Katalog CVE (hal. 564)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.391 (Critical 36.349 · High 105.294 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 26 Okt 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 28.151–28.200 dari 263.391 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-18985 Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. This issue affects Edit in-place field versions: from 0.0.0 to 2.1.1.	8.1 High	—	0,35%	25 Agt 2026
CVE-2026-18261 Vulnerability in Drupal Powerful Surveys. This issue affects Powerful Surveys versions: ..	5.7 Medium	—	0,31%	25 Agt 2026
CVE-2026-18260 Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force. This issue affects Disable Login Page versions: f...	5.7 Medium	—	0,36%	25 Agt 2026
CVE-2026-18259 Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2.	7.5 High	—	0,42%	25 Agt 2026
CVE-2026-16646 Vulnerability in Drupal PanKM. This issue affects PanKM versions: ..	5.7 Medium	—	0,28%	25 Agt 2026
CVE-2026-16645 Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive...	9.1 Critical	—	0,40%	25 Agt 2026
CVE-2026-16644 Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.	9.1 Critical	—	0,44%	25 Agt 2026
CVE-2026-16643 Vulnerability in Drupal Lunr exposed filters. This issue affects Lunr exposed filters versions: ..	5.7 Medium	—	0,31%	25 Agt 2026
CVE-2026-16642 Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions: ..	5.7 Medium	—	0,31%	25 Agt 2026
CVE-2026-16641 Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions: ..	9.8 Critical	—	0,52%	25 Agt 2026
CVE-2026-16640 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affe...	6.1 Medium	—	0,25%	25 Agt 2026
CVE-2026-16639 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects Inte...	9.8 Critical	—	0,64%	25 Agt 2026
CVE-2026-16638 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Fol...	6.1 Medium	—	0,25%	25 Agt 2026
CVE-2026-15917 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue aff...	4.7 Medium	—	0,21%	25 Agt 2026
CVE-2026-15916 Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14...	4.2 Medium	—	0,20%	25 Agt 2026
CVE-2026-15088 Vulnerability in Drupal Development Environment. This issue affects Development Environment versions: ..	5.7 Medium	—	0,31%	25 Agt 2026
CVE-2026-80186 A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted E...	7.6 High	—	0,50%	25 Agt 2026
CVE-2026-80185 BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so...	5.7 Medium	—	0,29%	25 Agt 2026
CVE-2026-80184 In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials, trusts) could be submitted to...	7.6 High	—	0,60%	25 Agt 2026
CVE-2026-80182 In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust-scoped authentication could create new long-lived credentia...	7.6 High	—	0,57%	25 Agt 2026
CVE-2026-79845 A vulnerability was identified in code-projects Simple Inventory System 1.0. This vulnerability affects unknown code of the file /InventoryManagement/edit.php. The manipu...	7.3 High	—	0,43%	25 Agt 2026
CVE-2026-79804 A vulnerability was found in SililaWijesinghe Food Ordering System up to ba314e897e3365600461e5ea59432e39ceaa0fa5. Affected by this issue is some unknown functionality of...	7.3 High	—	0,41%	25 Agt 2026
CVE-2026-78655 Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route coun...	9.1 Critical	—	0,50%	25 Agt 2026
CVE-2026-78619 Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totp_use_recovery compares user identifiers nu...	9.8 Critical	—	0,62%	25 Agt 2026
CVE-2026-73180 apache tomcat Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had...	6.8 Medium	—	0,44%	25 Agt 2026
CVE-2026-68763 apache tomcat Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset This issue affects Apache...	7.5 High	—	0,75%	25 Agt 2026
CVE-2026-68569 apache tomcat Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user did...	8.1 High	—	0,46%	25 Agt 2026
CVE-2026-68525 apache tomcat Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resour...	9.1 Critical	—	0,49%	25 Agt 2026
CVE-2026-66422 apache tomcat Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the...	8.1 High	—	0,43%	25 Agt 2026
CVE-2026-65927 apache tomcat Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first...	7.5 High	—	0,68%	25 Agt 2026
CVE-2026-65905 Advisory apache tomcat Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST aut...	9.8 Critical	—	0,56%	25 Agt 2026
CVE-2026-65637 Advisory apache tomcat Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from...	9.8 Critical	—	0,61%	25 Agt 2026
CVE-2026-65183 apache tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix do...	8.1 High	—	0,40%	25 Agt 2026
CVE-2026-65182 apache tomcat Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before...	9.1 Critical	—	0,54%	25 Agt 2026
CVE-2026-63404 Faktory is a language-agnostic background job server. In versions prior to 1.10.0, the embedded Redis bootstrapper is vulnerable to an insecure temporary file flaw that l...	7.3 High	—	0,16%	25 Agt 2026
CVE-2026-63403 Faktory is a language-agnostic background job server. In versions prior to 1.10.0, the server is vulnerable to an unauthenticated denial of service in which a single malf...	8.7 High	—	0,45%	25 Agt 2026
CVE-2026-62865 Typebot is an open-source chatbot builder. In self-hosted versions prior to 3.18.0, the server-side Send Email integration block allows arbitrary reading of local files o...	8.7 High	—	0,32%	25 Agt 2026
CVE-2026-62862 Typebot is an open-source chatbot builder. In self-hosted versions up to and including 3.17.1, the default passwordless email magic-link authentication is vulnerable to l...	9.1 Critical	—	0,53%	25 Agt 2026
CVE-2026-62861 TypeBot is a chatbot builder tool. Prior to 3.18.0, any authenticated non-guest workspace member can remove another workspace's public custom domain and make typebots on...	6.4 Medium	—	0,41%	25 Agt 2026
CVE-2026-38474 GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 suffers from a Broken access control vulnerability in the IP lock manager, which allows remo...	5.4 Medium	—	0,37%	25 Agt 2026
CVE-2026-38473 A Stored XSS vulnerability in the subtitle deletion flow in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated user...	5.4 Medium	—	0,36%	25 Agt 2026
CVE-2026-38472 A Stored XSS vulnerability in forum reward comments in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote attackers to inject arb...	6.1 Medium	—	0,40%	25 Agt 2026
CVE-2026-38470 A Broken access control vulnerability in the API user endpoint in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows unprivileged, authe...	4.3 Medium	—	0,34%	25 Agt 2026
CVE-2026-38469 A Stored XSS vulnerability in the custom bonus title feature in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated...	5.4 Medium	—	0,36%	25 Agt 2026
CVE-2026-38468 A SQL injection vulnerability in the country-code lookup endpoint in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authentic...	4.3 Medium	—	0,41%	25 Agt 2026
CVE-2026-38467 A SQL injection vulnerability in the tags manager in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users with...	5.4 Medium	—	0,31%	25 Agt 2026
CVE-2026-38466 A Stored XSS vulnerability in the torrent remaster custom title feature in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote aut...	5.4 Medium	—	0,38%	25 Agt 2026
CVE-2026-38465 A Stored XSS vulnerability in the donor avatar mouse-over text feature in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote auth...	5.4 Medium	—	0,36%	25 Agt 2026
CVE-2026-32637 Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1, an attacker who compromises t...	5.9 Medium	—	0,54%	25 Agt 2026
CVE-2026-80104 DB-GPT builds the destination path for an uploaded skill from the multipart filename without constraining it to the upload directory. skill_upload in packages/dbgpt-app/s...	9.8 Critical	—	1,1%	25 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.