Katalog CVE (hal. 571)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.917 (Critical 36.380 · High 105.432 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 27 Okt 2026, 12:31 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 28.501–28.550 dari 263.917 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-74748 In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix refcount race between list:set GC and swap __ip_set_put_byindex() resolved the...	7.8 High	—	0,14%	26 Agt 2026
CVE-2026-74747 In the Linux kernel, the following vulnerability has been resolved: ipvs: revalidate ihl to prevent out-of-bounds access While the outer IP header is already pulled int...	7.8 High	—	0,18%	26 Agt 2026
CVE-2026-74746 In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish GC-visible tuple last nf_flow_table_iterate() only treats original-dir...	9.8 Critical	—	0,54%	26 Agt 2026
CVE-2026-74745 In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: avoid deadlock when canceling IRQ affinity notifier Unregistering IRQ affinity notifiers...	7.5 High	—	0,45%	26 Agt 2026
CVE-2026-74744 In the Linux kernel, the following vulnerability has been resolved: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev ipvlan devices inherit hard_header_...	9.8 Critical	—	0,51%	26 Agt 2026
CVE-2026-74743 In the Linux kernel, the following vulnerability has been resolved: macvlan: inherit needed_headroom and needed_tailroom from lowerdev macvlan devices inherit hard_head...	9.8 Critical	—	0,54%	26 Agt 2026
CVE-2026-74742 In the Linux kernel, the following vulnerability has been resolved: veth: fix queue index used to wake the peer txq in veth_poll veth_poll() derives the index of the pe...	7.5 High	—	0,46%	26 Agt 2026
CVE-2026-74741 In the Linux kernel, the following vulnerability has been resolved: net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling In non-MSI-X mode (such as l...	7.5 High	—	0,61%	26 Agt 2026
CVE-2026-74739 In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: skip hash tables in u32_bind_class() u32_walk() enumerates both struct tc_u_hnod...	7.8 High	—	0,14%	26 Agt 2026
CVE-2026-74737 In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG On the packet reception path,...	9.8 Critical	—	0,55%	26 Agt 2026
CVE-2026-74736 In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_bpf: reject dev-bound programs bound to a different device cls_bpf_prog_from_efd() ob...	7.8 High	—	0,14%	26 Agt 2026
CVE-2026-54556 Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, an unauthenticated HTTP/2 peer can cause an out-of-memory denial of service in the Ember ba...	8.2 High	—	0,52%	26 Agt 2026
CVE-2026-54553 Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API does not vali...	5.4 Medium	—	0,45%	26 Agt 2026
CVE-2026-54550 IzPack is a widely used tool for packaging applications on the Java platform as cross-platform installers. In 5.2.6 and earlier, UnpackerBase.unpack() in izpack-installer...	7.4 High	—	0,45%	26 Agt 2026
CVE-2026-54548 kas is a setup tool for bitbake based projects. Prior to 5.4, internal SSH key setup triggered by SSH_PRIVATE_KEY or SSH_PRIVATE_KEY_FILE creates ~/.ssh/config when no us...	3.3 Low	—	0,11%	26 Agt 2026
CVE-2026-54523 Kyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1.18.2, the NamespacedMutatingPolicy CEL compiler exposes the generator...	9.6 Critical	—	0,47%	26 Agt 2026
CVE-2026-54511 LogTape is an unobtrusive logging library. Prior to 1.3.11, 2.0.14, and 2.1.5, the @logtape/syslog package's escapeStructuredDataValue() function in packages/syslog/src/s...	8.6 High	—	0,48%	26 Agt 2026
CVE-2026-13481 zephyrproject zephyr The IEEE 1588 PTP management-message parser in subsys/net/lib/ptp/tlv.c mishandles the PTP_MGMT_TIME management id. In tlv_mgmt_post_recv(), the PTP_MGMT_TIME case casts...	5.4 Medium	—	0,24%	26 Agt 2026
CVE-2026-13480 zephyrproject zephyr The LoRaWAN TS004 Fragmented Data Block Transport handler frag_transport_package_callback() in subsys/lorawan/services/frag_transport.c parses downlink command bytes with...	3.1 Low	—	0,23%	26 Agt 2026
CVE-2026-13479 zephyrproject zephyr The LoRaWAN application-layer clock-synchronization service parses downlinks in clock_sync_package_callback() (subsys/lorawan/services/clock_sync.c). Its command loop onl...	4.3 Medium	—	0,23%	26 Agt 2026
CVE-2026-79902 gimp A flaw was found in the Seattle FilmWorks plugin in GIMP. When processing a specially crafted SFW image file, the plugin allocates a Variable-Length Array (VLA) on the st...	5.5 Medium	—	0,27%	26 Agt 2026
CVE-2026-7487 gitlab GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an...	3.5 Low	—	0,32%	26 Agt 2026
