Katalog CVE (hal. 616)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 264.331 (Critical 36.436 · High 105.591 · KEV 1.760 · sejak 2020) · Pembaruan terakhir: 28 Okt 2026, 12:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 30.751–30.800 dari 264.331 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-77640 torproject tor tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches Z_STREAM_END, causing zli...	5.3 Medium	—	0,38%	20 Agt 2026
CVE-2026-77639 torproject tor Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection thre...	5.3 Medium	—	0,39%	20 Agt 2026
CVE-2026-77638 torproject tor Tor before 0.4.9.11 is prone to a race condition where in just the right circumstances a rendezvous point could man-in-the-middle (impersonate) the onion service that the...	9.0 Critical	—	0,30%	20 Agt 2026
CVE-2026-77587 torproject tor Tor before 0.4.9.11 is prone to a use-after-free (and potential double free) of a conflux object when a recovery leg revives a conflux set whose last linked leg has alrea...	7.5 High	—	0,41%	20 Agt 2026
CVE-2026-77584 torproject tor Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams. A malicious client could send a RELAY_COMMAND_BEGIN b...	8.2 High	—	0,25%	20 Agt 2026
CVE-2026-77506 Znuny before LTS 6.5.22 allows AgentTicketEmailResend template XSS.	4.8 Medium	—	0,24%	20 Agt 2026
CVE-2026-76023 google chrome Improper resource control in Linux Toolkit Theming in Google Chrome prior to 151.0.7922.173 allowed a remote attacker who had compromised the renderer process to execute...	8.8 High	—	0,45%	20 Agt 2026
CVE-2026-76022 google chrome Buffer overflow in Network in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chro...	8.8 High	—	0,45%	20 Agt 2026
CVE-2026-76021 google chrome Use after free in DOM in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium s...	8.8 High	—	0,41%	20 Agt 2026
CVE-2026-76020 google chrome Race condition in V8 in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium se...	7.5 High	—	0,29%	20 Agt 2026
CVE-2026-76019 google chrome Incorrect authorization in Workers in Google Chrome prior to 151.0.7922.173 allowed a remote attacker who had compromised the renderer process and leveraged social engine...	8.1 High	—	0,34%	20 Agt 2026
CVE-2026-76018 google chrome Privilege elevation in Import in Google Chrome prior to 151.0.7922.173 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outsi...	8.8 High	—	0,38%	20 Agt 2026
CVE-2026-76017 google chrome Use after free in Chromoting in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic....	8.8 High	—	0,38%	20 Agt 2026
CVE-2026-75484 Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in mtrudel bandit allows an unauthenticated remote attacker to smuggle CR, LF, or NUL character...	6.9 Medium	—	0,71%	20 Agt 2026
CVE-2026-74836 Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin an unbounded number of HTTP/2 stream...	8.7 High	—	0,64%	20 Agt 2026
CVE-2026-73137 A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). A tenant with HelmRelease create permissions can explo...	7.7 High	—	0,53%	20 Agt 2026
CVE-2026-73040 Dockge validates a stack name only on the write path. In backend/stack.ts the allow-list check in validate(), which requires the name to match ^[a-z0-9_-]+$, is reached f...	8.8 High	—	0,94%	20 Agt 2026
CVE-2026-71485 Centrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copies the client-controlled protocol.ConnectRequest.headers map through OnCl...	9.1 Critical	—	0,61%	20 Agt 2026
CVE-2026-70654 libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, applications that define unusual custom libvips sources and use them to process...	5.8 Medium	—	0,11%	20 Agt 2026
CVE-2026-70653 libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, the old-style Radiance RLE decoder in libvips/foreign/radiance.c can process a...	4.8 Medium	—	0,12%	20 Agt 2026
CVE-2026-70652 libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built with libultrahdr support can incorrectly size an output buffer in...	2.0 Low	—	0,14%	20 Agt 2026
CVE-2026-70651 libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built without libtiff support but with ImageMagick support can overflow...	6.9 Medium	—	0,12%	20 Agt 2026
CVE-2026-69242 libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, a crafted many-band TIFF processed through VipsForeignLoadTiff can evade scanli...	8.4 High	—	0,19%	20 Agt 2026
CVE-2026-68921 DiceBear is an avatar library for designers and developers. Prior to 9.4.3, @dicebear/core interpolates the rotate option into an SVG transform attribute without XML esca...	4.7 Medium	—	0,29%	20 Agt 2026
CVE-2026-67567 A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a tenant, who has the ability to create HelmRelease custom resources (CRs),...	9.9 Critical	—	0,62%	20 Agt 2026
