Katalog CVE (hal. 548)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.383 (Critical 36.349 · High 105.290 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 26 Okt 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 27.351–27.400 dari 263.383 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-78239 Xiiaozet LK100W exposes a critical management function that can be invoked without authentication, allowing a remote attacker to enable administrative services that sho...	9.8 Critical	—	0,77%	28 Agt 2026
CVE-2026-78037 Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated attacker may be able to execute arbitrary operating s...	8.8 High	—	1,9%	28 Agt 2026
CVE-2026-77977 Ebyte gateway product's vendor configuration utility does not require authentication before allowing certain disruptive administrative actions when default credentials...	8.1 High	—	0,37%	28 Agt 2026
CVE-2026-77358 cpp-httplib is a C++ header-only HTTP/HTTPS library. In versions 0.33.0 through 0.50.0, the TLS-enabled WebSocket client frees the TLS session before closing the WebSocke...	8.2 High	—	0,45%	28 Agt 2026
CVE-2026-77341 cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes trailer header names and values directly to the so...	5.3 Medium	—	0,46%	28 Agt 2026
CVE-2026-76945 The affected Ebyte device relies on client-managed authentication tokens without sufficient server-side validation. An attacker may replay or manipulate authentication...	7.5 High	—	0,50%	28 Agt 2026
CVE-2026-76943 Xiiaozet LK100Wt contains an authentication weakness within an administrative service that may allow an attacker to bypass intended access controls and obtain command e...	9.8 Critical	—	1,0%	28 Agt 2026
CVE-2026-76940 The affected Ebyte device does not restrict repeated authentication attempts through rate limiting or account lockout mechanisms. This could allow an attacker to perfor...	7.5 High	—	0,50%	28 Agt 2026
CVE-2026-76179 An improper protection of authentication tokens vulnerability exists in certain Ebyte gateway products. Authentication tokens used by the web management interface are i...	9.8 Critical	—	0,65%	28 Agt 2026
CVE-2026-76060 An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a...	8.8 High	—	2,4%	28 Agt 2026
CVE-2026-75814 The Ebyte device does not adequately verify the origin or authenticity of requests submitted to the web management interface. An unauthenticated remote attacker could p...	8.8 High	—	0,25%	28 Agt 2026
CVE-2026-75813 Certain configuration endpoints may lack proper server-side authorization checks, allowing unauthorized users to access or modify sensitive device settings. This could...	7.5 High	—	0,36%	28 Agt 2026
CVE-2026-75548 The affected Ebyte device web management interface does not restrict the interface from being rendered within an external frame. An unauthenticated remote attacker coul...	5.4 Medium	—	0,29%	28 Agt 2026
CVE-2026-75419 go-wind-cms (GoWind) before 1.0.0 has a missing authorization vulnerability. The NewAuthorizer() function in app/admin/service/internal/data/data.go and app/app/service/i...	8.8 High	—	0,55%	28 Agt 2026
CVE-2026-75418 A path traversal vulnerability exists in the built-in preview/development web server of Lektor <3.3.14 on Windows. An attacker with network access to the server can send...	7.5 High	—	0,63%	28 Agt 2026
CVE-2026-75417 A SQL injection vulnerability was found in YzmCMS 7.5. The issue occurs in the get_arrchildid() function within application/admin/controller/category.class.php, where the...	7.2 High	—	0,50%	28 Agt 2026
CVE-2026-75339 The storage endpoint /storage/upload of cjbi admin3 v3.0.0 are missing permission checks. /Any logged-in user can upload arbitrary files, and any anonymous attacker can d...	8.8 High	—	0,42%	28 Agt 2026
CVE-2026-75337 The static resource interface /api/static/{deployKey}/ of Yu AI Code Mother v4.3 is vulnerable to path traversal. The user-controlled path is concatenated to the preview...	9.8 Critical	—	0,61%	28 Agt 2026
CVE-2026-73839 Administrative credentials may be exposed in plaintext within the Ebyte device's management interface, increasing the risk of credential compromise through visual or re...	4.6 Medium	—	0,20%	28 Agt 2026
CVE-2026-73809 A cleartext transmission of sensitive information vulnerability exists in certain Ebyte gateway products. The web management interface does not adequately protect sensi...	7.5 High	—	0,22%	28 Agt 2026
CVE-2026-73125 Ebyte device web management interface does not consistently enforce authentication before granting access to administrative functionality. An unauthenticated remote att...	9.8 Critical	—	0,80%	28 Agt 2026
CVE-2026-71396 Bendix EC80 Brake ECU uses hard-coded credentials, which could allow an attacker to disable automatic traction control.	5.4 Medium	—	0,24%	28 Agt 2026
