Katalog CVE (hal. 395)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 262.448 (Critical 36.231 · High 104.903 · KEV 1.754 · sejak 2020) · Pembaruan terakhir: 22 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 19.701–19.750 dari 262.448 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-54177 backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. F...	6.6 Medium	—	0,93%	14 Sep 2026
CVE-2026-54176 backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. F...	6.5 Medium	—	0,65%	14 Sep 2026
CVE-2026-54175 backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. P...	7.6 High	—	0,55%	14 Sep 2026
CVE-2026-54150 next-video is a library for adding video to Next.js applications. Prior to 2.8.1, the GET endpoint exported by next-video/request-handler and commonly mounted at /api/vid...	6.9 Medium	—	0,42%	14 Sep 2026
CVE-2026-54087 EasyAdmin is a fast and modern admin generator for Symfony applications. From 5.0.0 until 5.0.13, FileField and ImageField can accept browser-executable uploads while tem...	7.6 High	—	0,40%	14 Sep 2026
CVE-2026-53752 docx4j is an open source Java library for creating, editing, and saving OpenXML packages, including DOCX, PPTX, and XLSX files. Prior to 11.5.14, PropertyResolver and adj...	7.5 High	—	0,63%	14 Sep 2026
CVE-2026-53659 http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.49.0.0, ServerFilters.GZip, RequestFilters.GunZip, and the underlying Gzip...	7.5 High	—	0,63%	14 Sep 2026
CVE-2026-53495 containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drai...	6.8 Medium	—	0,16%	14 Sep 2026
CVE-2026-50276 dd-trace-rb is Datadog's client library for Ruby. Prior to 2.32.0, W3C baggage extraction does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS, which defaults to 64, or DD_TRACE_B...	7.5 High	—	0,79%	14 Sep 2026
CVE-2026-50270 dd-trace-java is a Datadog APM client for Java. Prior to 1.62.0, W3C baggage extraction does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS, which defaults to 64, or DD_TRACE_BAG...	7.5 High	—	0,79%	14 Sep 2026
CVE-2026-50157 Auth0 Symfony is a Symfony SDK for Auth0 Authentication and Management APIs. From 5.0.0-BETA0 until 5.9.0, the Authorizer::authenticate() and Authorizer::supports() paths...	6.5 Medium	—	0,51%	14 Sep 2026
CVE-2026-49400 October System provides the system module for October Content Management System. Prior to versions 3.7.17 and 4.2.21, the backend `SessionMaker` trait stored widget sessi...	3.3 Low	—	0,24%	14 Sep 2026
CVE-2026-49250 Conform, a type-safe form validation library, allows the parsing of nested objects in the form of object.property. From 1.8.0 until 1.19.4, the parseSubmission future API...	8.7 High	—	0,51%	14 Sep 2026
CVE-2026-47256 OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as...	5.3 Medium	—	0,44%	14 Sep 2026
CVE-2026-46696 October System provides the system module for October Content Management System. Versions prior to 3.7.17 and 4.2.21 have a vulnerability in the Twig sandbox security pol...	3.3 Low	—	0,27%	14 Sep 2026
CVE-2026-44162 fluent-plugin-s3 is an Amazon S3 input and output plugin for Fluentd. From 0.7.0 to 1.8.4, the in_s3 input plugin reads the entire decompressed payload of gzip, lzma2, an...	2.7 Low	—	0,48%	14 Sep 2026
CVE-2026-34151 XWiki Platform is a generic wiki platform. Prior to 17.10.5 and 18.2.0, the /skin/ action in com.xpn.xwiki.web.SkinAction can resolve double-encoded parent-directory segm...	8.2 High	—	1,1%	14 Sep 2026
CVE-2026-19542 Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which m...	5.6 Medium	—	0,23%	14 Sep 2026
CVE-2026-19499 Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified...	7.7 High	—	0,30%	14 Sep 2026
CVE-2026-90804 gnu binutils A vulnerability was detected in GNU Binutils 2.47. Affected by this issue is the function _bfd_elf_write_section_eh_frame of the file bfd/elf-eh-frame.c of the component...	6.1 Medium	—	0,20%	14 Sep 2026
CVE-2026-90803 gnu binutils A security vulnerability has been detected in GNU Binutils 2.47. Affected by this vulnerability is the function elf_x86_64_relocate_section of the file bfd/elf64-x86-64.c...	6.8 Medium	—	0,20%	14 Sep 2026
CVE-2026-90802 gnu binutils A weakness has been identified in GNU Binutils 2.47. Affected is the function bfd_putl64 of the file bfd/libbfd.c of the component ld. This manipulation causes null point...	4.4 Medium	—	0,18%	14 Sep 2026
CVE-2026-90801 gnu binutils A security flaw has been discovered in GNU Binutils 2.47. This impacts the function cache_bwrite of the file bfd/cache.c of the component ld. The manipulation of the argu...	6.6 Medium	—	0,21%	14 Sep 2026
CVE-2026-90796 A vulnerability was identified in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/company/index.php. The manipulation of th...	6.3 Medium	—	0,33%	14 Sep 2026
