Katalog CVE (hal. 301)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 260.056 (Critical 36.033 · High 103.924 · KEV 1.748 · sejak 2020) · Pembaruan terakhir: 20 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 15.001–15.050 dari 260.056 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-76104 dell objectscale Dell ObjectScale, versions prior to 4.4.0.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability in the OS. A high privileged attacker with re...	5.5 Medium	—	0,36%	16 Sep 2026
CVE-2026-70416 dell objectscale Dell ObjectScale, versions prior to 4.4.0.0, contains a Deserialization of Untrusted Data vulnerability. An unauthenticated attacker with remote access could potentially...	9.8 Critical	—	0,85%	16 Sep 2026
CVE-2026-61595 djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, `djust.tenants` isolation was enfor...	7.7 High	—	0,39%	16 Sep 2026
CVE-2026-61593 djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the SSE client→server POST endpoint...	8.1 High	—	0,21%	16 Sep 2026
CVE-2026-26947 Dell ECS versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.4.0.0, contains an Improper Privilege Management vulnerability. A high privileged atta...	6.7 Medium	—	0,15%	16 Sep 2026
CVE-2026-19607 A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs...	5.3 Medium	—	0,51%	16 Sep 2026
CVE-2026-17526 Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a realm admini...	7.2 High	—	0,45%	16 Sep 2026
CVE-2025-59953 LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.1 and prior to version 0.10.2, the LMdeploy implements an rpc...	9.8 Critical	—	0,80%	16 Sep 2026
CVE-2025-43936 dell objectscale Dell ObjectScale, versions prior to ObjectScale 4.4.0.0, contains an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potential...	9.1 Critical	—	0,48%	16 Sep 2026
CVE-2026-92616 FileRise before version 3.28.0 contains a privilege escalation vulnerability that allows authenticated low-privilege attackers to gain unauthorized read and write access...	6.8 Medium	—	0,39%	16 Sep 2026
CVE-2026-92570 reNgine through 2.2.0 contains an authorization bypass vulnerability in the GetFileContents API endpoint that allows any authenticated user to read bundled recon tool con...	6.5 Medium	—	0,44%	16 Sep 2026
CVE-2026-92569 Hippo4j through 1.5.0 contains a server-side request forgery vulnerability in four ThreadPoolController endpoints that fail to validate the clientAddress parameter. Authe...	4.3 Medium	—	0,34%	16 Sep 2026
CVE-2026-92568 MLRun through 1.11.0 contains a server-side request forgery vulnerability in the WebhookNotification handler that allows authenticated users to make the API server send a...	5.4 Medium	—	0,33%	16 Sep 2026
CVE-2026-92567 TDuck survey form through version 5.0 contains an authorization bypass vulnerability in the POST /user/form/data/update endpoint that allows authenticated users to overwr...	6.5 Medium	—	0,42%	16 Sep 2026
CVE-2026-92566 DataGear through 6.0.0 contains a server-side request forgery vulnerability in the /dataSet/preview/Http endpoint that allows unauthenticated attackers to execute arbitra...	8.2 High	—	0,54%	16 Sep 2026
CVE-2026-92565 Rallly before 4.15.0 contains an information disclosure vulnerability in the polls.get tRPC procedure that returns scheduled-event invitee names and email addresses to un...	5.3 Medium	—	0,46%	16 Sep 2026
CVE-2026-92395 @fastify/proxy-addr is a Fastify plugin that determines a request's client address behind trusted reverse proxies, and it backs Fastify request.ip and request.ips. In ver...	9.1 Critical	—	0,33%	16 Sep 2026
CVE-2026-92383 A security vulnerability has been detected in PbootCMS up to 3.2.24. This vulnerability affects the function UserController::del/UserController::mod of the file apps/admi...	4.3 Medium	—	0,24%	16 Sep 2026
CVE-2026-92381 A weakness has been identified in PbootCMS up to 3.2.22. This affects the function decode_string of the file apps/admin/controller/content/ContentController.php of the co...	3.5 Low	—	0,35%	16 Sep 2026
CVE-2026-92380 A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Re...	7.3 High	—	0,50%	16 Sep 2026
CVE-2026-92366 A vulnerability was determined in code-projects Matrimonial System 1.0. This affects an unknown part of the file /search.php of the component Regular Search. This manipul...	7.3 High	—	0,56%	16 Sep 2026
CVE-2026-92087 @fastify/auth is a Fastify plugin that composes multiple authentication and authorization strategies into a single route guard. In versions 5.0.0 through 5.1.0, when stra...	8.1 High	—	0,48%	16 Sep 2026
CVE-2026-89031 Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to modify the scheduled post records of other users. The b2s_calendar_move_post AJAX han...	5.4 Medium	—	0,30%	16 Sep 2026
CVE-2026-88976 Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.11, and in the discontinued 54.0.0-beta.0 through 54.0.0-beta.1 builds, Plate core HTML deserialization A...	6.1 Medium	—	0,34%	16 Sep 2026
