Katalog CVE (hal. 410)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 262.594 (Critical 36.242 · High 104.951 · KEV 1.754 · sejak 2020) · Pembaruan terakhir: 23 Okt 2026, 00:26 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 20.451–20.500 dari 262.594 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-44715 OpenMRS is an open source electronic medical record system platform. Prior to versions 1.23.0 and 2.10.0, an authenticated user can trigger administrative DWR services. S...	8.7 High	—	0,41%	11 Sep 2026
CVE-2026-81918 concretecms concrete cms Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block. A user with edit_page_contents permissions could store...	4.8 Medium	—	0,25%	11 Sep 2026
CVE-2026-81907 concretecms concrete cms Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) in the Express "Clear Entries" function (POST /index.php/dashboard/system/express/entities...	7.1 High	—	0,14%	11 Sep 2026
CVE-2026-81917 concretecms concrete cms Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with permission...	5.4 Medium	—	0,24%	11 Sep 2026
CVE-2026-68535 concretecms concrete cms Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate() method on submitted data, which, for file-r...	4.3 Medium	—	0,21%	11 Sep 2026
CVE-2026-54165 Dobase is an open-source, self-hosted workspace with installable tools. Versions prior to 2026.06.03 have a one-click stored DOM-based cross-site scripting (XSS) vulnerab...	6.4 Medium	—	0,55%	11 Sep 2026
CVE-2026-54166 Shelf is a platform for tracking physical assets. Prior to version 1.20.3, authenticated users with the `asset:import` permission can trigger server-side HTTP requests to...	7.1 High	—	0,43%	11 Sep 2026
CVE-2026-54174 melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the contro...	8.3 High	—	0,16%	11 Sep 2026
CVE-2026-48490 ArduinoCore-avr contains the source code and configuration files of the Arduino AVR Boards platform. A vulnerability in versions prior to 1.8.8 allows an attacker to trig...	6.9 Medium	—	0,67%	11 Sep 2026
CVE-2026-49439 OpenRemote is an open-source internet-of-things platform. Prior to version 1.24.1, the predicted datapoint write endpoint allows users with only `read:assets` privileges...	4.3 Medium	—	0,26%	11 Sep 2026
CVE-2026-49464 NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The `nl...	8.1 High	—	0,35%	11 Sep 2026
CVE-2026-49865 Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain a server-side request forgery vulnerability in their invoice PDF preview and generatio...	5.3 Medium	—	0,35%	11 Sep 2026
CVE-2026-50025 Mousehole is a background service to update a seedbox IP for MAM and web app to manage it. Prior to version 0.4.05, Mousehole's HTTP/WebSocket management boundary is reac...	6.9 Medium	—	0,26%	11 Sep 2026
CVE-2026-47773 ArduinoBLE enables Bluetooth Low Energy connectivity on certain Arduino models. Versions prior to 2.0.2 contain a missing bounds check in the ATT layer write request hand...	7.2 High	—	0,15%	11 Sep 2026
CVE-2026-45057 matrix-sdk-ui provides GUI-centric utilities on top of matrix-rust-sdk. The message edit validation logic in the `matrix-sdk-ui` crate prior to 0.17.0 is missing a check...	4.9 Medium	—	0,23%	11 Sep 2026
CVE-2026-89769 In the Linux kernel, the following vulnerability has been resolved: clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path When cpuhp_setup_state fai...	7.4 High	—	0,17%	11 Sep 2026
CVE-2026-89771 In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ring buffer readers trace_buffer subbuf_size is read lockle...	7.8 High	—	0,12%	11 Sep 2026
CVE-2026-89760 In the Linux kernel, the following vulnerability has been resolved: mm, swap: don't free a hibernation slot that is in the swap cache A slot with a folio in the swap ca...	7.8 High	—	0,17%	11 Sep 2026
CVE-2026-89761 In the Linux kernel, the following vulnerability has been resolved: apparmor: fix out-of-bounds write when null terminating a label vec aa_vec_unique() null terminates...	7.8 High	—	0,12%	11 Sep 2026
CVE-2026-89762 In the Linux kernel, the following vulnerability has been resolved: apparmor: fix cred UAF caused by begin_current_label_crit_section() AppArmor's begin_current_label_c...	7.8 High	—	0,12%	11 Sep 2026
CVE-2026-89763 In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix TPM teardown ordering trusted_tpm_exit() drops the TPM chip reference and frees t...	7.8 High	—	0,12%	11 Sep 2026
CVE-2026-89764 In the Linux kernel, the following vulnerability has been resolved: rust: devres: fix race between concurrent revokers There is a potential race condition when two path...	7.8 High	—	0,17%	11 Sep 2026
CVE-2026-89767 In the Linux kernel, the following vulnerability has been resolved: ovl: fix double end_creating() on the casefold-mismatch path ovl_create_real() releases the new dent...	7.8 High	—	0,17%	11 Sep 2026
CVE-2026-89754 In the Linux kernel, the following vulnerability has been resolved: mm/pagewalk: fix stale walk->action escaping walk_pmd_range() If ->pmd_entry() sets walk->action = A...	7.8 High	—	0,14%	11 Sep 2026
CVE-2026-89755 In the Linux kernel, the following vulnerability has been resolved: mm/migrate_device: clear stale mapping after freeing swapcache __migrate_device_pages() reads the fo...	7.8 High	—	0,16%	11 Sep 2026
