Katalog CVE (hal. 619)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 264.331 (Critical 36.436 · High 105.591 · KEV 1.760 · sejak 2020) · Pembaruan terakhir: 28 Okt 2026, 12:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 30.901–30.950 dari 264.331 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-18270 Kenwood DNR1007XR udhcpd Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on aff...	7.8 High	—	0,15%	20 Agt 2026
CVE-2026-18269 Kenwood DNR1007XR tchdr_bytestream_read Out-Of-Bounds Write Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code...	6.8 Medium	—	0,36%	20 Agt 2026
CVE-2026-18268 Kenwood DNR1007XR JKGenService Command Injection Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected in...	7.0 High	—	0,83%	20 Agt 2026
CVE-2026-18267 Kenwood DNR1007XR Firmware Update Link Following Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affecte...	6.8 Medium	—	0,42%	20 Agt 2026
CVE-2026-18265 OSNEXUS QuantaStor Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installati...	9.8 Critical	—	1,0%	20 Agt 2026
CVE-2026-18264 NoMachine getstat Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of...	8.8 High	—	2,3%	20 Agt 2026
CVE-2026-18263 Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privil...	7.8 High	—	0,17%	20 Agt 2026
CVE-2026-18262 Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privil...	7.8 High	—	0,17%	20 Agt 2026
CVE-2026-15686 Adminer multi_query Incorrect Check of Function Return Value Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on...	7.2 High	—	1,1%	20 Agt 2026
CVE-2026-15679 Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute...	7.8 High	—	0,45%	20 Agt 2026
CVE-2026-13121 Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privil...	7.8 High	—	0,17%	20 Agt 2026
CVE-2026-77004 A flaw has been found in Comfast CF-N1-S 2.6.0.1. This impacts the function sprintf of the file /cgi-bin/mbox-config?method=SET&section=ptest_sn. Executing a manipulation...	7.4 High	—	1,8%	20 Agt 2026
CVE-2026-76999 A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This affects the function add_grade of the file /index.php....	6.3 Medium	—	0,35%	20 Agt 2026
CVE-2026-76998 A security vulnerability has been detected in SourceCodester Simple Online Food Ordering System 1.0. The impacted element is an unknown function of the file /admin/ajax.p...	7.3 High	—	0,43%	20 Agt 2026
CVE-2026-76997 A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=sa...	6.3 Medium	—	0,33%	20 Agt 2026
CVE-2026-75140 jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM h...	7.5 High	—	0,53%	20 Agt 2026
CVE-2026-63044 apache inlong Server-Side Request Forgery (SSRF) vulnerability in Apache InLong. Any authenticated user (no admin role required) can cause the InLong Manager server to make outbound H...	5.4 Medium	—	0,50%	20 Agt 2026
CVE-2026-63043 apache inlong Relative Path Traversal vulnerability in Apache InLong. Arbitrary file read from the Agent host filesystem. This issue affects Apache InLong: from 2.0.0 before 2.4.0....	7.5 High	—	0,81%	20 Agt 2026
CVE-2026-63042 apache inlong Files or Directories Accessible to External Parties vulnerability in Apache InLong. Any user who can authenticate to the manager can create, modify and delete Data Node d...	8.1 High	—	0,64%	20 Agt 2026
CVE-2026-63040 apache inlong Files or Directories Accessible to External Parties vulnerability in Apache InLong. StreamSource performs no authorization check, any authenticated user can logically del...	8.1 High	—	0,64%	20 Agt 2026
CVE-2026-63039 apache inlong Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This allows an attacker to inject the string value in...	9.8 Critical	—	0,69%	20 Agt 2026
CVE-2026-63038 apache inlong Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This allows an attacker to inject arbitrary SQL code...	9.8 Critical	—	0,69%	20 Agt 2026
CVE-2026-63037 apache inlong Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This appears to allow SQL injection in the ORDER BY c...	9.8 Critical	—	0,69%	20 Agt 2026
CVE-2026-63016 apache inlong Uncontrolled Resource Consumption vulnerability in Apache InLong. Users could affect operational configuration or allow upload of non-official packages. This issue affec...	5.3 Medium	—	0,63%	20 Agt 2026
