Katalog CVE (hal. 596)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 264.125 (Critical 36.415 · High 105.508 · KEV 1.758 · sejak 2020) · Pembaruan terakhir: 28 Okt 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 29.751–29.800 dari 264.125 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-71905 Multiple DrayTek VigorAP models contain a command injection vulnerability in the ExportSettings function. The vulnerability is caused by insufficient filtering of the bac...	7.2 High	—	2,3%	24 Agt 2026
CVE-2026-71904 Multiple DrayTek VigorAP models contain a command injection vulnerability in the tr069TestInform function. The vulnerability is caused by insufficient filtering of danger...	7.2 High	—	1,8%	24 Agt 2026
CVE-2026-34491 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows C...	6.1 Medium	—	0,40%	24 Agt 2026
CVE-2026-16348 An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root p...	8.5 High	—	2,2%	24 Agt 2026
CVE-2026-13213 The Hearing Access Service (HAS) GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BT_CONN_CB_DEFINE, so security_changed...	5.3 Medium	—	0,25%	24 Agt 2026
CVE-2026-78465 gimp A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plugin calculates memory allocation sizes based on th...	7.0 High	—	0,28%	24 Agt 2026
CVE-2026-78329 apache camel Improper input validation vulnerability in Apache Camel Undertow component. This issue affects Apache Camel: from 4.11.0 before 4.14.9, from 4.15.0 before 4.18.4, from...	9.8 Critical	—	0,74%	24 Agt 2026
CVE-2026-77915 rConfig Core 8.0.0 before 8.2.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator p...	9.8 Critical	—	0,77%	24 Agt 2026
CVE-2026-77914 rConfig Core 8.0.0 before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying crafted filenames containing...	6.5 Medium	—	0,72%	24 Agt 2026
CVE-2026-75099 apache allura Unauthenticated REST disclosure of certain content items in Apache Allura. This issue affects Apache Allura: through 1.19.1. Users are recommended to upgrade to ver...	5.3 Medium	—	0,57%	24 Agt 2026
CVE-2026-71300 apache camel Improper input validation vulnerability in Apache Camel Atmosphere Websocket component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4...	9.8 Critical	—	0,74%	24 Agt 2026
CVE-2026-66908 apache camel Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue affects Apache Camel: from 4.8.0 before 4.22.0. The camel-main embedd...	7.5 High	—	0,61%	24 Agt 2026
CVE-2026-66907 apache camel Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, f...	7.5 High	—	0,81%	24 Agt 2026
CVE-2026-66906 apache camel Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18....	9.1 Critical	—	0,78%	24 Agt 2026
CVE-2026-63621 apache camel Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel Knative compon...	5.3 Medium	—	0,59%	24 Agt 2026
CVE-2026-60093 apache camel Relative path traversal vulnerability in Apache Camel Azure-Storage Datalake component This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4....	5.5 Medium	—	0,24%	24 Agt 2026
CVE-2026-59230 apache camel Improper input validation vulnerability in Apache Camel. This issue affects Apache Camel: from 2.17.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22...	6.5 Medium	—	0,68%	24 Agt 2026
CVE-2026-19685 NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-202...	7.1 High	—	0,24%	24 Agt 2026
CVE-2026-18349 Improper protection against voltage and clock glitches vulnerability in Microchip SAMA5D4 allows Hardware Fault Injection. This issue affects SAMA5D4.	7.3 High	—	0,18%	24 Agt 2026
CVE-2026-15469 The use of hard-coded cryptographic key vulnerability has been identified in the mesh functionality of Deco XE75 v3, XE5300 v3.6 and WE10800 v3.6. A shared RSA-512 mesh...	7.7 High	—	0,41%	24 Agt 2026
CVE-2025-36940 Use-After-Free vulnerability in a zircon kernel pager proxy (Fuchsia), which could lead to a Privilege Escalation from Userspace to Kernel (AP)	8.8 High	—	0,25%	24 Agt 2026
CVE-2025-36939 google nest wifi router firmware, google nest wifi point firmware +1 lainnya Multiple vulnerabilities exist in OpenThread's handling of MLE packets. An authenticated attacker on the same Thread network could send specially crafted packets to cause...	5.7 Medium	—	0,26%	24 Agt 2026
CVE-2026-78416 Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-sea...	8.7 High	—	1,0%	24 Agt 2026
CVE-2026-76071 Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability that allows unauthenticated remote attackers to overwrite saved stack state b...	9.8 Critical	—	1,4%	24 Agt 2026
CVE-2026-76070 Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability that allows unauthenticated remote attackers to overwrite saved stack state b...	9.8 Critical	—	1,3%	24 Agt 2026