CVE-2026-89758 In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: skip non-present PMDs when queueing folios Patch series "mm: handle device-private PMD...	7.8 High	—	0,17%	11 Sep 2026
CVE-2026-89744 In the Linux kernel, the following vulnerability has been resolved: device property: fix infinite loop in fwnode_for_each_child_node() When iterate over children of a f...	8.4 High	—	0,14%	11 Sep 2026
CVE-2026-89746 In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free with same-name named triggers When two hist triggers on different events...	7.8 High	—	0,16%	11 Sep 2026
CVE-2026-89747 In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in trace_pipe read on sub-buffer order change Writing to buffer_subbuf_s...	7.8 High	—	0,16%	11 Sep 2026
CVE-2026-89748 In the Linux kernel, the following vulnerability has been resolved: tracing: Fix retry exhaustion in simple ring buffer reader swap simple_ring_buffer_swap_reader_page(...	7.8 High	—	0,17%	11 Sep 2026
CVE-2026-89750 In the Linux kernel, the following vulnerability has been resolved: tracing/user_events: Clear copied tracing state before fork duplication dup_task_struct() copies use...	7.8 High	—	0,16%	11 Sep 2026
CVE-2026-89736 In the Linux kernel, the following vulnerability has been resolved: usb: gadget: u_audio: Fix use-after-free on sound card disconnect g_audio_cleanup() invokes snd_card...	7.8 High	—	0,13%	11 Sep 2026
CVE-2026-89738 In the Linux kernel, the following vulnerability has been resolved: usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed In polled-VBUS mode (board.v...	7.8 High	—	0,17%	11 Sep 2026
CVE-2026-89741 In the Linux kernel, the following vulnerability has been resolved: Revert "media: v4l2-dev: fix error handling in __video_register_device()" This reverts commit 2a934f...	7.8 High	—	0,17%	11 Sep 2026
CVE-2026-89742 In the Linux kernel, the following vulnerability has been resolved: rapidio: mport_cdev: fix use-after-free in dma_req_free() dma_req_free() acquires buf_mutex through...	7.8 High	—	0,16%	11 Sep 2026
CVE-2026-89743 In the Linux kernel, the following vulnerability has been resolved: misc: nsm: bound the device-reported response length nsm_sendrecv_msg_locked() stores the virtqueue...	7.7 High	—	0,14%	11 Sep 2026
CVE-2026-89729 In the Linux kernel, the following vulnerability has been resolved: HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature sensor_hub_get_feature() clamps i...	8.8 High	—	0,36%	11 Sep 2026
CVE-2026-89731 In the Linux kernel, the following vulnerability has been resolved: cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read cxl_rch_get_aer_info() copies th...	7.1 High	—	0,16%	11 Sep 2026
CVE-2026-89733 In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() In uvc_func...	7.8 High	—	0,17%	11 Sep 2026
CVE-2026-89724 In the Linux kernel, the following vulnerability has been resolved: media: vicodec: fix out-of-bounds write in FWHT encoder vidioc_s_fmt_vid_out() sizes the encoder CAP...	7.8 High	—	0,17%	11 Sep 2026
CVE-2026-89725 In the Linux kernel, the following vulnerability has been resolved: media: cec: stm32: prevent out-of-bounds write on RX overflow stm32_rx_done() appends each received...	8.8 High	—	0,26%	11 Sep 2026
CVE-2026-89723 In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation Shuangpeng Bai reported th...	7.8 High	—	0,17%	11 Sep 2026
CVE-2026-89720 In the Linux kernel, the following vulnerability has been resolved: ubifs: fix out-of-bounds read in signature length check ubifs_sb_verify_signature() bounds the on-di...	7.7 High	—	0,19%	11 Sep 2026
CVE-2026-89707 In the Linux kernel, the following vulnerability has been resolved: nfsd: release path refs on follow_down() error nfsd_cross_mnt() initializes a local struct path with...	7.5 High	—	0,61%	11 Sep 2026
CVE-2026-89708 In the Linux kernel, the following vulnerability has been resolved: nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown After a DESTROY_SESSION th...	9.8 Critical	—	0,44%	11 Sep 2026
CVE-2026-89709 In the Linux kernel, the following vulnerability has been resolved: lockd, nfsd: RCU-protect nlmsvc_ops dispatch nlmsvc_ops is published by nfsd_lockd_init() and cleare...	8.1 High	—	0,55%	11 Sep 2026
CVE-2026-89711 In the Linux kernel, the following vulnerability has been resolved: NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check The header for commit e75b23f9e323 ("nfsd: che...	8.2 High	—	0,44%	11 Sep 2026
CVE-2026-89712 In the Linux kernel, the following vulnerability has been resolved: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock nfsd4_ssc_expire_umount() walks nn...	9.8 Critical	—	0,71%	11 Sep 2026
CVE-2026-89713 In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsd_setattr() checks whether a size update needs N...	9.1 Critical	—	0,61%	11 Sep 2026
CVE-2026-89706 In the Linux kernel, the following vulnerability has been resolved: nfsd: Reset write verifier when async COPY writeback fails Async COPY captures nn->writeverf at requ...	7.5 High	—	0,53%	11 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.