Katalog CVE (hal. 613)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 264.271 (Critical 36.431 · High 105.570 · KEV 1.760 · sejak 2020) · Pembaruan terakhir: 28 Okt 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 30.601–30.650 dari 264.271 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-62945 TREK is a collaborative travel planner. Prior to 3.1.3, TREK file upload, update, and link actions accept attacker-controlled reservation_id, place_id, and assignment_id...	4.3 Medium	—	0,34%	20 Agt 2026
CVE-2026-62834 microsoft azure data factory Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized attacker to elevate privileges over a network.	9.8 Critical	—	0,53%	20 Agt 2026
CVE-2026-55894 Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c sh_disassemble() function computes an idx value from a raw 16-bit in...	6.8 Medium	—	0,19%	20 Agt 2026
CVE-2026-55893 Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c SH floating-point decoders such as opFADD, opFMUL, and opFSUB call s...	7.3 High	—	0,19%	20 Agt 2026
CVE-2026-55769 CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG opened superuser connections...	9.4 Critical	—	0,77%	20 Agt 2026
CVE-2026-55765 CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG embedded cleartext role pass...	8.5 High	—	0,50%	20 Agt 2026
CVE-2026-55491 BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton failed to escape meetingName in record-and-playback/screenshare/playback/index.html.erb...	5.4 Medium	—	0,29%	20 Agt 2026
CVE-2026-55489 BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton presenters could submit a presentationId through /api/graphql that identified a presenta...	4.9 Medium	—	0,31%	20 Agt 2026
CVE-2026-55015 microsoft remote help Uncontrolled search path element in Windows Remote Help allows an authorized attacker to deny service locally.	5.5 Medium	—	0,98%	20 Agt 2026
CVE-2026-55013 microsoft remote help Uncontrolled search path element in Windows Remote Help Defense allows an authorized attacker to perform spoofing locally.	7.1 High	—	0,46%	20 Agt 2026
CVE-2026-54509 TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourne...	6.5 Medium	—	0,42%	20 Agt 2026
CVE-2026-54508 TREK is a collaborative travel planner. Prior to 3.1.0, TREK validates only the initial URL before native redirect following in importGoogleList() and importNaverList() i...	5.3 Medium	—	0,43%	20 Agt 2026
CVE-2026-54505 TREK is a collaborative travel planner. Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into journey.fron...	2.0 Low	—	0,58%	20 Agt 2026
CVE-2026-54389 Ghidra before 12.1.3 contains an uncontrolled resource consumption vulnerability in the PDB parser that allows attackers to terminate the Ghidra process by supplying a cr...	5.5 Medium	—	0,18%	20 Agt 2026
CVE-2026-50192 Kerberos Agent is an open source video (surveillance) management agent. Prior to version 3.6.26, the Kerberos Hub upload path sends the agent's Hub credentials in the cus...	6.9 Medium	—	0,42%	20 Agt 2026
CVE-2026-49436 LinkAce is a self-hosted archive to collect website links. Prior to version 2.5.7, the Bulk Link API endpoint (`POST /api/v2/bulk/links`) accepts URLs without any format...	7.3 High	—	0,37%	20 Agt 2026
CVE-2026-49245 SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user...	3.7 Low	—	0,25%	20 Agt 2026
CVE-2026-49244 SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates...	5.9 Medium	—	0,45%	20 Agt 2026
CVE-2026-49217 Mailu is a mail server as a set of Docker images. Prior to version 2024.06.52, a missing authorization check in the Mailu admin REST API allows any unauthenticated attack...	7.5 High	—	0,36%	20 Agt 2026
CVE-2026-46682 BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton allowed authenticated moderators to inject SQL through the meetingId and userId values u...	8.5 High	—	0,58%	20 Agt 2026
CVE-2026-46355 BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton exposed /bigbluebutton/api/handleJoinExistingUser through bigbluebutton-web/grails-app/c...	7.1 High	—	0,37%	20 Agt 2026
CVE-2026-19783 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause kernel memory corruption due to insufficient validation. A crafted filesystem image ca...	7.8 High	—	0,16%	20 Agt 2026
