Katalog CVE (hal. 553)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.383 (Critical 36.349 · High 105.290 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 26 Okt 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 27.601–27.650 dari 263.383 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-30072 A NULL pointer dereference in the CDR processing path of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying crafted payload.	7.5 High	—	0,46%	27 Agt 2026
CVE-2026-30071 An issue in the RechargePut function of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.	7.5 High	—	0,46%	27 Agt 2026
CVE-2026-30070 An issue in the HandleGetSharedData function of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.	7.5 High	—	0,46%	27 Agt 2026
CVE-2026-30069 A NULL pointer dereference in the UDMC registration handler component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying crafted payload.	7.5 High	—	0,46%	27 Agt 2026
CVE-2026-30068 Improper input validation in the HandleUpdate function (/sbi/parameter_provision.go) of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted i...	7.5 High	—	0,46%	27 Agt 2026
CVE-2026-30067 An issue in the complexQueryFilterSubprocess function in the NRF Discovery service of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted inp...	7.5 High	—	0,46%	27 Agt 2026
CVE-2026-30064 Improper input validation in the buildFilter function (processor/processor.go) of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.	7.5 High	—	0,46%	27 Agt 2026
CVE-2026-30063 An issue in the NF Discovery endpoint of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted snssais query.	7.5 High	—	0,46%	27 Agt 2026
CVE-2026-30062 An issue in the NGAP handler of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted NAS PDU.	7.5 High	—	0,46%	27 Agt 2026
CVE-2026-30060 An issue in free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) when parsing crafted SUCI data during UE registration.	7.5 High	—	0,46%	27 Agt 2026
CVE-2026-30059 An issue in the NAS decoder component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted Registration Request message.	7.5 High	—	0,46%	27 Agt 2026
CVE-2026-30058 Improper Input Validation in the HTTPModifySubscription handler of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.	7.5 High	—	0,46%	27 Agt 2026
CVE-2026-30057 An issue in the CreateUEContext handler component of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted request.	7.5 High	—	0,46%	27 Agt 2026
CVE-2026-30056 A NULL pointer dereference in the AMF NGAP Dispatcher component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying crafted NGAP messages...	7.5 High	—	0,46%	27 Agt 2026
CVE-2026-30051 An issue in the CreateUEContextProcedure function (/v1/ue-contexts/{supi}) of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted P...	7.5 High	—	0,46%	27 Agt 2026
CVE-2026-30050 An issue in the ModifyAMFEventSubscriptionProcedure function (processor/event_exposure.go) of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via suppl...	7.5 High	—	0,46%	27 Agt 2026
CVE-2026-30047 A reachable assertion vulnerability in the /nsmf-pdusession/v1/sm-contexts component of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a...	7.5 High	—	0,46%	27 Agt 2026
CVE-2026-30046 A reachable assertion vulnerability in the NUDM-UECM interface of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted DELETE reques...	7.5 High	—	0,46%	27 Agt 2026
CVE-2026-30045 An integer overflow in the /nnrf-disc/v1/nf-instances component of open5gs v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted HTTP/2 GET r...	7.5 High	—	0,56%	27 Agt 2026
CVE-2026-26899 An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR #15 (< 2026-01-17). The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenti...	8.8 High	—	0,79%	27 Agt 2026
CVE-2026-26897 An issue in EcoOnline EHS (com.airsweb.v10) application for Android, version 0.2.499 allows a remote attacker to obtain sensitive information and execute arbitrary code v...	9.8 Critical	—	1,1%	27 Agt 2026
CVE-2026-26459 ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a vulnerability in the option parsing logic that causes a segmentation fault when processing malformed COAP messag...	7.5 High	—	0,49%	27 Agt 2026
CVE-2026-26457 ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a null pointer dereference vulnerability in the coap_dump_msg() function when processing COAP messages containing...	7.5 High	—	0,49%	27 Agt 2026
CVE-2026-26456 A null pointer dereference vulnerability exists in the server-side session management logic of ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5. The issue is caused by a ra...	7.5 High	—	0,38%	27 Agt 2026
CVE-2026-26453 ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a null pointer dereference vulnerability in the coap_server_handle_session() function when processing COAP message...	7.5 High	—	0,49%	27 Agt 2026
