Katalog CVE (hal. 631)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 264.414 (Critical 36.443 · High 105.610 · KEV 1.760 · sejak 2020) · Pembaruan terakhir: 28 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 31.501–31.550 dari 264.414 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-73136 zenhive machine payments protocol Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated third party to obtain paid resources by replaying a transfer settled by an unrelated paye...	7.5 High	—	0,60%	19 Agt 2026
CVE-2026-72717 Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a schema def...	9.3 Critical	—	0,65%	19 Agt 2026
CVE-2026-72716 Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a query para...	9.3 Critical	—	0,65%	19 Agt 2026
CVE-2026-71871 Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a header par...	9.3 Critical	—	0,65%	19 Agt 2026
CVE-2026-71869 Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in an array ite...	9.3 Critical	—	0,65%	19 Agt 2026
CVE-2026-71868 Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in an enum defa...	9.3 Critical	—	0,65%	19 Agt 2026
CVE-2026-71867 Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a single quote in a schema property name is emi...	9.3 Critical	—	0,65%	19 Agt 2026
CVE-2026-71866 Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. From version 8.19.0 until 8.21.0, a double quote in a schema pro...	9.3 Critical	—	0,65%	19 Agt 2026
CVE-2026-71865 Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a query parameter name is emi...	9.3 Critical	—	0,65%	19 Agt 2026
CVE-2026-71864 Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a header parameter name is em...	9.3 Critical	—	0,65%	19 Agt 2026
CVE-2026-67581 zenhive machine payments protocol Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated remote client to obtain paid resources by resubmitting one settled on-chain transfer. MP...	7.5 High	—	0,60%	19 Agt 2026
CVE-2026-66794 A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the u...	9.3 Critical	—	0,62%	19 Agt 2026
CVE-2026-63652 freerdp FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, rdpsnd_server_recv_formats in channels/rdpsnd/server/rdpsnd_main.c frees context->client...	6.5 Medium	—	0,58%	19 Agt 2026
CVE-2026-63633 freerdp FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdp_dsp_decode_opus in libfreerdp/codec/dsp.c calls Stream_EnsureRemainingCapacity o...	9.8 Critical	—	0,62%	19 Agt 2026
CVE-2026-63117 freerdp FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, an authenticated RDP client can advertise DVI ADPCM with nBlockAlign equal to 8 and nCha...	6.5 Medium	—	0,55%	19 Agt 2026
CVE-2026-62682 Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in servers[0].url is emit...	9.3 Critical	—	0,65%	19 Agt 2026
CVE-2026-62681 Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in an OpenAPI path is emi...	9.3 Critical	—	0,65%	19 Agt 2026
CVE-2026-62680 Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref v...	7.1 High	—	0,40%	19 Agt 2026
CVE-2026-61518 ISPConfig contains an authenticated SQL injection vulnerability in the Remote API. The primary_id parameter passed to delete and update API methods is concatenated direct...	8.8 High	—	0,46%	19 Agt 2026
CVE-2026-55648 freerdp FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, freerdp_image_copy_from_icon_data in libfreerdp/codec/color.c calculates nWidth multipli...	7.5 High	—	0,43%	19 Agt 2026
CVE-2026-55564 freerdp FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, the glyph_cache_get function in libfreerdp/cache/glyph.c checks whether index is greater...	7.1 High	—	0,33%	19 Agt 2026
CVE-2026-55194 freerdp FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpc_client_recv_fragment in libfreerdp/core/gateway/rpc_client.c ensures the response re...	9.8 Critical	—	0,62%	19 Agt 2026
CVE-2026-55193 freerdp FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients using TS Gateway accept a server-controlled max_xmit_frag value in libfr...	8.8 High	—	0,48%	19 Agt 2026
CVE-2026-55192 freerdp FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP H.264 decoder backends can return YUV planes sized from the bitstream without co...	8.2 High	—	0,45%	19 Agt 2026