CVE-2026-19449 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 has a vulnerability in cmdnim that may allow an unprivileged local user to executes the payload as root.	8.8 High	—	0,14%	20 Agt 2026
CVE-2026-19448 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 A stack memory corruption vulnerability exists in the AIX IPsec ESP decapsulation handler. Successful exploitation may corru...	7.5 High	—	0,35%	20 Agt 2026
CVE-2026-19446 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 allows a remote unauthenticated attacker can send a crafted UDP packet to a reachable RPC service, resulting in complete sys...	7.5 High	—	1,5%	20 Agt 2026
CVE-2026-19442 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 has a pointer validation flaw exists in the AIX Virtual SCSI (vSCSI) initiator driver. Successful exploitation may result in...	8.8 High	—	0,16%	20 Agt 2026
CVE-2026-19437 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a buffer overflow.	9.8 Critical	—	0,67%	20 Agt 2026
CVE-2026-18842 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to an out-of-bounds write.	7.8 High	—	0,16%	20 Agt 2026
CVE-2026-18840 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to improper validation of an attacker-controlled pointer.	7.8 High	—	0,17%	20 Agt 2026
CVE-2026-18835 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements...	9.9 Critical	—	0,79%	20 Agt 2026
CVE-2026-18832 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a heap-based buffer overflow.	9.8 Critical	—	0,92%	20 Agt 2026
CVE-2026-18828 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a stack-based buffer overflow.	7.5 High	—	0,56%	20 Agt 2026
CVE-2026-18824 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements...	8.8 High	—	0,63%	20 Agt 2026
CVE-2026-18822 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to uncontrolled resource consumption when parsing directory re...	5.5 Medium	—	0,14%	20 Agt 2026
CVE-2026-18716 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to obtain sensitive information or cause a denial of service due to an out-of-bo...	9.1 Critical	—	0,39%	20 Agt 2026
CVE-2026-18670 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service and potentially disclose sensitive information due to an integer...	9.1 Critical	—	0,53%	20 Agt 2026
CVE-2026-17436 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a heap-based buffer overflow.	9.8 Critical	—	0,92%	20 Agt 2026
CVE-2026-17425 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a stack buffer overflow.	7.5 High	—	0,55%	20 Agt 2026
CVE-2026-17424 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to bypass security restrictions due to improper limitation of a pathname to a restricted direc...	6.5 Medium	—	0,37%	20 Agt 2026
CVE-2026-17423 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information and cause a denial of service due to an out-of-bounds read.	9.1 Critical	—	0,45%	20 Agt 2026
CVE-2026-17422 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to a buffer overflow.	8.8 High	—	0,17%	20 Agt 2026
CVE-2026-17195 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to an out-of-bounds write.	6.5 Medium	—	0,13%	20 Agt 2026
CVE-2026-17171 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to overwrite arbitrary files due to improper resolution of symbolic links.	7.8 High	—	0,17%	20 Agt 2026
CVE-2026-17170 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to improper validation of an allocation size.	7.5 High	—	0,55%	20 Agt 2026
CVE-2026-17168 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.	8.8 High	—	0,63%	20 Agt 2026
CVE-2026-17165 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a NULL pointer dereference.	7.5 High	—	0,55%	20 Agt 2026
CVE-2026-17163 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to improper validation of an array size field.	7.5 High	—	0,55%	20 Agt 2026
CVE-2026-17160 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an integer overflow during size computation.	9.8 Critical	—	0,80%	20 Agt 2026
CVE-2026-17159 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an integer overflow.	7.5 High	—	0,55%	20 Agt 2026
CVE-2026-17157 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack buffer overflow.	9.8 Critical	—	0,80%	20 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.