Katalog CVE (hal. 537)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.295 (Critical 36.348 · High 105.272 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 25 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 26.801–26.850 dari 263.295 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-55784 free5GC is an open-source implementation of the 5G core network. In version 1.4.4 and earlier, the AUSF component stores per-subscriber authentication state in a global s...	7.5 High	—	0,42%	28 Agt 2026
CVE-2026-55779 Silverstripe Versioned provides versioning for Silverstripe models. Prior to 3.2.1, RestoreAction::getRestoreMessage() in src/RestoreAction.php builds ArchiveAdmin restor...	5.4 Medium	—	0,34%	28 Agt 2026
CVE-2026-55764 Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, Klever-Go allows a mint-role holder to bypass a finite per-nonce MaxSupply on the s...	8.7 High	—	0,54%	28 Agt 2026
CVE-2026-82333 expressjs multer multer is a middleware for handling multipart/form-data in Node.js. A small multipart request with two specially crafted text field names can make multer's field parser s...	7.5 High	—	0,49%	28 Agt 2026
CVE-2026-82018 IGEL OS 12 before 12.9.0, 12.8.3 LTS and IGEL OS 11 before 11.11.150 contain a secure boot bypass vulnerability in the GRUB boot stage that allows physically present atta...	6.1 Medium	—	0,25%	28 Agt 2026
CVE-2026-82017 IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry parameter injection vulnerability that allows attackers with physical access to execute a...	7.6 High	—	0,21%	28 Agt 2026
CVE-2026-81533 mongodb bi connector odbc driver An application using the MongoDB BI Connector ODBC Driver may encounter a memory-safety issue when a submitted SQL statement contains an unusually long run of digits foll...	7.1 High	—	0,37%	28 Agt 2026
CVE-2026-81532 mongodb bi connector odbc driver A user able to submit SQL through an application using the MongoDB Connector for BI ODBC driver can supply a positioned-cursor statement whose cursor name exceeds the siz...	8.8 High	—	0,49%	28 Agt 2026
CVE-2026-81520 mongodb bi connector A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication session open indefinitely by beginning a SASL-based login exc...	7.5 High	—	0,42%	28 Agt 2026
CVE-2026-81518 mongodb bi connector When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a...	7.5 High	—	0,25%	28 Agt 2026
CVE-2026-81517 mongodb bi connector An unauthenticated party able to reach the port of a MongoDB Connector for BI (mongosqld) instance may generate enough routine connection log activity to exhaust the stor...	7.5 High	—	0,46%	28 Agt 2026
CVE-2026-81490 mongodb bi connector A database user able to create a view in a namespace that MongoDB Connector for BI samples can cause the schema-sampling routine to stop functioning by defining a view wh...	7.7 High	—	0,47%	28 Agt 2026
CVE-2026-77078 expressjs multer multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an uncaught Rang...	7.5 High	—	0,49%	28 Agt 2026
CVE-2026-77063 expressjs multer multer is a middleware for handling multipart/form-data in Node.js. When an application uses an asynchronous fileFilter together with the fileSize limit, a race condition...	3.7 Low	—	0,23%	28 Agt 2026
CVE-2026-77037 expressjs multer multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream finishes,...	7.5 High	—	0,35%	28 Agt 2026
CVE-2026-76651 A buffer overflow vulnerability exists in the embedded HTTP service in TL-WR841N v14 when processing multipart/form-data requests. Insufficient validation of an attacker-...	5.3 Medium	—	0,44%	28 Agt 2026
CVE-2026-76650 A NULL pointer dereference vulnerability exists in TL-WR841N v14 in the UPnP service when processing SOAP state variable query requests. A specially crafted SOAP query ma...	5.3 Medium	—	0,27%	28 Agt 2026
CVE-2026-76649 A NULL pointer dereference vulnerability exists in TL-WR841N v14 in the UPnP service when processing SOAP action requests. A specially crafted SOAP action request contain...	5.3 Medium	—	0,27%	28 Agt 2026
CVE-2026-75118 A pre-authentication stack-based buffer overflow vulnerability exists in the http_gdpr_decrypt function of TL-MR100 V3.20 due to insufficient bounds checking of encrypted...	8.7 High	—	0,37%	28 Agt 2026
CVE-2026-55763 Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, processPercentageRoyaltiesTransfer in core/kapp/accounts/accounts.go calls SubFromB...	8.7 High	—	0,51%	28 Agt 2026
CVE-2026-55696 PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, AttachmentViewer.setAttachment in js/privatebin.js uses getAttachment...	4.3 Medium	—	0,37%	28 Agt 2026
CVE-2026-55678 Arc is an open, SQL-native time-series database for telemetry. From 26.02.1 until 26.06.2, Arc Enterprise clustering accepts cluster join requests without authentication...	6.9 Medium	—	0,67%	28 Agt 2026
