Katalog CVE (hal. 344)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 261.924 (Critical 36.195 · High 104.712 · KEV 1.754 · sejak 2020) · Pembaruan terakhir: 21 Okt 2026, 12:26 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 17.151–17.200 dari 261.924 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-89793 In the Linux kernel, the following vulnerability has been resolved: ublk: clear VM_MAYWRITE on read-only ublk char device mmap ublk_ch_mmap() rejects mmap requests with...	7.8 High	—	0,17%	16 Sep 2026
CVE-2026-86792 apache-airflow-providers-apache-kafka Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's `extra` field into Python callables via `impor...	8.8 High	—	1,2%	16 Sep 2026
CVE-2026-86474 The lack of TLS certificate validation when downloading firmware updates in VEO and VEO-XS Wi-Fi monitors, in versions prior to 01.48.001, allows an attacker to perform m...	7.7 High	—	0,13%	16 Sep 2026
CVE-2026-86466 apache-airflow-providers-fab Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_token it accepts. An attacker hold...	8.1 High	—	0,37%	16 Sep 2026
CVE-2026-86443 Cleartext storage of sensitive information in the DuoxMe application for Android, in versions prior to 4.3.4, allows an attacker with local access to the device to retrie...	6.9 Medium	—	0,10%	16 Sep 2026
CVE-2026-85628 Transmission of the home Wi-Fi credentials without encryption during the pairing process between the DuoxMe application and VEO and VEO-XS Wi-Fi monitors, in versions pri...	7.0 High	—	0,09%	16 Sep 2026
CVE-2026-84501 apache zookeeper An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble", ...) request containing...	5.3 Medium	—	0,74%	16 Sep 2026
CVE-2026-84439 apache zookeeper When audit logging is enabled (zookeeper.audit.enable=true), an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest...	5.3 Medium	—	0,74%	16 Sep 2026
CVE-2026-82310 apache-airflow-providers-fab Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rejects the di...	7.2 High	—	1,0%	16 Sep 2026
CVE-2026-79993 apache zookeeper The `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the dat...	7.5 High	—	0,60%	16 Sep 2026
CVE-2026-77190 On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device with PIM Sparse Mode and MLAG...	6.5 Medium	—	0,28%	16 Sep 2026
CVE-2026-76187 apache-airflow-providers-keycloak Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not...	9.8 Critical	—	0,98%	16 Sep 2026
CVE-2026-76186 apache-airflow-providers-keycloak Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token but takes the Keycloak access a...	9.1 Critical	—	0,81%	16 Sep 2026
CVE-2026-76151 Out-of-bounds read (buffer over-read) in the HTTP Cache-Control response header parsing in the QtNetwork module in Qt Group Qt 6.0.0 through 6.8.8, and 6.9.0 through 6.11...	4.6 Medium	—	0,67%	16 Sep 2026
CVE-2026-73469 When specific platforms are using Arista EOS with a loose Unicast Reverse Path Forwarding (uRPF) configuration, certain traffic may not be subjected to the intended verif...	5.8 Medium	—	0,29%	16 Sep 2026
CVE-2026-73468 A specially crafted packet can cause the premature expiry of multicast forwarding state on affected interfaces, potentially resulting in temporary multicast traffic loss...	6.5 Medium	—	0,29%	16 Sep 2026
CVE-2026-73455 On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, a specially crafted packet can cause the OSPFv3 agent to restart une...	7.5 High	—	0,50%	16 Sep 2026
CVE-2026-73453 An unauthenticated P4Runtime (Programming Protocol-Independent Packet Processors Runtime) client can achieve arbitrary code execution under certain conditions on affected...	10.0 Critical	—	0,70%	16 Sep 2026
CVE-2026-73440 On affected platforms running Arista EOS with Simple Network Management Protocol (SNMP) configured, SNMPv3 local or remote user credentials may be exposed as a one-way ha...	4.2 Medium	—	0,27%	16 Sep 2026
CVE-2026-73438 On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, an unauthenticated attacker on the same OSPFv3 broadcast domain can...	5.3 Medium	—	0,25%	16 Sep 2026
CVE-2026-73436 On affected platforms running Arista EOS with OSPFv2 and OSPFv2 segment routing configured, a specially crafted OSPFv2 packet from an adjacent OSPF neighbor may cause OSP...	6.5 Medium	—	0,27%	16 Sep 2026
CVE-2026-73435 On affected platforms running Arista EOS with Open Shortest Path First version 2 (OSPFv2) configured, a specially crafted OSPFv2 packet from an unauthenticated attacker o...	8.2 High	—	0,19%	16 Sep 2026
CVE-2026-59969 apache zookeeper Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerifi...	7.5 High	—	0,33%	16 Sep 2026
CVE-2026-59739 apache zookeeper Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-w...	7.5 High	—	0,55%	16 Sep 2026