CVE-2026-71366 A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backend...	7.7 High	—	0,56%	24 Agt 2026
CVE-2026-71364 A path traversal vulnerability was found in AWX's project archive extraction. The project_archive action plugin extracts zip and tar archive members by joining the projec...	7.2 High	—	1,7%	24 Agt 2026
CVE-2026-67204 BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate ot...	5.4 Medium	—	0,41%	24 Agt 2026
CVE-2026-21752 HCL Hive is affected by a use of vulnerable third-party components which could allow an attacker unauthorized access or compromise of the system by exploiting publicly do...	7.5 High	—	0,45%	24 Agt 2026
CVE-2026-13343 The UMP Stream responder library in lib/midi2/ump_stream_responder.c builds reply packets in a 16-byte struct midi_ump (uint32_t data[4]). The builders make_endpoint_info...	5.3 Medium	—	0,40%	24 Agt 2026
CVE-2026-13212 The Zephyr virtio driver does not validate the descriptor-chain head id that the virtio device writes into the used ring. In virtio_isr() (drivers/virtio/virtio_common.c)...	8.8 High	—	0,37%	24 Agt 2026
CVE-2026-12556 Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. These potential vulnerabilities may lead to escalatio...	7.7 High	—	0,25%	24 Agt 2026
CVE-2026-12555 Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. These potential vulnerabilities may lead to escalatio...	7.7 High	—	0,40%	24 Agt 2026
CVE-2026-12554 Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. These potential vulnerabilities may lead to escalatio...	8.5 High	—	0,31%	24 Agt 2026
CVE-2025-68825 HCL Hive is affected by incorrect default permissions which could allow an attacker unauthorized lateral movement, container breakout, and interception of sensitive inter...	7.5 High	—	0,39%	24 Agt 2026
CVE-2026-9728 The userspace syscall verifier z_vrfy_mbox_send() in drivers/mbox/mbox_handlers.c validated the nested msg->data/msg->size fields by reading them directly out of live use...	6.4 Medium	—	0,11%	24 Agt 2026
CVE-2026-78414 Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attac...	8.0 High	—	0,34%	24 Agt 2026
CVE-2026-78391 RansomLook contains a stored cross-site scripting (XSS) vulnerability in the cryptocurrency wallet detail view. Cryptocurrency addresses and blockchain names originating...	8.8 High	—	0,44%	24 Agt 2026
CVE-2026-78387 RansomLook contains an authorization weakness in the web-based configuration editor exposed through the /admin/config endpoint. The endpoint requires an authenticated ses...	9.4 Critical	—	0,58%	24 Agt 2026
CVE-2026-76055 Improper Neutralization of Special Elements used in an OS Command in the package manager component of Black Duck blackduck-c-cpp before 3.0.7 allows an actor able to crea...	7.5 High	—	0,19%	24 Agt 2026
CVE-2026-76054 Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned proje...	7.1 High	—	0,18%	24 Agt 2026
CVE-2026-65053 Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, _IMPr...	6.1 Medium	—	0,41%	24 Agt 2026
CVE-2026-39915 TIM Flow before 26.0.6 contains a CRLF injection vulnerability that allows remote attackers to inject arbitrary HTTP headers and response body content by embedding unsani...	8.1 High	—	0,48%	24 Agt 2026
CVE-2026-39914 TIM Flow before 26.0.6 contains an improper authorization vulnerability that allows any authenticated user to submit arbitrary SQL queries to a privileged dashboard Excel...	6.5 Medium	—	0,38%	24 Agt 2026
CVE-2026-21755 HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or credential stuffing attacks, or cause a denial of servic...	5.3 Medium	—	0,29%	24 Agt 2026
CVE-2026-19874 A heap-based buffer overflow vulnerability exists in Konami's Metal Gear Online 3, originating from improper validation of lobby data fields related to kicked players. Th...	9.1 Critical	—	0,83%	24 Agt 2026
CVE-2026-78386 RansomLook exposed sensitive operator-side scraping configuration through multiple unauthenticated API responses. Location records associated with ransomware groups and m...	8.7 High	—	0,80%	24 Agt 2026
CVE-2026-78385 RansomLook contains insufficient resource validation in the analysis PDF generation functionality. Analysis documents are converted from Markdown to HTML and passed to We...	8.2 High	—	0,41%	24 Agt 2026
CVE-2026-78381 RansomLook contains a path traversal vulnerability in the handling of the screen field associated with group posts. The GroupPost.get API handler concatenates the databas...	8.2 High	—	0,59%	24 Agt 2026
CVE-2026-78380 RansomLook fails to enforce the privacy status of ransomware groups and markets when distributing newly collected victim posts to external notification channels. The post...	8.7 High	—	0,45%	24 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.