Katalog CVE (hal. 331)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 261.514 (Critical 36.161 · High 104.405 · KEV 1.754 · sejak 2020) · Pembaruan terakhir: 21 Okt 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 16.501–16.550 dari 261.514 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-77404 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, URI.String in uri.go concatenates CertFile, KeyFile, CACertFile, and ServerName values directly into an AM...	8.7 High	—	0,10%	16 Sep 2026
CVE-2026-77403 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Connection.openTune in connection.go accepts a server-advertised FrameMax below the AMQP frameMinSize valu...	8.9 High	—	0,52%	16 Sep 2026
CVE-2026-77401 Zope AccessControl provides a general security framework for use in Zope. Prior to 7.4, applications that allow untrusted users to create and execute AccessControl-contro...	6.8 Medium	—	0,47%	16 Sep 2026
CVE-2026-77119 A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through...	5.9 Medium	—	0,23%	16 Sep 2026
CVE-2026-76825 RestrictedPython is a tool that helps define a subset of the Python language for accepting program input in a trusted environment. Prior to 8.4, RestrictedPython could al...	8.4 High	—	0,62%	16 Sep 2026
CVE-2026-76163 If BIND is loaded with a "`named.conf`" file that contains no global "`options`" block, an attacker can send a query of QTYPE TKEY which may cause an assertion failure an...	7.5 High	—	0,57%	16 Sep 2026
CVE-2026-75029 In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the cop...	5.3 Medium	—	0,48%	16 Sep 2026
CVE-2026-74909 Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enforcer fails...	8.1 High	—	0,85%	16 Sep 2026
CVE-2026-63671 MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to 0.22.1, @nuxtjs/mdc uses parseMarkdown with allowDangerousHtm...	8.1 High	—	0,47%	16 Sep 2026
CVE-2026-63128 RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's stateful Streamable HTTP server in crates/rmcp/src/transport/streamable_http...	7.5 High	—	0,63%	16 Sep 2026
CVE-2026-63127 RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's OAuth implementation in crates/rmcp/src/transport/auth.rs omits the RFC 9728...	8.2 High	—	0,20%	16 Sep 2026
CVE-2026-61709 OpenFGA is an authorization and permission engine built for developers. Prior to 1.18.1, the ListUsers API could return a user that should have been excluded when an auth...	5.3 Medium	—	0,35%	16 Sep 2026
CVE-2026-19668 A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of a particular kind of invalid DNSSEC record. Default limits on "...	5.3 Medium	—	0,48%	16 Sep 2026
CVE-2026-19666 On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit un...	7.5 High	—	0,57%	16 Sep 2026
CVE-2026-19033 For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG signature a...	6.5 Medium	—	0,24%	16 Sep 2026
CVE-2026-18212 A flaw was found in the SAML Redirect Binding implementation of Keycloak, an open-source identity and access management solution. The issue occurs because the custom DEFL...	7.5 High	—	0,52%	16 Sep 2026
CVE-2025-36591 Dell ECS versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.4.0.0, contains an Use of a Broken or Risky Cryptographic Algorithm vulnerability. A h...	4.4 Medium	—	0,11%	16 Sep 2026
CVE-2026-92469 zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the file-center module DELETE /files/{id} endpoint that performs no ownersh...	8.1 High	—	0,54%	16 Sep 2026
CVE-2026-92468 zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the search-center service that allows authenticated attackers to read any E...	6.5 Medium	—	0,48%	16 Sep 2026
CVE-2026-92467 zlt2000 microservices-platform through 6.0.0 contains an unverified password change vulnerability in the PUT /users/password endpoint that allows authenticated users to c...	8.3 High	—	0,46%	16 Sep 2026
CVE-2026-92466 zlt2000 microservices-platform through 6.0.0 contains a missing authorization vulnerability where the zlt.security.auth.urlPermission.enable flag defaults to false, disab...	8.8 High	—	0,91%	16 Sep 2026
CVE-2026-92365 A vulnerability was found in vllm-project vllm up to 0.29.0. Affected by this issue is some unknown functionality of the file vllm/v1/sample/thinking_budget_state.py. The...	4.3 Medium	—	0,52%	16 Sep 2026
CVE-2026-92364 A vulnerability has been found in itsourcecode Leave Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /module/employee/index....	6.3 Medium	—	0,33%	16 Sep 2026
CVE-2026-92363 A flaw has been found in ag-ui-protocol ag-ui 1.0. Affected is an unknown function of the file src/stream/sse_parser.cpp of the component JSON Parser. Executing a manipul...	4.3 Medium	—	0,55%	16 Sep 2026
CVE-2026-92362 A vulnerability was detected in ag-ui-protocol ag-ui 1.0. This impacts an unknown function of the file crates/ag-ui-client/src/sse.rs of the component SSE Frame Parser. P...	7.3 High	—	0,53%	16 Sep 2026
