Katalog CVE (hal. 626)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 264.331 (Critical 36.436 · High 105.591 · KEV 1.760 · sejak 2020) · Pembaruan terakhir: 28 Okt 2026, 12:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 31.251–31.300 dari 264.331 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-75616 tp-link archer c20 firmware An OS command injection vulnerability exists in the web management interface of Archer C20 v6 firmware when processing certain WAN-related configuration operations. An au...	6.8 Medium	—	2,8%	19 Agt 2026
CVE-2026-75596 netty Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the default io.netty.handler.ssl.SniHandler constructors us...	7.5 High	—	0,37%	19 Agt 2026
CVE-2026-75595 netty Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the...	9.1 Critical	—	0,32%	19 Agt 2026
CVE-2026-75569 A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinni...	7.7 High	—	0,60%	19 Agt 2026
CVE-2026-75476 Tanium addressed a compression bomb vulnerability in Threat Response.	3.1 Low	—	0,29%	19 Agt 2026
CVE-2026-69222 LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.2, the join filter in src/filters/array.ts computes complexity from arr...	7.5 High	—	0,63%	19 Agt 2026
CVE-2026-68555 Coturn is a free open source implementation of TURN and STUN Server. In 4.15.0, an authenticated TURN user can repeatedly resume one allocation from fresh UDP 5-tuples wi...	6.5 Medium	—	0,53%	19 Agt 2026
CVE-2026-68554 Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an on-path attacker can append attributes after MESSAGE-INTEGRITY to an authenticate...	2.3 Low	—	0,19%	19 Agt 2026
CVE-2026-68553 Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, an authenticated TURN user can place printf-style format specifiers in the STUN USER...	7.1 High	—	0,48%	19 Agt 2026
CVE-2026-68552 Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an unauthenticated remote client can send a STUN message over TCP or TLS with a body...	5.3 Medium	—	0,52%	19 Agt 2026
CVE-2026-62727 microsoft windows 10 1607, microsoft windows 10 1809 +11 lainnya Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to elevate privileg...	7.0 High	—	0,20%	19 Agt 2026
CVE-2026-61556 LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. From 10.26.0 until 10.27.1, the strip_html filter in src/filters/html.ts can enter an...	8.7 High	—	0,52%	19 Agt 2026
CVE-2026-54743 Lemmy is a link aggregator and forum for the fediverse. Prior to lemmy-ui 0.19.19-beta.1, LemmyNet/lemmy-ui renders Markdown in src/shared/markdown.ts for post bodies, co...	6.4 Medium	—	0,55%	19 Agt 2026
CVE-2026-54741 Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, Lemmy blocks new private messages from a sender after the recipient blocks th...	5.3 Medium	—	0,48%	19 Agt 2026
CVE-2026-54740 Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, a lower-ranked remote moderator can remove a higher-ranked moderator by sendi...	6.5 Medium	—	0,43%	19 Agt 2026
CVE-2026-54739 Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, Lemmy's login endpoint in crates/api/api/src/local_user/login.rs returns differ...	6.9 Medium	—	0,59%	19 Agt 2026
CVE-2026-54738 Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, actix-web ConnectionInfo::realip_remote_addr reads the first value of X-Forward...	6.5 Medium	—	0,56%	19 Agt 2026
CVE-2026-54494 Koel is a free, open-source music streaming solution. Prior to 9.7.1, App\Helpers\Network::isPublicHost() uses filter_var() with FILTER_FLAG_NO_PRIV_RANGE and FILTER_FLAG...	5.3 Medium	—	0,43%	19 Agt 2026
CVE-2026-54493 Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createInternetRadioStation.view and updateInternetRadioStation.view routes a...	7.7 High	—	0,42%	19 Agt 2026
CVE-2026-54492 Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createPodcastChannel.view route accepts an authenticated user's private URL...	4.3 Medium	—	0,41%	19 Agt 2026
CVE-2026-54491 Koel is a free, open-source music streaming solution. Prior to 9.7.1, outbound podcast and radio fetch paths perform a point-in-time App\Helpers\Network::isPublicHost() o...	7.1 High	—	0,38%	19 Agt 2026
CVE-2026-53549 Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /host/db/proxy/test endpoint accept...	7.7 High	—	0,45%	19 Agt 2026
CVE-2026-53548 Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.6.1, the GET /host/db/host/:id/password endpoint...	9.6 Critical	—	0,46%	19 Agt 2026
CVE-2026-53547 Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /database/export endpoint creates a...	8.8 High	—	0,54%	19 Agt 2026
CVE-2026-53546 Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the terminal WebSocket accepts a user-contro...	9.6 Critical	—	0,46%	19 Agt 2026
CVE-2026-53545 Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the DELETE /ssh/tunnel/disconnect/:tunnelNam...	9.8 Critical	—	0,73%	19 Agt 2026
CVE-2026-53542 Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the archive creation endpoint in src/backend...	8.8 High	—	0,66%	19 Agt 2026
