Katalog CVE (hal. 585)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.973 (Critical 36.402 · High 105.447 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 27 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 29.201–29.250 dari 263.973 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-48429 Advisory adobe substance 3d designer Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulne...	5.5 Medium	—	0,23%	25 Agt 2026
CVE-2026-48428 Advisory adobe substance 3d designer Substance3D - Designer is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploit...	7.8 High	—	0,34%	25 Agt 2026
CVE-2026-48427 Advisory adobe substance 3d designer Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation...	7.8 High	—	0,26%	25 Agt 2026
CVE-2026-48426 Advisory adobe substance 3d designer Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation...	7.8 High	—	0,26%	25 Agt 2026
CVE-2026-48425 Advisory adobe substance 3d sampler Substance3D - Sampler is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploita...	7.8 High	—	0,34%	25 Agt 2026
CVE-2026-48424 Advisory adobe substance 3d sampler Substance3D - Sampler is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploita...	7.8 High	—	0,34%	25 Agt 2026
CVE-2026-48423 Advisory adobe substance 3d sampler Substance3D - Sampler is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploita...	7.8 High	—	0,34%	25 Agt 2026
CVE-2026-48422 Advisory adobe substance 3d sampler Substance3D - Sampler is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploita...	7.8 High	—	0,34%	25 Agt 2026
CVE-2026-48421 Advisory adobe substance 3d sampler Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation o...	7.8 High	—	0,26%	25 Agt 2026
CVE-2026-48420 Advisory adobe substance 3d sampler Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation o...	7.8 High	—	0,26%	25 Agt 2026
CVE-2026-48419 Advisory adobe substance 3d sampler Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation o...	7.8 High	—	0,26%	25 Agt 2026
CVE-2026-48418 Advisory adobe substance 3d sampler Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation o...	7.8 High	—	0,26%	25 Agt 2026
CVE-2026-48417 Advisory adobe substance 3d sampler Substance3D - Sampler is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploit...	7.8 High	—	0,34%	25 Agt 2026
CVE-2026-26211 Ekushey Project Manager CRM stores the administrator-configured system name and writes it to the login page without output encoding. The value is emitted in three places...	4.8 Medium	—	0,36%	25 Agt 2026
CVE-2026-75498 Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL quer...	7.2 High	—	0,81%	25 Agt 2026
CVE-2026-75497 Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL quer...	7.2 High	—	0,81%	25 Agt 2026
CVE-2026-75496 Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the file to a publicly accessible directory. A remote, authentic...	7.2 High	—	0,98%	25 Agt 2026
CVE-2026-64204 ni labview There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution. Successful exploitati...	7.8 High	—	0,19%	25 Agt 2026
CVE-2026-64203 ni labview There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution. Successful exploitati...	7.8 High	—	0,19%	25 Agt 2026
CVE-2026-64202 ni labview There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution. Successful exploitati...	7.8 High	—	0,19%	25 Agt 2026
CVE-2026-64201 ni labview There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution. Successful exploitati...	7.8 High	—	0,19%	25 Agt 2026
CVE-2026-59189 OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In OpenEXRUtil versions 3.3.0 through 3.3....	7.1 High	—	0,31%	25 Agt 2026
CVE-2026-59187 OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.3.0 through 3.3.12 and...	7.1 High	—	0,40%	25 Agt 2026
CVE-2026-59186 OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions before 3.2.11, 3.3.0 through 3...	7.1 High	—	0,27%	25 Agt 2026
CVE-2026-59184 OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions before 3.2.11, 3.3.0 through 3.3....	7.1 High	—	0,22%	25 Agt 2026
CVE-2026-55585 QWED is open-source AI verification infrastructure for deterministic verification of LLM outputs, tool calls, code, schemas, and agent state before production execution....	8.8 High	—	0,78%	25 Agt 2026
CVE-2026-55571 djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to 1.0.4, LiveViewConsumer.handle_mount sends a `{"ty...	8.2 High	—	0,51%	25 Agt 2026
CVE-2026-55557 browse-mcp is a Playwright-based headless-browser MCP server for MCP-capable agents. Prior to 0.8.2, browser_download writes a fetched response body to join(save_dir, fil...	8.6 High	—	0,24%	25 Agt 2026