CVE-2026-51665 Incorrect access control in the getTracerouteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain traceroute diagnostic logs via s...	4.3 Medium	—	0,29%	28 Agt 2026
CVE-2026-51664 Incorrect access control in the getTelnetCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain Telnet service enablement status inf...	4.3 Medium	—	0,29%	28 Agt 2026
CVE-2026-51663 Incorrect access control in the getWiFiApcliScan function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger wireless scans and retrieve AP-...	9.8 Critical	—	0,64%	28 Agt 2026
CVE-2026-51662 Incorrect access control in the getCloudSrvCheckStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain cloud firmware check statu...	7.5 High	—	0,50%	28 Agt 2026
CVE-2026-51661 Incorrect access control in the getPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain port-forwarding rules via sen...	9.1 Critical	—	0,51%	28 Agt 2026
CVE-2026-3686 IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 is vulnerable to a denial of service due to improper limitation of resources.	6.2 Medium	—	0,16%	28 Agt 2026
CVE-2026-3627 ibm concert IBM Concert 1.0.0 through 2.3.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add...	9.1 Critical	—	0,51%	28 Agt 2026
CVE-2026-22056 StorageGRID (formerly StorageGRID Webscale) versions 11.5 and higher in a non-standard configuration and scenario are susceptible to a Denial of Service vulnerability. Su...	2.3 Low	—	0,25%	28 Agt 2026
CVE-2026-19295 langflow IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafte...	9.9 Critical	—	3,0%	28 Agt 2026
CVE-2026-19294 langflow IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute and read any user's private flow due to improper authorization.	6.5 Medium	—	0,24%	28 Agt 2026
CVE-2026-19286 langflow IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to improper enforcement of security restrictions on the A2A public endpo...	9.8 Critical	—	0,80%	28 Agt 2026
CVE-2026-18904 langflow IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to obtain sensitive information and inject unauthorized messages due to a namespace collision between...	8.2 High	—	0,33%	28 Agt 2026
CVE-2026-18899 langflow IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to read arbitrary files due to path traversal.	7.5 High	—	0,52%	28 Agt 2026
CVE-2026-18891 langflow IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary flows and access sensitive information due to improper authentication.	8.2 High	—	0,32%	28 Agt 2026
CVE-2026-18729 langflow IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.	8.8 High	—	1,8%	28 Agt 2026
CVE-2026-18545 langflow IBM Langflow OSS 1.0.0 through 1.11.1 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the...	4.3 Medium	—	0,22%	28 Agt 2026
CVE-2026-18527 IBM Administration Runtime Expert for i 1R1M0 IBM Application Runtime Expert (ARE) for i could allow a remote attacker to gain elevated privileges, caused by ARE GUI comp...	9.9 Critical	—	0,29%	28 Agt 2026
CVE-2026-17203 IBM Administration Runtime Expert for i 1R1M0 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication enforcement.	7.5 High	—	0,43%	28 Agt 2026
CVE-2026-16821 ibm aix, ibm vios IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to a format string vulnerability.	7.8 High	—	0,10%	28 Agt 2026
CVE-2026-13735 Zephyr's WireGuard implementation in subsys/net/lib/wireguard/wg_crypto.c mishandled keepalive packets. In wg_process_data_message(), any type-4 transport-data message wh...	3.7 Low	—	0,25%	28 Agt 2026
CVE-2026-13734 Zephyr's WireGuard VPN data-plane receive handler wg_process_data_message() in subsys/net/lib/wireguard/wg_crypto.c validated the anti-replay counter too late. After AEAD...	6.5 Medium	—	0,25%	28 Agt 2026
CVE-2025-64649 ibm concert IBM Concert 1.0.0 through 2.3.1 could allow a remote attacker to perform unauthorized actions using man in the middle techniques due to improper certificate validation.	5.9 Medium	—	0,17%	28 Agt 2026
CVE-2025-36290 ibm integrated analytics system IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sen...	5.9 Medium	—	0,16%	28 Agt 2026
CVE-2025-36271 ibm integrated analytics system IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive infor...	5.9 Medium	—	0,16%	28 Agt 2026
CVE-2026-82343 gimp, redhat enterprise linux A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count parameter. Th...	6.1 Medium	—	0,18%	28 Agt 2026
CVE-2026-82329 Advisory jfrog artifactory JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrativ...	9.8 Critical	KEV	14,4%	28 Agt 2026
CVE-2026-82306 StarRocks through 4.0.13 contains an information disclosure vulnerability in the query_detail endpoint that returns unfiltered query history for all users. Authenticated...	6.5 Medium	—	0,55%	28 Agt 2026
CVE-2026-82291 HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers c...	8.1 High	—	0,55%	28 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.