CVE-2026-67446 Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded d...	5.3 Medium	—	0,51%	20 Agt 2026
CVE-2026-67445 Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit reads SMTP commands through internal/smtpd/smtpd.go session.readLine() using bufio.Reade...	5.3 Medium	—	0,51%	20 Agt 2026
CVE-2026-53804 OTRS Community Edition contains an authenticated OS command injection vulnerability in the PGP encryption module that allows administrators to execute arbitrary operating...	7.2 High	—	1,5%	20 Agt 2026
CVE-2026-52021 An issue in code100xDevs 100xdevs CMS v.1.0 (2026-04-30) allows a remote attacker to obtain sensitive information via the src/middleware.ts, and src/app/api/mobile/search...	7.5 High	—	0,49%	20 Agt 2026
CVE-2026-43798 apple swiftnio ssh A single crafted SSH message gives an unauthenticated network attacker an out-of-bounds stack write of attacker-controlled length and content against any application buil...	9.8 Critical	—	0,47%	20 Agt 2026
CVE-2026-19755 NoSleep 1.5.1 exposes a privileged XPC Mach service and accepts raw dictionary messages containing attacker-controlled command and NSBundlePath values.This issue affects...	6.9 Medium	—	0,14%	20 Agt 2026
CVE-2026-18420 Improper input validation in the Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards allows an authenticated remote user to execute arbitrary code on the se...	8.8 High	—	0,96%	20 Agt 2026
CVE-2026-77151 A security flaw has been discovered in lin-snow Ech0 up to 5.4.1. Affected by this issue is the function MD5Encrypt of the file internal/util/crypto/crypto.go. Performing...	3.7 Low	—	0,37%	20 Agt 2026
CVE-2026-75910 Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1 could allow an authenticated remote us...	6.5 Medium	—	0,51%	20 Agt 2026
CVE-2026-72861 The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src/github.js...	5.8 Medium	—	0,27%	20 Agt 2026
CVE-2026-9033 tp-link er7212pc firmware, tp-link er605 firmware +16 lainnya An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout...	4.3 Medium	—	0,28%	20 Agt 2026
CVE-2026-77148 A vulnerability was found in Comfast CF-N1-S 2.6.0.1. This impacts the function sub_44B50C of the file /cgi-bin/mbox-config?method=SET&section=ptest_channel of the compon...	9.9 Critical	—	0,79%	20 Agt 2026
CVE-2026-75526 django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. From 5.0.8 until 5.0.9, ContentRenderer.render_placeholder in...	4.4 Medium	—	0,26%	20 Agt 2026
CVE-2026-75514 BunkerWeb is an open-source, next-generation Web Application Firewall. Prior to 1.6.13, the blacklist, greylist, and antibot modules in src/common/core/blacklist/blacklis...	5.9 Medium	—	0,60%	20 Agt 2026
CVE-2026-72854 msgpack_unpacker_expand_buffer in src/unpack.c, reached through the public msgpack_unpacker_reserve_buffer API, computes its new buffer size using an unchecked size_t add...	5.3 Medium	—	0,16%	20 Agt 2026
CVE-2026-72852 hank-ai/darknet sizes a convolutional layer's weight and output heap buffers by multiplying configuration fields taken from a .cfg file in unchecked 32-bit int arithmetic...	7.8 High	—	0,21%	20 Agt 2026
CVE-2026-66788 A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is...	9.9 Critical	—	0,66%	20 Agt 2026
CVE-2026-66787 A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of advertised IP...	8.7 High	—	0,30%	20 Agt 2026
CVE-2026-66785 A flaw was found in Submariner. This vulnerability allows a malicious cluster (spoke) to redirect network traffic from other connected clusters (peer clusters) by publish...	8.7 High	—	0,21%	20 Agt 2026
CVE-2026-66002 Frappe is a full-stack web application framework. Prior to 15.115.0 and 16.27.0, the public request-data web form and PersonalDataDownloadRequest class in frappe/website/...	6.9 Medium	—	0,82%	20 Agt 2026
CVE-2026-66001 Frappe is a full-stack web application framework. Prior to 15.114.0 and 16.26.0, the approve and authorize functions in frappe/integrations/oauth2.py allow the OAuth2 con...	8.5 High	—	0,34%	20 Agt 2026
CVE-2026-64777 apple container A malicious builder peer may be able to request an in-context file by name from the host and receive the contents of whatever the name resolves to, even when it resolves...	4.3 Medium	—	0,34%	20 Agt 2026
CVE-2026-63654 Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted frappe.model.workflow.bulk_workflow_approval endpoint in frappe/model/wo...	6.9 Medium	—	0,26%	20 Agt 2026
CVE-2026-63003 django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, page duplication lacks an object-level authori...	6.5 Medium	—	0,42%	20 Agt 2026
CVE-2026-62315 Frappe is a full-stack web application framework. In version 16.31.0 and earlier, frappe.client.set_value in frappe/client.py checks a dictionary supplied through the fie...	7.1 High	—	0,49%	20 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.