Katalog CVE (hal. 528)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.288 (Critical 36.348 · High 105.269 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 25 Okt 2026, 12:26 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 26.351–26.400 dari 263.288 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-52730 Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing Authorization in Module:...	4.3 Medium	—	0,29%	31 Agt 2026
CVE-2026-51740 Incorrect access control in the killProcess function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to terminate critical services via sending a cr...	9.8 Critical	—	0,64%	31 Agt 2026
CVE-2026-51739 Incorrect access control in the CloudSrvVersionCheck function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger cloud update checks via sen...	5.9 Medium	—	0,43%	31 Agt 2026
CVE-2026-51738 Incorrect access control in the LoadDefSettings function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reset the device configuration and reboo...	9.8 Critical	—	0,64%	31 Agt 2026
CVE-2026-51737 Incorrect access control in the clearTracerouteLog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase traceroute logs via sending a c...	5.3 Medium	—	0,40%	31 Agt 2026
CVE-2026-51736 Incorrect access control in the clearSyslog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase system logs via sending a crafted POST...	9.1 Critical	—	0,51%	31 Agt 2026
CVE-2026-51735 Incorrect access control in the showSyslog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to retrieve recent system logs via sending a cra...	7.5 High	—	0,50%	31 Agt 2026
CVE-2026-51734 Incorrect access control in the informSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger mesh slave update coordination...	9.8 Critical	—	0,64%	31 Agt 2026
CVE-2026-51733 Incorrect access control in the FirmwareUpgrade function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Wi-Fi schedule entries via sendin...	9.8 Critical	—	0,64%	31 Agt 2026
CVE-2026-51732 Incorrect access control in the delWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Wi-Fi schedule entries via sen...	5.3 Medium	—	0,40%	31 Agt 2026
CVE-2026-51731 Incorrect access control in the delVlanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove VLAN entries via sending a crafted POS...	9.1 Critical	—	0,51%	31 Agt 2026
CVE-2026-14697 net_ipv6_send_ns() in subsys/net/ip/ipv6_nbr.c allocates a transmit net_pkt for a Neighbor Solicitation. When it is called with a data packet pending on an unresolved nei...	6.5 Medium	—	0,18%	31 Agt 2026
CVE-2026-13732 A flaw was found in GDB's STABS debug format parser. The read_member_functions() function in gdb/stabsread.c contains a linked list removal bug in the code that separates...	7.0 High	—	0,13%	31 Agt 2026
CVE-2026-83497 Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows a remote authenticated user with basic read/search p...	8.8 High	—	0,96%	31 Agt 2026
CVE-2026-82821 A vulnerability was determined in FLVMeta up to 1.2.2. Affected by this vulnerability is the function amf_object_get of the file src/amf.c of the component AMF Object Par...	4.3 Medium	—	0,58%	31 Agt 2026
CVE-2026-82820 A vulnerability was found in FLVMeta up to 1.2.2. Affected is the function amf_string_new of the file src/amf.c of the component AMF String Processing. The manipulation o...	4.3 Medium	—	0,63%	31 Agt 2026
CVE-2026-82818 A vulnerability was determined in dibo-software diboot 3.8.0. This affects an unknown part of the file /api/iam/tenant/resource of the component Tenant Resource Assignmen...	6.3 Medium	—	0,35%	31 Agt 2026
CVE-2026-72001 Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access any protected resource by supplying an attacker-con...	8.1 High	—	0,49%	31 Agt 2026
CVE-2026-53553 Goploy is an open-source automation deployment system. Prior to version 1.18.0, a severe path traversal vulnerability exists in its backend API endpoints, specifically /d...	7.7 High	—	0,47%	31 Agt 2026
CVE-2026-53552 Goploy is an open-source automation deployment system. In versions 1.17.5 and prior, Project.AddFile, Project.EditFile, Project.RemoveFile, and Project.Edit in cmd/server...	9.6 Critical	—	0,35%	31 Agt 2026
CVE-2026-53508 oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.2 through version 1.18.0, oasdiff did not enforce...	6.0 Medium	—	0,50%	31 Agt 2026
CVE-2026-53507 oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review on every pull request. Before version 0.0.51, the oasdiff actions resol...	8.3 High	—	0,50%	31 Agt 2026
CVE-2026-14696 When Ethernet bridging is enabled (CONFIG_NET_ETHERNET_BRIDGE), eth_bridge_input_process() in subsys/net/l2/ethernet/bridge/bridge_input.c decides how each frame received...	6.5 Medium	—	0,20%	31 Agt 2026
