Katalog CVE (hal. 272)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 259.945 (Critical 36.018 · High 103.876 · KEV 1.748 · sejak 2020) · Pembaruan terakhir: 20 Okt 2026, 06:26 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 13.551–13.600 dari 259.945 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-84036 ibm guardium data protection IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization.	7.4 High	—	0,32%	18 Sep 2026
CVE-2026-84034 ibm guardium data protection IBM Guardium Data Protection 12.2 is vulnerable to a hardcoded credentials vulnerability in the hardware_assess/obstore binaries. A low-privileged authenticated user can...	8.8 High	—	0,42%	18 Sep 2026
CVE-2026-84031 ibm guardium data protection IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation...	9.0 Critical	—	0,63%	18 Sep 2026
CVE-2026-82967 ibm guardium data protection IBM Guardium Data Protection 12.2 is vulnerable to an authentication bypass that allows an unauthenticated remote attacker to bypass IP-based access controls and access t...	9.8 Critical	—	0,75%	18 Sep 2026
CVE-2026-82896 ibm guardium data protection IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to traverse directories on the system due to a path traversal vulnerability.	7.6 High	—	0,51%	18 Sep 2026
CVE-2026-82893 ibm guardium data protection IBM Guardium Data Protection 12.2 could allow a local attacker to gain elevated privileges due to improper privilege management.	7.8 High	—	0,14%	18 Sep 2026
CVE-2026-82892 ibm guardium data protection IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.	8.1 High	—	0,62%	18 Sep 2026
CVE-2026-82890 ibm guardium data protection IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary JavaScript code due to improper neutralization of input during web page...	5.9 Medium	—	0,32%	18 Sep 2026
CVE-2026-82887 ibm guardium data protection IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an...	8.8 High	—	0,79%	18 Sep 2026
CVE-2026-82885 ibm guardium data protection IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to gain elevated privileges due to missing authorization in the REST API.	8.8 High	—	0,50%	18 Sep 2026
CVE-2026-82832 ibm guardium data protection IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation...	9.6 Critical	—	0,62%	18 Sep 2026
CVE-2026-82340 ibm guardium data protection IBM Guardium Data Protection 12.2 is vulnerable to unauthenticated insecure deserialization and attacker-controlled reflective method dispatch in the Change Audit System...	9.8 Critical	—	0,70%	18 Sep 2026
CVE-2026-81937 ibm guardium data protection IBM Guardium Data Protection 12.2 is vulnerable to a command injection vulnerability in the import remotelog_config file CLI command. A highly privileged authenticated us...	7.2 High	—	1,5%	18 Sep 2026
CVE-2026-81933 ibm guardium data protection IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Analytic Grid Service Handler. A low-privileged authenticated user can inject SQL...	8.8 High	—	0,44%	18 Sep 2026
CVE-2026-81669 ibm guardium data protection IBM Guardium Data Protection 12.2 is vulnerable to a command injection vulnerability in the create csr wildcard CLI command. An authenticated privileged CLI user can inje...	7.2 High	—	1,3%	18 Sep 2026
CVE-2026-81657 ibm guardium data protection IBM Guardium Data Protection 12.2 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.	9.8 Critical	—	0,85%	18 Sep 2026
CVE-2026-81656 ibm guardium data protection IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the New Query Builder REST Processor. A low-privileged authenticated user can inject S...	8.8 High	—	0,44%	18 Sep 2026
CVE-2026-81626 ibm guardium data protection IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Load Balancer Groups component. An unauthenticated user can inject SQL statements...	8.6 High	—	0,37%	18 Sep 2026
CVE-2026-81623 ibm guardium data protection IBM Guardium Data Protection 12.2 could allow an authenticated user to execute arbitrary commands with low user privileges on the system due to improper validation of use...	8.8 High	—	0,34%	18 Sep 2026
CVE-2026-80442 ibm guardium data protection IBM Guardium Data Protection 12.2 is vulnerable to an authenticated OS command injection vulnerability in the exportCertificate functionality. Successful exploitation cou...	8.8 High	—	0,65%	18 Sep 2026
CVE-2026-80441 ibm guardium data protection IBM Guardium Data Protection 12.2 is vulnerable to an unauthenticated second-order SQL injection vulnerability in the generateInsertQuery functionality of change-tracker-...	9.8 Critical	—	0,56%	18 Sep 2026
CVE-2026-77528 Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate a...	5.3 Medium	—	0,52%	18 Sep 2026
