Katalog CVE (hal. 277)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 259.945 (Critical 36.018 · High 103.876 · KEV 1.748 · sejak 2020) · Pembaruan terakhir: 20 Okt 2026, 06:26 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 13.801–13.850 dari 259.945 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-93558 A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send reques...	7.5 High	—	1,1%	18 Sep 2026
CVE-2026-93506 A vulnerability was determined in SveltyCMS 0.0.6. This issue affects some unknown processing of the file /mediagallery/upload-media of the component File Upload Endpoint...	6.3 Medium	—	0,37%	18 Sep 2026
CVE-2026-93505 A vulnerability was found in SveltyCMS 0.0.6. This vulnerability affects unknown code of the file src/utils/media/media-service.server.ts of the component SVG Media Uploa...	3.5 Low	—	0,35%	18 Sep 2026
CVE-2026-85511 A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substituti...	4.2 Medium	—	0,28%	18 Sep 2026
CVE-2026-77929 ClipBucket v5 before 5.5.3-#182 contains a file upload vulnerability that allows authenticated users to achieve remote code execution by uploading a PHP file with valid i...	8.8 High	—	0,94%	18 Sep 2026
CVE-2026-77928 ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary database contents by submitting the msg_...	6.5 Medium	—	0,42%	18 Sep 2026
CVE-2026-77927 ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary data from the database by submitting the...	6.5 Medium	—	0,42%	18 Sep 2026
CVE-2026-25684 A file type attribution issue in Zscaler Internet Access File Type Control evaluation rules may allow improper evaluation of File Type Control policies in rare circumstan...	4.4 Medium	—	0,20%	18 Sep 2026
CVE-2026-16515 net_icmpv6_send_error() in subsys/net/ip/icmpv6.c implemented only one of the three RFC 4443 section 2.4 suppression rules (do not answer an ICMPv6 error with an ICMPv6 e...	4.7 Medium	—	0,20%	18 Sep 2026
CVE-2026-16514 gptp_mi_qualify_announce() in subsys/net/l2/ethernet/gptp/gptp_mi.c walks the Path Trace TLV of a received IEEE 802.1AS Announce message, comparing each clock identity ag...	4.3 Medium	—	0,24%	18 Sep 2026
CVE-2026-16512 gptp_handle_msg() in subsys/net/l2/ethernet/gptp/gptp.c dereferenced the gPTP header returned by GPTP_HDR() and switched on hdr->message_type without first checking that...	3.1 Low	—	0,17%	18 Sep 2026
CVE-2026-10832 A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit this resource exhaustion vulnerability by sending a specially crafted...	5.9 Medium	—	0,42%	18 Sep 2026
CVE-2025-13882 IBM Sterling Partner Engagement Manager Essentials Edition 6.3.0.0 through 6.3.0.2, and 6.2.4.0 through 6.2.4.4 and IBM Sterling Partner Engagement Manager Standard Editi...	5.3 Medium	—	0,25%	18 Sep 2026
CVE-2025-1350 IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow a remote attacker to obtain sensitive information when a detailed technical error mess...	5.3 Medium	—	0,24%	18 Sep 2026
CVE-2024-56344 IBM Cognos Analytics 12.0.4 through 12.0.4 FP2, and 12.1.0 through 12.1.3 FP1 could allow a remote attacker to obtain sensitive information, caused by the failure to prop...	5.9 Medium	—	0,17%	18 Sep 2026
CVE-2026-93606 vm2 (npm) versions 3.12.0 and earlier contain a sandbox escape in `VM` and `NodeVM`. When an embedder exposes a host API that returns a host-realm Promise, the bridge's r...	10.0 Critical	—	0,71%	18 Sep 2026
CVE-2026-93605 vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite blocking other host-spawning mo...	10.0 Critical	—	0,73%	18 Sep 2026
CVE-2026-93604 vm2 through 3.12.0 exposes Node.js's crypto.setFips() function to untrusted guest code when an embedder explicitly allowlists the crypto builtin for a NodeVM (require.bui...	7.2 High	—	0,35%	18 Sep 2026
CVE-2026-93603 vm2 through 3.12.0 (fixed in 3.12.1) does not correctly handle a nullish `this` receiver in the apply trap of its bridge (lib/bridge.js): when sandboxed code calls a host...	10.0 Critical	—	0,73%	18 Sep 2026
CVE-2026-93602 rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against each CRL's I...	4.4 Medium	—	0,20%	18 Sep 2026
CVE-2026-93601 rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constrai...	2.2 Low	—	0,18%	18 Sep 2026
CVE-2026-93600 rustls-webpki (rustls/webpki) versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI names, c...	2.2 Low	—	0,18%	18 Sep 2026
CVE-2026-93599 rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs. The input guard fails t...	7.5 High	—	0,35%	18 Sep 2026
CVE-2026-93598 ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 contains an incomplete deny-list in the polyglot script sandbox: com.arcadedb.query.polyglot.HostCla...	7.1 High	—	0,63%	18 Sep 2026
