Katalog CVE (hal. 371)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 262.314 (Critical 36.225 · High 104.856 · KEV 1.754 · sejak 2020) · Pembaruan terakhir: 22 Okt 2026, 06:31 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 18.501–18.550 dari 262.314 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-71047 oracle identity manager Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0....	8.8 High	—	0,43%	15 Sep 2026
CVE-2026-70915 oracle identity manager Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0....	8.8 High	—	0,43%	15 Sep 2026
CVE-2026-70913 oracle identity manager Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0....	9.8 Critical	—	0,51%	15 Sep 2026
CVE-2026-70757 oracle weblogic server Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1....	9.8 Critical	—	0,51%	15 Sep 2026
CVE-2026-70756 oracle weblogic server Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1....	9.8 Critical	—	0,51%	15 Sep 2026
CVE-2026-70755 Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: File download). Supported versions that are affected are 1...	6.5 Medium	—	0,34%	15 Sep 2026
CVE-2026-70748 oracle weblogic server Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1....	9.8 Critical	—	0,51%	15 Sep 2026
CVE-2026-69218 Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, When Ember receives an HTTP/2 HEADERS or PUSH_PROMISE frame without END_HEADERS, H2Connecti...	7.5 High	—	0,63%	15 Sep 2026
CVE-2026-69217 Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/1.1 parser accepts differing duplicate Content-Length headers and uses the las...	8.7 High	—	0,50%	15 Sep 2026
CVE-2026-69215 Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware uses unanchored substring checks instead of RFC 6265 domain...	6.8 Medium	—	0,51%	15 Sep 2026
CVE-2026-69210 Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, WebSocket FrameTranscoder.bodyLength rejects extended payload lengths above Integer.MAX_VAL...	7.5 High	—	0,63%	15 Sep 2026
CVE-2026-69206 Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, DigestAuth replay protection records lastNc plus one instead of the highest nonce-count val...	5.9 Medium	—	0,40%	15 Sep 2026
CVE-2026-69205 Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HeaderP.parse uses a case-sensitive substring test for the Transfer-Encoding value...	8.7 High	—	0,48%	15 Sep 2026
CVE-2026-69203 Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, An Ember server with HTTP/2 enabled through withHttp2 does not enforce SETTINGS_MAX_CONCURR...	7.5 High	—	0,63%	15 Sep 2026
CVE-2026-69202 Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/2 flow-control window is replenished according to bytes received from the netw...	7.5 High	—	0,63%	15 Sep 2026
CVE-2026-62597 Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Management). Supported versions that are affected are...	6.5 Medium	—	0,30%	15 Sep 2026
CVE-2026-61544 libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.13.1, libp2p-quic could panic during an inbound QUIC handshake when a...	8.2 High	—	0,28%	15 Sep 2026
CVE-2026-51134 The C-MOR Video Surveillance web interface (up to version 6.0104) is vulnerable to Path Traversal via the 'cam' parameter in show-movies.pml.	7.5 High	—	1,7%	15 Sep 2026
CVE-2026-51133 Cross Site Scripting vulnerability in za-internet GmbH C-MOR Video Surveillance <= V6.0104 allows a remote attacker to execute arbitrary code via the size parameter in pt...	6.1 Medium	—	0,91%	15 Sep 2026
CVE-2026-32599 Netmaker makes networks with WireGuard. Prior to version 1.5.0, the `sqliteDeleteRecord` function in Netmaker's database layer constructs SQL `DELETE` statements using di...	5.3 Medium	—	0,36%	15 Sep 2026
CVE-2026-18425 concretecms concrete cms Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action (Concrete\Controller\Backend\Dashboard\SitemapUpdate) using only the global access_sitemap tas...	2.7 Low	—	0,12%	15 Sep 2026
CVE-2026-18424 concretecms concrete cms Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Request Forgery iremote file import via cross-port reuse of a host's validated DNS pin. When multiple remote URLs...	7.1 High	—	0,24%	15 Sep 2026
CVE-2026-18423 concretecms concrete cms Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search preset delete and edit dialogs . An authenticated u...	7.1 High	—	0,25%	15 Sep 2026
CVE-2026-18422 concretecms concrete cms Concrete CMS before 9.5.3 did not enforce a destination-side authorization check and did not validate a CSRF token in the multilingual page assignment backend action (Bac...	6.5 Medium	—	0,44%	15 Sep 2026
CVE-2026-13327 Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept pri...	8.3 High	—	0,13%	15 Sep 2026
