Katalog CVE (hal. 592)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.973 (Critical 36.402 · High 105.447 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 27 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 29.551–29.600 dari 263.973 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2025-26238 In D-Link DI-8100G 17.12.20A1, the flag parameter in msp_info can be exploited to execute arbitrary code.	8.1 High	—	0,33%	24 Agt 2026
CVE-2025-26237 D-Link DI-7001 MINI_5G 19.10.31A1 contains a code execution vulnerability in the flag parameter of msp_info, which can be exploited to run arbitrary commands.	8.1 High	—	0,33%	24 Agt 2026
CVE-2026-9254 An unauthenticated OS command injection vulnerability exists in the parental control functionality of Archer BE800 V1, BE3600 V1, and AX75 V1 due to improper filtering an...	8.7 High	—	3,1%	24 Agt 2026
CVE-2026-78475 gimp, redhat enterprise linux A flaw was found in the file-pix (ESM) plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array (VLA) on the stack...	6.1 Medium	—	0,26%	24 Agt 2026
CVE-2026-76838 Hi.Events validates a webhook destination only when it is registered, never when it is used. NoInternalUrlRule in backend/app/Validators/Rules/NoInternalUrlRule.php resol...	8.5 High	—	0,42%	24 Agt 2026
CVE-2026-76837 Baserow interpolates a user's display name into the rich-text mention markup without HTML encoding. PATCH /api/user/account/ stores the first_name value verbatim, and the...	6.4 Medium	—	0,33%	24 Agt 2026
CVE-2026-76836 AzuraCast exposes the Liquidsoap custom configuration fields through an endpoint that does not require the permission guarding them. The backend_config property in backen...	8.8 High	—	0,41%	24 Agt 2026
CVE-2026-76835 OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip authentication, because the guard added for CVE-2026-40575 is inert...	9.1 Critical	—	0,45%	24 Agt 2026
CVE-2026-76073 Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in label_studio/tasks/api.py declares queryset = Annotatio...	8.8 High	—	0,52%	24 Agt 2026
CVE-2026-76072 The Continue CLI applies an incomplete denylist as its only barrier to destructive shell commands when running unattended. In headless mode and auto mode the default poli...	7.4 High	—	0,39%	24 Agt 2026
CVE-2026-71943 Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevNet function. The vulnerability is caused by insufficient filtering of the user...	7.2 High	—	2,3%	24 Agt 2026
CVE-2026-71942 Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the mail_mailalert function. The vulnerability is caused by concatenating multiple smtpRece...	7.2 High	—	0,68%	24 Agt 2026
CVE-2026-71941 Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the diag_logmail function. The vulnerability is caused by concatenating multiple smtpReceiv...	7.2 High	—	0,68%	24 Agt 2026
CVE-2026-71940 Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general_setup Edit ACE function. The vulnerability is caused by copying the name fi...	7.2 High	—	0,68%	24 Agt 2026
CVE-2026-71939 Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general_setup Add ACE function. The vulnerability is caused by copying the name fie...	7.2 High	—	0,68%	24 Agt 2026
CVE-2026-71938 Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the switch_lan_gvrp function. The vulnerability is caused by unsafe copying of the portList...	7.2 High	—	0,68%	24 Agt 2026
CVE-2026-71937 Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the poe_schedule_profile function. The vulnerability is caused by repeated concatenation of...	7.2 High	—	0,68%	24 Agt 2026
CVE-2026-71936 Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the sysreboot function. The vulnerability is caused by unsafe concatenation of split valueN...	7.2 High	—	0,68%	24 Agt 2026
CVE-2026-71935 Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the webBackupAction function. The vulnerability is caused by repeated string concatenation...	7.2 High	—	0,68%	24 Agt 2026
CVE-2026-71934 Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the pingtrace function. The vulnerability is caused by missing length checks when the host,...	7.2 High	—	0,68%	24 Agt 2026
CVE-2026-71933 Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple syslog functions. The vulnerability is caused by missing authorization chec...	9.1 Critical	—	0,55%	24 Agt 2026
CVE-2026-71932 Multiple DrayTek VigorSwitch models contain a directory traversal vulnerability in the getSyslogFile function. The vulnerability is caused by insufficient validation of t...	4.9 Medium	—	1,0%	24 Agt 2026
CVE-2026-71931 Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the tftp_upgrade function. The vulnerability is caused by insufficient filtering before t...	7.2 High	—	1,8%	24 Agt 2026
CVE-2026-71930 Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setTime function. The vulnerability is caused by insufficient filtering of the userna...	7.2 High	—	2,3%	24 Agt 2026
CVE-2026-71929 Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevProto function. The vulnerability is caused by insufficient filtering of the us...	7.2 High	—	2,3%	24 Agt 2026
