Katalog CVE (hal. 520)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.288 (Critical 36.348 · High 105.269 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 25 Okt 2026, 12:26 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 25.951–26.000 dari 263.288 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-73706 arubanetworks fabric composer A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to obtain limited system information and to change the state o...	8.6 High	—	0,46%	1 Sep 2026
CVE-2026-73705 arubanetworks fabric composer An arbitrary file write vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to escalate privileges. Succes...	8.8 High	—	0,62%	1 Sep 2026
CVE-2026-73704 arubanetworks fabric composer A command sanitization bypass exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to esc...	8.8 High	—	0,53%	1 Sep 2026
CVE-2026-73703 arubanetworks fabric composer A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to conduct a stored cross-site sc...	8.8 High	—	0,34%	1 Sep 2026
CVE-2026-73702 arubanetworks fabric composer A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user...	8.8 High	—	0,42%	1 Sep 2026
CVE-2026-73701 arubanetworks fabric composer An unauthenticated remote code execution vulnerability exists in the underlying operating system of HPE Networking Fabric Composer and could be exploited if certain preco...	9.0 Critical	—	0,67%	1 Sep 2026
CVE-2026-73700 arubanetworks fabric composer A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to conduct a stored cross...	9.0 Critical	—	0,42%	1 Sep 2026
CVE-2026-72682 elastic kibana Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holdi...	6.5 Medium	—	0,47%	1 Sep 2026
CVE-2026-72654 elastic kibana Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An operation av...	6.5 Medium	—	0,51%	1 Sep 2026
CVE-2026-72652 elastic kibana Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can s...	6.5 Medium	—	0,42%	1 Sep 2026
CVE-2026-72649 elasticsearch Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586). A speciall...	8.8 High	—	0,92%	1 Sep 2026
CVE-2026-72644 elastic kibana Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only the low-privileged feat...	6.5 Medium	—	0,42%	1 Sep 2026
CVE-2026-72641 elastic kibana Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authe...	5.4 Medium	—	0,31%	1 Sep 2026
CVE-2026-72633 elastic kibana Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs (CAPEC...	4.3 Medium	—	0,27%	1 Sep 2026
CVE-2026-72628 elastic kibana Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding Stream...	6.5 Medium	—	0,47%	1 Sep 2026
CVE-2026-63138 elastic kibana Improper Neutralization of Special Elements in Data Query Logic (CWE-943) in Kibana can lead to information disclosure via NoSQL Injection (CAPEC-676). An authenticated u...	6.5 Medium	—	0,47%	1 Sep 2026
CVE-2026-63137 elastic kibana Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). A user hold...	8.3 High	—	0,50%	1 Sep 2026
CVE-2026-56143 elasticsearch Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user with elevated...	4.9 Medium	—	0,44%	1 Sep 2026
CVE-2026-45221 Konga before 2.1.0 contains a privilege escalation vulnerability that allows low-privileged local attackers to execute arbitrary code by planting attacker-controlled Open...	7.8 High	—	0,17%	1 Sep 2026
CVE-2026-33465 elastic kibana Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with...	6.5 Medium	—	0,42%	1 Sep 2026
CVE-2026-19766 arubanetworks fabric composer An authentication bypass vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated...	9.6 Critical	—	0,26%	1 Sep 2026
CVE-2026-8712 Wyoming before 1.10.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers with network access to force outbound connections to arbi...	8.3 High	—	0,32%	1 Sep 2026
CVE-2026-84306 Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.6 and 5.7.6, packages/panels/src/Auth/MultiFactor/App/AppAuth...	6.5 Medium	—	0,45%	1 Sep 2026
CVE-2026-84305 sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, reindent=True) and sqlformat --reindent route attacker-controlled parenthe...	5.1 Medium	—	0,19%	1 Sep 2026
CVE-2026-84304 gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recv...	8.7 High	—	0,61%	1 Sep 2026
CVE-2026-84303 gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher nam...	6.3 Medium	—	0,31%	1 Sep 2026
CVE-2026-83551 Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an...	7.2 High	—	0,80%	1 Sep 2026