CVE-2026-92180 pdfforge PDF Architect activation-service Update Service Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attack...	7.8 High	—	0,19%	15 Sep 2026
CVE-2026-92179 pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a...	7.8 High	—	0,23%	15 Sep 2026
CVE-2026-92178 pdfforge PDF Architect PDF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on aff...	7.8 High	—	0,23%	15 Sep 2026
CVE-2026-92177 pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a...	7.8 High	—	0,23%	15 Sep 2026
CVE-2026-92176 pdfforge PDF Architect App Object Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected...	7.8 High	—	0,23%	15 Sep 2026
CVE-2026-90971 Server-Side Request Forgery (SSRF) in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a low-privileged authenticated user to obtain...	6.5 Medium	—	0,34%	15 Sep 2026
CVE-2026-90969 Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking the view-password permission t...	6.5 Medium	—	0,35%	15 Sep 2026
CVE-2026-84850 Improper certificate validation in the shared HTTP client used by synchronization and integration features in Devolutions Server 2026.2.16 and earlier allows a network-po...	4.8 Medium	—	0,14%	15 Sep 2026
CVE-2026-84048 Joomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file upload via the TUS endpoint in JoomGallery < 4.4.2 - The TUS endpoint allows arbitrary file upl...	6.3 Medium	—	0,50%	15 Sep 2026
CVE-2026-82191 Joomla Extension - j2commerce.com - Unescaped request data reflected into PayPal notify redirect in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - A crafted link to the...	5.3 Medium	—	0,45%	15 Sep 2026
CVE-2026-82190 Joomla Extension - j2commerce.com - Predictable/forgeable order access token in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Anyone who obtains the site's Joomla `sec...	6.3 Medium	—	0,33%	15 Sep 2026
CVE-2026-82189 Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Unauthenticated denial-of-service against...	8.7 High	—	0,43%	15 Sep 2026
CVE-2026-81924 concretecms concrete cms Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in the theme page-template activation feature. The Dashboard theme Inspect controller's activ...	6.5 Medium	—	0,21%	15 Sep 2026
CVE-2026-81923 concretecms concrete cms In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check per-page edit permissions before saving. The saveRecord() action validated the per-page C...	2.7 Low	—	0,30%	15 Sep 2026
CVE-2026-81922 concretecms concrete cms Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. In the sitemap Explore dashboard controller, the send_to_...	2.7 Low	—	0,30%	15 Sep 2026
CVE-2026-81921 concretecms concrete cms Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new access tokens from a valid refresh...	5.4 Medium	—	0,24%	15 Sep 2026
CVE-2026-81920 concretecms concrete cms Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the dashboard SEO Excluded Words page. The reset() controller action cleared the administrator-co...	4.3 Medium	—	0,18%	15 Sep 2026
CVE-2026-81919 concretecms concrete cms Concrete CMS below 9.5.3 did not validate an anti-CSRF token on the block-arrangement backend endpoint (the arrange() action of Concrete\Controller\Backend\Page\ArrangeBl...	4.3 Medium	—	0,15%	15 Sep 2026
CVE-2026-81568 Joomla Extension - j2commerce.com - Arbitrary file read via `task=download` in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - `J2StoreModelOrderdownloads::getFilePath()...	8.7 High	—	0,50%	15 Sep 2026
CVE-2026-81567 Joomla Extension - j2commerce.com - Unauthenticated blind SQL injection in the storefront product list in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Unauthenticated...	8.7 High	—	0,39%	15 Sep 2026
CVE-2026-79411 Incorrect privilege assignment in the admin user-management component of Webkul Bagisto 2.4.9 allows an authenticated backend user holding only the settings.users.edit pe...	8.8 High	—	0,45%	15 Sep 2026
CVE-2026-79410 Improper validation of the quantity parameter in the add-to-cart path of Webkul Bagisto v2.4.9 allows authenticated attackers to reduce their order total below the legiti...	8.1 High	—	0,39%	15 Sep 2026
CVE-2026-79409 An issue in Webkul Bagisto 2.4.9 allows a remote attacker to obtain sensitive information via the add-to-cart API and the downloadable fulfilment components.	6.5 Medium	—	0,46%	15 Sep 2026
CVE-2026-78081 Joomla Extension - j2commerce.com - Missing CSRF protection on cart, checkout and myprofile controllers in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - A forged reque...	7.1 High	—	0,21%	15 Sep 2026
CVE-2026-73467 On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System Plus (TACAC...	6.3 Medium	—	0,13%	15 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.