Katalog CVE (hal. 311)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 260.253 (Critical 36.047 · High 103.974 · KEV 1.748 · sejak 2020) · Pembaruan terakhir: 21 Okt 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 15.501–15.550 dari 260.253 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-73435 On affected platforms running Arista EOS with Open Shortest Path First version 2 (OSPFv2) configured, a specially crafted OSPFv2 packet from an unauthenticated attacker o...	8.2 High	—	0,19%	16 Sep 2026
CVE-2026-59969 apache zookeeper Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerifi...	7.5 High	—	0,33%	16 Sep 2026
CVE-2026-59739 apache zookeeper Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-w...	7.5 High	—	0,55%	16 Sep 2026
CVE-2026-19640 On affected platforms running Arista EOS, an authenticated user with access to the gNMI (gRPC Network Management Interface) may receive incorrect authorization results, p...	4.2 Medium	—	0,19%	16 Sep 2026
CVE-2026-14917 A SAML authentication bypass vulnerability affects the Kong SAML plugin when the validate_assertion_signature option is explicitly set to false. This option is enabled by...	7.7 High	—	0,69%	16 Sep 2026
CVE-2026-92081 fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a response trailer via reply.trailer() and is served over...	5.9 Medium	—	0,41%	16 Sep 2026
CVE-2026-89792 In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent out-of-bounds reads in share config responses Validate IPC share configuration payloa...	7.1 High	—	0,16%	16 Sep 2026
CVE-2026-89791 In the Linux kernel, the following vulnerability has been resolved: perf: Fix use-after-free when perf mmap() revival races with the last munmap() perf_mmap_close() dro...	7.8 High	—	0,15%	16 Sep 2026
CVE-2026-89789 In the Linux kernel, the following vulnerability has been resolved: gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free gtp_newlink()'s err...	7.8 High	—	0,16%	16 Sep 2026
CVE-2026-89788 In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix tree connection use-after-free in smb2_tree_connect() ksmbd_tree_conn_connect() publishes...	9.8 Critical	—	0,55%	16 Sep 2026
CVE-2026-89786 In the Linux kernel, the following vulnerability has been resolved: ext4: fix out-of-bounds read in ext4_read_inline_dir() ext4_read_inline_dir() can read a dirent head...	9.1 Critical	—	0,70%	16 Sep 2026
CVE-2026-89783 In the Linux kernel, the following vulnerability has been resolved: xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full The depth check in xfrm6_i...	9.8 Critical	—	0,71%	16 Sep 2026
CVE-2026-89782 In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject restart table growth beyond U16_MAX entries During $LogFile replay, log_replay() in...	8.4 High	—	0,18%	16 Sep 2026
CVE-2026-89781 In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix out-of-bounds read in read_log_rec_buf() read_log_rec_buf() copies a log record into a...	8.4 High	—	0,19%	16 Sep 2026
CVE-2026-89779 In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate ef->size covers the record's name and value When an EA record has a non-zero ef->...	9.1 Critical	—	0,70%	16 Sep 2026
CVE-2026-89778 In the Linux kernel, the following vulnerability has been resolved: isofs: fix out-of-bounds page array access on empty zisofs block zisofs_uncompress_block()'s empty-b...	9.8 Critical	—	0,70%	16 Sep 2026
CVE-2026-89777 In the Linux kernel, the following vulnerability has been resolved: vfio/pci: clear vdev->msi_perm after freeing it on init failure vfio_msi_cap_len() lazily allocates...	8.8 High	—	0,16%	16 Sep 2026
CVE-2026-89775 In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation Computing the effects of a TL...	9.3 Critical	—	0,23%	16 Sep 2026
CVE-2026-89774 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: hold sk properly in sco_conn_ready sk deref in sco_conn_ready must be done either un...	8.8 High	—	0,40%	16 Sep 2026
CVE-2026-89186 Use of Cache Containing Sensitive Information in ZenHive mpp allows a shared HTTP cache to store a paid response and serve it to clients that never paid. MPP.Plug.verify...	6.3 Medium	—	0,52%	16 Sep 2026
CVE-2026-88255 Improper Validation of Unsafe Equivalence in Input in ZenHive mpp allows an unauthenticated remote client to pass the Tempo duplicate-submission gate twice with one signe...	6.3 Medium	—	0,52%	16 Sep 2026
CVE-2026-86465 apache-airflow-providers-akeyless Apache Airflow Akeyless provider: the Akeyless secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author sco...	6.5 Medium	—	0,81%	16 Sep 2026
CVE-2026-86462 apache-airflow-providers-fab Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions. An a...	9.1 Critical	—	0,83%	16 Sep 2026
