Katalog CVE (hal. 400)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 262.448 (Critical 36.231 · High 104.903 · KEV 1.754 · sejak 2020) · Pembaruan terakhir: 22 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 19.951–20.000 dari 262.448 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-82780 Unrestricted upload of file with dangerous type issue exists in CONPROSYS TM Series. If a specially crafted file is uploaded by a remote authenticated attacker, an arbitr...	8.8 High	—	0,61%	14 Sep 2026
CVE-2026-82779 Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS TM Series. If this vulnerability is exploited, an arb...	8.8 High	—	1,9%	14 Sep 2026
CVE-2026-82778 An exposure of information through directory listing issue exists in CONPROSYS PAC Series. Accessing a specific URL on this product may allow a remote unauthenticated att...	4.3 Medium	—	0,45%	14 Sep 2026
CVE-2026-82777 Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS PAC Series. If this vulnerability is exploited, an ar...	8.8 High	—	1,9%	14 Sep 2026
CVE-2026-82776 Cross-site scripting vulnerability exists in CONPROSYS PAC Series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web brows...	6.1 Medium	—	0,26%	14 Sep 2026
CVE-2026-82775 An exposure of information through directory listing issue exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series. Accessing a specific URL on this pr...	4.3 Medium	—	0,45%	14 Sep 2026
CVE-2026-82774 Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Serie...	8.8 High	—	1,9%	14 Sep 2026
CVE-2026-82773 Cross-site scripting vulnerability exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series. If this vulnerability is exploited, an arbitrary script may...	6.1 Medium	—	0,26%	14 Sep 2026
CVE-2026-82772 Buffer overflow vulnerability exists in Contec EC1000 series. If a remote attacker sends a specially crafted request to the product's web service, an arbitrary program ma...	8.8 High	—	0,66%	14 Sep 2026
CVE-2026-82771 Cross-site scripting vulnerability exists in Contec EC1000 series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web brows...	5.4 Medium	—	0,24%	14 Sep 2026
CVE-2026-82770 Buffer overflow vulnerability exists in Contec RP-WAH-SR Series. If a remote attacker sends a specially crafted request to the product's web service, an arbitrary program...	8.8 High	—	0,66%	14 Sep 2026
CVE-2026-82769 Cross-site scripting vulnerability exists in Contec RP-WAH-SR Series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web br...	5.4 Medium	—	0,24%	14 Sep 2026
CVE-2026-82768 Path traversal vulnerability exists in SGA1000. If this vulnerability is exploited, arbitrary files on the server may be viewed and/or altered by an attacker who can acce...	8.1 High	—	0,49%	14 Sep 2026
CVE-2026-82767 Cross-site scripting vulnerability exists in SGA1000. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser.	5.2 Medium	—	0,24%	14 Sep 2026
CVE-2026-82766 Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in SGA1000. If this vulnerability is exploited, an arbitrary OS co...	8.8 High	—	1,9%	14 Sep 2026
CVE-2026-82765 Path traversal vulnerability exists in Contec FX5000 series, FX4000 series, and FX3000 series. If this vulnerability is exploited, arbitrary files on the server may be vi...	8.1 High	—	0,49%	14 Sep 2026
CVE-2026-82764 Cross-site request forgery vulnerability exists in multiple Contec products. If a user views a specially crafted page while logged in to the affected product, unintended...	5.1 Medium	—	0,19%	14 Sep 2026
CVE-2026-82763 Cross-site scripting vulnerability exists in Contec FX5000 series, FX4000 series, and FX3000 series. If this vulnerability is exploited, an arbitrary script may be execut...	5.4 Medium	—	0,24%	14 Sep 2026
CVE-2026-82762 Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Contec FX5000 series, FX4000 series, and FX3000 series. If this...	8.8 High	—	1,9%	14 Sep 2026
CVE-2026-71198 In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image. Unlike the web-download import path, the...	7.0 High	—	0,45%	14 Sep 2026
CVE-2026-68955 The installer for Rakuten Kobo Desktop Application (Windows version) insecurely loads Dynamic Link Libraries. If there is a crafted DLL at the same directory when invokin...	8.4 High	—	0,18%	14 Sep 2026
CVE-2026-25832 In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group.	3.7 Low	—	0,28%	14 Sep 2026
CVE-2025-26790 Withsecure Atlant with Capricorn engine before 2025-01-20_02 allows a Remote Denial of Service via an out-of-bounds memory read during processing of a document file by th...	3.7 Low	—	0,33%	14 Sep 2026
CVE-2024-23176 An issue was discovered in the MassMessage extension in MediaWiki before 1.40.2. For a Special:MassMessage?uselang=x-xss URL, the i18n key massmessage-form-page-help allo...	5.4 Medium	—	0,21%	14 Sep 2026
CVE-2023-51769 Frappe before 14.49.0 allows an XSS attack that is associated with blog pages and exception pages.	6.1 Medium	—	0,19%	14 Sep 2026
