Katalog CVE (hal. 504)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.273 (Critical 36.346 · High 105.264 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 25 Okt 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 25.151–25.200 dari 263.273 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-85432 themoos core-moos MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowing authenticated attackers to attribute writes to other clients by sup...	8.2 High	—	0,51%	3 Sep 2026
CVE-2026-85431 themoos essential-moos MOOS essential-moos through version 10.0.1 contains an unauthenticated UDP packet injection vulnerability in pMOOSBridge when configured with UDPListen. Attackers can sen...	7.5 High	—	3,4%	3 Sep 2026
CVE-2026-85430 themoos essential-moos MOOS essential-moos through 10.0.1 contains an authentication bypass vulnerability in pShare that accepts UDP datagrams from any source and republishes them with the atta...	9.1 Critical	—	1,7%	3 Sep 2026
CVE-2026-85429 mit moos-ivp MOOS-IvP uFldNodeComms through 24.8.1 trusts the source node identity from the message body rather than validating it from the connection source. Attackers can craft NODE...	7.5 High	—	0,35%	3 Sep 2026
CVE-2026-85428 themoos core-moos MOOS core-moos through 10.4.0 contains an authentication bypass vulnerability in the optional MOOSDB HTTP server that allows unauthenticated clients to write variables. A...	9.8 Critical	—	0,81%	3 Sep 2026
CVE-2026-85427 themoos essential-moos MOOS essential-moos pAntler through 10.0.1 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary programs by publishin...	9.8 Critical	—	0,55%	3 Sep 2026
CVE-2026-85426 MOOS-IvP uMemWatch through 24.8.1 constructs shell commands from attacker-chosen MOOS client names without sanitization. Attackers can inject shell metacharacters into cl...	9.8 Critical	—	0,92%	3 Sep 2026
CVE-2026-85425 mit moos-ivp MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAY_MOOS variable handler that passes unsanitized text to a shell command. Attackers ca...	9.8 Critical	—	1,8%	3 Sep 2026
CVE-2026-85424 themoos core-moos MOOS core-moos through 10.4.0 lacks authentication in the wire protocol, allowing unauthenticated clients to connect with full publish, subscribe, and database clear priv...	9.8 Critical	—	0,81%	3 Sep 2026
CVE-2026-85378 A vulnerability was identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is the function...	7.3 High	—	0,52%	3 Sep 2026
CVE-2026-85241 A weakness has been identified in SpecterOps BloodHound up to 9.5.1. The affected element is the function NewV2API of the file cmd/api/src/api/registration/v2.go of the c...	6.3 Medium	—	0,37%	3 Sep 2026
CVE-2026-85225 A vulnerability was identified in code-projects Doctor Appointment System 1.0. This vulnerability affects unknown code of the file /patient_login.php. The manipulation of...	7.3 High	—	0,43%	3 Sep 2026
CVE-2026-83711 microsoft azure active directory b2c Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network.	10.0 Critical	—	0,80%	3 Sep 2026
CVE-2026-80098 microsoft copilot studio Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker to elevate privileges over a network.	10.0 Critical	—	0,49%	3 Sep 2026
CVE-2026-70352 microsoft azure ai language authoring Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network.	10.0 Critical	—	0,90%	3 Sep 2026
CVE-2026-70178 microsoft fabric Missing authorization in Microsoft Fabric allows an authorized attacker to elevate privileges over a network.	8.8 High	—	0,63%	3 Sep 2026
CVE-2026-69857 microsoft azure cosmos db Authorization bypass through user-controlled key in Azure Cosmos DB allows an authorized attacker to perform spoofing over a network.	8.8 High	—	0,63%	3 Sep 2026
CVE-2026-65818 microsoft power platform Server-side request forgery (ssrf) in Power Automate allows an authorized attacker to elevate privileges over a network.	9.9 Critical	—	0,63%	3 Sep 2026
CVE-2026-62916 microsoft entra id Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.	9.8 Critical	—	0,87%	3 Sep 2026
CVE-2026-62906 microsoft discovery studio Improper neutralization of special elements in data query logic in Microsoft Discovery Studio allows an unauthorized attacker to disclose information over a network.	7.4 High	—	0,92%	3 Sep 2026
CVE-2026-18330 A hard-coded cryptographic key vulnerability exists in the web module of TP-Link Archer AX55 v4. A LAN attacker who captures an HTTP login session may use the known share...	6.1 Medium	—	0,24%	3 Sep 2026
CVE-2026-18167 A stack-based buffer overflow vulnerability exists in the EasyMesh module of TP-Link Archer AX55 v4. When Mesh mode is enabled, a LAN attacker may submit crafted input th...	7.7 High	—	0,26%	3 Sep 2026
CVE-2026-85224 A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01. This affects an unknown part of the file /cgi/file_sharing.cgi of the component File Sharing. Execut...	9.1 Critical	—	3,6%	3 Sep 2026
CVE-2026-85223 A vulnerability was found in D-Link DNS-340L 1.01B04. Affected by this issue is some unknown functionality of the file /cgi-bin/dropbox.cgi of the component CGI Handler....	9.9 Critical	—	3,3%	3 Sep 2026