CVE-2026-71187 The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacker may generate valid authentication requests and...	9.8 Critical	—	0,78%	28 Agt 2026
CVE-2026-69658 MQTT credentials and control traffic are transmitted in cleartext, exposing sensitive information to network-level attackers. This may enable unauthorized device impers...	9.8 Critical	—	0,34%	28 Agt 2026
CVE-2026-68967 Bendix EC80 Brake ECU is vulnerable to an out-of-bounds write, which could allow an attacker to deliver a payload that could establish an arbitrary write primitive, whi...	6.5 Medium	—	0,26%	28 Agt 2026
CVE-2026-68929 FastGPT is an open-source LLM platform for building AI applications on a knowledge base. In versions prior to 4.15.2, the WeChat (iLink) share-channel endpoints authorize...	9.3 Critical	—	0,44%	28 Agt 2026
CVE-2026-67560 Bendix EC80 Brake ECU is vulnerable to a stack-based buffer overflow, which may allow an attacker to crash the ECU. A crafted payload can then be used to remotely exec...	7.5 High	—	0,33%	28 Agt 2026
CVE-2026-61783 Advisory wazuh Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, an authenticated...	6.5 Medium	—	0,41%	28 Agt 2026
CVE-2026-5706 In Bluetooth Mesh SDK 6.1.4 and earlier, malformed extended advertisements can trigger out-of-bounds writes leading to stack corruption and remote code execution. These m...	8.9 High	—	0,39%	28 Agt 2026
CVE-2026-54330 Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway (RGW) SigV4...	8.1 High	—	0,37%	28 Agt 2026
CVE-2026-54085 Advisory wazuh Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.2.0 through 4.14.6, multiple active r...	7.1 High	—	0,42%	28 Agt 2026
CVE-2026-54084 Advisory wazuh Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.0.0 through 4.14.6, a malicious or ma...	5.3 Medium	—	0,20%	28 Agt 2026
CVE-2026-54083 Advisory wazuh Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. The ip-customblock active response script contain...	8.1 High	—	0,57%	28 Agt 2026
CVE-2026-50152 Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fa...	9.1 Critical	—	0,25%	28 Agt 2026
CVE-2026-44629 Improper access control to the Synergis Softwire installation folder. This vulnerability affects Streamvault all-in-one appliances (SV-100E and SV-300E series) and Synerg...	7.9 High	—	0,15%	28 Agt 2026
CVE-2026-39944 Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the RADOS Gateway (RGW) protects ST...	8.8 High	—	0,29%	28 Agt 2026
CVE-2026-38350 An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via suppl...	7.5 High	—	0,46%	28 Agt 2026
CVE-2026-38349 An integer overflow in the hScale16To19_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplyin...	7.5 High	—	0,46%	28 Agt 2026
CVE-2026-38348 An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image f...	7.5 High	—	0,46%	28 Agt 2026
CVE-2026-38347 A heap overflow in the ff_sws_alphablendaway function (libswscale/alphablend.c) of FFmpeg git-master commit 722a217 allows attackers to cause a Denial of Service (DoS) vi...	7.5 High	—	0,46%	28 Agt 2026
CVE-2026-38346 An integer overflow in the yuv2planeX_8_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplyin...	7.5 High	—	0,46%	28 Agt 2026
CVE-2026-38345 A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Ser...	6.5 Medium	—	0,36%	28 Agt 2026
CVE-2026-38344 A NULL pointer dereference in the get_min_buffer_size function (/libswscale/slice.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) vi...	7.5 High	—	0,46%	28 Agt 2026
CVE-2026-38343 An integer overflow in the libavfilter/vf_scale.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted vid...	6.5 Medium	—	0,36%	28 Agt 2026
CVE-2026-18965 PayRange API is missing proper authorization on management endpoints, which allows verbose details of every device on the PayRange network to be publicly accessible, with...	8.8 High	—	0,44%	28 Agt 2026
CVE-2026-18717 ASE2000 2.35 through 2.37 is vulnerable to an improper certificate validation vulnerability, which may allow an attacker to impersonate the trusted peer, complete the TLS...	7.4 High	—	0,27%	28 Agt 2026
CVE-2026-17610 In SiSDK v2026.6.0 and earlier, high network traffic loads can cause a dropped ACK leading to a denial of service. This is only present for EFR32MG24 and EFR32MG26 device...	6.0 Medium	—	0,25%	28 Agt 2026
CVE-2025-30156 Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the CephX authentication protocol e...	8.9 High	—	0,13%	28 Agt 2026
CVE-2026-81934 Advisory Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support....	7.1 High	—	0,48%	27 Agt 2026
CVE-2026-81931 Unrestricted Upload of File with Dangerous Type in the product photo upload in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated user holding the create prod...	4.8 Medium	—	0,49%	27 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.