CVE-2026-84445 gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept...	8.7 High	—	0,64%	14 Sep 2026
CVE-2026-76461 Advisory cisco asyncos A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary command...	9.8 Critical	KEV	29,5%	14 Sep 2026
CVE-2026-76443 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team ha...	9.8 Critical	—	0,53%	14 Sep 2026
CVE-2026-76442 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team ha...	7.5 High	—	0,47%	14 Sep 2026
CVE-2026-76441 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team ha...	9.8 Critical	—	0,53%	14 Sep 2026
CVE-2026-76440 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team ha...	9.8 Critical	—	0,62%	14 Sep 2026
CVE-2026-61701 Laravel MagicLink creates links for authentication without a password or for accessing private content. From 2.0.0 until 2.25.1, MagicLink stores serialized action object...	8.8 High	—	0,76%	14 Sep 2026
CVE-2026-59960 Argos JavaScript provides official Argos SDKs for JavaScript. Prior to Argos core package version 6.2.1, attacker-controlled CI branch or ref values from GITHUB_HEAD_REF...	7.5 High	—	0,64%	14 Sep 2026
CVE-2026-57579 Alchemy is an open source content management system engine written in Ruby on Rails. Prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6, the unauthenticated GET /api/pages/nested...	7.5 High	—	0,65%	14 Sep 2026
CVE-2026-57497 webtransport-go is an implementation of the WebTransport protocol. Prior to 0.11.1, Session.parseNextCapsule() in session.go skips an unknown WebTransport capsule on the...	5.3 Medium	—	0,52%	14 Sep 2026
CVE-2026-55837 dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.20.0, the local OAuth helper in src/dbt_mcp/oauth/fastapi_app.py exposes GET /dbt_platform...	6.8 Medium	—	0,27%	14 Sep 2026
CVE-2026-55451 gettext-converter provides gettext resource conversion utilities for JavaScript. Prior to 1.3.3, js2i18next() in lib/js2i18next.js splits nested translation keys using op...	8.3 High	—	0,57%	14 Sep 2026
CVE-2026-55416 Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, an authenticated user with reports_config permission can place a...	8.8 High	—	0,65%	14 Sep 2026
CVE-2026-55102 hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, every API method in src/Vault.js passes failed requests through parseAxio...	5.8 Medium	—	0,16%	14 Sep 2026
CVE-2026-55073 WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive url_fetcher and pass attacker-influenced val...	6.2 Medium	—	0,22%	14 Sep 2026
CVE-2026-55072 Pimcore is an Open Source Data & Experience Management Platform. Prior to 2026.1.5, an authenticated user with the objects permission can submit a malicious ClassDefiniti...	8.5 High	—	0,41%	14 Sep 2026
CVE-2026-54452 safeurl is a server-side request forgery protection library. Prior to 0.2.4, the privateNetworks list in ip.go omits the IPv6 ranges 64:ff9b:1::/48, 5f00::/16, 3fff::/20,...	6.3 Medium	—	0,52%	14 Sep 2026
CVE-2026-54156 node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the process-global g_alreadyUsedNonce cache used by nonceAlreadyBeenUsed in packages/...	7.5 High	—	0,78%	14 Sep 2026
CVE-2026-54155 node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the UserNameIdentityToken authentication handler in packages/node-opcua-server/source...	7.7 High	—	0,42%	14 Sep 2026
CVE-2026-53496 ExifReader is a JavaScript Exif information parser. Prior to 4.40.1, ExifReader.load() and the asynchronous file and URL loaders can pass attacker-supplied HEIC or AVIF d...	5.3 Medium	—	0,51%	14 Sep 2026
CVE-2026-20353 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team ha...	9.8 Critical	—	0,40%	14 Sep 2026
CVE-2026-15923 The Zephyr SDIO subsystem function sdio_io_rw_extended_helper() in subsys/sd/sdio.c finishes transfers with a byte-I/O loop that uses size = MIN(remaining, func->cis.max_...	4.6 Medium	—	0,17%	14 Sep 2026
CVE-2026-90996 fedoraproject sssd, redhat openshift container platform +1 lainnya A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services (NSS) responder. This...	5.5 Medium	—	0,13%	14 Sep 2026
CVE-2026-90995 fedoraproject sssd, redhat openshift container platform +1 lainnya A flaw was found in SSSD (System Security Services Daemon). A local attacker with privileges to connect to the PAM (Pluggable Authentication Modules) responder socket can...	5.5 Medium	—	0,14%	14 Sep 2026
CVE-2026-90994 A flaw was found in sssd, specifically within the PAM (Pluggable Authentication Modules) responder's protocol v1 parser, pam_parse_in_data(). A local client with access t...	4.0 Medium	—	0,17%	14 Sep 2026
CVE-2026-90947 A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light sources. Th...	7.8 High	—	0,13%	14 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.