CVE-2026-81846 An authorization bypass in the runZero Platform MCP service has been resolved in version 5.1.260826.0. This issue is an instance of CWE-639: Authorization Bypass Through...	3.5 Low	—	0,27%	1 Sep 2026
CVE-2026-52295 ffmpeg FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-based access in libavformat/iamf_writer.c.	2.9 Low	—	0,18%	1 Sep 2026
CVE-2026-52132 ggml llama.cpp llama.cpp through commit 97f06e9, when started with the --reranking flag, allows remote attackers to cause a denial of service (std::bad_alloc and HTTP 500) via a negativ...	7.5 High	—	0,59%	1 Sep 2026
CVE-2026-52131 ggml llama.cpp llama.cpp b5693 and before has a Reachable Assertion via the gguf_reader::read function.	7.5 High	—	0,43%	1 Sep 2026
CVE-2026-52130 ggml llama.cpp llama.cpp b5693 and before is vulnerable to Uncontrolled Recursion in common/json-schema-to-grammar.cpp, resulting in a denial of service.	7.5 High	—	0,49%	1 Sep 2026
CVE-2026-52111 An issue in fast-note-sync-service <=2.13.7 allows a remote attacker to escalate privileges via the admin configuration endpoint exposes authTokenKey	9.8 Critical	—	0,61%	1 Sep 2026
CVE-2026-52023 kamailio An issue in kamailio v.6.1.1 and before allows a remote attacker to cause a denial of service via the ims_registrar_pcscf module, specifically the pcscf_save_pending/save...	7.5 High	—	0,45%	1 Sep 2026
CVE-2026-52022 kamailio An issue in kamailio v.6.1.1 and before allows a remote attacker to cause a denial of service via the IMS P-CSCF registration handling components	7.5 High	—	0,58%	1 Sep 2026
CVE-2026-51974 An eval() injection vulnerability in the get_list function in modules/meta_parser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remote attackers to execute arbitr...	8.8 High	—	0,77%	1 Sep 2026
CVE-2026-19593 OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace. If the workspace contains a reposi...	9.8 Critical	—	0,37%	1 Sep 2026
CVE-2026-19592 OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS automatically collected Git repository metadata without disabling the repository-lo...	7.3 High	—	0,11%	1 Sep 2026
CVE-2026-19591 OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS misclassified certain PowerShell commands as safe because their command-safety pars...	8.8 High	—	0,31%	1 Sep 2026
CVE-2026-19590 OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because automated Git operations trusted the repository's local core.hooksPath sett...	7.3 High	—	0,11%	1 Sep 2026
CVE-2024-7953 A vulnerability exists in the affected products that allows a threat actor to create a project and become the administrator for it. If exploited, a threat actor could cre...	8.7 High	—	0,24%	1 Sep 2026
CVE-2024-7952 A data exposure vulnerability exists in the affected product. There are hardcoded links in the source code that lead to JSON files that can be reached without authenticat...	8.7 High	—	0,41%	1 Sep 2026
CVE-2026-58566 Dell PowerStore, an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation...	8.8 High	—	0,42%	1 Sep 2026
CVE-2026-51956 A Broken Object Level Authorization vulnerability exists in Grashjs Atlas CMMS prior to v1.6.0. An authenticated user from one tenant can read and modify another tenant's...	8.1 High	—	0,41%	1 Sep 2026
CVE-2026-51934 Buffer Overflow vulnerability in Shenzhen Jixiang Tengda Technology Co., Ltd. Tenda A18 v.15.13.07.09 allows a remote attacker to execute arbitrary code via the fromSetCm...	9.8 Critical	—	1,2%	1 Sep 2026
CVE-2026-51788 An issue in cleverange_auth v.0.1.10 allows a remote attacker to cause a denial of service via the account_verification function and the accounts/models.py component	7.5 High	—	0,75%	1 Sep 2026
CVE-2026-84270 A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, do_read() in gvfsbackendmtp.c trusts the data length returned by the device wi...	4.3 Medium	—	0,22%	1 Sep 2026
CVE-2026-84269 A flaw was found in the AFP backend in gvfs. When mounting a share, a malicious AFP server can cause the DSI read path to process a length that exceeds the size requested...	6.5 Medium	—	0,45%	1 Sep 2026
CVE-2026-84268 A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a length that exceeds th...	8.8 High	—	0,46%	1 Sep 2026
CVE-2026-84267 A flaw was found in the SFTP backend in gvfs. When mounting a share, a malicious SFTP server can cause read_string() to allocate a buffer with a certain length but the fu...	4.3 Medium	—	0,37%	1 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.