CVE-2026-71928 Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the fdftDevice function. The vulnerability is caused by insufficient filtering of the use...	7.2 High	—	2,3%	24 Agt 2026
CVE-2026-71927 Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the rebDevice function. The vulnerability is caused by insufficient filtering of the user...	7.2 High	—	2,3%	24 Agt 2026
CVE-2026-71926 Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevice function. The vulnerability is caused by insufficient sanitization of the u...	7.2 High	—	2,3%	24 Agt 2026
CVE-2026-71925 Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getDetail function. The vulnerability is caused by insufficient filtering of the user...	7.2 High	—	2,3%	24 Agt 2026
CVE-2026-71924 Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getVid function. The vulnerability is caused by insufficient filtering of the usernam...	7.2 High	—	2,3%	24 Agt 2026
CVE-2026-71923 Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the auth_set function. The vulnerability is caused by insufficient filtering of the usern...	7.2 High	—	2,3%	24 Agt 2026
CVE-2026-71922 Multiple DrayTek VigorSwitch models contain a pre-authentication null pointer dereference vulnerability in the setget.cgi interface. The vulnerability is caused by missin...	7.5 High	—	0,69%	24 Agt 2026
CVE-2026-71921 Multiple DrayTek VigorSwitch models contain a pre-authentication command injection vulnerability in the setget.cgi interface. The vulnerability is caused by insufficient...	9.8 Critical	—	2,8%	24 Agt 2026
CVE-2026-71920 Multiple DrayTek VigorSwitch models contain a null pointer dereference vulnerability in the formlogout function. The vulnerability is caused by missing checks for an empt...	4.9 Medium	—	0,56%	24 Agt 2026
CVE-2026-71919 Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the sysreboot function. The vulnerability is caused by insufficient filtering of the conf...	7.2 High	—	2,3%	24 Agt 2026
CVE-2026-71918 Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the webBackupAction function. The vulnerability is caused by insufficient filtering of th...	7.2 High	—	2,3%	24 Agt 2026
CVE-2026-71917 Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the pingtrace function. The vulnerability is caused by insufficient validation of the hos...	7.2 High	—	2,3%	24 Agt 2026
CVE-2026-71916 Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the commandTable function. The vulnerability is caused by incomplete filtering of dangero...	7.2 High	—	1,8%	24 Agt 2026
CVE-2026-71915 Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the jsonstatus function. The vulnerability is caused by insufficient filtering of the use...	7.2 High	—	2,3%	24 Agt 2026
CVE-2026-71914 Multiple DrayTek VigorAP models contain a command injection vulnerability in the dray_apm component. The vulnerability is caused by insufficient validation of UDP message...	9.8 Critical	—	2,6%	24 Agt 2026
CVE-2026-71913 Multiple DrayTek VigorAP models contain a command injection vulnerability in the upload_settings.cgi interface. The vulnerability is caused by insufficient filtering befo...	7.2 High	—	1,8%	24 Agt 2026
CVE-2026-71912 Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the apautotest function. The vulnerability is caused by missing length checks during memory cop...	7.2 High	—	0,68%	24 Agt 2026
CVE-2026-71911 Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the setLan function. The vulnerability is caused by missing length checks during memory copy op...	7.2 High	—	0,68%	24 Agt 2026
CVE-2026-71910 Multiple DrayTek VigorAP models contain a command injection vulnerability in the apautotest function. The vulnerability is caused by insufficient validation of the CMD0,...	7.2 High	—	2,3%	24 Agt 2026
CVE-2026-71909 Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime function. The vulnerability is caused by insufficient filtering of the time f...	7.2 High	—	2,3%	24 Agt 2026
CVE-2026-71908 Multiple DrayTek VigorAP models contain a command injection vulnerability in the mesh_start_speed_test function. The vulnerability is caused by insufficient sanitization...	7.2 High	—	2,3%	24 Agt 2026
CVE-2026-71907 Multiple DrayTek VigorAP models contain a command injection vulnerability in the setcamset function. The vulnerability is caused by insufficient filtering of the selectSl...	7.2 High	—	2,3%	24 Agt 2026
CVE-2026-71906 Multiple DrayTek VigorAP models contain a command injection vulnerability in the setLan function. The vulnerability is caused by insufficient validation of the lanIp and...	7.2 High	—	2,3%	24 Agt 2026
CVE-2026-71905 Multiple DrayTek VigorAP models contain a command injection vulnerability in the ExportSettings function. The vulnerability is caused by insufficient filtering of the bac...	7.2 High	—	2,3%	24 Agt 2026
CVE-2026-71904 Multiple DrayTek VigorAP models contain a command injection vulnerability in the tr069TestInform function. The vulnerability is caused by insufficient filtering of danger...	7.2 High	—	1,8%	24 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.