CVE-2026-77801 gitlab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions,...	6.5 Medium	—	0,43%	26 Agt 2026
CVE-2026-75960 Rently Smart Home versions 20.1.0 and prior are vulnerable to an Insufficiently Protected Credentials vulnerability. This could allow an attacker to retrieve pins includi...	8.1 High	—	0,35%	26 Agt 2026
CVE-2026-75896 Use of Hard-coded Credentials vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk allows Try Common or Default Usernames and Passwords. T...	9.1 Critical	—	0,40%	26 Agt 2026
CVE-2026-73108 RustDesk versions before 1.4.7 contain an uncontrolled speculative memory allocation vulnerability in BytesCodec. Before authentication, the decoder trusts the payload le...	7.5 High	—	0,77%	26 Agt 2026
CVE-2026-73102 RustDesk versions 1.3.9 through 1.4.9 contain a path traversal vulnerability in the macOS clipboard file-paste code path. The application accepts peer-supplied file descr...	5.7 Medium	—	0,39%	26 Agt 2026
CVE-2026-3035 gitlab GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an...	5.5 Medium	—	0,32%	26 Agt 2026
CVE-2026-19271 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk a...	7.5 High	—	0,42%	26 Agt 2026
CVE-2026-18252 gitlab GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an...	8.1 High	—	0,52%	26 Agt 2026
CVE-2026-15990 The Formidable Charts plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.0.1 via the 'frm_graph' parameter. This makes it p...	7.5 High	—	0,93%	26 Agt 2026
CVE-2026-15387 gitlab GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an...	4.3 Medium	—	0,21%	26 Agt 2026
CVE-2026-12717 An Improper Input Validation vulnerability in CData JDBC driver integration in Google Cloud BigQuery Data Transfer Service versions prior to 2026-05-01 on Google Cloud Pl...	9.4 Critical	—	0,62%	26 Agt 2026
CVE-2025-10903 gitlab GitLab has remediated an issue in GitLab EE affecting all versions from 11.10 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an...	6.5 Medium	—	0,53%	26 Agt 2026
CVE-2026-79619 On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, all...	7.3 High	—	0,20%	26 Agt 2026
CVE-2026-77658 A stack-based buffer overflow vulnerability exists in the Dia diagram editor when processing Network Bus objects from Dia XML project files. In objects/network/bus.c, bu...	7.8 High	—	0,20%	26 Agt 2026
CVE-2026-12587 The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credentials within the application. The generation mechanism...	8.6 High	—	0,39%	26 Agt 2026
CVE-2026-63041 apache apisix Reliance on Untrusted Inputs in a Security Decision vulnerability in Apache APISIX. This vulnerability allows an attacker to escalate privilege or perform an authorizati...	8.8 High	—	0,68%	26 Agt 2026
CVE-2026-15985 The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due t...	8.1 High	—	0,54%	26 Agt 2026
CVE-2026-80206 nltk NLTK before 3.10.3 contains a regular expression denial of service (ReDoS) vulnerability in the tgrep module. The _tgrep_node_action function compiles user-supplied regul...	5.9 Medium	—	0,44%	26 Agt 2026
CVE-2026-80205 nltk NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSearcher.findall() methods that accept user-supplied r...	7.5 High	—	0,65%	26 Agt 2026
CVE-2026-80204 The Grav API plugin (getgrav/grav-plugin-api) before 1.0.18 does not apply the API-key scope cap in the injectSecurityTab() function of BlueprintController when deciding...	5.4 Medium	—	0,24%	26 Agt 2026
CVE-2026-80203 The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget() function in UsersController.php across seven sensitive user...	9.8 Critical	—	0,51%	26 Agt 2026
CVE-2026-77557 A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to escalate privileges on the device.	9.8 Critical	—	0,55%	26 Agt 2026
CVE-2026-77554 A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Talk Application to execute a Command Injection on th...	10.0 Critical	—	1,6%	26 Agt 2026
CVE-2026-77553 A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Access Application to escalate privi...	9.9 Critical	—	0,47%	26 Agt 2026
CVE-2026-77552 A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Enterprise Audio/Video Bridge to execute a Command In...	9.8 Critical	—	1,6%	26 Agt 2026
CVE-2026-77551 A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Connect Display Cast Pro t...	9.0 Critical	—	0,37%	26 Agt 2026
CVE-2026-77550 A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS to bypass...	10.0 Critical	—	0,80%	26 Agt 2026
CVE-2026-77549 A malicious actor with access to the network and under certain conditions could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain device...	9.0 Critical	—	0,51%	26 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.