CVE-2026-14368 The LwM2M JSON content formatter's get_string() in subsys/net/lib/lwm2m/lwm2m_rw_json.c copies a parsed JSON string into a caller-supplied buffer and NUL-terminates it. T...	5.4 Medium	—	0,23%	31 Agt 2026
CVE-2026-14367 The I3C IBI subsystem in drivers/i3c/i3c_ibi_workq.c hands out statically-allocated work nodes through a free-list i3c_ibi_work_nodes_free implemented as a plain sys_slis...	3.1 Low	—	0,10%	31 Agt 2026
CVE-2023-31308 A malicious virtual function can invoke the certain command handlers in the SMU, causing a denial of service due to out-of-bounds memory read.	3.3 Low	—	0,10%	31 Agt 2026
CVE-2023-20511 Release of an invalid pointer in the AMD kernel mode driver (KMD) could allow a privileged attacker to create a double free condition potentially leading to arbitrary cod...	6.4 Medium	—	0,23%	31 Agt 2026
CVE-2026-82817 A vulnerability was found in dibo-software diboot 3.8.0. Affected by this issue is some unknown functionality of the file /admin/ of the component Tenant Administrator Ma...	6.3 Medium	—	0,35%	31 Agt 2026
CVE-2026-82816 A vulnerability has been found in dibo-software diboot 3.8.0. Affected by this vulnerability is an unknown functionality of the file /api/ai-session/ of the component AI...	6.3 Medium	—	0,37%	31 Agt 2026
CVE-2026-82815 A flaw has been found in MegaEase EaseProbe up to 2.3.0. Affected is the function realIP of the file web/server.go of the component Middleware. This manipulation of the a...	7.3 High	—	0,51%	31 Agt 2026
CVE-2026-82813 A vulnerability was detected in BEN Group TubeBuddy for YouTube Extension up to 5.8.4 on Chrome. This impacts the function TBGlobal.GetToken of the file tubebuddymaster1....	5.4 Medium	—	0,22%	31 Agt 2026
CVE-2026-82811 A security vulnerability has been detected in Toggl OÜ Toggl Track Extension 4.11.16. This affects an unknown function of the component postMessage Handler. The manipulat...	5.4 Medium	—	0,22%	31 Agt 2026
CVE-2026-79750 MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to...	7.7 High	—	0,43%	31 Agt 2026
CVE-2026-79749 MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to...	7.6 High	—	0,45%	31 Agt 2026
CVE-2026-79748 MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to...	9.9 Critical	—	0,64%	31 Agt 2026
CVE-2026-79747 MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to...	7.1 High	—	0,30%	31 Agt 2026
CVE-2026-79746 MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to...	8.1 High	—	0,43%	31 Agt 2026
CVE-2026-79745 MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to...	7.1 High	—	0,44%	31 Agt 2026
CVE-2026-79744 MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to...	8.8 High	—	0,56%	31 Agt 2026
CVE-2026-79743 MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to...	6.9 Medium	—	0,54%	31 Agt 2026
CVE-2026-51730 Incorrect access control in the delWiFiAclRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Wi-Fi ACL rules via sending a cra...	9.1 Critical	—	0,51%	31 Agt 2026
CVE-2026-51729 Incorrect access control in the delDevice function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to request deletion of a managed slave device via...	9.1 Critical	—	0,51%	31 Agt 2026
CVE-2026-51728 Incorrect access control in the UploadFirmwareFile function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to upload a crafted firmware image via s...	9.8 Critical	—	0,64%	31 Agt 2026
CVE-2026-51727 Incorrect access control in the SystemSettings function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to retrieve administrative import and export...	5.3 Medium	—	0,41%	31 Agt 2026
CVE-2026-51726 Incorrect access control in the delParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove parental-control rules via sendi...	9.1 Critical	—	0,51%	31 Agt 2026
CVE-2026-51725 Incorrect access control in the NTPSyncWithHost function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the device clock via sending a cr...	9.1 Critical	—	0,51%	31 Agt 2026
CVE-2026-19953 URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep. nameprep lowercases each host label bu...	6.5 Medium	—	0,23%	31 Agt 2026
CVE-2026-82810 A weakness has been identified in extension.vn 2FA Authenticator Extension 1.0.0.2 on Chrome. The impacted element is the function chrome.runtime.onMessageExternal.addLis...	3.3 Low	—	0,15%	31 Agt 2026
CVE-2026-82809 A security flaw has been discovered in vidIQ Vision for YouTube Extension 3.199.0 on Chrome. The affected element is the function window.addEventListener of the component...	4.3 Medium	—	0,45%	31 Agt 2026
CVE-2026-82808 A vulnerability was identified in Inbox Foundry ActiveInbox Extension up to 7.10.24 on Chrome. Impacted is an unknown function of the file dist/service-worker.production-...	7.3 High	—	0,47%	31 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.