CVE-2026-64200 ni dasylab There is an out-of-bounds read vulnerability in DASYLab due to improper validation of user-supplied data. This results in a read a past the end of an allocated heap buf...	7.3 High	—	0,16%	3 Sep 2026
CVE-2026-64199 ni dasylab There is an out-of-bounds read vulnerability in DASYLab due to improper validation of user-supplied data. This results in a read outside the bounds of an allocated data...	7.3 High	—	0,16%	3 Sep 2026
CVE-2026-64198 ni dasylab There is an out-of-bounds read vulnerability in DASYLab due to improper validation of user-supplied data. This results in a read a few bytes past the end of an allocate...	7.3 High	—	0,16%	3 Sep 2026
CVE-2026-64197 ni dasylab There is an out-of-bounds write vulnerability in DASYLab due to improper validation of user-supplied data, resulting in a write past the end of an allocated data structur...	7.3 High	—	0,16%	3 Sep 2026
CVE-2026-64196 ni dasylab There is an out-of-bounds write vulnerability in DASYLab due to improper validation of user-supplied data, resulting in a write past the end of an allocated heap. Success...	7.3 High	—	0,16%	3 Sep 2026
CVE-2026-64195 ni dasylab There is an out-of-bounds write vulnerability in DASYLab due to lack of proper validation of user-supplied data. Successful exploitation requires an attacker to get a use...	7.3 High	—	0,16%	3 Sep 2026
CVE-2026-9745 ibm netezza performance server IBM Netezza Software 11.3.0.3 through Interim Fix 002 has operations that are performed without validating bucket ownership using the ExpectedBucketOwner parameter. This...	6.5 Medium	—	0,32%	3 Sep 2026
CVE-2026-9744 ibm netezza performance server IBM Netezza Software 11.3.0.3 through Interim Fix 002 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensit...	5.9 Medium	—	0,18%	3 Sep 2026
CVE-2026-9736 ibm netezza performance server IBM Netezza Software 11.3.0.3 through Interim Fix 002 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements...	4.3 Medium	—	0,29%	3 Sep 2026
CVE-2026-9036 ibm netezza performance server IBM Netezza Software 11.3.0.3 through Interim Fix 002 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensit...	5.9 Medium	—	0,20%	3 Sep 2026
CVE-2026-8862 ibm netezza performance server IBM Netezza Software 11.3.0.3 through Interim Fix 002 has credentials that are hardcoded in the application source code, allowing unauthorized access to the container reg...	7.5 High	—	0,39%	3 Sep 2026
CVE-2026-85458 Divide-by-zero in Xpdf 4.06 (and earlier), when a glyph in a Type 3 font has a zero height.	2.1 Low	—	0,14%	3 Sep 2026
CVE-2026-85222 A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addon_center.cgi of the compone...	9.1 Critical	—	3,6%	3 Sep 2026
CVE-2026-85208 A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. The affected element is the function doInsert of the file /rider/orders/controlle...	7.3 High	—	0,50%	3 Sep 2026
CVE-2026-85063 node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and group_columns_by_name optio...	6.9 Medium	—	0,57%	3 Sep 2026
CVE-2026-85062 Colord is a tiny yet powerful tool for high-performance color manipulations and conversions. Prior to 2.9.4, synchronous CSS color string matchers in src/colorModels/rgbS...	6.9 Medium	—	0,51%	3 Sep 2026
CVE-2026-85061 MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanitize() in src/util/dom.ts iterates elem.attributes as a live NamedNodeM...	10.0 Critical	—	0,52%	3 Sep 2026
CVE-2026-84185 A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption (JOSE) standards. The issue occurs when the library veri...	5.9 Medium	—	0,13%	3 Sep 2026
CVE-2026-82521 parsedmarc 9.0.6 before 11.0.1 writes forensic report sample files using an output path derived from the email subject. When the subject consists entirely of path travers...	5.3 Medium	—	0,43%	3 Sep 2026
CVE-2026-82520 parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompressed output size. Because parsedmarc automatically proc...	7.5 High	—	0,78%	3 Sep 2026
CVE-2026-77465 toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0, toml.parse() uses a Peggy 5.1.0 generated recursive-descent parser in lib/parser.js whose peg$pars...	7.5 High	—	0,61%	3 Sep 2026
CVE-2026-71429 stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.5.0, the path filters pick, ignore, filter,...	6.2 Medium	—	0,16%	3 Sep 2026
CVE-2026-63376 toml-node is a TOML parser for Node.js and the browser. Prior to 4.1.2, toml.parse() in lib/compiler.js can be tricked by a table path such as a.b.y.__proto__.__proto__,...	8.2 High	—	0,68%	3 Sep 2026
CVE-2026-85207 A vulnerability was identified in itsourcecode Online Medicine Delivery System 1.0. Impacted is an unknown function of the file /index.php?q=orderdetails. Such manipulati...	3.5 Low	—	0,35%	3 Sep 2026
CVE-2026-85053 google chrome Improper resource exposure in CacheStorage in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HT...	8.8 High	—	0,41%	3 Sep 2026
CVE-2026-85052 google chrome Out of bounds read in CrashReporting in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to read memory outside the...	3.1 Low	—	0,23%	3 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.