Katalog CVE (hal. 559)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.391 (Critical 36.349 · High 105.294 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 26 Okt 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 27.901–27.950 dari 263.391 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2020-15876 An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL inje...	8.8 High	—	0,60%	26 Agt 2026
CVE-2020-15874 An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can execute arbitrary shell commands through a command injection in the /...	8.8 High	—	2,3%	26 Agt 2026
CVE-2026-81036 Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validation routine in crates/http/src/...	8.1 High	—	0,39%	26 Agt 2026
CVE-2026-81035 Midday allows any member of a team to delete it. The delete procedure in apps/api/src/trpc/routers/team.ts authorises the caller with the team-access helper, which return...	8.1 High	—	0,34%	26 Agt 2026
CVE-2026-81034 Netmaker disables certificate verification on the connection to the configured mail server. The sender in pro/email/smtp.go assigns a TLS configuration whose skip-verify...	6.5 Medium	—	0,26%	26 Agt 2026
CVE-2026-81033 Automatisch reveals whether an address is registered through the response to its forgot-password request. The controller at packages/backend/src/controllers/internal/api/...	5.3 Medium	—	0,48%	26 Agt 2026
CVE-2026-81032 NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service. Each daemon starts the web service defined in src/webservice/WebService.cpp, whose bin...	9.8 Critical	—	0,36%	26 Agt 2026
CVE-2026-81031 IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlew...	7.2 High	—	0,41%	26 Agt 2026
CVE-2026-81030 Mage AI does not confine the paths accepted by its browser-items API to the project directory. BrowserItemResource in mage_ai/api/resources/BrowserItemResource.py passes...	6.5 Medium	—	0,48%	26 Agt 2026
CVE-2026-81029 OpenMetadata accepts a caller-supplied post-authentication redirect target and appends the issued token to it. SamlLoginServlet reads the callback request parameter and s...	8.1 High	—	0,55%	26 Agt 2026
CVE-2026-81028 ZLMediaKit confines the downloadFile API to a configured set of root directories with a prefix comparison that does not account for directory boundaries. The configuratio...	4.9 Medium	—	0,52%	26 Agt 2026
CVE-2026-81027 one-api gates one of its two channel-pinning paths and not the other. middleware/auth.go permits a request to name a specific channel either through a suffix on the API k...	8.5 High	—	0,35%	26 Agt 2026
CVE-2026-80428 ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code...	9.8 Critical	—	4,7%	26 Agt 2026
CVE-2026-80427 bestzip builds the argument list for the system zip utility without separating options from operands. The destination archive path and the caller-supplied source paths ar...	8.4 High	—	0,21%	26 Agt 2026
CVE-2026-80426 FiftyOne renders a dataset field's description as markup. The sidebar field-information component at app/packages/core/src/components/FieldLabelAndInfo/index.tsx passes t...	7.1 High	—	0,41%	26 Agt 2026
CVE-2026-54614 DebugKit provides a debugging toolbar for CakePHP applications. Prior to 4.10.3 and 5.2.4, the DebugKit MailPreview feature in src/Controller/MailPreviewController.php ac...	4.3 Medium	—	0,54%	26 Agt 2026
CVE-2026-54606 SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.j...	8.5 High	—	0,58%	26 Agt 2026
CVE-2026-54569 SENAITE.CORE is the core framework for the SENAITE laboratory information management system. From 2.0.0 to 2.6.0, the SENAITE.CORE JSON API permits unauthenticated remote...	9.8 Critical	—	1,2%	26 Agt 2026
CVE-2026-48549 Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 contains a CSRF vulnerability in cmd.cgi. When no Cookie header is present, the double-submit cookie protection ca...	6.5 Medium	—	0,26%	26 Agt 2026
CVE-2026-48548 Nagios Core before 4.5.12 contains a cross-site request forgery vulnerability in cmd.cgi where the CSRF protection mechanism passes validation when the NagFormId cookie i...	6.5 Medium	—	0,21%	26 Agt 2026
CVE-2026-80589 In the Linux kernel, the following vulnerability has been resolved: block: stop the timeout timer when releasing a never added disk disk_release() undoes blk_mq_init_al...	9.8 Critical	—	0,37%	26 Agt 2026
CVE-2026-80588 In the Linux kernel, the following vulnerability has been resolved: mptcp: reclaim forward-allocated memory on RX path errors After commit 9db5b3cec4ec ("mptcp: borrow...	7.5 High	—	0,61%	26 Agt 2026
CVE-2026-80587 In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid combining some incoming suboptions Some MPTCP suboptions are mutually exclusive accordi...	9.8 Critical	—	0,40%	26 Agt 2026
CVE-2026-80586 In the Linux kernel, the following vulnerability has been resolved: mptcp: options: reset DSS fields in case of unexpected size A remote peer could send a malformed DSS...	9.8 Critical	—	0,40%	26 Agt 2026
CVE-2026-80585 In the Linux kernel, the following vulnerability has been resolved: mptcp: fastopen: only mark MPTFO subflows with SYN data Passive TCP Fast Open accepts a valid-cookie...	9.4 Critical	—	0,31%	26 Agt 2026