CVE-2026-26452 ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 lcontains a vulnerability in the option parsing logic that causes a segmentation fault when processing COAP messages contai...	7.5 High	—	0,49%	27 Agt 2026
CVE-2026-19889 GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.9.0 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2...	8.2 High	—	0,36%	27 Agt 2026
CVE-2026-19854 When the ClickHouse plugin uses Native protocol (the default) with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in...	6.1 Medium	—	0,07%	27 Agt 2026
CVE-2026-16279 An Improper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could allow an attacker to g...	9.3 Critical	—	0,36%	27 Agt 2026
CVE-2026-11754 Observable discrepancy vulnerability in Seres Software syWEB allows Account Footprinting. This issue affects syWEB: through 27082026. NOTE: The vendor was contacted and...	5.3 Medium	—	0,33%	27 Agt 2026
CVE-2026-11747 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Seres Software syWEB allows Reflected XSS. This issue affects syWEB...	6.1 Medium	—	0,25%	27 Agt 2026
CVE-2025-62343 HCL IntelliOps Event Management (IEM) is affected by an Admin Session Concurrency Vulnerability. it may allows user sessions to remain active after logout or session dele...	3.1 Low	—	0,24%	27 Agt 2026
CVE-2025-62342 HCL IntelliOps Event Management (IEM) is affected by a Session Deletion Vulnerability. It may allow improper handling of user sessions, resulting in sessions not being fu...	6.4 Medium	—	0,26%	27 Agt 2026
CVE-2026-81814 Affected versions of Flowintel render calendar event titles using innerHTML. Because those titles are derived from case titles, a user able to create or modify a case tit...	5.1 Medium	—	0,40%	27 Agt 2026
CVE-2026-81753 Affected versions of Flowintel render Mermaid blocks contained in stored case notes without sufficiently neutralizing attacker-controlled markup. Because Mermaid note con...	5.1 Medium	—	0,55%	27 Agt 2026
CVE-2026-81743 Affected versions of Flowintel allow the LOG_FILE configuration value to be modified through system settings without restricting it to a filename inside the intended log...	7.5 High	—	0,42%	27 Agt 2026
CVE-2026-81677 The ‘/ws/apiprensa/getVideo’ endpoint is vulnerable to SQL injection due to improper validation of the GET parameter `id_ambito`. An attacker can inject SQL syntax that b...	8.8 High	—	0,39%	27 Agt 2026
CVE-2026-81676 A vulnerability in the endpoint ‘/ws/apitribuna/ultimosVideos’ where the `limit_videos` parameter is directly concatenated into a MariaDB SQL query without proper sanitiz...	8.8 High	—	0,47%	27 Agt 2026
CVE-2026-81675 The endpoint ‘/ws/apiprensa/getVideoUltimasSeccion’ contains an SQL injection vulnerability in the id_seccion parameter. The parameter is directly embedded in a complex S...	9.3 Critical	—	0,43%	27 Agt 2026
CVE-2026-81674 The endpoint ‘/ws/apiprensa/getVideoNextPrev’ is vulnerable to SQL injection via the id_ambito parameter. Unsanitized input is directly incorporated into a MariaDB query,...	9.3 Critical	—	0,48%	27 Agt 2026
CVE-2026-81673 The ‘/ws/apitribuna/setVisita’ endpoint is vulnerable to SQL injection through the id_video and id_ambito parameters. The application does not validate or sanitize these...	9.3 Critical	—	0,61%	27 Agt 2026
CVE-2026-81672 SQL injection vulnerability in the ‘/ws/apiprensa/getVideoSubcanal’ endpoint due to improper handling of the id_video parameter. The application does not sanitize input b...	9.3 Critical	—	0,48%	27 Agt 2026
CVE-2026-81668 A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated, low-privi...	5.4 Medium	—	0,24%	27 Agt 2026
CVE-2026-81662 Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint. While configuration values were normalized to Python l...	8.6 High	—	0,53%	27 Agt 2026
CVE-2026-81659 Affected versions of Flowintel allow attacker-controlled note content to be processed by Pandoc and XeLaTeX during PDF export in a way that can cause local files on the F...	7.1 High	—	0,45%	27 Agt 2026
CVE-2026-81658 redhat satellite, theforeman foreman A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, lo...	6.5 Medium	—	0,34%	27 Agt 2026
CVE-2026-81562 A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a manipulation re...	5.3 Medium	—	1,1%	27 Agt 2026
CVE-2026-81560 A vulnerability was identified in blackms aistack up to 1.6.1. Affected by this issue is some unknown functionality of the file src/web/server.ts of the component Static...	5.3 Medium	—	0,69%	27 Agt 2026
CVE-2026-74233 Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmwar...	9.8 Critical	—	3,4%	27 Agt 2026
CVE-2026-74232 Zbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink ZBT-ZBT7621 firmware 1.0.0.3.001, MoreQuick MQAC-7...	9.8 Critical	—	0,81%	27 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.