CVE-2026-55191 freerdp FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients that negotiate RDPGFX AVC444 with an H.264 decoder backend calculate the...	9.8 Critical	—	0,62%	19 Agt 2026
CVE-2026-32475 Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through...	9.0 Critical	—	2,0%	19 Agt 2026
CVE-2026-19875 langflow IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to overwrite administrator email information and abuse the server as an outbound relay due to missing...	7.5 High	—	0,52%	19 Agt 2026
CVE-2026-19653 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to improper handling of memory page table configurations.	5.5 Medium	—	0,13%	19 Agt 2026
CVE-2026-19234 ibm power system s1122 (9824-22a) firmware, ibm power system s1124 (9824-42a) firmware +17 lainnya Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in the host firmware boot process image vali...	8.2 High	—	0,17%	19 Agt 2026
CVE-2026-18874 A flaw was found in volsync-addon-controller. This vulnerability allows an attacker to inject malicious YAML (Yet Another Markup Language) code into the OpenShift Lifecyc...	6.2 Medium	—	0,54%	19 Agt 2026
CVE-2026-17183 An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression w...	7.1 High	—	0,29%	19 Agt 2026
CVE-2025-14603 The application component processes user-supplied parameters insecurely, passing them into SQL queries. This can enable blind SQL injection, potentially exposing database...	8.8 High	—	0,39%	19 Agt 2026
CVE-2025-14600 An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, a...	9.3 Critical	—	0,51%	19 Agt 2026
CVE-2026-75583 keeper.sh's calendar module version prior to 2.18.14 contains a server-side request forgery (SSRF) guard bypass vulnerability that allows authenticated attackers to reach...	3.5 Low	—	0,33%	19 Agt 2026
CVE-2026-75147 FFmpeg before commit 983dae9 contains an out-of-bounds read in the AV1 RTP packetizer (libavformat/rtpenc_av1.c). The keyframe detection loop that searches for a sequence...	7.1 High	—	0,12%	19 Agt 2026
CVE-2026-75146 FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is...	8.1 High	—	0,26%	19 Agt 2026
CVE-2026-75145 FFmpeg before commit b4c199c contains an incorrect integer narrowing conversion in the AV1 RTP packetizer (libavformat/rtpenc_av1.c). The OBU size is cast to long before...	5.8 Medium	—	0,16%	19 Agt 2026
CVE-2026-75144 FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger...	7.8 High	—	0,20%	19 Agt 2026
CVE-2026-75143 FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the...	9.8 Critical	—	0,70%	19 Agt 2026
CVE-2026-75142 FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c). When muxing input with more streams than the muxer's fixed-siz...	7.8 High	—	0,20%	19 Agt 2026
CVE-2026-75141 FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than t...	7.8 High	—	0,20%	19 Agt 2026
CVE-2026-72530 Advisory trueconf server A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use...	9.0 Critical	KEV	1,7%	19 Agt 2026
CVE-2026-72529 Advisory trueconf server A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could exe...	9.8 Critical	KEV	1,5%	19 Agt 2026
CVE-2026-71470 A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource (CR) editor, to manipulate Search CR fields such a...	9.1 Critical	—	0,71%	19 Agt 2026
CVE-2026-50173 Flow-Like is a platform for building end-to-end use cases. Prior to version 1.0.4, `GET /api/v1/apps/{app_id}/invoke/presign` grants Azure Blob Storage SAS credentials wi...	7.2 High	—	0,68%	19 Agt 2026
CVE-2026-49441 wazuh Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.3.0 until 4.14.6 and 5.0.0-beta3, the non-merged branch of process_fi...	9.1 Critical	—	0,77%	19 Agt 2026
CVE-2026-49392 wazuh Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.6.0 until 4.14.6 and 5.0.0-beta3, DB::getFile() and DB::searchFile()...	5.3 Medium	—	0,30%	19 Agt 2026
CVE-2026-48162 wazuh Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, DistributedAPI.send_tmp_file() in f...	9.1 Critical	—	0,65%	19 Agt 2026
CVE-2026-48024 wazuh Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, cluster.unmerge_info() in framework...	9.1 Critical	—	0,78%	19 Agt 2026
CVE-2026-45798 wazuh Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.5.0 until 4.14.6 and 5.0.0-beta2, compare_wazuh_versions() in src/sha...	7.5 High	—	0,92%	19 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.