CVE-2026-80584 In the Linux kernel, the following vulnerability has been resolved: s390/qeth: validate user buffer length in SNMP and ARP query ioctls qeth_snmp_command() and qeth_l3_...	8.4 High	—	0,20%	26 Agt 2026
CVE-2026-80583 In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses The "DEC0 MODE" to "DEC7 MODE" controls are...	7.8 High	—	0,18%	26 Agt 2026
CVE-2026-80582 In the Linux kernel, the following vulnerability has been resolved: drm/shmem_helper: Check VMA boundaries for PMD mappings In the ->huge_fault handler do not install a...	7.8 High	—	0,17%	26 Agt 2026
CVE-2026-80580 In the Linux kernel, the following vulnerability has been resolved: fbdev: bound mode sysfs output to the sysfs buffer mode_string() uses snprintf() which can return a...	7.8 High	—	0,11%	26 Agt 2026
CVE-2026-80579 In the Linux kernel, the following vulnerability has been resolved: fbdev: clear fb_info->mode before deleting a videomode fb_set_var() can delete a mode from info->mod...	7.8 High	—	0,17%	26 Agt 2026
CVE-2026-80578 In the Linux kernel, the following vulnerability has been resolved: fbdev: core: Fix pointer desynchronization in fb_io_read() In fb_io_read(), if copy_to_user() perfor...	7.3 High	—	0,12%	26 Agt 2026
CVE-2026-80576 In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject oversized IBs with per-ring packet limits On GFX rings, amdgpu_cs_p2_ib() passed...	8.8 High	—	0,12%	26 Agt 2026
CVE-2026-80575 In the Linux kernel, the following vulnerability has been resolved: Input: cs40l50-vibra - validate custom data from user space cs40l50_add() copies the custom data of...	7.8 High	—	0,18%	26 Agt 2026
CVE-2026-80574 In the Linux kernel, the following vulnerability has been resolved: Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet Make finger2 (and also fi...	8.4 High	—	0,13%	26 Agt 2026
CVE-2026-80572 In the Linux kernel, the following vulnerability has been resolved: Input: byd - synchronize timer deletion before freeing private data byd_disconnect() uses timer_dele...	7.8 High	—	0,12%	26 Agt 2026
CVE-2026-80570 In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - zero report size on F54 work error In rmi_f54_work(), if an error occurs dur...	7.8 High	—	0,14%	26 Agt 2026
CVE-2026-80569 In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer rmi_f54_work() reads a dia...	7.8 High	—	0,12%	26 Agt 2026
CVE-2026-80568 In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - block s_input when F54 queue is busy Changing the input (diagnostic report t...	7.8 High	—	0,19%	26 Agt 2026
CVE-2026-80565 In the Linux kernel, the following vulnerability has been resolved: crypto: qce - fix error path in devm_qce_register_algs If ops->register_algs() fails, the error path...	7.8 High	—	0,18%	26 Agt 2026
CVE-2026-80561 In the Linux kernel, the following vulnerability has been resolved: libceph: fix multiple unsafe decodes in decode_locker() decode_locker() in cls_lock_client.c contain...	9.8 Critical	—	0,51%	26 Agt 2026
CVE-2026-80560 In the Linux kernel, the following vulnerability has been resolved: openrisc: signal: do not restore privileged SR bits on sigreturn restore_sigcontext() copies the who...	7.8 High	—	0,18%	26 Agt 2026
CVE-2026-80559 In the Linux kernel, the following vulnerability has been resolved: Input: sur40 - fix input device registration ordering In sur40_probe(), input_register_device() was...	7.8 High	—	0,18%	26 Agt 2026
CVE-2026-80558 In the Linux kernel, the following vulnerability has been resolved: libceph: Avoid using invalid osd indices from primary_temp A corrupted osdmap received from a Ceph m...	9.8 Critical	—	0,51%	26 Agt 2026
CVE-2026-80557 In the Linux kernel, the following vulnerability has been resolved: libceph: fix OOB read in decode_watchers() via missing bounds check ceph_start_decoding() validates...	9.8 Critical	—	0,53%	26 Agt 2026
CVE-2026-80556 In the Linux kernel, the following vulnerability has been resolved: mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition In atmci_probe, &host->bh_w...	7.8 High	—	0,17%	26 Agt 2026
CVE-2026-80555 In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Free all memory if cp_init() fails The routine cp_free() is called to unpin/free any...	7.1 High	—	0,19%	26 Agt 2026
CVE-2026-80554 In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Limit the number of channel program segments The processing of channel programs, and...	9.3 Critical	—	0,20%	26 Agt 2026
CVE-2026-80553 In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Cancel existing workqueues The initialization of the io_work and crw_work workqueues...	8.8 High	—	0,18%	26 Agt 2026
CVE-2026-80552 In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Ensure index for read/write regions are within range The introduction of the capabili...	8.8 High	—	0,18%	26 Agt 2026
CVE-2026-80551 In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Ensure first IDAW remains constant The first IDAW in a list does not need to be on a...	9.3 Critical	—	0,20%	26 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.