Katalog CVE (hal. 523)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.288 (Critical 36.348 · High 105.269 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 25 Okt 2026, 12:26 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 26.101–26.150 dari 263.288 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-84218 A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows a bypass of the denylist introduced t...	8.1 High	—	0,95%	1 Sep 2026
CVE-2026-84109 A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6. Affected by this issue is the function getOrder of the file webmain/webmainAction.php. Executing a ma...	6.3 Medium	—	0,32%	1 Sep 2026
CVE-2026-80047 A vulnerability in Hugging Face Transformers (versions 4.57.0 to 5.16.1) allows remote Python files to be written to local disk without user consent when using Generative...	7.8 High	—	0,10%	1 Sep 2026
CVE-2026-79684 dell powerstoreos Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to bypas...	8.8 High	—	0,49%	1 Sep 2026
CVE-2026-58572 dell powerstoreos Dell PowerStore contains a Code Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary c...	8.8 High	—	0,26%	1 Sep 2026
CVE-2026-58571 dell powerstoreos Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbi...	8.8 High	—	0,75%	1 Sep 2026
CVE-2026-51766 Incorrect access control in the setDevReboot function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reboot the local device and, on a master, f...	7.5 High	—	0,60%	1 Sep 2026
CVE-2026-51765 Incorrect access control in the recvIndirectMeshInfo function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to insert or replace mesh neighbor rec...	9.8 Critical	—	0,64%	1 Sep 2026
CVE-2026-51764 Incorrect access control in the recvSlaveCloudCheckStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to overwrite cloud-result trackin...	9.8 Critical	—	0,64%	1 Sep 2026
CVE-2026-51763 Incorrect access control in the freeStaClient function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to forcibly disconnect wireless clients via s...	9.8 Critical	—	0,64%	1 Sep 2026
CVE-2026-51762 Incorrect access control in the meshInfoKick function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to kick or clean stale mesh information/state...	9.8 Critical	—	0,64%	1 Sep 2026
CVE-2026-51761 Incorrect access control in the updateLanIp function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to refresh the LAN address state via sending a...	5.3 Medium	—	0,40%	1 Sep 2026
CVE-2026-51760 Incorrect access control in the informSyncUpgfw function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to mass-trigger firmware update activity ac...	9.8 Critical	—	0,64%	1 Sep 2026
CVE-2026-51757 Incorrect access control in the meshSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to start a firmware download or flash workf...	9.8 Critical	—	0,64%	1 Sep 2026
CVE-2026-51756 Incorrect access control in the meshSlaveUpgfw function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to start firmware flashing using existing up...	5.9 Medium	—	0,43%	1 Sep 2026
CVE-2026-51754 Incorrect access control in the updateSlaveIpList function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to overwrite the slave IP inventory state...	9.8 Critical	—	0,62%	1 Sep 2026
CVE-2026-51752 Incorrect access control in the staticInfoSend function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger static information reporting to t...	5.3 Medium	—	0,41%	1 Sep 2026
CVE-2026-51751 Incorrect access control in the delSlaveDevice function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove a specified slave device from loca...	9.8 Critical	—	0,64%	1 Sep 2026
CVE-2026-51750 Incorrect access control in the updatePriChannel function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to rescan and switch the primary mesh chan...	9.8 Critical	—	0,64%	1 Sep 2026
CVE-2026-51748 Incorrect access control in the sendStaticInfoToMaster function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to update stored slave inventory rec...	5.9 Medium	—	0,43%	1 Sep 2026
CVE-2026-19513 The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.0.2. This is due to insufficient validation of multi...	8.1 High	—	0,50%	1 Sep 2026
CVE-2026-18808 Improper Control of Generation of Code ('Code Injection') vulnerability in Klemsan Electrical Electronics Inc. KIO (Klemsan Internet Objects) allows Code Injection. This...	9.8 Critical	—	0,39%	1 Sep 2026
CVE-2026-18210 Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in TRtek Technological Products Computer Software Hardware Industry and...	9.8 Critical	—	0,36%	1 Sep 2026
CVE-2026-16675 A privilege escalation security issue exists within FactoryTalk® Activation Manager. The security issue stems from custom actions in the installer that spawn visible cons...	8.5 High	—	0,12%	1 Sep 2026
