Katalog CVE (hal. 518)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.280 (Critical 36.347 · High 105.266 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 25 Okt 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 25.851–25.900 dari 263.280 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-84287 A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is some unknown functionality of the file gateway/platforms/api_server.py of the compone...	4.3 Medium	—	0,52%	1 Sep 2026
CVE-2026-73783 hpe arubaos-cx Stack overflow vulnerabilities exist in an API endpoint of AOS-CX. Successful exploitation could allow an authenticated malicious actor to cause a denial-of-service condi...	4.9 Medium	—	0,44%	1 Sep 2026
CVE-2026-73782 hpe arubaos-cx A format string vulnerability exists in the command line interface of AOS-CX that could lead to unauthenticated remote code execution. Successful exploitation of this vul...	8.8 High	—	0,42%	1 Sep 2026
CVE-2026-73781 hpe arubaos-cx A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against...	8.4 High	—	0,51%	1 Sep 2026
CVE-2026-73780 hpe arubaos-cx A vulnerability in the web-based management interface of AOS-CX switches exposes some sessions to a lack of Cross-Site Request Forgery (CSRF) protection. This could allow...	8.3 High	—	0,20%	1 Sep 2026
CVE-2026-73779 hpe arubaos-cx Vulnerabilities have been identified in the operating system of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authen...	8.2 High	—	0,24%	1 Sep 2026
CVE-2026-73778 hpe arubaos-cx A vulnerability exists in the Credential Manager component that may allow for unauthorized administrative access. An unauthenticated remote attacker could exploit this vu...	9.8 Critical	—	0,51%	1 Sep 2026
CVE-2026-73777 hpe arubaos-cx Vulnerabilities have been identified in the API endpoint of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authentica...	8.1 High	—	0,46%	1 Sep 2026
CVE-2026-73776 hpe arubaos-cx A signature verification bypass vulnerability exists in the command line interface of AOS-CX. Successful exploitation could allow an authenticated malicious actor with ad...	7.9 High	—	0,12%	1 Sep 2026
CVE-2026-73775 hpe arubaos-cx Vulnerabilities in the API endpoint of AOS-CX could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows...	7.7 High	—	0,46%	1 Sep 2026
CVE-2026-73774 hpe arubaos-cx A buffer overflow vulnerability exists in the underlying operating system of AOS-CX that could lead to unauthenticated disclosure of sensitive information by sending spec...	7.6 High	—	0,29%	1 Sep 2026
CVE-2026-73773 hpe arubaos-cx An unauthenticated Denial-of-Service (DoS) vulnerability exists in the API endpoint of AOS-CX. Successful exploitation of this vulnerability results in the ability to int...	7.5 High	—	0,46%	1 Sep 2026
CVE-2026-73772 hpe arubaos-cx Buffer overflow vulnerabilities exist in an underlying service of AOS-CX that could lead to an unauthenticated denial-of-service condition by sending specially crafted pa...	6.5 Medium	—	0,29%	1 Sep 2026
CVE-2026-73771 hpe arubaos-cx An authentication vulnerability exists in the AOS-CX management interface and API that may allow improper authentication processing. An unauthenticated remote attacker co...	7.5 High	—	0,47%	1 Sep 2026
CVE-2026-73770 hpe arubaos-cx An authenticated arbitrary file write vulnerability exists in AOS-CX. Successful exploitation could allow an authenticated malicious actor, under specific conditions outs...	7.3 High	—	0,24%	1 Sep 2026
CVE-2026-73768 hpe arubaos-cx A vulnerability exists in the command line interface of AOS-CX that may allow for improper processing of malformed input. Successful exploitation could result in the exec...	7.3 High	—	0,19%	1 Sep 2026
CVE-2026-73767 hpe arubaos-cx Authenticated command injection vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities results in the ability to...	7.2 High	—	1,7%	1 Sep 2026
CVE-2026-73766 hpe arubaos-cx Command injection vulnerabilities in the API endpoint of AOS-CX could allow an authenticated remote attacker with administrative privileges to inject arbitrary commands....	7.2 High	—	1,5%	1 Sep 2026
CVE-2026-73765 hpe arubaos-cx Authenticated path traversal vulnerabilities exist in API endpoints of AOS-CX. Successful exploitation of these vulnerabilities allows an attacker to write arbitrary file...	7.2 High	—	0,87%	1 Sep 2026
CVE-2026-73764 hpe arubaos-cx Vulnerabilities have been identified in the operating system of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authen...	7.1 High	—	0,31%	1 Sep 2026
CVE-2026-73763 hpe arubaos-cx A vulnerability exists in a management component that could allow an unauthenticated adjacent attacker to execute arbitrary commands. Successful exploitation could result...	8.8 High	—	0,48%	1 Sep 2026
CVE-2026-73762 hpe arubaos-cx A vulnerability has been identified in the API endpoint of AOS-CX that could allow a remote actor to circumvent existing access controls. In some cases this could enable...	6.6 Medium	—	0,29%	1 Sep 2026
CVE-2026-73761 hpe arubaos-cx An out-of-bounds read vulnerability exists in the underlying operating system of AOS-CX that could lead to unauthenticated information disclosure by sending a specially c...	6.5 Medium	—	0,28%	1 Sep 2026
