Katalog CVE (hal. 512)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.280 (Critical 36.347 · High 105.266 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 25 Okt 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 25.551–25.600 dari 263.280 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-84664 Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to connect to an a...	5.4 Medium	—	0,14%	2 Sep 2026
CVE-2026-84663 A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows attackers to delete shared library cac...	5.4 Medium	—	0,14%	2 Sep 2026
CVE-2026-84662 Jenkins LDAP Plugin 807.809.vd3a_4e5e4ec98 and earlier allows connecting to a specified URL through Stapler data binding, allowing attackers to connect to an attacker-spe...	4.3 Medium	—	0,25%	2 Sep 2026
CVE-2026-84661 A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds awaited by the `waitForBuild` step when the `p...	5.4 Medium	—	0,36%	2 Sep 2026
CVE-2026-84660 A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds triggered by the `build` step to be canceled e...	5.4 Medium	—	0,36%	2 Sep 2026
CVE-2026-84659 jenkins script security Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally...	4.3 Medium	—	0,28%	2 Sep 2026
CVE-2026-84658 jenkins script security Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses the `@DataBoundConstructor` annotation on a constructor that loads script approval configuration, allo...	4.3 Medium	—	0,31%	2 Sep 2026
CVE-2026-84657 jenkins In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a build triggered...	4.2 Medium	—	0,25%	2 Sep 2026
CVE-2026-84656 jenkins A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build parameter na...	4.3 Medium	—	0,30%	2 Sep 2026
CVE-2026-84655 jenkins Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to c...	4.3 Medium	—	0,31%	2 Sep 2026
CVE-2026-84654 In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows sett...	5.4 Medium	—	0,25%	2 Sep 2026
CVE-2026-84653 jenkins Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly perform permission checks in the Appearance configuration pa...	3.5 Low	—	0,34%	2 Sep 2026
CVE-2026-84652 jenkins In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers a...	7.3 High	—	0,44%	2 Sep 2026
CVE-2026-84651 jenkins In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submitted configuration from overw...	6.3 Medium	—	0,31%	2 Sep 2026
CVE-2026-84650 jenkins In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates t...	8.8 High	—	0,47%	2 Sep 2026
CVE-2026-84649 In Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (both inclusive), except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.447 through 2.579 (both inclusive),...	8.8 High	—	0,20%	2 Sep 2026
CVE-2026-84648 jenkins In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata (source, level, and timestamp) resulting in a stored cros...	8.8 High	—	0,58%	2 Sep 2026
CVE-2026-84647 In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Stapler does not restrict the...	8.8 High	—	0,52%	2 Sep 2026
CVE-2026-84646 jenkins In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/R...	4.3 Medium	—	0,34%	2 Sep 2026
CVE-2026-84645 jenkins In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level configuration files in Jenkins (suc...	8.8 High	—	0,79%	2 Sep 2026
CVE-2026-78689 Description NGINX JavaScript (njs) has a vulnerability in the XML module's namespace prefix list parser, reachable through the xml.exclusiveC14n() method. An unauthenti...	8.1 High	—	0,76%	2 Sep 2026
CVE-2026-78410 A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user w...	7.8 High	—	0,16%	2 Sep 2026
CVE-2026-78409 The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag...	7.0 High	—	0,19%	2 Sep 2026
CVE-2026-78408 The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across...	7.9 High	—	0,19%	2 Sep 2026
CVE-2026-78222 A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.status...	7.5 High	—	0,62%	2 Sep 2026
CVE-2026-77180 When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multip...	8.3 High	—	0,50%	2 Sep 2026
CVE-2026-66842 BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts through an undisclosed request to Traffic Management...	8.8 High	—	0,47%	2 Sep 2026
CVE-2026-66362 Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of...	8.1 High	—	0,57%	2 Sep 2026
CVE-2026-63020 f5 big-ip access policy manager, f5 big-ip advanced firewall manager +19 lainnya A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages Impact: An attacker may trick authen...	3.1 Low	—	0,23%	2 Sep 2026
CVE-2026-53611 Looking Glass is a modern, stateless network-diagnostic platform — a single self-contained Go binary that fronts a fleet of routers over SSH and exposes ping / traceroute...	9.8 Critical	—	2,0%	2 Sep 2026
CVE-2026-53600 async-tar is a tar archive reading/writing library for async Rust. Prior to version 0.6.1, async-tar mis-applies a buffered PAX size extension to an intermediary extensio...	6.3 Medium	—	0,45%	2 Sep 2026
CVE-2026-19475 An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Graf...	6.5 Medium	—	0,42%	2 Sep 2026
CVE-2026-18329 Description NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a js_access handler performs asynchronous request body processing and an exception...	8.2 High	—	0,38%	2 Sep 2026
CVE-2026-18058 The mobile Smart Connect dashboard UI was subject to manipulation by 3rd party apps. When paired with a phishing attack, this manipulation could result in escalated privi...	7.5 High	—	0,08%	2 Sep 2026
CVE-2026-14199 grafana Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concat...	8.1 High	—	0,33%	2 Sep 2026
CVE-2026-12704 When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated...	6.8 Medium	—	0,27%	2 Sep 2026
CVE-2026-8151 The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administ...	5.4 Medium	—	0,14%	2 Sep 2026
CVE-2026-83547 The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets' settings before outputting them within HTML attributes, which could allow user...	6.8 Medium	—	0,43%	2 Sep 2026
CVE-2026-83533 The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthen...	5.3 Medium	—	0,16%	2 Sep 2026
CVE-2026-82955 In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Gateway component had the disabl...	9.0 Critical	—	0,18%	2 Sep 2026
CVE-2026-82884 The All in One SEO WordPress plugin before 5.0.0.1 does not sanitise and escape some content stored in posts before rendering it back in the post editor, which could allo...	6.8 Medium	—	0,43%	2 Sep 2026
CVE-2026-82293 Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting Incorrectly Configured Access Contro...	4.3 Medium	—	0,37%	2 Sep 2026
CVE-2026-81571 The Brave WordPress plugin before 0.8.8 does not prevent a URL parameter used to pre-fill a form field from being passed to WordPress's shortcode engine, allowing unauthe...	4.8 Medium	—	0,24%	2 Sep 2026
CVE-2026-79991 Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments(), which is t...	7.1 High	—	0,51%	2 Sep 2026
CVE-2026-79990 Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments(), which is t...	8.7 High	—	0,45%	2 Sep 2026
CVE-2026-79989 The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows t...	8.7 High	—	0,43%	2 Sep 2026
CVE-2026-78609 elastic cloud on kubernetes Incorrect Authorization (CWE-863) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized modification of data via Metadata Spoofing (CAPEC-690). An actor holding l...	5.4 Medium	—	0,15%	2 Sep 2026
CVE-2026-78604 elastic agent Incorrect Permission Assignment for Critical Resource (CWE-732) in Elastic Agent can lead to local privilege escalation via Replace Binaries (CAPEC-642). On Windows syste...	7.8 High	—	0,15%	2 Sep 2026
CVE-2026-78602 elastic maps server Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Elastic Maps Server can lead to information disclosure via Path Traversal (CAPE...	5.3 Medium	—	0,56%	2 Sep 2026
CVE-2026-78601 elastic kibana Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to a Kibana Entity...	5.5 Medium	—	0,35%	2 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.