Katalog CVE (hal. 510)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.280 (Critical 36.347 · High 105.266 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 25 Okt 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 25.451–25.500 dari 263.280 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-71220 redhat enterprise linux A stack out-of-bounds write vulnerability was found in gfs2-utils. In gfs2_edit, the di_height field from on-disk inode metadata is used as an array index without bounds...	7.0 High	—	0,17%	3 Sep 2026
CVE-2026-71219 redhat enterprise linux A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk.c uses alloca() with an exponentially-derived size from the untrusted on...	4.7 Medium	—	0,14%	3 Sep 2026
CVE-2026-68860 dell powerprotect data manager Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Reliance on Data/Memory Layout vulnerability. An unauthenticated remote attacker could potentially...	6.8 Medium	—	0,38%	3 Sep 2026
CVE-2026-3852 The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `skype_url` shortcode attribute of the Social Media Follow module in all versions up to,...	6.4 Medium	—	0,26%	3 Sep 2026
CVE-2026-3416 wso2 api control plane, wso2 api manager The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation. This PRNG lacks...	7.5 High	—	0,36%	3 Sep 2026
CVE-2026-2573 The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘postBody...	6.4 Medium	—	0,26%	3 Sep 2026
CVE-2026-17539 RTU500 has a vulnerability, where high-load scenarios, such as sending GI requests at short intervals, may cause a NULL pointer dereference in the last entry of the enhan...	5.9 Medium	—	0,27%	3 Sep 2026
CVE-2026-15933 OptimiDoc Server (On-Premise) stores credentials for external services in cleartext. An authenticated administrator can view previously configured service passwords, incl...	6.9 Medium	—	0,36%	3 Sep 2026
CVE-2021-43614 Error in handling the PlatformLangCodes UEFI variable could cause a buffer overflow, leading to resource exhaustion and failure.	6.7 Medium	—	0,11%	3 Sep 2026
CVE-2021-43613 An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashes are exposed in runtime UEFI variables, leading to escalation of priv...	6.5 Medium	—	0,09%	3 Sep 2026
CVE-2021-38489 HDD password plaintext is stored in a UEFI variable.	8.2 High	—	0,12%	3 Sep 2026
CVE-2026-84888 A weakness has been identified in RightNow-AI OpenFang up to 0.6.9. This vulnerability affects the function shell_exec of the file crates/openfang-runtime/src/tool_runner...	4.3 Medium	—	0,47%	3 Sep 2026
CVE-2026-84887 A vulnerability was identified in simular-ai Agent-S up to 0.3.2. Affected by this issue is some unknown functionality of the file grounding.py of the component Model-gen...	4.3 Medium	—	0,57%	3 Sep 2026
CVE-2026-84886 A vulnerability was determined in simular-ai Agent-S up to 0.3.2. Affected by this vulnerability is the function ImageData of the file gui_agents/s1/utils/ocr_server.py o...	5.3 Medium	—	0,64%	3 Sep 2026
CVE-2026-84885 A vulnerability has been found in simular-ai Agent-S 0.3.1/0.3.2. This impacts an unknown function of the file code_agent.py of the component CodeAgent. Such manipulation...	4.3 Medium	—	0,47%	3 Sep 2026
CVE-2026-84851 An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion data that exhausts the native ca...	7.5 High	—	0,61%	3 Sep 2026
CVE-2026-84394 openjsf fast-uri fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end...	7.5 High	—	0,38%	3 Sep 2026
CVE-2026-84857 A flaw has been found in sigoden aichat up to 0.30.4. This affects an unknown function of the file src/serve.rs of the component API Endpoint. This manipulation causes un...	5.3 Medium	—	0,64%	2 Sep 2026
CVE-2026-84856 A vulnerability was detected in rowboatlabs rowboat up to 0.9.1. The impacted element is the function request.text/req.json of the file apps/rowboat/app/api/composio/webh...	5.3 Medium	—	0,70%	2 Sep 2026
CVE-2026-84852 A security vulnerability has been detected in Reader Tools PDF Reader App 98.8 on Android. The affected element is the function ActSplashNew.handleDeeplink of the compone...	4.4 Medium	—	0,21%	2 Sep 2026
CVE-2026-84452 Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models for Windows ML. Prior to 0.4.0, the src/winml/modelkit/serve/cli_api.p...	8.6 High	—	1,6%	2 Sep 2026
CVE-2026-84292 openjsf fast-uri fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concat...	7.5 High	—	0,24%	2 Sep 2026
CVE-2026-82524 UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to upload arbitrary PHP files through the TinyMCE image u...	7.2 High	—	0,63%	2 Sep 2026
CVE-2026-78662 golang crypto Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking...	7.5 High	—	0,43%	2 Sep 2026
CVE-2026-75137 UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover cleartext vault data from process memory even a...	6.1 Medium	—	0,10%	2 Sep 2026
