Katalog CVE (hal. 628)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 264.414 (Critical 36.443 · High 105.610 · KEV 1.760 · sejak 2020) · Pembaruan terakhir: 28 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 31.351–31.400 dari 264.414 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-54494 Koel is a free, open-source music streaming solution. Prior to 9.7.1, App\Helpers\Network::isPublicHost() uses filter_var() with FILTER_FLAG_NO_PRIV_RANGE and FILTER_FLAG...	5.3 Medium	—	0,43%	19 Agt 2026
CVE-2026-54493 Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createInternetRadioStation.view and updateInternetRadioStation.view routes a...	7.7 High	—	0,42%	19 Agt 2026
CVE-2026-54492 Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createPodcastChannel.view route accepts an authenticated user's private URL...	4.3 Medium	—	0,41%	19 Agt 2026
CVE-2026-54491 Koel is a free, open-source music streaming solution. Prior to 9.7.1, outbound podcast and radio fetch paths perform a point-in-time App\Helpers\Network::isPublicHost() o...	7.1 High	—	0,38%	19 Agt 2026
CVE-2026-53549 Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /host/db/proxy/test endpoint accept...	7.7 High	—	0,45%	19 Agt 2026
CVE-2026-53548 Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.6.1, the GET /host/db/host/:id/password endpoint...	9.6 Critical	—	0,46%	19 Agt 2026
CVE-2026-53547 Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /database/export endpoint creates a...	8.8 High	—	0,54%	19 Agt 2026
CVE-2026-53546 Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the terminal WebSocket accepts a user-contro...	9.6 Critical	—	0,46%	19 Agt 2026
CVE-2026-53545 Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the DELETE /ssh/tunnel/disconnect/:tunnelNam...	9.8 Critical	—	0,73%	19 Agt 2026
CVE-2026-53542 Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the archive creation endpoint in src/backend...	8.8 High	—	0,66%	19 Agt 2026
CVE-2026-4937 ibm power system s1122 (9824-22a) firmware, ibm power system s1124 (9824-42a) firmware +22 lainnya IBM PowerVM Hypervisor FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2 could allow a local attacker with administrative privileges...	6.0 Medium	—	0,13%	19 Agt 2026
CVE-2026-4936 ibm power system s1122 (9824-22a) firmware, ibm power system s1124 (9824-42a) firmware +24 lainnya IBM PowerVM Hypervisor Platform KeyStore (PKS) and virtual TPM FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2 use persistent stor...	6.2 Medium	—	0,11%	19 Agt 2026
CVE-2026-18849 ibm openbmc, ibm power system e1050 (9043-mrx) firmware +7 lainnya IBM OpenBMC FW1060.00 through FW1060.80 is affected by a vulnerability in the BMC firmware update process. An attacker with authenticated administrator-level access to th...	6.8 Medium	—	0,37%	19 Agt 2026
CVE-2026-18544 ibm portieris IBM Portieris 0.5.0 through 0.14.2 could allow a remote authenticated attacker to bypass image policy enforcement due to improper authorization of pod owner references.	8.1 High	—	0,43%	19 Agt 2026
CVE-2026-18102 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to overwrite adjacent memory due to an integer underflow during bounds checking.	4.3 Medium	—	0,30%	19 Agt 2026
CVE-2026-17015 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service and obtain sensitive information due to an out-of-bounds read.	8.1 High	—	0,49%	19 Agt 2026
CVE-2026-14978 hashicorp go-slug HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploa...	5.5 Medium	—	0,14%	19 Agt 2026
CVE-2026-14514 ibm reliable scalable cluster technology IBM Reliable Scalable Cluster Technology (RSCT) 3.0 could allow a remote attacker to cause a denial of service by sending a specially crafted request due improper input v...	6.5 Medium	—	0,31%	19 Agt 2026
CVE-2026-12634 The NVS backend of the Zephyr settings subsystem (subsys/settings/src/settings_nvs.c) reads stored setting-name entries into fixed 74-byte stack buffers and NUL-terminate...	5.3 Medium	—	0,14%	19 Agt 2026
CVE-2026-12633 The IPv6 neighbor-discovery code in subsys/net/ip/ipv6_nbr.c processes the 6LoWPAN Context Option (6CO, RFC 6775) carried inside ICMPv6 Router Advertisements. In handle_r...	8.1 High	—	0,31%	19 Agt 2026
CVE-2026-12522 The HL7800 cellular modem driver's +CGCONTRDP: response handler on_cmd_atcmdinfo_ipaddr() in drivers/modem/vendor_standalone/hl7800.c parses the PDP-context dynamic param...	8.8 High	—	0,34%	19 Agt 2026
CVE-2026-11617 Tanium addressed a compression bomb vulnerability in Findings.	3.1 Low	—	0,29%	19 Agt 2026
CVE-2026-76647 Leantime JSON-RPC API through version 3.9.0 contains a missing authorization vulnerability in the JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php. The dispa...	8.8 High	—	0,51%	19 Agt 2026
CVE-2026-76574 A flaw has been found in code-projects Hospital Information System 1.0. The impacted element is the function User::login of the file includes/users/UsersController.php of...	7.3 High	—	0,43%	19 Agt 2026