CVE-2026-13348 CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to gain unauthorized access to a user account by perf...	6.9 Medium	—	0,31%	1 Sep 2026
CVE-2026-13337 CWE-564: SQL Injection: Hibernate vulnerability exists that could allow the injection of a malicious HQL query in the NetBotz database when a malicious user is logged int...	5.1 Medium	—	0,18%	1 Sep 2026
CVE-2026-13336 CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause execution of Linux Operating syst...	7.3 High	—	0,60%	1 Sep 2026
CVE-2026-12663 A security issue exists within ControlFLASH™, where the installer grants write permissions to the "Everyone" group on a product installation directory. This could allow a...	7.0 High	—	0,12%	1 Sep 2026
CVE-2026-12661 A denial-of-service security issue exists within FactoryTalk® Historian Machine Edition. A network adjacent attacker who is authenticated could send crafted requests to...	4.8 Medium	—	0,16%	1 Sep 2026
CVE-2025-12768 A security issue exists within FactoryTalk® Historian Machine Edition. An attacker with low-level authentication could exploit this vulnerability to achieve remote code e...	8.6 High	—	0,31%	1 Sep 2026
CVE-2024-14047 elastic winlogbeat A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users. A low-privileged attacker with...	7.1 High	—	0,11%	1 Sep 2026
CVE-2024-10085 CWE-770: Allocation of Resources Without Limits or Throttling vulnerability exists that could cause denial of service of the OPC UA communication platform when a large nu...	8.2 High	—	0,32%	1 Sep 2026
CVE-2026-84235 A denial-of-service security issue exists in the affected product. The security issue stems from a crafted CIP packet being sent crashing the module. The device requires...	8.7 High	—	0,43%	1 Sep 2026
CVE-2026-84149 This vulnerability exists in the ERP system due to exposure of repository information through a publicly accessible .git directory. An unauthenticated remote attacker cou...	9.2 Critical	—	0,54%	1 Sep 2026
CVE-2026-84148 This vulnerability exists in the ERP system due to improper authentication and authorization controls in the API endpoint. An unauthenticated remote attacker could exploi...	9.2 Critical	—	0,68%	1 Sep 2026
CVE-2026-84147 This vulnerability exists in the ERP system due to improper authentication controls and inadequate file type validation at the API endpoint. An unauthenticated remote att...	10.0 Critical	—	0,96%	1 Sep 2026
CVE-2026-84145 mozilla firefox, mozilla thunderbird Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14. Some of these bugs showed evidence of memory corruption or another sec...	7.5 High	—	0,37%	1 Sep 2026
CVE-2026-84144 mozilla firefox, mozilla thunderbird Internally found bugs present in Thunderbird 154 and Thunderbird ESR 153.1. Some of these bugs showed evidence of memory corruption or another security-relevant defect an...	7.5 High	—	0,43%	1 Sep 2026
CVE-2026-84143 mozilla firefox, mozilla thunderbird Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14. Some of these bugs showed evidence of memory corruption or another sec...	9.8 Critical	—	0,38%	1 Sep 2026
CVE-2026-84142 mozilla firefox, mozilla thunderbird Internally found bugs present in Thunderbird 154. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with eno...	9.8 Critical	—	0,56%	1 Sep 2026
CVE-2026-84141 mozilla firefox, mozilla thunderbird Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.	9.8 Critical	—	0,34%	1 Sep 2026
CVE-2026-84140 mozilla firefox, mozilla thunderbird Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.	9.8 Critical	—	0,18%	1 Sep 2026
CVE-2026-84139 mozilla firefox, mozilla thunderbird Clickjacking issue in the DOM: Events component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.	6.1 Medium	—	0,34%	1 Sep 2026
CVE-2026-84138 mozilla firefox, mozilla thunderbird Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 155 and Thunderbird 155.	6.5 Medium	—	0,37%	1 Sep 2026
CVE-2026-84137 mozilla firefox, mozilla thunderbird Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.	4.3 Medium	—	0,13%	1 Sep 2026
CVE-2026-84136 mozilla firefox, mozilla thunderbird Other issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.	6.1 Medium	—	0,20%	1 Sep 2026
CVE-2026-84135 mozilla firefox mobile Other issue in Firefox Focus for Android. This vulnerability was fixed in Firefox 155.	9.8 Critical	—	0,45%	1 Sep 2026
CVE-2026-84134 mozilla firefox, mozilla thunderbird Other issue in the Profile Backup component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.	9.8 Critical	—	0,57%	1 Sep 2026
CVE-2026-84133 mozilla firefox, mozilla thunderbird Site isolation issue in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.	9.8 Critical	—	0,19%	1 Sep 2026
CVE-2026-84132 mozilla firefox, mozilla thunderbird Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.	7.5 High	—	0,26%	1 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.