CVE-2026-86338 Ash field_policies are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced in a filter, it is replaced wit...	6.0 Medium	—	0,43%	16 Sep 2026
CVE-2026-85501 nlnetlabs unbound Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicio...	7.5 High	—	0,48%	16 Sep 2026
CVE-2026-82720 nlnetlabs unbound NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with '--with-libnghttp2'. During failure...	5.9 Medium	—	0,38%	16 Sep 2026
CVE-2026-82717 nlnetlabs unbound In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation option...	9.8 Critical	—	0,78%	16 Sep 2026
CVE-2026-82311 apache-airflow-providers-fab Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cle...	9.8 Critical	—	0,98%	16 Sep 2026
CVE-2026-81642 nlnetlabs unbound In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution as a...	9.8 Critical	—	0,96%	16 Sep 2026
CVE-2026-81634 nlnetlabs unbound In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation r...	7.5 High	—	0,48%	16 Sep 2026
CVE-2026-80225 nlnetlabs unbound In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive...	7.5 High	—	0,48%	16 Sep 2026
CVE-2026-78227 nlnetlabs unbound NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each DoQ stream...	6.5 Medium	—	0,34%	16 Sep 2026
CVE-2026-77955 nlnetlabs unbound In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a trust ancho...	4.4 Medium	—	0,17%	16 Sep 2026
CVE-2026-77860 nlnetlabs unbound In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per clie...	3.7 Low	—	0,30%	16 Sep 2026
CVE-2026-73464 On affected platforms running Arista EOS with gRPC Network Management Interface (gNMI) enabled, a specially crafted request could allow a malicious authenticated client w...	8.8 High	—	0,64%	16 Sep 2026
CVE-2026-73463 On affected platforms running Arista EOS, when multiple gRPC Network Security Interface (gNSI) transports are configured, a race condition in the gNSI Authz service may c...	5.3 Medium	—	0,21%	16 Sep 2026
CVE-2026-73461 On affected EOS platforms with AAA-based gRPC authorization enabled for OpenConfig, gRPC requests of an authenticated user to OpenConfig may use the wrong privilege level...	8.0 High	—	0,39%	16 Sep 2026
CVE-2026-73454 On affected platforms running Arista EOS with gRPC Network Security Interface (gNSI) Credentialz configured, a specially crafted request can cause unintended modification...	8.1 High	—	0,39%	16 Sep 2026
CVE-2026-73445 On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface (gNSI) Authz Rotate RPC may cause an incorrect Authz policy which was uploaded...	4.9 Medium	—	0,35%	16 Sep 2026
CVE-2026-73439 On affected platforms running Arista EOS, if OpenConfig is configured and running a gNMI server on the system, and if gNSI Pathz is configured and a gNSI Pathz policy is...	7.5 High	—	0,36%	16 Sep 2026
CVE-2026-2380 On affected platforms running Arista EOS with OpenConfig-related services (i.e., gNMI, gNSI, RESTCONF and NETCONF), sensitive requests and responses may be unintentionall...	7.4 High	—	0,25%	16 Sep 2026
CVE-2026-92355 In affected versions of Octopus Server, a user with permission to modify non built-in external feeds could exploit a path traversal flaw to overwrite arbitrary files on t...	8.7 High	—	0,69%	16 Sep 2026
CVE-2026-92091 A flaw was found in jwcrypto. The JWK.import_key() function validates the key_ops JWK member for duplicate values using an algorithm with O(n^2) time complexity, and the...	5.9 Medium	—	0,57%	16 Sep 2026
CVE-2026-89207 A vulnerability has been identified in WTV676-HB6035 Web Interface (All versions < V3.94), WTV776-HB6035 Web Interface (All versions < V4.17). Affected devices do not pro...	6.5 Medium	—	0,43%	16 Sep 2026
CVE-2026-88263 XikeStor Layer3 switches miss authentication for downloading configuration data. Unauthenticated attacker may retrieve the configuration data containing network configura...	8.7 High	—	0,59%	16 Sep 2026
CVE-2026-86341 gitlab GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an...	4.4 Medium	—	0,36%	16 Sep 2026
CVE-2026-84408 QND contains an improper access control vulnerability in a named pipe, which may allow a local attacker who is logged in to a Windows PC where the affected product's clie...	8.7 High	—	0,63%	16 Sep 2026
CVE-2026-81326 QND uses a hard-coded cryptographic key, which may allow a local attacker who is logged in to a Windows PC where the affected product's client is installed to obtain admi...	6.8 Medium	—	0,14%	16 Sep 2026
CVE-2026-27565 An unauthenticated remote attacker can upload a malicious IODD file that places and executes a shell script with root privileges. The shell script remains active even aft...	9.8 Critical	—	0,97%	16 Sep 2026
CVE-2026-27564 A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a PUT request with admin credentials allo...	7.2 High	—	2,7%	16 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.