Katalog CVE (hal. 503)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.273 (Critical 36.346 · High 105.264 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 25 Okt 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 25.101–25.150 dari 263.273 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-85407 A vulnerability was found in Eleveo Quality Management 9.7.0. This issue affects some unknown processing of the file /enc-fwk-data/api/v3/conversations/<ID>/events of the...	4.3 Medium	—	0,47%	4 Sep 2026
CVE-2026-11613 The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.1.2 via the 'custom_loop_template' parameter param...	9.8 Critical	—	0,59%	4 Sep 2026
CVE-2026-85406 A vulnerability has been found in Eleveo Quality Management 9.7.0. This vulnerability affects unknown code of the component Conversation Review. The manipulation leads to...	3.5 Low	—	0,33%	4 Sep 2026
CVE-2026-85405 A flaw has been found in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/roleAddAction.do. Executing a manipulation of the argumen...	3.5 Low	—	0,33%	4 Sep 2026
CVE-2026-85403 A flaw has been found in code-projects Doctor Appointment System 1.0. This issue affects some unknown processing of the file /contactus.php. This manipulation of the argu...	7.3 High	—	0,43%	4 Sep 2026
CVE-2026-85402 A vulnerability was detected in code-projects Doctor Appointment System 1.0. This vulnerability affects unknown code of the file /patient/booking.php. The manipulation of...	7.3 High	—	0,43%	4 Sep 2026
CVE-2026-85401 A weakness has been identified in Dolibarr up to 21.0.4/22.0.5/23.0.3. Affected by this issue is some unknown functionality of the file htdocs/core/filemanagerdol/connect...	6.3 Medium	—	0,43%	4 Sep 2026
CVE-2026-85399 A security flaw has been discovered in code-projects Hospital Information System 1.0. Affected by this vulnerability is the function getSinglePresp of the file includes/p...	7.3 High	—	0,43%	4 Sep 2026
CVE-2026-85398 A vulnerability was identified in code-projects Hospital Information System 1.0. Affected is the function viewReq of the file viewReq.php. Such manipulation of the argume...	7.3 High	—	0,43%	4 Sep 2026
CVE-2026-85149 SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SFTP service credentials...	5.3 Medium	—	0,41%	4 Sep 2026
CVE-2026-85148 SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed password to remotel...	9.8 Critical	—	0,63%	4 Sep 2026
CVE-2026-85147 SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain a specific password from the...	7.5 High	—	0,33%	4 Sep 2026
CVE-2026-85146 SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SSH service account cred...	9.8 Critical	—	0,63%	4 Sep 2026
CVE-2026-75754 Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), and Use of Hard-coded Credentials in ASUS Control Center allow an unauthorized user to o...	10.0 Critical	—	0,34%	4 Sep 2026
CVE-2026-85397 A vulnerability was determined in code-projects Hospital Information System 1.0. This impacts the function findBySearch of the file addReq.php. This manipulation of the a...	7.3 High	—	0,43%	4 Sep 2026
CVE-2026-85383 A flaw has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/inv_del.php. Executing a manipulation...	6.3 Medium	—	0,33%	4 Sep 2026
CVE-2026-85382 A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Impacted is the function htmlspecialchars...	4.3 Medium	—	0,47%	4 Sep 2026
CVE-2026-45200 Software installed and run as a non-privileged user may conduct improper GPU driver IOCTL calls to create an allocation scenario that when freed would cause double free a...	7.8 High	—	0,16%	4 Sep 2026
CVE-2026-45197 Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a read and/or write data outside the Guest's virtualised...	2.5 Low	—	0,09%	4 Sep 2026
CVE-2026-85381 A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This issue affects some unk...	5.3 Medium	—	0,57%	4 Sep 2026
CVE-2026-85380 A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This vulnerability affects the function...	7.3 High	—	0,50%	4 Sep 2026
CVE-2026-85379 A security flaw has been discovered in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This affects the function ChapterM...	7.3 High	—	0,43%	4 Sep 2026
CVE-2026-67402 An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated a...	9.2 Critical	—	0,54%	4 Sep 2026
CVE-2026-67398 Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.7, from 9.0.0 before 9.0.8, all other EOL versions f...	8.2 High	—	0,48%	4 Sep 2026
CVE-2026-67397 Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root.	8.5 High	—	0,17%	4 Sep 2026
CVE-2026-49509 Out-of-bounds read vulnerability in Samsung Opensource rLottie allows Overread Buffers. This issue affects rLottie: 25648aef19187b3f87f4d9420b8d761453ad4630.	4.4 Medium	—	0,15%	4 Sep 2026
CVE-2026-85456 mit moos-ivp MOOS-IvP through 24.8.1 fails to properly validate variable names extracted from alog files in the SplitHandler, allowing attackers to write files outside the split direc...	5.5 Medium	—	0,23%	3 Sep 2026
CVE-2026-85455 themoos core-moos MOOS core-moos through 10.4.0 contains a buffer over-read vulnerability in CMOOSCommPkt where a four-byte packet triggers out-of-bounds memory access during deserializati...	8.2 High	—	0,67%	3 Sep 2026
