · Pembaruan terakhir: 20 Okt 2026, 00:28 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 13.451–13.500 dari 259.784 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-11539 IBM WebSphere Application Server 9.0 and 8.5 is affected by an authentication bypass vulnerability in the SOAP/JMX connector.	5.3 Medium	—	0,30%	18 Sep 2026
CVE-2017-20284 Caucho Resin contains a path traversal vulnerability in the documentation webapp (resin-doc) that allows remote unauthenticated attackers to read arbitrary files by suppl...	7.5 High	—	0,96%	18 Sep 2026
CVE-2026-93854 In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations (PUT /v2/leases/{lease_id} and DELETE...	7.2 High	—	0,41%	18 Sep 2026
CVE-2026-93852 In OpenStack Blazar before 17.0.1, the V2 lease listing operation (GET /v2/leases) returns leases for every project without enforcing project scoping or an administrator-...	7.1 High	—	0,37%	18 Sep 2026
CVE-2026-93650 A vulnerability was determined in Saleor up to 3.20.118/3.21.54/3.22.47/3.23.14. This vulnerability affects the function get_client_ip of the file saleor/account/throttli...	3.7 Low	—	0,69%	18 Sep 2026
CVE-2026-75894 In osmo-iuh from 0.1.0 through 1.8.0 a reachable assertion was found in the ranap_handle_co_dt() function via a arbitrarily sized NAS-PDU that leads to process crash and...	7.5 High	—	0,31%	18 Sep 2026
CVE-2026-75893 In osmo-bsc from 1.0.1 through 1.14.1 a heap based buffer overflow issue was found in the ipaccess_proxy_read_msg() function via IPA frame lengths.	7.5 High	—	0,46%	18 Sep 2026
CVE-2026-75892 In osmo-ggsn 1.14.0 an out of bounds write issue was found in the gtp_decode_pdp_ctx() function through the PDP context GSN-Address sub-field, leading to memory corruptio...	6.5 Medium	—	0,28%	18 Sep 2026
CVE-2026-11538 ibm websphere application server IBM WebSphere Application Server 9.0 and 8.5 is affected by a log injection vulnerability through crafted LTPA token cookies.	5.3 Medium	—	0,16%	18 Sep 2026
CVE-2023-54399 Hongjing e-HR before 8.2 contains a SQL injection vulnerability in the /servlet/codesettree endpoint where the categories query parameter is passed to a database query wi...	9.8 Critical	—	0,42%	18 Sep 2026
CVE-2021-48008 Chanjet CRM contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by manipulating the site_id GET paramete...	7.5 High	—	0,34%	18 Sep 2026
CVE-2019-25776 Weaver E-cology contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by submitting malicious input throug...	7.5 High	—	0,36%	18 Sep 2026
CVE-2026-93764 mongodb mongoid Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema. Applications that enable this feat...	6.5 Medium	—	0,15%	18 Sep 2026
CVE-2026-93763 mongodb mongoid A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an application declared for client-side field-lev...	6.5 Medium	—	0,15%	18 Sep 2026
CVE-2026-93762 mongodb mongoid Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to certain in-m...	9.8 Critical	—	0,57%	18 Sep 2026
CVE-2026-93761 mongodb mongoid An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to cause excessiv...	7.5 High	—	0,46%	18 Sep 2026
CVE-2026-93760 mongodb mongoid Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In an applica...	8.2 High	—	0,53%	18 Sep 2026
CVE-2026-93759 mongodb mongoid Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An...	8.6 High	—	0,43%	18 Sep 2026
CVE-2026-93753 deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject() function that fails to properly validate keys being written to target objects. A...	7.5 High	—	0,51%	18 Sep 2026
CVE-2026-93752 CSSOM through 0.5.0 contains a denial of service vulnerability in CSSStyleDeclaration.setProperty() that fails to validate reserved property names. Attackers can supply a...	7.5 High	—	0,68%	18 Sep 2026
CVE-2026-93751 uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars() that decodes invalid and overlong percent-encoded sequences into ASCII metacharact...	6.5 Medium	—	0,40%	18 Sep 2026
CVE-2026-93750 http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the _varyMatches() function that fails to properly validate Vary header wildcards due to b...	5.9 Medium	—	0,45%	18 Sep 2026
CVE-2026-93749 source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers...	7.5 High	—	0,35%	18 Sep 2026
CVE-2026-93748 http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attacker...	7.5 High	—	0,57%	18 Sep 2026
CVE-2026-93432 A flaw was found in the Quarkus Qute template engine. When the {#eval} section helper processes a sub-template, it fails to pass the parent template's content type inform...	6.1 Medium	—	0,54%	18 Sep 2026