CVE-2026-76902 CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, ShiroFilter configures /attachment/previe...	5.0 Medium	—	0,27%	18 Sep 2026
CVE-2026-76901 CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, GET /pool/lead/get/{id} in PoolClueContro...	5.8 Medium	—	0,40%	18 Sep 2026
CVE-2026-76900 CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. In version 1.7.3, ApprovalResourceService.sendWebHook rea...	6.8 Medium	—	0,50%	18 Sep 2026
CVE-2026-76899 CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. From 1.7.0 until 1.7.4, POST /account-pool/page allows an...	5.7 Medium	—	0,40%	18 Sep 2026
CVE-2026-75895 In libsmpp35 from 0.1.0 through 1.8.0 out of bound read issue was found in the at smpp34_unpack() function via attacker controlled SMPP PDUs, leading to memory corruption...	7.5 High	—	0,43%	18 Sep 2026
CVE-2026-75878 IBM Sterling File Gateway could allow a remote attacker to bypass authentication and obtain a fully authenticated session due to improper authentication via an unvalidate...	9.1 Critical	—	0,64%	18 Sep 2026
CVE-2026-63647 CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, SseController exposes the anonymous /sse/...	9.3 Critical	—	0,50%	18 Sep 2026
CVE-2026-63646 CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, GET /mcp/form/config/{formKey} calls McpC...	6.9 Medium	—	0,66%	18 Sep 2026
CVE-2026-61822 pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, run_maintenance() handles exceptions outside the loop that processes r...	6.5 Medium	—	0,53%	18 Sep 2026
CVE-2026-61821 pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, drop_partition_id() and drop_partition_time() use part_config.retentio...	8.5 High	—	0,38%	18 Sep 2026
CVE-2026-61820 pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, inherit_template_properties() manually surrounds primary-key column na...	8.5 High	—	0,73%	18 Sep 2026
CVE-2026-61819 pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, when pg_jobmon is installed and part_config.jobmon is true, exception...	8.5 High	—	0,73%	18 Sep 2026
CVE-2026-61818 pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, undo_partition() reads part_config.time_encoder as unrestricted text a...	8.5 High	—	0,51%	18 Sep 2026
CVE-2026-61817 pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, run_maintenance(), show_partitions(), show_partition_info(), undo_part...	8.5 High	—	0,73%	18 Sep 2026
CVE-2026-61781 pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, create_partition_time() reads the writable part_config.time_encoder te...	9.9 Critical	—	0,80%	18 Sep 2026
CVE-2026-61723 FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS parser validates ptbl chunks with the unsigned expres...	6.8 Medium	—	0,18%	18 Sep 2026
CVE-2026-61722 FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS parser validates articulation chunks using the unsign...	6.8 Medium	—	0,20%	18 Sep 2026
CVE-2026-61721 FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS loader assigns file-controlled wsmp.loop_start and ws...	8.0 High	—	0,19%	18 Sep 2026
CVE-2026-61720 FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the SF2 parser computes the DMOD modulator count as chunk.size / SF_...	6.2 Medium	—	0,18%	18 Sep 2026
CVE-2026-61714 FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.2.4 until 2.5.6, configuring synth.midi-channels above 16 allows the MIDI player to i...	7.8 High	—	0,14%	18 Sep 2026
CVE-2026-58264 FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 1.1.2 until 2.5.6, the FluidSynth command handler accepts a pitch_bend_range command wh...	9.8 Critical	—	0,59%	18 Sep 2026
CVE-2026-57226 oisf suricata Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, HTTP SWF decompression wi...	5.9 Medium	—	0,59%	18 Sep 2026
CVE-2026-57224 oisf suricata Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the DHCP parser in rust/src/...	6.5 Medium	—	0,41%	18 Sep 2026
CVE-2026-57222 oisf suricata Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, crafted IPv4 and IPv6 add...	5.3 Medium	—	0,44%	18 Sep 2026
CVE-2026-52745 CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.0, the POST /account-pool/page endpoint allo...	5.3 Medium	—	0,34%	18 Sep 2026
CVE-2026-18869 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions and access internal network services due to improper validation o...	6.4 Medium	—	0,22%	18 Sep 2026
CVE-2026-17619 IBM Platform RTM is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or de...	8.6 High	—	0,30%	18 Sep 2026
CVE-2026-17262 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to cause a denial of service due to improper validation of FTP authentication commands.	5.4 Medium	—	0,19%	18 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.