CVE-2026-85454 themoos core-moos MOOS core-moos through 10.4.0 contains a buffer overflow vulnerability in CMOOSSerialPort::GetTelegram() that writes a NUL terminator one byte past the serial telegram st...	6.1 Medium	—	0,32%	3 Sep 2026
CVE-2026-85453 themoos core-moos MOOS core-moos through 10.4.0 fails to escape database contents when rendering MOOSDB HTTP pages, allowing attackers to inject malicious scripts. Any MOOS publisher can s...	6.1 Medium	—	0,34%	3 Sep 2026
CVE-2026-85452 MOOS ui-moos through 50b9c6c contains a buffer overflow vulnerability in ScopeTabPane.cpp and ScopeGrid.cpp where client and variable names are formatted into fixed 1024-...	8.8 High	—	0,69%	3 Sep 2026
CVE-2026-85451 themoos core-moos MOOS core-moos through 10.4.0 contains a remote process termination vulnerability in the SuicidalSleeper component that uses a hard-coded passphrase for multicast command...	7.1 High	—	0,36%	3 Sep 2026
CVE-2026-85450 themoos core-moos MOOS core-moos through 10.4.0 contains a denial of service vulnerability in the MOOSDB HTTP server that creates unbounded connections and threads without limits. Attacker...	7.5 High	—	0,63%	3 Sep 2026
CVE-2026-85449 mit moos-ivp MOOS-IvP pMarineViewer through 24.8.1 fails to limit the number of tracked node identities from NODE_REPORT messages, allowing attackers to exhaust memory by supplying un...	7.5 High	—	0,92%	3 Sep 2026
CVE-2026-85448 mit moos-ivp MOOS-IvP uFldShoreBroker through 24.8.1 fails to limit the number of claimed communities stored in parallel vectors within ShoreBroker::handleMailNodePing(). A single pub...	7.5 High	—	0,78%	3 Sep 2026
CVE-2026-85447 mit moos-ivp MOOS-IvP pRealm through version 24.8.1 accepts unbounded REALMCAST_REQ subscriptions without validating duration or variable list limits. Attackers can register long-live...	7.5 High	—	0,78%	3 Sep 2026
CVE-2026-85446 mit moos-ivp MOOS-IvP versions through 24.8.1 contain a quadratic processing vulnerability in uFldNodeComms where each new node identity creates a ledger entry and triggers all-pairs...	7.5 High	—	0,78%	3 Sep 2026
CVE-2026-85445 mit moos-ivp MOOS-IvP through 24.8.1 contains a denial of service vulnerability in the Demuxer::addMuxPacket() function that trusts the packet count declared in mux headers without va...	7.5 High	—	0,78%	3 Sep 2026
CVE-2026-85444 mit moos-ivp MOOS-IvP through 24.8.1 contains a buffer over-read vulnerability in isQuoted(), isBraced(), and isChevroned() functions that strip whitespace but index using the origina...	7.5 High	—	0,78%	3 Sep 2026
CVE-2026-85443 themoos core-moos MOOS core-moos through 10.4.0 contains a denial of service vulnerability in MOOSCommServer::ListenLoop() where the accept thread performs a blocking receive without timeo...	7.5 High	—	0,63%	3 Sep 2026
CVE-2026-85442 themoos core-moos MOOS core-moos through 10.4.0 fails to validate packet length declarations in CMOOSCommPkt::OnBytesWritten(), allowing unauthenticated attackers to trigger unbounded buff...	7.5 High	—	0,76%	3 Sep 2026
CVE-2026-85441 themoos core-moos MOOS core-moos through 10.4.0 fails to validate that serialized string lengths are non-negative in CMOOSMsg::operator>>. Unauthenticated attackers can send a crafted mess...	7.5 High	—	0,66%	3 Sep 2026
CVE-2026-85440 themoos core-moos MOOS core-moos through 10.4.0 contains a pre-authentication heap overflow vulnerability in MOOSCommPkt packet handling that allows remote attackers to write arbitrary dat...	9.8 Critical	—	1,0%	3 Sep 2026
CVE-2026-85439 mit moos-ivp MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::handlePreCheckSplitDir() function that fails to sanitize shell metacha...	7.8 High	—	0,47%	3 Sep 2026
CVE-2026-85438 mit moos-ivp MOOS-IvP through 24.8.1 contains a buffer overflow vulnerability in StringToIvPFunction() where dimension, piece, and degree counts from encoded BHV_IPF payloads are used...	9.8 Critical	—	1,1%	3 Sep 2026
CVE-2026-85437 mit moos-ivp MOOS-IvP through 24.8.1 contains multiple buffer overflow vulnerabilities in IvP function string decoders that trust attacker-controlled length fields without validation....	9.8 Critical	—	1,4%	3 Sep 2026
CVE-2026-85436 themoos essential-moos MOOS essential-moos through 10.0.1 contains a buffer overflow vulnerability in CMOOSUDPLink::ReadPktFromArray() that allows remote attackers to corrupt heap memory by sen...	7.5 High	—	2,1%	3 Sep 2026
CVE-2026-85435 mit moos-ivp MOOS-IvP uFldNodeBroker through 24.8.1 fails to validate the source of TRY_SHORE_HOST messages on the vehicle bus, allowing any publisher to enroll attacker-controlled sh...	9.1 Critical	—	0,41%	3 Sep 2026
CVE-2026-85434 mit moos-ivp MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity before creating outbound bridge routes. Attackers can publish NODE_BROKER_PING messages wit...	9.1 Critical	—	0,41%	3 Sep 2026
CVE-2026-85433 themoos essential-moos MOOS essential-moos pShare through 10.0.1 fails to properly authorize PSHARE_CMD messages, allowing any publisher to reconfigure network routes and listeners at runtime....	9.8 Critical	—	0,77%	3 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.