CVE-2026-75136 UpSignOn for Windows before 7.19.0 contains an insecure credential storage vulnerability that allows local attackers to retrieve the biometric unlock key stored in the Wi...	6.1 Medium	—	0,16%	2 Sep 2026
CVE-2026-75135 UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover the master password and decrypt vault contents...	6.1 Medium	—	0,10%	2 Sep 2026
CVE-2026-75134 SEOWriting plugin for WordPress through 1.12.5 contains a stored cross-site scripting vulnerability that allows authenticated contributors to inject malicious JavaScript...	6.4 Medium	—	0,32%	2 Sep 2026
CVE-2026-56855 golang crypto Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 chan...	7.5 High	—	0,50%	2 Sep 2026
CVE-2023-20577 A heap overflow in SMM module may allow an attacker with access to a second vulnerability that enables writing to SPI flash, potentially resulting in arbitrary code execu...	7.4 High	—	0,16%	2 Sep 2026
CVE-2023-20576 Insufficient Verification of Data Authenticity in AGESA™ may allow an attacker to update SPI ROM data potentially resulting in denial of service or privilege escalation.	7.7 High	—	0,13%	2 Sep 2026
CVE-2026-84841 A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. This vulnerability affects unknown code. The manipulation results in client-side enforcement of...	7.3 High	—	0,54%	2 Sep 2026
CVE-2026-84840 A vulnerability was identified in tsi-coop tsi-dpdp-cms up to 0.5.0. This affects an unknown part of the file InterceptingFilter.java of the component Bootstrap Setup End...	6.5 Medium	—	0,80%	2 Sep 2026
CVE-2026-84839 A vulnerability was determined in tsi-coop tsi-dpdp-cms up to 0.5.0. Affected by this issue is some unknown functionality of the file web.xml of the component Admin Conso...	5.3 Medium	—	0,77%	2 Sep 2026
CVE-2026-84382 HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in src/httpx2/httpx2/_decoders.py fully inflate each gzip, deflate, br, o...	7.5 High	—	0,63%	2 Sep 2026
CVE-2026-84381 HTTPX2 is a next generation HTTP client for Python. Prior to 2.10.0, httpcore2 fails to start TLS in src/httpcore2/httpcore2/_sync/socks_proxy.py and src/httpcore2/httpco...	8.1 High	—	0,12%	2 Sep 2026
CVE-2026-19117 Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as that user. This issue affect...	9.8 Critical	—	0,28%	2 Sep 2026
CVE-2026-84833 A vulnerability was found in ntegrals openbrowser up to 067fc45d649baa961750da8e2f4a75d87c5c75c8. Affected by this vulnerability is an unknown functionality of the file p...	4.3 Medium	—	0,51%	2 Sep 2026
CVE-2026-84380 HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request._prepare() in src/httpx2/httpx2/_models.py can add a body-derived Content-Length header to a...	5.6 Medium	—	0,22%	2 Sep 2026
CVE-2026-84379 HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.render_headers() in src/httpx2/httpx2/_multipart.py directly interpolates attacker-controll...	5.3 Medium	—	0,32%	2 Sep 2026
CVE-2026-84378 HTTPX2 is a next generation HTTP client for Python. From 2.5.0 until 2.10.0, the HTTPX2 Server-Sent Events parser in src/httpx2/httpx2/_sse.py repeatedly copies and resca...	5.9 Medium	—	0,32%	2 Sep 2026
CVE-2026-84377 LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to versions 1.88.6 and 1.96.2, any authenticated LiteLLM proxy user could redi...	6.5 Medium	—	0,54%	2 Sep 2026
CVE-2026-82522 libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploiting 64-bit...	5.4 Medium	—	0,41%	2 Sep 2026
CVE-2026-77125 sonatype nexus repository manager A vulnerability was identified in Sonatype Nexus Repository 3 in which two blobstore group management REST API endpoints did not correctly enforce the intended authorizat...	7.1 High	—	0,29%	2 Sep 2026
CVE-2026-77124 sonatype nexus repository manager In affected versions of Nexus Repository 3, the script execution endpoint (POST /service/rest/v1/script/{name}/run) did not verify whether script execution had been admin...	7.2 High	—	0,72%	2 Sep 2026
CVE-2026-77123 sonatype nexus repository manager Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability read API. An account holding the nexus:capabilities:read privilege can retr...	6.5 Medium	—	0,46%	2 Sep 2026
CVE-2026-77122 sonatype nexus repository manager An authorization flaw in the REST API repository details endpoint (GET /service/rest/v1/repositories/{repositoryName}) in Sonatype Nexus Repository 3 allowed an account h...	4.3 Medium	—	0,28%	2 Sep 2026
CVE-2026-77121 sonatype nexus repository manager A user account with permission to deploy artifacts to a hosted Maven repository could upload a POM file containing an oversized metadata field. This causes future attempt...	6.5 Medium	—	0,25%	2 Sep 2026
CVE-2026-66786 A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition (CRD) without proper...	9.1 Critical	—	1,4%	2 Sep 2026
CVE-2026-55221 Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.10.0, Boru...	6.5 Medium	—	0,48%	2 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.