CVE-2026-63015 apache inlong Uncontrolled Resource Consumption vulnerability in Apache InLong. Non-template responsible persons can view template information. This issue affects Apache InLong: from...	4.3 Medium	—	0,56%	20 Agt 2026
CVE-2026-19611 A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A...	7.4 High	—	0,89%	20 Agt 2026
CVE-2026-76996 A security flaw has been discovered in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/admin/view_order.php. The m...	7.3 High	—	0,43%	20 Agt 2026
CVE-2026-76995 A vulnerability was identified in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /admin/ajax.php?action=sav...	4.7 Medium	—	0,40%	20 Agt 2026
CVE-2026-76993 A vulnerability was determined in GreyDGL PentestGPT up to 1.0.0. This vulnerability affects unknown code of the component Web-Page Crawling. Executing a manipulation of...	5.0 Medium	—	0,37%	20 Agt 2026
CVE-2026-76991 A vulnerability was found in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /viewappointmentapproved.php. Performing a manipulation...	6.3 Medium	—	0,33%	20 Agt 2026
CVE-2026-73220 CVAT is an open source interactive video and image annotation tool for computer vision. From 2.68.0 until 2.70.0, the audio-task annotation guide renderer in cvat-ui/src/...	8.5 High	—	0,48%	20 Agt 2026
CVE-2026-63490 Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves attack...	7.5 High	—	0,69%	20 Agt 2026
CVE-2026-61898 The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE ent...	7.8 High	—	0,19%	20 Agt 2026
CVE-2026-61897 An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID...	7.8 High	—	0,14%	20 Agt 2026
CVE-2026-55558 aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.start_tls in src/aiosmtplib/protocol.py consumes the server's 220 response an...	5.9 Medium	—	0,40%	20 Agt 2026
CVE-2026-49825 lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which...	8.2 High	—	0,30%	20 Agt 2026
CVE-2026-44725 EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and connected vehicles. Prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, the plugin-instal...	6.6 Medium	—	0,37%	20 Agt 2026
CVE-2026-16932 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to improper validation of the ODMDIR environment variable.	8.8 High	—	0,19%	20 Agt 2026
CVE-2026-16928 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a heap-based buffer overflow.	7.5 High	—	0,55%	20 Agt 2026
CVE-2026-16927 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain root privileges due to a time-of-check to time-of-use (TOCTOU) race condition.	7.0 High	—	0,10%	20 Agt 2026
CVE-2026-16926 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to overwrite arbitrary files due to improper neutralization of special elements in input.	9.1 Critical	—	0,56%	20 Agt 2026
CVE-2026-16925 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to achieve privilege escalation due to improper authorization.	7.8 High	—	0,13%	20 Agt 2026
CVE-2026-16924 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an improper calculation of a memory offset during IPsec de...	7.5 High	—	0,55%	20 Agt 2026
CVE-2026-16923 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper privilege management.	7.8 High	—	0,12%	20 Agt 2026
CVE-2026-16922 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to a time-of-check to time-of-use (TOCTOU) race condition.	7.0 High	—	0,10%	20 Agt 2026
CVE-2026-76990 A vulnerability has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file /delete.php. Such manipulati...	7.3 High	—	0,43%	20 Agt 2026
CVE-2026-76833 @cgauge/yaml npm package contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary JavaScript by embedding a custom !js YAML tag whose...	7.8 High	—	0,22%	20 Agt 2026
CVE-2026-76635 baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled table names a...	7.2 High	—	0,44%	20 Agt 2026
CVE-2026-76634 WeGIA before 3.9.2 contains an insecure direct object reference vulnerability in the employee profile page that allows authenticated attackers to access arbitrary employe...	6.5 Medium	—	0,40%	20 Agt 2026
CVE-2026-76633 WeGIA before 3.9.2 contains an authorization bypass vulnerability in the password change flow that allows any authenticated user to change their account password without...	8.1 High	—	0,44%	20 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.