CVE-2026-19640 On affected platforms running Arista EOS, an authenticated user with access to the gNMI (gRPC Network Management Interface) may receive incorrect authorization results, p...	4.2 Medium	—	0,19%	16 Sep 2026
CVE-2026-14917 A SAML authentication bypass vulnerability affects the Kong SAML plugin when the validate_assertion_signature option is explicitly set to false. This option is enabled by...	7.7 High	—	0,69%	16 Sep 2026
CVE-2026-92081 fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a response trailer via reply.trailer() and is served over...	5.9 Medium	—	0,41%	16 Sep 2026
CVE-2026-89792 In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent out-of-bounds reads in share config responses Validate IPC share configuration payloa...	7.1 High	—	0,16%	16 Sep 2026
CVE-2026-89791 In the Linux kernel, the following vulnerability has been resolved: perf: Fix use-after-free when perf mmap() revival races with the last munmap() perf_mmap_close() dro...	7.8 High	—	0,15%	16 Sep 2026
CVE-2026-89789 In the Linux kernel, the following vulnerability has been resolved: gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free gtp_newlink()'s err...	7.8 High	—	0,16%	16 Sep 2026
CVE-2026-89788 In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix tree connection use-after-free in smb2_tree_connect() ksmbd_tree_conn_connect() publishes...	9.8 Critical	—	0,55%	16 Sep 2026
CVE-2026-89786 In the Linux kernel, the following vulnerability has been resolved: ext4: fix out-of-bounds read in ext4_read_inline_dir() ext4_read_inline_dir() can read a dirent head...	9.1 Critical	—	0,70%	16 Sep 2026
CVE-2026-89783 In the Linux kernel, the following vulnerability has been resolved: xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full The depth check in xfrm6_i...	9.8 Critical	—	0,71%	16 Sep 2026
CVE-2026-89782 In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject restart table growth beyond U16_MAX entries During $LogFile replay, log_replay() in...	8.4 High	—	0,18%	16 Sep 2026
CVE-2026-89781 In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix out-of-bounds read in read_log_rec_buf() read_log_rec_buf() copies a log record into a...	8.4 High	—	0,19%	16 Sep 2026
CVE-2026-89779 In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate ef->size covers the record's name and value When an EA record has a non-zero ef->...	9.1 Critical	—	0,70%	16 Sep 2026
CVE-2026-89778 In the Linux kernel, the following vulnerability has been resolved: isofs: fix out-of-bounds page array access on empty zisofs block zisofs_uncompress_block()'s empty-b...	9.8 Critical	—	0,70%	16 Sep 2026
CVE-2026-89777 In the Linux kernel, the following vulnerability has been resolved: vfio/pci: clear vdev->msi_perm after freeing it on init failure vfio_msi_cap_len() lazily allocates...	8.8 High	—	0,16%	16 Sep 2026
CVE-2026-89775 In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation Computing the effects of a TL...	9.3 Critical	—	0,23%	16 Sep 2026
CVE-2026-89774 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: hold sk properly in sco_conn_ready sk deref in sco_conn_ready must be done either un...	8.8 High	—	0,40%	16 Sep 2026
CVE-2026-89186 Use of Cache Containing Sensitive Information in ZenHive mpp allows a shared HTTP cache to store a paid response and serve it to clients that never paid. MPP.Plug.verify...	6.3 Medium	—	0,52%	16 Sep 2026
CVE-2026-88255 Improper Validation of Unsafe Equivalence in Input in ZenHive mpp allows an unauthenticated remote client to pass the Tempo duplicate-submission gate twice with one signe...	6.3 Medium	—	0,52%	16 Sep 2026
CVE-2026-86465 apache-airflow-providers-akeyless Apache Airflow Akeyless provider: the Akeyless secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author sco...	6.5 Medium	—	0,81%	16 Sep 2026
CVE-2026-86462 apache-airflow-providers-fab Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions. An a...	9.1 Critical	—	0,83%	16 Sep 2026
CVE-2026-86338 Ash field_policies are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced in a filter, it is replaced wit...	6.0 Medium	—	0,43%	16 Sep 2026
CVE-2026-85501 nlnetlabs unbound Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicio...	7.5 High	—	0,48%	16 Sep 2026
CVE-2026-82720 nlnetlabs unbound NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with '--with-libnghttp2'. During failure...	5.9 Medium	—	0,38%	16 Sep 2026
CVE-2026-82717 nlnetlabs unbound In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation option...	9.8 Critical	—	0,78%	16 Sep 2026
CVE-2026-82311 apache-airflow-providers-fab Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cle...	9.8 Critical	—	0,98%	16 Sep 2026
CVE-2026-81642 nlnetlabs unbound In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution as a...	9.8 Critical	—	0,96%	16 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.