Katalog CVE (hal. 391)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 262.397 (Critical 36.228 · High 104.890 · KEV 1.754 · sejak 2020) · Pembaruan terakhir: 22 Okt 2026, 12:26 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 19.501–19.550 dari 262.397 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-43689 apple ipados, apple iphone os +2 lainnya A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27....	7.8 High	—	0,15%	14 Sep 2026
CVE-2026-43688 apple ipados, apple iphone os +1 lainnya A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. Processing a maliciously crafte...	7.8 High	—	0,16%	14 Sep 2026
CVE-2026-43687 apple ipados, apple iphone os +4 lainnya The issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, tvOS...	6.5 Medium	—	0,44%	14 Sep 2026
CVE-2026-43686 apple ipados, apple iphone os +4 lainnya A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS S...	8.8 High	—	0,50%	14 Sep 2026
CVE-2026-43684 apple ipados, apple iphone os +1 lainnya A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, macOS Golden Gate 27, macOS Sequoia 15.8. An app ma...	7.8 High	—	0,17%	14 Sep 2026
CVE-2026-43683 apple macos An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able t...	7.1 High	—	0,16%	14 Sep 2026
CVE-2026-43677 apple macos An out-of-bounds write issue was addressed by removing the vulnerable code. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Connecting...	6.5 Medium	—	0,40%	14 Sep 2026
CVE-2026-43674 apple ipados, apple iphone os An authentication issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27. An attacker with physical access to an unlocked device...	4.6 Medium	—	0,22%	14 Sep 2026
CVE-2026-43664 apple ipados, apple iphone os +3 lainnya This issue was addressed with improved data protection. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, m...	5.5 Medium	—	0,16%	14 Sep 2026
CVE-2026-28968 apple ipados, apple iphone os +4 lainnya An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, mac...	5.5 Medium	—	0,16%	14 Sep 2026
CVE-2026-28966 apple ipados, apple iphone os +3 lainnya An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, mac...	4.3 Medium	—	0,42%	14 Sep 2026
CVE-2026-28960 apple ipados, apple iphone os A denial-of-service issue was addressed with improved validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10. A remote attacker may be able to cause a denial-o...	7.5 High	—	0,51%	14 Sep 2026
CVE-2026-28938 apple ipados, apple iphone os A privacy issue was addressed by moving sensitive data. This issue is fixed in iOS 26.6 and iPadOS 26.6. An app may be able to fingerprint the user.	7.5 High	—	0,37%	14 Sep 2026
CVE-2026-28937 apple macos This issue was addressed through improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to access sensitive user data.	5.5 Medium	—	0,16%	14 Sep 2026
CVE-2026-28935 apple ipados, apple iphone os +4 lainnya The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27,...	7.5 High	—	0,49%	14 Sep 2026
CVE-2026-28934 apple macos A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Mounting a malicious dis...	6.5 Medium	—	0,44%	14 Sep 2026
CVE-2026-28933 apple macos A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be ab...	5.5 Medium	—	0,16%	14 Sep 2026
CVE-2026-28899 apple macos A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.6, macOS Tahoe 26.7. An app may bypass G...	5.5 Medium	—	0,16%	14 Sep 2026
CVE-2026-28836 apple macos A correctness issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.8.8. An attacker with physical access may be able to silently persist an Ap...	6.1 Medium	—	0,20%	14 Sep 2026
CVE-2026-20683 apple ipados, apple iphone os +2 lainnya An authentication issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 2...	7.1 High	—	0,19%	14 Sep 2026
CVE-2026-19290 IBM Sterling File Gateway 6.2.0.0 through 6.2.0.6_1, 6.2.1.0 - 6.2.1.2, 6.2.2.0 - 6.2.2.1 could allow a remote attacker to obtain sensitive information due to improper ac...	7.5 High	—	0,40%	14 Sep 2026
CVE-2026-19280 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a denial of service as a result of a buffer overflow in a PASE process. An authenticated attacker could leverage this to terminat...	5.2 Medium	—	0,12%	14 Sep 2026
CVE-2026-19273 IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6_2, 6.2.1.0 - 6.2.1.2, 6.2.2.0 - 6.2.2.1 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.6_2, 6.2.1.0 - 6.2.1.2, 6....	5.4 Medium	—	0,30%	14 Sep 2026
