Katalog CVE (hal. 511)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.280 (Critical 36.347 · High 105.266 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 25 Okt 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 25.501–25.550 dari 263.280 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-53706 PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, the prevail eBPF verifier accepts ALU32 ADD and SUB instruct...	8.8 High	—	0,51%	2 Sep 2026
CVE-2026-53671 PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, the abstract transformer in prevail treats writes through a...	9.3 Critical	—	0,51%	2 Sep 2026
CVE-2026-53670 PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, in the Prevail eBPF verifier, EbpfTransformer::add() silentl...	9.3 Critical	—	0,51%	2 Sep 2026
CVE-2026-53649 Joro is a web exploitation framework. Prior to version 1.1.1, Joro's default proxy mode exposes a local API on 127.0.0.1:9090 that performs no authentication and applies...	9.6 Critical	—	0,33%	2 Sep 2026
CVE-2026-49833 DSpace open source software is a repository application which provides durable access to digital resources. From versions 8.0-rc1 to before 8.4, 9.0-rc1 to before 9.3, an...	5.5 Medium	—	0,37%	2 Sep 2026
CVE-2026-49832 DSpace open source software is a repository application which provides durable access to digital resources. From versions 8.0-rc1 to before 8.4, versions 9.0-rc1 to befor...	8.0 High	—	0,87%	2 Sep 2026
CVE-2026-49831 DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, the Curation Task...	5.5 Medium	—	0,53%	2 Sep 2026
CVE-2026-49830 DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, when ingesting an...	4.4 Medium	—	0,49%	2 Sep 2026
CVE-2026-49249 Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.10.0, Boru...	7.1 High	—	0,40%	2 Sep 2026
CVE-2026-84811 agentverus-scanner fails to analyze compiled Python bytecode files in companion code directories, allowing attackers to bypass security scanning by shipping malicious __p...	6.5 Medium	—	0,52%	2 Sep 2026
CVE-2026-84810 claude-skill-antivirus fails to analyze executable files when scanning local skill directories, reading only SKILL.md while ignoring Python source, bytecode, and other ar...	6.5 Medium	—	0,32%	2 Sep 2026
CVE-2026-84809 Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding __pycache__ directories and .pyc/.pyo/.pyd extensions in...	6.5 Medium	—	0,57%	2 Sep 2026
CVE-2026-84376 Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured non-root base path from request pathnames using a string-prefix check wi...	6.3 Medium	—	0,71%	2 Sep 2026
CVE-2026-82404 TOON is a compact, human-readable serialization of JSON data for LLM prompts. Prior to 2.3.1, decoding attacker-controlled TOON with a __proto__, constructor, or prototyp...	8.3 High	—	0,68%	2 Sep 2026
CVE-2026-79756 Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashb...	8.7 High	—	7,5%	2 Sep 2026
CVE-2026-79755 Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, on the Nuclio local Docker platform, the function namespace is inter...	8.0 High	—	0,67%	2 Sep 2026
CVE-2026-79754 Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. From version 1.6.19 to before version 1.17.2, Nuclio's Dashboard build pipeline does not sani...	7.1 High	—	0,72%	2 Sep 2026
CVE-2026-55421 Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 00b7c3c, the endpoint accepts user-supplied files[].url, performs a...	6.8 Medium	—	0,46%	2 Sep 2026
CVE-2026-53636 Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in the Open ed...	4.7 Medium	—	0,28%	2 Sep 2026
CVE-2026-53635 Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 59bb6d6, the view function set_course_mode_price() at lms/djangoapps...	7.6 High	—	0,40%	2 Sep 2026
CVE-2026-52833 Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio's Java runtime generates a build.gradle file during function...	8.0 High	—	0,55%	2 Sep 2026
CVE-2026-52832 Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio Dashboard exposes POST /api/functions without authentication...	4.9 Medium	—	0,56%	2 Sep 2026
CVE-2026-52831 Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.4, the Nuclio controller builds a curl invocation string for each cron...	8.0 High	—	0,53%	2 Sep 2026
CVE-2026-45730 Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnerability in Nuclio Dashboard's project management AP...	8.3 High	—	0,48%	2 Sep 2026
CVE-2026-20355 Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco Secure Email could allow an unauthenticated, remot...	5.9 Medium	—	0,16%	2 Sep 2026
CVE-2026-20354 Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco Secure Email could allow an unauthenticated, remot...	5.9 Medium	—	0,16%	2 Sep 2026
CVE-2026-20281 A vulnerability in Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 that are running Cisco Session Initiation Protocol (SIP)...	7.5 High	—	0,37%	2 Sep 2026
CVE-2026-20280 cisco ios xr As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal se...	8.8 High	—	0,29%	2 Sep 2026
CVE-2026-20279 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal securit...	9.8 Critical	—	0,30%	2 Sep 2026
CVE-2026-20278 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal securit...	8.8 High	—	0,30%	2 Sep 2026
CVE-2026-20277 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal securit...	8.2 High	—	0,23%	2 Sep 2026
CVE-2026-20276 cisco ios xr As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal securit...	8.6 High	—	0,27%	2 Sep 2026
CVE-2026-20275 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal securit...	8.8 High	—	0,20%	2 Sep 2026
CVE-2026-20274 cisco ios xr As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal securit...	9.8 Critical	—	0,73%	2 Sep 2026
CVE-2026-20212 Advisory A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute code with root privile...	9.8 Critical	—	0,72%	2 Sep 2026
CVE-2026-84838 A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a...	7.8 High	—	1,1%	2 Sep 2026
CVE-2026-84837 A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include...	7.8 High	—	1,3%	2 Sep 2026
CVE-2026-84677 Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values (plugin names, descriptions, and version metadata) on plugin download index pages, result...	5.4 Medium	—	0,23%	2 Sep 2026
CVE-2026-84676 Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by user...	4.3 Medium	—	0,19%	2 Sep 2026
CVE-2026-84675 OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control build environment variable values to execute arbitrary com...	7.4 High	—	1,2%	2 Sep 2026
CVE-2026-84674 Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credential...	5.4 Medium	—	0,23%	2 Sep 2026
CVE-2026-84673 Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows overwriting the plugin's appearance configuration through Stapler data binding, allowing attack...	8.8 High	—	0,51%	2 Sep 2026
CVE-2026-84672 Jenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0b_ff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID and its disp...	8.8 High	—	0,42%	2 Sep 2026
CVE-2026-84671 Jenkins File Parameter Plugin 425.v3fa_801681b_5e and earlier allows writing files to arbitrary locations on the Jenkins controller file system through Stapler data bindi...	8.8 High	—	0,84%	2 Sep 2026
CVE-2026-84670 Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in...	8.8 High	—	0,64%	2 Sep 2026
CVE-2026-84669 A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish Allure report results to read a...	8.8 High	—	0,55%	2 Sep 2026
CVE-2026-84668 Jenkins SAML Plugin 4.618.v441a_27fa_46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data binding, allowing attackers to repl...	8.8 High	—	0,42%	2 Sep 2026
CVE-2026-84667 Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data binding, allowing attackers to redirect backup write...	7.1 High	—	0,38%	2 Sep 2026
CVE-2026-84666 Jenkins Job Configuration History Plugin 1367.vc8fa_b_15101dc and earlier allows overwriting the plugin's history recording configuration through Stapler data binding, al...	5.4 Medium	—	0,14%	2 Sep 2026
CVE-2026-84665 Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner results, allowing the `javasc...	8.0 High	—	0,41%	2 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.