CVE-2026-92141 Jenkins Keycloak Authentication Plugin 2.4.1 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks.	4.3 Medium	—	0,33%	16 Sep 2026
CVE-2026-92140 Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, resulting in a stored cross-site scr...	6.8 Medium	—	0,43%	16 Sep 2026
CVE-2026-92139 Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket cred...	6.5 Medium	—	0,25%	16 Sep 2026
CVE-2026-92138 The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the `oauth_callback` URL from the submitted form rather than from...	4.2 Medium	—	0,11%	16 Sep 2026
CVE-2026-92137 Jenkins Robot Framework Plugin 6.2.2 and earlier does not check that the archive directory configured for Robot Framework report files is contained within the build direc...	8.8 High	—	0,84%	16 Sep 2026
CVE-2026-92136 Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored cross-site scrip...	8.0 High	—	0,41%	16 Sep 2026
CVE-2026-92135 Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted through the REST API, allowing at...	8.0 High	—	0,41%	16 Sep 2026
CVE-2026-92134 Jenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ and earlier does not validate the analysis results ID when a job configuration is submitted through the REST API, allowi...	8.0 High	—	0,41%	16 Sep 2026
CVE-2026-92133 Jenkins GitLab Plugin 1.2149.vcfc32c82b_f7f and earlier caches the GitLab API client built for alternative GitLab API token credentials under a cache key derived from the...	5.4 Medium	—	0,23%	16 Sep 2026
CVE-2026-92132 Jenkins Gradle Plugin 2.19.1252.v15196b_5a_6e10 and earlier requests build scan data from the build scan link detected in the build log, even when a Develocity server URL...	5.4 Medium	—	0,25%	16 Sep 2026
CVE-2026-92131 Jenkins Pipeline: Groovy Libraries Plugin 805.va_fc79344957d and earlier does not restrict the library path provided to the library Pipeline step to a relative path insid...	4.2 Medium	—	0,23%	16 Sep 2026
CVE-2026-92130 Jenkins Pipeline: Multibranch Plugin 841.vec5b_9e1806ec and earlier does not set the appropriate context for credentials lookup in the resolveScm Pipeline step, allowing...	3.1 Low	—	0,22%	16 Sep 2026
CVE-2026-92129 jenkins script security Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check calls from sandboxed scripts to methods added dynamically to a class at runtime, allowing...	7.5 High	—	0,48%	16 Sep 2026
CVE-2026-92128 jenkins script security Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier downloads a JAR file specified by URL twice, confirming the approval of the first download and loading th...	7.5 High	—	0,29%	16 Sep 2026
CVE-2026-92127 jenkins script security Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier automatically approves the classpath entries in an item configuration when a user with Overall/Administer...	8.0 High	—	0,61%	16 Sep 2026
CVE-2026-92126 jenkins script security Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class, allowing atta...	8.5 High	—	0,62%	16 Sep 2026
CVE-2026-92125 jenkins script security Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing attackers with permission to defin...	8.8 High	—	0,56%	16 Sep 2026
CVE-2026-92124 jenkins script security Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier checks the operations Groovy will perform with the elements it reads from a collection that a sandboxed s...	8.8 High	—	0,63%	16 Sep 2026
CVE-2026-92123 jenkins script security Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not intercept operations performed on a null receiver (method calls, property and attribute accesses...	8.8 High	—	0,63%	16 Sep 2026
CVE-2026-92122 jenkins script security Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check the method called through the proxy created when a sandboxed script coerces a value to an...	8.8 High	—	0,63%	16 Sep 2026
CVE-2026-91843 A stack overflow during the unauthenticated login process may allow an attacker to run arbitrary code remotely with root privileges.	9.8 Critical	—	0,52%	16 Sep 2026
CVE-2026-89030 Adenion Blog2Social plugin for WordPress before 9.1.0 exposes the email addresses of all registered WordPress users to low-privileged accounts. The b2s_search_user AJAX h...	4.3 Medium	—	0,28%	16 Sep 2026
CVE-2026-89029 Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to enumerate WordPress user accounts. The b2s_get_select_mandant_user AJAX handler in in...	4.3 Medium	—	0,28%	16 Sep 2026
CVE-2026-89028 MikroTik RouterOS before 7.24 contains a heap memory corruption vulnerability in the userspace SMB daemon that allows remote attackers to corrupt adjacent heap memory by...	7.5 High	—	0,58%	16 Sep 2026
CVE-2026-85104 In Sooma 2GEN brain stimulator, an attacker within Bluetooth range can make unauthenticated changes to brain stimulation parameters.	5.3 Medium	—	0,16%	16 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.