CVE-2026-19086 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a denial of service as a result of a buffer overflow in a PASE process. An authenticated attacker could leverage this to terminat...	3.3 Low	—	0,12%	14 Sep 2026
CVE-2026-18069 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to obtain ownership of arbitrary file system objects due to a time-of-check to time-of-use (TOCTOU) race conditi...	6.0 Medium	—	0,13%	14 Sep 2026
CVE-2026-14277 IBM i Access Family 1.1.2.0 through 1.1.9.15 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper val...	6.3 Medium	—	0,50%	14 Sep 2026
CVE-2026-14276 IBM i Access Family 1.1.2.0 through 1.1.9.15 IBM i Access Client Solutions could allow an authenticated user to execute arbitrary commands with normal user privileges on...	6.3 Medium	—	0,27%	14 Sep 2026
CVE-2026-14275 IBM i Access Family 1.1.2.0 through 1.1.9.15 IBM i Access Client Solutions could allow an authenticated user to execute arbitrary commands with normal user privileges on...	6.3 Medium	—	0,27%	14 Sep 2026
CVE-2026-13293 IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through...	8.8 High	—	0,65%	14 Sep 2026
CVE-2026-13287 IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through...	7.1 High	—	0,39%	14 Sep 2026
CVE-2026-13285 IBM MQ is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive inf...	7.1 High	—	0,39%	14 Sep 2026
CVE-2026-13277 IBM Verify Identity Access could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted W...	4.7 Medium	—	0,28%	14 Sep 2026
CVE-2026-13276 IBM Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001 and IBM Security Verify Access 10.0.0 through 10.0.9.2 Interim Fix 001 and IBM Verify Identity Access Con...	6.1 Medium	—	0,24%	14 Sep 2026
CVE-2026-13275 IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through...	7.1 High	—	0,25%	14 Sep 2026
CVE-2026-13272 IBM Verify Identity Access is missing origin validation which could allow a remote attacker to perform operations as the victim and potentially launch further attacks aga...	5.4 Medium	—	0,15%	14 Sep 2026
CVE-2026-13260 IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources.	7.5 High	—	0,43%	14 Sep 2026
CVE-2026-13107 IBM Business Automation Workflow containers and traditional may use programming model artifacts that are vulnerable to XML Entity Injection attacks by default.	7.1 High	—	0,28%	14 Sep 2026
CVE-2026-12767 IBM Langflow OSS 1.0.0 through 1.11.5 is vulnerable to server-side request forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from t...	6.5 Medium	—	0,22%	14 Sep 2026
CVE-2026-12766 IBM Langflow OSS 1.0.0 through 1.11.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the...	5.4 Medium	—	0,18%	14 Sep 2026
CVE-2026-12765 IBM Langflow OSS 1.0.0 through 1.10.2 is vulnerable to server-side request forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from t...	6.5 Medium	—	0,23%	14 Sep 2026
CVE-2026-12763 IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to access another user's MCP server context due to improper cache key isolation in the MCP Too...	4.2 Medium	—	0,15%	14 Sep 2026
CVE-2026-90816 A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a mani...	4.3 Medium	—	0,58%	14 Sep 2026
CVE-2026-90815 A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of...	6.3 Medium	—	0,42%	14 Sep 2026
CVE-2026-90814 A flaw has been found in cosmicstack-labs mercury-agent up to 1.1.13. Affected by this vulnerability is the function githubRequest of the file src/utils/github.ts of the...	6.3 Medium	—	0,37%	14 Sep 2026
CVE-2026-90813 A vulnerability was detected in cosmicstack-labs mercury-agent up to 1.1.13. Affected is the function checkShellCommand of the file src/capabilities/permissions.ts of the...	4.3 Medium	—	0,55%	14 Sep 2026
CVE-2026-82028 Magistrala before 1.0.0 contains a SQL injection vulnerability in the timescale-reader and postgres-reader HTTP API services that allows authenticated attackers to inject...	8.8 High	—	0,60%	14 Sep 2026
CVE-2026-73497 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). From 0.17.0 until 0.22.0, validate_url_for_ssrf resolves the attacker...	6.5 Medium	—	0,38%	14 Sep 2026
CVE-2026-73496 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the confluence_upload_attachment and confluence_uplo...	7.7 High	—	0,48%	14 Sep 2026
CVE-2026-65838 Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.g...	8.2 High	—	0,46%	14 Sep 2026
CVE-2026-55244 ASTEVAL is an evaluator of Python expressions and statements. Prior to 1.0.9, FROM_PY in asteval/astutils.py exposes BaseException, SystemExit, KeyboardInterrupt, and Gen...	5.0 Medium	—	0,18%	14 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.