CVE-2026-93597 ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attackers can supp...	7.7 High	—	0,35%	18 Sep 2026
CVE-2026-93596 ArcadeDB before 26.9.1 (com.arcadedb:arcadedb-engine <= 26.8.1) fails to bind the authenticated principal onto the DatabaseAsyncTransaction async worker threads used by t...	4.3 Medium	—	0,30%	18 Sep 2026
CVE-2026-93595 ArcadeDB before 26.9.1 contains an access control bypass vulnerability in the query_database tool exposed through the AI chat endpoints. The tool executes queries without...	6.5 Medium	—	0,38%	18 Sep 2026
CVE-2026-93594 ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 enforces its per-type/per-record access-control rules only in LocalBucket, keyed on file id. Query-e...	8.1 High	—	0,44%	18 Sep 2026
CVE-2026-93593 ArcadeDB before 26.9.1 fails to enforce security-group types ACL entries for TimeSeries types because the ACL resolver builds permissions from bucket IDs, but TimeSeries...	8.1 High	—	0,36%	18 Sep 2026
CVE-2026-93592 vllm vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing unauthenticated attackers to crash the en...	7.5 High	—	0,54%	18 Sep 2026
CVE-2026-93591 SiYuan versions before 3.8.3 contain an SQL injection vulnerability in the graph.go query2Stmt function where tag values are concatenated raw into SQL string literals wit...	7.6 High	—	0,32%	18 Sep 2026
CVE-2026-93590 imagemagick ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy checks during buffer allocation for image pixels. Atta...	7.5 High	—	0,39%	18 Sep 2026
CVE-2026-93589 imagemagick ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect value for ticks per second in the image being encoded causes...	7.5 High	—	0,34%	18 Sep 2026
CVE-2026-93588 imagemagick ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a NULL pointer dereference in the PNM coder. When the coder reaches a memory (resource) limit at a specific poin...	4.3 Medium	—	0,27%	18 Sep 2026
CVE-2026-93587 imagemagick ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the PCD (and, per the upstream advisory, CUBE and HALD) coder: when a specific command line o...	3.3 Low	—	0,12%	18 Sep 2026
CVE-2026-93586 imagemagick ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the ImagesToBlob method, caused by a pointer that is not updated correctly. Ex...	3.3 Low	—	0,10%	18 Sep 2026
CVE-2026-93560 A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum integer value....	7.5 High	—	0,41%	18 Sep 2026
CVE-2026-93504 A vulnerability has been found in SveltyCMS 0.0.6. This affects an unknown part of the file src/routes/api/[...path]/+server.ts of the component User Attribute Update End...	6.3 Medium	—	0,37%	18 Sep 2026
CVE-2026-93019 Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read. The reader unpacks the two-byte colou...	9.1 Critical	—	0,65%	18 Sep 2026
CVE-2026-93018 Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in i_gpix_p and i_glin_p. The pa...	5.5 Medium	—	0,18%	18 Sep 2026
CVE-2026-88623 NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter submitted by the user via POST is received, and fopen() is used to op...	7.5 High	—	0,50%	18 Sep 2026
CVE-2026-88622 NUUO Network Video Recorder 2.0.0 is vulnerable to Command Injection in handle_import_privilege.php.	8.8 High	—	1,1%	18 Sep 2026
CVE-2026-79294 Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbitrary code via the HTML artifact Preview rendering...	6.1 Medium	—	0,51%	18 Sep 2026
CVE-2026-62282 OpenCVE is a vulnerability intelligence platform. Prior to 3.0.0, OpenCVE notification testing for Webhook and Slack integrations does not sufficiently validate user-supp...	6.5 Medium	—	0,42%	18 Sep 2026
CVE-2023-5778 Improper handling of length parameter inconsistency vulnerability in ABB Freelance Controller DCP, ABB Freelance Controller AC700, ABB Freelance Controller AC800, and ABB...	7.5 High	—	0,29%	18 Sep 2026
CVE-2026-93492 A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE. This causes...	5.3 Medium	—	0,37%	18 Sep 2026
CVE-2026-93491 A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and...	7.5 High	—	0,73%	18 Sep 2026
CVE-2026-93488 A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VA...	7.5 High	—	0,80%	18 Sep 2026
CVE-2026-28199 An authenticated user with access to the NetBackup Flex OS management shell could read arbitrary files from the underlying operating system by supplying a specially cra...	3.3 Low	—	0,10%	18 Sep 2026
CVE-2026-28198 An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could bypass the cryptographic signature verification step of a privileged s...	8.8 High	—	0,34%	18 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.