CVE-2026-76572 A vulnerability was detected in pkp pkp-lib up to 3.3.0-22/3.4.0-10/3.5.0-4. The affected element is the function _transformPHP of the file classes/xslt/XSLTransformer.ph...	4.7 Medium	—	0,45%	19 Agt 2026
CVE-2026-75593 BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such a...	7.2 High	—	0,54%	19 Agt 2026
CVE-2026-75112 A security issue exists within OTTO® Fleet Manager. The vulnerability stems from the use of an insufficient work factor in the bcrypt password hashing implementation, whi...	6.9 Medium	—	0,16%	19 Agt 2026
CVE-2026-68901 Wekan is open source kanban built with Meteor. Prior to 10.38, the /api/boards/:boardId/export, /api/boards/:boardId/attachments/:attachmentId/export, /api/boards/:boardI...	6.5 Medium	—	0,53%	19 Agt 2026
CVE-2026-68900 Wekan is open source kanban built with Meteor. From 8.72 until 10.23, addBoardHTMLToZip() in client/lib/exportHTML.js read a card title and body through textContent, whic...	7.6 High	—	0,35%	19 Agt 2026
CVE-2026-68899 Wekan is open source kanban built with Meteor. Prior to 9.90, isFileValid() in models/fileValidation.js used the Unix file command for content-based MIME detection, but d...	8.7 High	—	0,53%	19 Agt 2026
CVE-2026-68561 Wekan is open source kanban built with Meteor. Prior to 9.89, the second Boards.allow({ update }) rule in server/permissions/boards.js called canUpdateBoardSort in server...	8.8 High	—	0,51%	19 Agt 2026
CVE-2026-68560 Wekan is open source kanban built with Meteor. Prior to 9.75, models/fileValidation.js interpolated the uploaded fileObj.path into the administrator-configured externalCo...	7.7 High	—	0,58%	19 Agt 2026
CVE-2026-68559 Wekan is open source kanban built with Meteor. From 9.57 until 9.74, the /api/boards/:boardId/exportExcel route in models/exportExcel.js called the asynchronous exporterE...	6.5 Medium	—	0,40%	19 Agt 2026
CVE-2026-68558 Wekan is open source kanban built with Meteor. From 8.36 until 9.74, the outgoing webhook Integration URL validator in models/integrations.js checked only the literal URL...	8.5 High	—	0,39%	19 Agt 2026
CVE-2026-67189 pfSense Plus before 26.07 and pfSense CE through 2.8.1 contain a stored cross-site scripting vulnerability in the Traffic Graphs top-talkers feature, where PTR records re...	6.1 Medium	—	1,2%	19 Agt 2026
CVE-2026-63722 ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by chaining an authent...	9.8 Critical	—	1,3%	19 Agt 2026
CVE-2026-63188 Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 0.3.9, the Logto Tunnel npm package enabled createStaticFileProxy from packages/tunnel...	8.7 High	—	0,54%	19 Agt 2026
CVE-2026-63187 Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.40.1 until 1.41.0, Logto's .github/workflows/commitlint.yml directly interpolated github...	6.3 Medium	—	0,39%	19 Agt 2026
CVE-2026-62317 Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's email subaddressing blocklist in packages/core/src/libraries/sign-in-e...	7.5 High	—	0,74%	19 Agt 2026
CVE-2026-61712 BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, BuildKit read attacker-controlled...	2.3 Low	—	0,40%	19 Agt 2026
CVE-2026-61711 BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, a custom frontend could place an i...	5.3 Medium	—	0,36%	19 Agt 2026
CVE-2026-55090 Etherpad is a real-time collaborative editor. Prior to 3.3.0, getHTMLFromAtext in src/node/utils/ExportHtml.ts interpolates values from the exportHtmlAdditionalTagsWithDa...	5.3 Medium	—	0,55%	19 Agt 2026
CVE-2026-55089 Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad's src/node/handler/APIHandler.ts authorizes requests to /api/2/* in the authorization_code...	9.9 Critical	—	0,46%	19 Agt 2026
CVE-2026-55088 Etherpad is a real-time collaborative editor. From 2.6.0 until 3.1.0, Etherpad's src/node/hooks/express/tokenTransfer.ts uses POST /tokenTransfer to store an author token...	6.8 Medium	—	0,44%	19 Agt 2026
CVE-2026-55087 Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad uses the attacker-controlled x-proxy-path request header in src/node/hooks/express/admin.ts...	6.1 Medium	—	0,58%	19 Agt 2026
CVE-2026-55086 Etherpad is a real-time collaborative editor. Prior to 3.1.0, src/node/handler/ImportHandler.ts and src/node/handler/ExportHandler.ts derive temporary filenames from Math...	4.2 Medium	—	0,14%	19 Agt 2026
CVE-2026-55085 Etherpad is a real-time collaborative editor. Prior to 3.3.1, result.appendSpan in src/static/js/domline.ts interpolates the start attribute of a numbered list directly i...	9.6 Critical	—	0,47%	19 Agt 2026
CVE-2026-54742 Lemmy is a link aggregator and forum for the fediverse. From 0.19.18 until 0.19.19 and 1.0.0-alpha.20, a community moderator can feature or unfeature posts in other commu...	5.1 Medium	—	0,55%	19 Agt 2026
CVE-2026-22306 Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext transmission of sensitive information vulnerability in...	10.0 Critical	—	0,21%	19 Agt 2026
CVE-2026-19509 Improper input validation in `ajaxSet_wireless_network_configuration.jst` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows an authenticated attacker to cause denial...	6.5 Medium	—	0,44%	19 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.