CVE-2026-4937 ibm power system s1122 (9824-22a) firmware, ibm power system s1124 (9824-42a) firmware +22 lainnya IBM PowerVM Hypervisor FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2 could allow a local attacker with administrative privileges...	6.0 Medium	—	0,13%	19 Agt 2026
CVE-2026-4936 ibm power system s1122 (9824-22a) firmware, ibm power system s1124 (9824-42a) firmware +24 lainnya IBM PowerVM Hypervisor Platform KeyStore (PKS) and virtual TPM FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2 use persistent stor...	6.2 Medium	—	0,11%	19 Agt 2026
CVE-2026-18849 ibm openbmc, ibm power system e1050 (9043-mrx) firmware +7 lainnya IBM OpenBMC FW1060.00 through FW1060.80 is affected by a vulnerability in the BMC firmware update process. An attacker with authenticated administrator-level access to th...	6.8 Medium	—	0,37%	19 Agt 2026
CVE-2026-18544 ibm portieris IBM Portieris 0.5.0 through 0.14.2 could allow a remote authenticated attacker to bypass image policy enforcement due to improper authorization of pod owner references.	8.1 High	—	0,43%	19 Agt 2026
CVE-2026-18102 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to overwrite adjacent memory due to an integer underflow during bounds checking.	4.3 Medium	—	0,30%	19 Agt 2026
CVE-2026-17015 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service and obtain sensitive information due to an out-of-bounds read.	8.1 High	—	0,49%	19 Agt 2026
CVE-2026-14978 hashicorp go-slug HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploa...	5.5 Medium	—	0,14%	19 Agt 2026
CVE-2026-14514 ibm reliable scalable cluster technology IBM Reliable Scalable Cluster Technology (RSCT) 3.0 could allow a remote attacker to cause a denial of service by sending a specially crafted request due improper input v...	6.5 Medium	—	0,31%	19 Agt 2026
CVE-2026-12634 The NVS backend of the Zephyr settings subsystem (subsys/settings/src/settings_nvs.c) reads stored setting-name entries into fixed 74-byte stack buffers and NUL-terminate...	5.3 Medium	—	0,14%	19 Agt 2026
CVE-2026-12633 The IPv6 neighbor-discovery code in subsys/net/ip/ipv6_nbr.c processes the 6LoWPAN Context Option (6CO, RFC 6775) carried inside ICMPv6 Router Advertisements. In handle_r...	8.1 High	—	0,31%	19 Agt 2026
CVE-2026-12522 The HL7800 cellular modem driver's +CGCONTRDP: response handler on_cmd_atcmdinfo_ipaddr() in drivers/modem/vendor_standalone/hl7800.c parses the PDP-context dynamic param...	8.8 High	—	0,34%	19 Agt 2026
CVE-2026-11617 Tanium addressed a compression bomb vulnerability in Findings.	3.1 Low	—	0,29%	19 Agt 2026
CVE-2026-76647 Leantime JSON-RPC API through version 3.9.0 contains a missing authorization vulnerability in the JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php. The dispa...	8.8 High	—	0,51%	19 Agt 2026
CVE-2026-76574 A flaw has been found in code-projects Hospital Information System 1.0. The impacted element is the function User::login of the file includes/users/UsersController.php of...	7.3 High	—	0,43%	19 Agt 2026
CVE-2026-76572 A vulnerability was detected in pkp pkp-lib up to 3.3.0-22/3.4.0-10/3.5.0-4. The affected element is the function _transformPHP of the file classes/xslt/XSLTransformer.ph...	4.7 Medium	—	0,45%	19 Agt 2026
CVE-2026-75593 BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such a...	7.2 High	—	0,54%	19 Agt 2026
CVE-2026-75112 A security issue exists within OTTO® Fleet Manager. The vulnerability stems from the use of an insufficient work factor in the bcrypt password hashing implementation, whi...	6.9 Medium	—	0,16%	19 Agt 2026
CVE-2026-68901 Wekan is open source kanban built with Meteor. Prior to 10.38, the /api/boards/:boardId/export, /api/boards/:boardId/attachments/:attachmentId/export, /api/boards/:boardI...	6.5 Medium	—	0,53%	19 Agt 2026
CVE-2026-68900 Wekan is open source kanban built with Meteor. From 8.72 until 10.23, addBoardHTMLToZip() in client/lib/exportHTML.js read a card title and body through textContent, whic...	7.6 High	—	0,35%	19 Agt 2026
CVE-2026-68899 Wekan is open source kanban built with Meteor. Prior to 9.90, isFileValid() in models/fileValidation.js used the Unix file command for content-based MIME detection, but d...	8.7 High	—	0,53%	19 Agt 2026
CVE-2026-68561 Wekan is open source kanban built with Meteor. Prior to 9.89, the second Boards.allow({ update }) rule in server/permissions/boards.js called canUpdateBoardSort in server...	8.8 High	—	0,51%	19 Agt 2026
CVE-2026-68560 Wekan is open source kanban built with Meteor. Prior to 9.75, models/fileValidation.js interpolated the uploaded fileObj.path into the administrator-configured externalCo...	7.7 High	—	0,58%	19 Agt 2026
CVE-2026-68559 Wekan is open source kanban built with Meteor. From 9.57 until 9.74, the /api/boards/:boardId/exportExcel route in models/exportExcel.js called the asynchronous exporterE...	6.5 Medium	—	0,40%	19 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.