Katalog CVE (hal. 574)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.917 (Critical 36.380 · High 105.432 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 27 Okt 2026, 12:31 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 28.651–28.700 dari 263.917 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-80191 GROWI applies its page-viewer permission check to attachment requests only when the request carries an authenticated user. retrieveAttachmentFromIdParam in apps/app/src/s...	7.5 High	—	0,48%	26 Agt 2026
CVE-2026-80189 LeafWiki extracts an uploaded ZIP archive without limiting how much data it will write. ZipExtractor.ExtractToDir in internal/importer/zip_extractor.go opens each entry a...	6.5 Medium	—	0,55%	26 Agt 2026
CVE-2026-76149 CorvusSKK contains an integer overflow vulnerability, which may allow malicious data to be written to a dictionary file.	4.6 Medium	—	0,15%	26 Agt 2026
CVE-2026-76148 CorvusSKK contains a code injection vulnerability, which may lead to arbitrary code execution on the affected product.	8.4 High	—	0,24%	26 Agt 2026
CVE-2026-73335 Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL Scheme (CWE-939). A malicious application installed on the user's Andro...	4.6 Medium	—	0,14%	26 Agt 2026
CVE-2026-58092 freebsd In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing...	8.1 High	—	0,35%	26 Agt 2026
CVE-2026-58091 freebsd The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sl...	7.8 High	—	0,15%	26 Agt 2026
CVE-2026-58090 freebsd The SOCK_STREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some error paths wo...	7.8 High	—	0,15%	26 Agt 2026
CVE-2026-58089 freebsd When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is supposed to detach PMCs owned by unprivileged processes. An inverted check meant that thi...	7.8 High	—	0,14%	26 Agt 2026
CVE-2026-57171 Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, th...	7.7 High	—	0,22%	26 Agt 2026
CVE-2026-57170 Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions prior to 3.12.4 and 4.0.0 through 4.0.3, the custo...	7.8 High	—	0,24%	26 Agt 2026
CVE-2026-54467 On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 accepts a non-secure, unvalidated, supplied pointer.	7.0 High	—	0,17%	26 Agt 2026
CVE-2026-52776 Compliance-trestle (Trestle) is a tooling platform for managing compliance as code. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the URLSecurityValidator t...	8.6 High	—	0,44%	26 Agt 2026
CVE-2026-29988 A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affected firmware versions allows an...	7.6 High	—	0,17%	26 Agt 2026
CVE-2026-19632 The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and incl...	9.8 Critical	—	4,5%	26 Agt 2026
CVE-2026-80138 ClipBucket V5's web installer fails to properly validate or escape the php_cli_filepath parameter before passing it to shell execution. Unauthenticated attackers can subm...	9.8 Critical	—	1,2%	25 Agt 2026
CVE-2026-79912 A vulnerability was detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The impacted element is the function getCurrentTime of the file /cgi-bin/cstecgi.cgi. Performing a...	8.3 High	—	2,1%	25 Agt 2026
CVE-2026-79911 A security vulnerability has been detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The affected element is the function setSystemConfig of the file /cgi-bin/cstecgi.cgi...	10.0 Critical	—	1,1%	25 Agt 2026
CVE-2026-70665 Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client Registrati...	4.2 Medium	—	0,26%	25 Agt 2026
CVE-2026-55805 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Stored XSS. This issue affects Drupal core...	5.4 Medium	—	0,23%	25 Agt 2026
CVE-2026-54757 Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, Tr...	7.8 High	—	0,36%	25 Agt 2026
CVE-2026-44476 Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's client_id, which is public information...	6.3 Medium	—	0,56%	25 Agt 2026
CVE-2026-41707 vmware spring security Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack v...	7.4 High	—	0,39%	25 Agt 2026
CVE-2026-18985 Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. This issue affects Edit in-place field versions: from 0.0.0 to 2.1.1.	8.1 High	—	0,35%	25 Agt 2026
CVE-2026-18261 Vulnerability in Drupal Powerful Surveys. This issue affects Powerful Surveys versions: ..	5.7 Medium	—	0,31%	25 Agt 2026
CVE-2026-18260 Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force. This issue affects Disable Login Page versions: f...	5.7 Medium	—	0,36%	25 Agt 2026
CVE-2026-18259 Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2.	7.5 High	—	0,42%	25 Agt 2026
CVE-2026-16646 Vulnerability in Drupal PanKM. This issue affects PanKM versions: ..	5.7 Medium	—	0,28%	25 Agt 2026
CVE-2026-16645 Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive...	9.1 Critical	—	0,40%	25 Agt 2026
CVE-2026-16644 Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.	9.1 Critical	—	0,44%	25 Agt 2026
CVE-2026-16643 Vulnerability in Drupal Lunr exposed filters. This issue affects Lunr exposed filters versions: ..	5.7 Medium	—	0,31%	25 Agt 2026
CVE-2026-16642 Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions: ..	5.7 Medium	—	0,31%	25 Agt 2026
CVE-2026-16641 Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions: ..	9.8 Critical	—	0,52%	25 Agt 2026
CVE-2026-16640 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affe...	6.1 Medium	—	0,25%	25 Agt 2026
CVE-2026-16639 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects Inte...	9.8 Critical	—	0,64%	25 Agt 2026
CVE-2026-16638 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Fol...	6.1 Medium	—	0,25%	25 Agt 2026
CVE-2026-15917 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue aff...	4.7 Medium	—	0,21%	25 Agt 2026
CVE-2026-15916 Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14...	4.2 Medium	—	0,20%	25 Agt 2026
CVE-2026-15088 Vulnerability in Drupal Development Environment. This issue affects Development Environment versions: ..	5.7 Medium	—	0,31%	25 Agt 2026
CVE-2026-80186 A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted E...	7.6 High	—	0,50%	25 Agt 2026
CVE-2026-80185 BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so...	5.7 Medium	—	0,29%	25 Agt 2026
CVE-2026-80184 In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials, trusts) could be submitted to...	7.6 High	—	0,60%	25 Agt 2026
CVE-2026-80182 In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust-scoped authentication could create new long-lived credentia...	7.6 High	—	0,57%	25 Agt 2026
CVE-2026-79845 A vulnerability was identified in code-projects Simple Inventory System 1.0. This vulnerability affects unknown code of the file /InventoryManagement/edit.php. The manipu...	7.3 High	—	0,43%	25 Agt 2026
CVE-2026-79804 A vulnerability was found in SililaWijesinghe Food Ordering System up to ba314e897e3365600461e5ea59432e39ceaa0fa5. Affected by this issue is some unknown functionality of...	7.3 High	—	0,41%	25 Agt 2026
CVE-2026-78655 Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route coun...	9.1 Critical	—	0,50%	25 Agt 2026
CVE-2026-78619 Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totp_use_recovery compares user identifiers nu...	9.8 Critical	—	0,62%	25 Agt 2026
CVE-2026-73180 apache tomcat Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had...	6.8 Medium	—	0,44%	25 Agt 2026
CVE-2026-68763 apache tomcat Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset This issue affects Apache...	7.5 High	—	0,75%	25 Agt 2026
CVE-2026-68569 apache tomcat Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user did...	8.1 High	—	0,46%	25 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.