CVE-2026-73760 hpe arubaos-cx An authenticated Path Traversal vulnerability exists in AOS-CX. Successful exploitation of this vulnerability allows an attacker to read arbitrary files from the web-base...	6.5 Medium	—	0,56%	1 Sep 2026
CVE-2026-73759 hpe arubaos-cx Vulnerabilities in AOS-CX could allow an unauthenticated remote malicious actor to trigger a denial-of-service condition by sending specially crafted packets. Successful...	6.5 Medium	—	0,29%	1 Sep 2026
CVE-2026-73758 hpe arubaos-cx A privilege escalation vulnerability exists in the API endpoint of AOS-CX. Successful exploitation could allow an authenticated low privilege operator user to change the...	6.5 Medium	—	0,30%	1 Sep 2026
CVE-2026-73757 hpe arubaos-cx A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to conduct a server-side request forgery (SSRF) attack. A suc...	6.4 Medium	—	0,31%	1 Sep 2026
CVE-2026-73756 hpe arubaos-cx A vulnerability in an API endpoint of AOS-CX could allow a remote unauthenticated attacker to obtain sensitive information via a man-in-the-middle attack. Successful expl...	5.9 Medium	—	0,26%	1 Sep 2026
CVE-2026-73755 hpe arubaos-cx A privilege escalation vulnerability exists in the API endpoint of AOS-CX. Successful exploitation could allow an authenticated low-privilege operator user, after a requi...	5.7 Medium	—	0,31%	1 Sep 2026
CVE-2026-73754 hpe arubaos-cx Denial-of-service vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation could allow an authenticated user to disrupt the normal operation...	5.3 Medium	—	0,34%	1 Sep 2026
CVE-2026-73753 hpe arubaos-cx Exploitation through affected command-line operations could allow an authenticated low-privileged user to execute arbitrary commands as a privileged user on the underlyin...	8.8 High	—	0,67%	1 Sep 2026
CVE-2026-73752 hpe arubaos-cx An unauthenticated arbitrary file write vulnerability exists in an API endpoint of AOS-CX. Successful exploitation of this vulnerability allows an attacker to write arbit...	8.8 High	—	0,47%	1 Sep 2026
CVE-2026-73751 hpe arubaos-cx An authenticated user with low-privileged access could submit crafted input through the web-based management interface to execute arbitrary commands on the underlying ope...	8.8 High	—	0,67%	1 Sep 2026
CVE-2026-73750 hpe arubaos-cx Vulnerabilities exist in the authentication module that may improperly process malformed or truncated input. An authenticated remote attacker could exploit these vulnerab...	8.8 High	—	0,80%	1 Sep 2026
CVE-2026-73749 hpe arubaos-cx Multiple vulnerabilities exist in a daemon of AOS-CX that may allow for improper processing of malformed input. An unauthenticated remote attacker could exploit these vul...	9.8 Critical	—	0,82%	1 Sep 2026
CVE-2026-73524 Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding mal...	6.1 Medium	—	0,41%	1 Sep 2026
CVE-2026-71981 Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafte...	8.8 High	—	0,97%	1 Sep 2026
CVE-2026-63435 Mail is an internet library for Ruby designed to handle email generation, parsing, and sending. Prior to 2.9.1, Mail::Utilities.q_value_decode and Mail::Utilities.b_value...	5.3 Medium	—	0,45%	1 Sep 2026
CVE-2026-84309 pypdf project pypdf pypdf is a free and open-source pure-python PDF library. Prior to 6.16.0, an attacker can craft a PDF whose cyclic tree structure causes pypdf/generic/_data_structures.py...	5.5 Medium	—	0,19%	1 Sep 2026
CVE-2026-84308 phpseclib is a PHP secure communications library. Prior to 3.0.57 and 4.0.1, pure-PHP X25519 scalar multiplication in phpseclib/Math/PrimeField/Integer.php performs data-...	6.3 Medium	—	0,33%	1 Sep 2026
CVE-2026-84307 Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.5 and 5.7.5, packages/panels/src/Auth/Pages/Login.php present...	3.7 Low	—	0,46%	1 Sep 2026
CVE-2026-78608 elastic kibana Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an internal Kiba...	6.5 Medium	—	0,38%	1 Sep 2026
CVE-2026-78607 elasticsearch Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). A user holding only infe...	7.1 High	—	0,33%	1 Sep 2026
CVE-2026-78606 elastic kibana Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained b...	4.2 Medium	—	0,23%	1 Sep 2026
CVE-2026-78605 elasticsearch Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch can lead to information disclosure via HTTP Request Smuggling (CAPEC-33...	5.9 Medium	—	0,34%	1 Sep 2026
CVE-2026-78603 elastic kibana Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenti...	4.3 Medium	—	0,29%	1 Sep 2026
CVE-2026-78597 elastic kibana Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by AC...	4.3 Medium	—	0,29%	1 Sep 2026
CVE-2026-78592 elastic kibana Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources via Path T...	7.3 High	—	0,41%	1 Sep 2026
CVE-2026-76658 arubanetworks fabric composer A vulnerability has been identified in the SSH daemon of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to gain administrative access...	10.0 Critical	—	0,75%	1 Sep 2026
CVE-2026-76657 arubanetworks fabric composer Vulnerabilities have been identified in the API of HPE Networking Fabric Composer that could potentially allow an unauthenticated remote attacker to circumvent existing a...	10.0 Critical	—	0,75%	1 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.