CVE-2026-55553 urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features. Prior to 4.9.1 and 2.44.1, urllib follows redirects th...	7.5 High	—	0,66%	25 Agt 2026
CVE-2026-47626 nvidia dgx spark uefi NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause an out-of-bounds write. A successful exploit of this...	8.2 High	—	0,20%	25 Agt 2026
CVE-2026-47624 nvidia dgx spark uefi NVIDIA DGX Spark contains a vulnerability in UEFI where a Attacker may cause a/an CWE-693 by privileged local user. A successful exploit of this vulnerability may allow a...	6.0 Medium	—	0,18%	25 Agt 2026
CVE-2026-24263 nvidia dgx spark uefi NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause a NULL pointer dereference. A successful exploit of t...	8.2 High	—	0,20%	25 Agt 2026
CVE-2026-24262 nvidia dgx spark uefi NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause an out-of-bounds write. A successful exploit of this...	8.2 High	—	0,20%	25 Agt 2026
CVE-2026-24225 nvidia dgx spark uefi NVIDIA DGX Spark contains a vulnerability in the standalone MM firmware where an attacker could be able to cause an out-of-bounds read. A successful exploit of this vulne...	6.0 Medium	—	0,18%	25 Agt 2026
CVE-2026-24170 NVIDIA UFM Enterprise contains a vulnerability in the web interface authorization component, where an authenticated user could cause improper authentication by sending sp...	8.8 High	—	0,51%	25 Agt 2026
CVE-2026-24169 NVIDIA UFM Enterprise contains a vulnerability in the plugin management API, where an authenticated user with low privileges could inject code by sending a specially craf...	8.0 High	—	0,54%	25 Agt 2026
CVE-2026-24168 NVIDIA UFM Enterprise contains a vulnerability in the IBDiagnet API where an authenticated attacker with administrative privileges may cause command injection by sending...	6.8 Medium	—	2,8%	25 Agt 2026
CVE-2026-24167 NVIDIA UFM Enterprise contains a vulnerability in the user management component, where an authenticated administrator could inject commands by sending a crafted API reque...	6.8 Medium	—	0,42%	25 Agt 2026
CVE-2026-24166 NVIDIA UFM Enterprise contains a vulnerability in the session management component, where an attacker could use a hard-coded cryptographic key to extract information. A s...	5.1 Medium	—	0,15%	25 Agt 2026
CVE-2026-19913 The Kaltura HTML5 player (mwEmbed / html5lib) contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php....	7.5 High	—	0,58%	25 Agt 2026
CVE-2026-19912 The Kaltura HTML5 player (mwEmbed / html5lib) contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesy...	9.8 Critical	—	1,0%	25 Agt 2026
CVE-2026-18445 ni labview There is an integer overflow vulnerability resulting in an out-of-bounds write recently discovered in NI LabVIEW. This may result in information disclosure or arbitrary...	7.8 High	—	0,18%	25 Agt 2026
CVE-2026-18444 ni labview There is an integer conversion vulnerability resulting in an out-of-bounds read when loading images recently discovered in NI LabVIEW. This may result in information dis...	7.8 High	—	0,18%	25 Agt 2026
CVE-2026-16234 ni labview There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution. Successful exploitati...	7.8 High	—	0,19%	25 Agt 2026
CVE-2026-16233 ni labview There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution. Successful exploitati...	7.8 High	—	0,19%	25 Agt 2026
CVE-2026-13478 The Zephyr ext2 filesystem driver validates the on-disk block bitmap in ext2_init_fs() (subsys/fs/ext2/ext2_impl.c) by passing fs_blocks = s_blocks_count - s_first_data_b...	5.5 Medium	—	0,14%	25 Agt 2026
CVE-2026-13217 The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp.c reconstructs a session handle and PDU id from the uid field of a CALLRESULT message. In ocpp_process_server_msg() the co...	5.9 Medium	—	0,67%	25 Agt 2026
CVE-2026-13216 The virtio PCI driver (drivers/virtio/virtio_pci.c) parses a device's PCI capability list during driver initialization. In virtio_pci_read_cap() the device-supplied capab...	6.1 Medium	—	0,26%	25 Agt 2026
CVE-2026-79785 X-AnyLabeling's model downloader disabled TLS certificate verification. download_with_retry in anylabeling/services/auto_labeling/model.py built a context with ssl._creat...	5.9 Medium	—	0,28%	25 Agt 2026
CVE-2026-79784 Vocos instantiates a class named by a configuration file without restricting which class may be named. instantiate_class in vocos/pretrained.py takes the class_path value...	8.8 High	—	0,57%	25 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.