Katalog CVE (hal. 509)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.280 (Critical 36.347 · High 105.266 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 25 Okt 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 25.401–25.450 dari 263.280 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-85089 freerdp FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp...	6.5 Medium	—	0,38%	3 Sep 2026
CVE-2026-85084 Out-of-bounds Write and Improper Validation of Array Index vulnerability in Samsung Open Source TizenFX Samsung/TizenFX allows Overflow Buffers.	6.3 Medium	—	0,13%	3 Sep 2026
CVE-2026-85040 A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0. Affected by this vulnerability is the function eval of the file /adminapi/system/crontab/save of the co...	4.7 Medium	—	2,1%	3 Sep 2026
CVE-2026-85031 A vulnerability was found in TOTOLINK CP450 4.1.0. The impacted element is an unknown function of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument...	9.9 Critical	—	0,79%	3 Sep 2026
CVE-2026-85030 A vulnerability has been found in HKUDS AI-Trader up to d03ff6c056b32ced735adf7c19ed8175adb1c8df. The affected element is an unknown function of the file service/server/r...	3.7 Low	—	0,46%	3 Sep 2026
CVE-2026-85022 A vulnerability was identified in langgenius dify 1.13.0. Affected by this vulnerability is the function router.replace of the file web/app/(shareLayout)/webapp-signin/co...	3.5 Low	—	0,37%	3 Sep 2026
CVE-2026-85021 A vulnerability was determined in langgenius dify 1.13.0. Affected is the function router.replace of the file web/app/(shareLayout)/components/splash.tsx of the component...	4.3 Medium	—	0,50%	3 Sep 2026
CVE-2026-84832 SEPPmail Secure Email Gateway before 15.0.6 deserializes attacker-controlled data in a privileged REST import workflow without adequate validation. An attacker with a pri...	8.6 High	—	0,64%	3 Sep 2026
CVE-2026-84831 SEPPmail Secure Email Gateway before 15.0.7 creates a fully privileged session before required multi-factor authentication enrollment is completed. An attacker with the p...	7.7 High	—	0,47%	3 Sep 2026
CVE-2026-84830 SEPPmail Secure Email Gateway before 15.0.7 contains a command injection vulnerability that allows authenticated administrators to execute commands with elevated privileg...	8.6 High	—	1,2%	3 Sep 2026
CVE-2026-82918 XG VisionTerminal, XG-X VisionTerminal, LJ Series Terminal-Software and WI Series Terminal-Software provided by Keyence Corporation improperly restrict XML external entit...	5.5 Medium	—	0,19%	3 Sep 2026
CVE-2026-80754 In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix F55 transmitter electrode count typo During F55 sensor detection, the tr...	7.8 High	—	0,12%	3 Sep 2026
CVE-2026-80753 In the Linux kernel, the following vulnerability has been resolved: ovpn: run deferred work on a module-owned workqueue ovpn queues several work items whose callbacks e...	8.4 High	—	0,19%	3 Sep 2026
CVE-2026-80752 In the Linux kernel, the following vulnerability has been resolved: Input: psxpad-spi - set driver data before use psxpad_spi_suspend() retrieves the controller state w...	8.4 High	—	0,20%	3 Sep 2026
CVE-2026-80751 In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev() mtk_mfg_attach_dev() reads prev_o...	7.8 High	—	0,17%	3 Sep 2026
CVE-2026-80750 In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix remaining %pOF after of_node_put() scpsys_get_bus_protection_legacy() looks...	8.4 High	—	0,19%	3 Sep 2026
CVE-2026-80749 In the Linux kernel, the following vulnerability has been resolved: drm/connector/hdmi: Fix out of bounds memory read A helper function was copying a given audio infofr...	7.1 High	—	0,12%	3 Sep 2026
CVE-2026-80748 In the Linux kernel, the following vulnerability has been resolved: mmc: loongson2: Fix sg iteration in data reorder functions In ls2k0500_mmc_reorder_cmd_data() and ls...	7.8 High	—	0,17%	3 Sep 2026
CVE-2026-80747 In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add bounds check for CRAT subtype length The CRAT parser validates that the subtype head...	8.0 High	—	0,13%	3 Sep 2026
CVE-2026-80745 In the Linux kernel, the following vulnerability has been resolved: regulator: fp9931: Fix VPOS/VNEG voltage selector table The VPOSNEG_table[] mapping does not match t...	8.4 High	—	0,18%	3 Sep 2026
CVE-2026-80741 In the Linux kernel, the following vulnerability has been resolved: drm/log: Fix out-of-bounds read on empty message length drm_log_draw_kmsg_record() accesses s[len -...	7.1 High	—	0,16%	3 Sep 2026
CVE-2026-80738 In the Linux kernel, the following vulnerability has been resolved: bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie bpf_tcp_gen_syncookie and bpf_tcp_chec...	7.3 High	—	0,17%	3 Sep 2026
CVE-2026-80737 In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: synchronize DMA teardown dmaengine_terminate_all() does not wait for a running c...	7.8 High	—	0,13%	3 Sep 2026
CVE-2026-80736 In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix bandwidth group reservation indexing Valid bandwidth group IDs range from 1 through...	7.8 High	—	0,13%	3 Sep 2026
CVE-2026-80735 In the Linux kernel, the following vulnerability has been resolved: ovpn: ensure socket is owned by ovpn before deref sk_user_data Some subsystems, like BPF SOCKMAP, se...	7.3 High	—	0,17%	3 Sep 2026