CVE-2026-92768 A flaw was found in cockpit-machines. This vulnerability allows a local attacker to expose sensitive Virtual Machine (VM) credentials, including plaintext passwords, by i...	5.5 Medium	—	0,15%	18 Sep 2026
CVE-2026-92747 A flaw was found in `cockpit-machines`. This vulnerability allows a local attacker with the ability to inspect running processes to expose sensitive guest virtual machine...	5.0 Medium	—	0,15%	18 Sep 2026
CVE-2026-92745 A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect process metadata to disclose a sensitive Red Hat Subscription...	5.0 Medium	—	0,10%	18 Sep 2026
CVE-2026-92702 Cocos AI is a confidential computing system for AI. In Cocos AI 0.8.2 and earlier, VerifyAttestationReportTLS in the AMD SEV-SNP verifier sets Policy.ReportData only when...	9.1 Critical	—	0,26%	18 Sep 2026
CVE-2026-92701 Cocos AI is a confidential computing system for AI. In Cocos AI 0.8.2 and earlier, VerifTeeAttestation in the Intel TDX aTLS verifier receives an expected current-session...	9.1 Critical	—	0,22%	18 Sep 2026
CVE-2026-91127 File Viewer is a browser-native viewer for Office, PDF, CAD, archive, and other files in private and internal web applications. Prior to @file-viewer/doc 2.3.1 and msdoc-...	8.2 High	—	0,40%	18 Sep 2026
CVE-2026-85058 Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client-controlled Last Will message through publish2Subscribers without in...	7.5 High	—	0,45%	18 Sep 2026
CVE-2026-84992 md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt() highlight callback in packages/MdEditor/layouts/C...	6.1 Medium	—	0,33%	18 Sep 2026
CVE-2026-84975 PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the OpenSSL and GnuTLS backends in pjlib/src/pj/ssl_sock_ossl.c and pj...	7.4 High	—	0,23%	18 Sep 2026
CVE-2026-81182 SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, an unauthenticated attacker who holds a public read-write note share link can disclose an...	4.2 Medium	—	0,27%	18 Sep 2026
CVE-2026-81181 SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, the password authentication flow for protected shared notes does not rotate the session id...	3.7 Low	—	0,28%	18 Sep 2026
CVE-2026-81180 SysReptor is a fully customizable pentest reporting platform. Prior to 2026.61, authenticated users of SysReptor Professional can upload image files whose formats cause i...	8.8 High	—	0,66%	18 Sep 2026
CVE-2026-81179 SysReptor is a fully customizable pentest reporting platform. Prior to 2026.58, installations that enable password reset by email while configuring ALLOWED_HOSTS with a w...	8.1 High	—	0,48%	18 Sep 2026
CVE-2026-81178 SysReptor is a fully customizable pentest reporting platform. Prior to 2026.55, an unauthenticated holder of a public note share link receives project-wide collaborative...	3.5 Low	—	0,30%	18 Sep 2026
CVE-2026-77396 teluu pjsip PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the PJSIP AVI parser in pjmedia/src/pjmedia/avi_player.c uses an input...	7.1 High	—	0,12%	18 Sep 2026
CVE-2026-77386 Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, an unauthenticated attacker could initiate the OIDC login flow with an attacker-c...	6.5 Medium	—	0,56%	18 Sep 2026
CVE-2026-77385 Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core.play permission could supply a base64-encoded fil...	4.3 Medium	—	0,34%	18 Sep 2026
CVE-2026-71537 Paymenter is a free and open-source webshop solution for management of hosting services. Prior to 1.5.7, app/Livewire/Services/Upgrade.php::doUpgrade() relies on Service:...	6.5 Medium	—	0,33%	18 Sep 2026
CVE-2026-69186 c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that t...	5.3 Medium	—	0,52%	18 Sep 2026
CVE-2026-69184 c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or...	7.5 High	—	0,68%	18 Sep 2026
CVE-2026-64847 AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO starts process-pool workers wi...	6.8 Medium	—	0,16%	18 Sep 2026
CVE-2026-63458 Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can s...	7.1 High	—	0,30%	18 Sep 2026
CVE-2026-63445 Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the requ...	7.1 High	—	0,56%	18 Sep 2026
CVE-2026-63199 Perses is an open-source dashboard and visualization project for observability data. From 0.43.0 until 0.54.0-rc.0, the datasource creation and unsaved datasource proxy p...	8.3 High	—	0,27%	18 Sep 2026
CVE-2026-62279 LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, an authenticated user could submit caller-controlled rec...	7.1 High	—	0,40%	18 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.