CVE-2026-88064 linuxfoundation backstage plugin-techdocs-node, linuxfoundation backstage Backstage is an open framework for building developer portals. Prior to 1.14.6 and from 1.15.0 until 1.15.4, the @backstage/plugin-techdocs-node package insufficiently va...	8.8 High	—	1,2%	16 Sep 2026
CVE-2026-84997 react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 0.6.0 until 1.11.1, React\Http\Io\ChunkedDecoder could enter an infinite...	7.5 High	—	0,66%	16 Sep 2026
CVE-2026-84860 ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authorization Bypass Spring Security gates DWR endpoints by URL path pattern, but DWR itself dispatches meth...	8.8 High	—	0,48%	16 Sep 2026
CVE-2026-84859 ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Blind SQL Injection The /api/events/search endpoint accepts a JSON body containing a sortBy ar...	6.5 Medium	—	0,37%	16 Sep 2026
CVE-2026-84858 ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Remote Code Execution via Scripting Sandbox Bypass The DWR "DataSourceEditDwr" class exposes t...	8.8 High	—	0,84%	16 Sep 2026
CVE-2026-82964 Improper preservation of permissions in the Avast sandbox minifilter driver (aswSnx.sys) on Windows allows a local, low-privileged attacker executing inside the sandbox t...	8.8 High	—	0,16%	16 Sep 2026
CVE-2026-82410 Pocketbase is an open source web backend written in go. Prior to 0.22.48 and 0.39.7, PocketBase's panic-recovery middleware covers regular request handling but not intern...	8.7 High	—	0,58%	16 Sep 2026
CVE-2026-80274 If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followe...	7.5 High	—	0,57%	16 Sep 2026
CVE-2026-79651 A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme manageme...	7.5 High	—	0,81%	16 Sep 2026
CVE-2026-77412 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, readField in read.go reads the length of an AMQP byte-array field with type tag x into a signed int32 and...	8.9 High	—	0,52%	16 Sep 2026
CVE-2026-77411 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, readLongstr in read.go returns an empty string and a nil error when a declared AMQP longstr length exceeds...	9.5 Critical	—	0,52%	16 Sep 2026
CVE-2026-77410 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.recvContent in channel.go preallocates the message body slice with the uint64 ch.header.Size value...	8.9 High	—	0,52%	16 Sep 2026
CVE-2026-77409 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.dispatch in channel.go, confirms.confirm in confirms.go, and Connection.dispatch0 in connection.go...	8.2 High	—	0,52%	16 Sep 2026
CVE-2026-77408 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, the writeShortstr function in write.go casts the byte length of AMQP shortstr property values to uint8 wit...	9.1 Critical	—	0,52%	16 Sep 2026
CVE-2026-77407 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, PlainAuth values defined in auth.go retain passwords as exported plaintext fields in Connection.Config.SAS...	7.0 High	—	0,13%	16 Sep 2026
CVE-2026-77406 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.Qos in channel.go accepts negative prefetchCount and prefetchSize integers and casts them directly...	8.2 High	—	0,41%	16 Sep 2026
CVE-2026-77405 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, tlsConfigFromURI in uri.go creates tls.Config values without setting MinVersion to tls.VersionTLS12. Build...	9.4 Critical	—	0,28%	16 Sep 2026
CVE-2026-77404 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, URI.String in uri.go concatenates CertFile, KeyFile, CACertFile, and ServerName values directly into an AM...	8.7 High	—	0,10%	16 Sep 2026
CVE-2026-77403 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Connection.openTune in connection.go accepts a server-advertised FrameMax below the AMQP frameMinSize valu...	8.9 High	—	0,52%	16 Sep 2026
CVE-2026-77401 Zope AccessControl provides a general security framework for use in Zope. Prior to 7.4, applications that allow untrusted users to create and execute AccessControl-contro...	6.8 Medium	—	0,47%	16 Sep 2026
CVE-2026-77119 A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through...	5.9 Medium	—	0,23%	16 Sep 2026
CVE-2026-76825 RestrictedPython is a tool that helps define a subset of the Python language for accepting program input in a trusted environment. Prior to 8.4, RestrictedPython could al...	8.4 High	—	0,62%	16 Sep 2026
CVE-2026-76163 If BIND is loaded with a "`named.conf`" file that contains no global "`options`" block, an attacker can send a query of QTYPE TKEY which may cause an assertion failure an...	7.5 High	—	0,57%	16 Sep 2026
CVE-2026-75029 In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the cop...	5.3 Medium	—	0,48%	16 Sep 2026
CVE-2026-74909 Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enforcer fails...	8.1 High	—	0,85%	16 Sep 2026
CVE-2026-63671 MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to 0.22.1, @nuxtjs/mdc uses parseMarkdown with allowDangerousHtm...	8.1 High	—	0,47%	16 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.