CVE-2023-50462 An issue was discovered in the content_consent (aka Content Consent) extension through 2.0.1 for TYPO3. It fails to verify whether a specified content element identifier...	5.3 Medium	—	0,27%	14 Sep 2026
CVE-2023-50461 An issue was discovered in the direct_mail (aka Direct Mail) extension through 9.5.1 for TYPO3. The Configuration backend module of the extension allows an authenticated...	8.8 High	—	0,33%	14 Sep 2026
CVE-2023-50460 An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. The backend module allows an authenticated backend user to perform various actions (userLog...	5.4 Medium	—	0,24%	14 Sep 2026
CVE-2023-50459 An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. It fails to check access permissions for the edit user component. An authenticated frontend...	5.4 Medium	—	0,42%	14 Sep 2026
CVE-2026-90687 A vulnerability was determined in GPAC up to f1219cde. This vulnerability affects the function gf_node_changed_internal of the file scenegraph/base_scenegraph.c of the co...	6.3 Medium	—	0,51%	14 Sep 2026
CVE-2026-90686 A vulnerability was found in GPAC up to f1219cde. This affects the function gf_bt_report of the file scene_manager/loader_bt.c of the component MP4Box. The manipulation r...	5.3 Medium	—	0,86%	14 Sep 2026
CVE-2026-90685 A vulnerability has been found in GPAC up to f1219cde. Affected by this issue is the function lsr_exec_command_list of the file laser/lsr_dec.c of the component MP4Box. T...	2.8 Low	—	0,16%	14 Sep 2026
CVE-2026-16726 Buffer overflow vulnerability in Panasonic Industry USB Driver for MINAS A5/A6 allows attackers to stop Windows.	6.8 Medium	—	0,11%	14 Sep 2026
CVE-2023-46273 Bonjour Gateway in Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4 before 10.6r5, has an ah_bgd buffer overflow via ah_event_send.	8.8 High	—	0,31%	14 Sep 2026
CVE-2023-46035 The svg_optimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents.	5.9 Medium	—	0,41%	14 Sep 2026
CVE-2023-45858 A directory traversal was identified in Paessler PRTG before 23.4.88.1429 that made it possible to read local files.	8.6 High	—	0,66%	14 Sep 2026
CVE-2023-45023 The femanager extension 7 before 7.2.2 for TYPO3 has Incorrect Access Control: it lacks a check for permissions for the invitation component.	4.2 Medium	—	0,15%	14 Sep 2026
CVE-2023-40772 A directory Traversal vulnerability in DataEase before 1.18.10 allows a remote attacker to obtain sensitive information via a a crafted request to the StaticResourceContr...	4.3 Medium	—	1,1%	14 Sep 2026
CVE-2023-37366 An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor, and Modem Exynos 9810, Exynos 9610, Exynos 9820, Exynos 980, Exynos 850, Exynos 1080, Ex...	2.8 Low	—	0,09%	14 Sep 2026
CVE-2023-37253 An issue was discovered in the ProofreadPage extension for MediaWiki through 1.39.3. It leaks information about a suppressed user via the API and config variables.	3.1 Low	—	0,24%	14 Sep 2026
CVE-2026-90684 A flaw has been found in GPAC up to f1219cde. Affected by this vulnerability is the function gf_node_get_field_count of the file scenegraph/base_scenegraph.c of the compo...	2.8 Low	—	0,16%	14 Sep 2026
CVE-2026-90683 A vulnerability was detected in GPAC up to f1219cde. Affected is the function gf_node_unregister of the file scenegraph/base_scenegraph.c of the component MP4Box. Perform...	3.3 Low	—	0,17%	14 Sep 2026
CVE-2026-90682 A security vulnerability has been detected in Matthias-Wandel jhead up to 3.3. This impacts the function ProcessGpsInfo of the file gpsinfo.c of the component WebP EXIF H...	5.3 Medium	—	0,17%	14 Sep 2026
CVE-2026-90681 A weakness has been identified in Matthias-Wandel jhead up to 3.3. This affects the function Get16u of the file exif.c of the component EXIF Parsing. This manipulation ca...	3.3 Low	—	0,16%	14 Sep 2026
CVE-2023-37252 An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. Special:CheckUserLog shows usernames that have been hidden.	3.1 Low	—	0,24%	14 Sep 2026
CVE-2023-34854 HotelDruid before 3.0.6 has insufficient file upload sanitation in the backup/restore function.	6.6 Medium	—	0,23%	14 Sep 2026
CVE-2023-32803 The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not properly remove certain TrustCor root certificates from the root store....	7.5 High	—	0,18%	14 Sep 2026
CVE-2023-32778 An issue was discovered in ILIAS 6.23, 7 before 7.22, and 8.1. An attacker can execute arbitrary code via ZIP upload.	3.3 Low	—	0,22%	14 Sep 2026
CVE-2023-29377 An issue was discovered in Softing OPC UA C++ SDK through 6.20 and Softing Secure Integration Server through 1.22. By using FileType renames, it is possible to bypass lim...	6.6 Medium	—	0,49%	14 Sep 2026
CVE-2023-28148 A bodyclass XSS issue was discovered in Paessler PRTG before 23.3.86.1520.	7.2 High	—	0,21%	14 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.