CVE-2026-80734 In the Linux kernel, the following vulnerability has been resolved: btrfs: initialize inode mapping flags for cached inodes [BUG] When running generic/795 with 8K block...	8.8 High	—	0,60%	3 Sep 2026
CVE-2026-80732 In the Linux kernel, the following vulnerability has been resolved: ata: pata_sl82c105: fix bridge revision use-after-free pci_get_slot() returns a referenced PCI devic...	7.8 High	—	0,17%	3 Sep 2026
CVE-2026-80731 In the Linux kernel, the following vulnerability has been resolved: net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header dev_validate_header() reads dev->hard_...	7.8 High	—	0,14%	3 Sep 2026
CVE-2026-80465 A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.3), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.3), Mendix SAML...	8.7 High	—	0,28%	3 Sep 2026
CVE-2026-80254 Authorization bypass through user-controlled key issue exists in ShizenBox2 (edge-app). If exploited, an attacker who can log in to the product may change the other user'...	7.1 High	—	0,35%	3 Sep 2026
CVE-2026-80253 An improper physical access control issue exists in ShizenBox2 (dev-conf). If exploited, an attacker with physical access to the product may execute bootloader commands w...	7.0 High	—	0,33%	3 Sep 2026
CVE-2026-79679 Use of Weak Credentials vulnerability in B&R Industrial Automation GmbH mapp Audit used in mapp Services. This issue affects mapp Audit used in mapp Services: before 6.8...	8.7 High	—	0,35%	3 Sep 2026
CVE-2026-78080 Advisory Joomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Lite < 5.1.0 - The cid parameter is used in queries without validation, allowing SQLi vector...	9.3 Critical	—	0,39%	3 Sep 2026
CVE-2026-78069 Advisory Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - `J2StoreControllerApps`...	9.5 Critical	—	0,41%	3 Sep 2026
CVE-2026-78065 Joomla Extension - j2commerce.com - Guest checkout address disclosure to any authenticated user (IDOR) in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - `editAddress()...	7.1 High	—	0,35%	3 Sep 2026
CVE-2026-78064 Joomla Extension - j2commerce.com - Anonymous cart-record tampering via inherited FOF `save` task in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - `fof.xml` grants th...	8.8 High	—	0,41%	3 Sep 2026
CVE-2026-78000 Joomla Extension - j2commerce.com - Reflected XSS via `filter_tag`, `pricefrom` and `priceto` in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - Four task handlers acce...	5.3 Medium	—	0,55%	3 Sep 2026
CVE-2026-77999 Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - The P...	8.7 High	—	0,43%	3 Sep 2026
CVE-2026-76642 util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged op...	7.8 High	—	0,22%	3 Sep 2026
CVE-2026-76178 A stored Cross-Site Scripting (XSS) vulnerability in the notification template functionality of the endpoint /ocsreports/?function=notification. A user with administrator...	9.2 Critical	—	0,42%	3 Sep 2026
CVE-2026-76177 Server-Side Request Forgery (SSRF) vulnerability in the /ocsreports/?function=tele_activate endpoint due to insufficient validation of the HTTPS_SERV and FILE_SERV parame...	7.1 High	—	0,35%	3 Sep 2026
CVE-2026-76176 SQL injection vulnerability in the endpoint /ocsreports/index.php?function=admin_double due to improper processing of the values in the ID field included in the selected_...	8.6 High	—	0,34%	3 Sep 2026
CVE-2026-76175 SQL injection vulnerability in the del_check parameter of the /ocsreports/?function=save_query_list endpoint. Input provided by an authenticated user with operator privil...	8.6 High	—	0,34%	3 Sep 2026
CVE-2026-76174 Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admin_info endpoint. The application validates files solely based on the nam...	9.4 Critical	—	0,51%	3 Sep 2026
CVE-2026-74769 dell powerprotect data manager Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain an Incorrect Authorization vulnerability in the REST API. A low privileged remote attacker could pote...	6.5 Medium	—	0,38%	3 Sep 2026
CVE-2026-74768 dell powerprotect data manager Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Server-Side Request Forgery (SSRF) vulnerability in the REST API. A high privileged remote attacker...	4.1 Medium	—	0,36%	3 Sep 2026
CVE-2026-73600 dell powerprotect data manager Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a stack buffer overflow vulnerability in file-level restore agent. A high privileged remote attacker...	7.8 High	—	0,20%	3 Sep 2026
CVE-2026-71224 redhat enterprise linux A stack overflow vulnerability was found in gfs2-utils. The metadata walk code in metawalk.c uses alloca() with an untrusted inode height value from on-disk metadata with...	4.7 Medium	—	0,14%	3 Sep 2026
CVE-2026-71222 redhat enterprise linux A heap out-of-bounds read vulnerability was found in gfs2-utils. The ea_num_ptrs field from on-disk extended attribute metadata is consumed without bounds validation, cau...	6.3 Medium	—	0,14%	3 Sep 2026
CVE-2026-71221 redhat enterprise linux A stack out-of-bounds write vulnerability was found in gfs2-utils. In savemeta, the height value from on-disk inode metadata is used as a loop bound without bounds checki...	7.0 High	—	0,17%	3 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.