Katalog CVE (hal. 632)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 264.414 (Critical 36.443 · High 105.610 · KEV 1.760 · sejak 2020) · Pembaruan terakhir: 28 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 31.551–31.600 dari 264.414 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-44901 wazuh Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AffectedItemsWazuhResult.merge() in...	8.4 High	—	0,75%	19 Agt 2026
CVE-2026-44256 wazuh Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.4.0 until 4.14.6 and 5.0.0-beta2, api/api/middlewares.py decodes the...	5.3 Medium	—	0,49%	19 Agt 2026
CVE-2026-44255 wazuh Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AuthenticationManager.check_user()...	5.3 Medium	—	0,62%	19 Agt 2026
CVE-2026-41424 wazuh Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.9.0 until 4.10.4 and 4.14.6, PUT /security/users/{user_id} in api/api...	8.2 High	—	0,47%	19 Agt 2026
CVE-2026-20359 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security revi...	9.9 Critical	—	0,42%	19 Agt 2026
CVE-2026-20358 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security revi...	10.0 Critical	—	0,48%	19 Agt 2026
CVE-2026-20357 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security revi...	10.0 Critical	—	0,62%	19 Agt 2026
CVE-2026-20327 A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection a...	6.5 Medium	—	0,35%	19 Agt 2026
CVE-2026-20320 A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration informat...	7.5 High	—	0,50%	19 Agt 2026
CVE-2026-20319 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal securit...	7.5 High	—	0,47%	19 Agt 2026
CVE-2026-20318 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal securit...	9.6 Critical	—	0,44%	19 Agt 2026
CVE-2026-20317 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal securit...	10.0 Critical	—	0,56%	19 Agt 2026
CVE-2026-20315 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal securit...	10.0 Critical	—	0,49%	19 Agt 2026
CVE-2026-20314 A vulnerability in Cisco Packaged Contact Center Enterprise (Packaged CCE) and Cisco Unified Contact Center Enterprise (Unified CCE) could allow an authenticated, remote...	5.0 Medium	—	0,44%	19 Agt 2026
CVE-2026-20302 A vulnerability in the USB driver of Cisco RoomOS could allow an unauthenticated, local attacker with physical access to the USB port on an affected device to execute arb...	6.1 Medium	—	0,23%	19 Agt 2026
CVE-2026-20232 A vulnerability in the web-based management interface of Cisco Industrial Ethernet (IE) 1000 Series Switches could allow an authenticated, remote attacker to conduct a st...	5.4 Medium	—	0,27%	19 Agt 2026
CVE-2026-20231 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal securit...	9.9 Critical	—	0,53%	19 Agt 2026
CVE-2026-20177 A vulnerability in the handling of management plane packets by Cisco Industrial Ethernet (IE) 1000 Series Switches could allow an unauthenticated, remote attacker to&nbsp...	5.3 Medium	—	0,51%	19 Agt 2026
CVE-2026-20030 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security revi...	10.0 Critical	—	0,57%	19 Agt 2026
CVE-2024-13942 Secure BootROM of RK3588s SoC is vulnerable to a time-of-check to time-of-use attack in case of booting from external media (SPI NOR or NAND, EMMC or SD). The code re...	7.6 High	—	0,23%	19 Agt 2026
CVE-2026-64852 Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.8, the Grav API plugin intercepts the apiKeyGenerate...	8.7 High	—	0,41%	19 Agt 2026
CVE-2026-64851 Grav Shortcode Core Plugin allows for the development shortcode plugins that utilize the common format utilized by WordPress and BBCode. Prior to 6.2.2, Grav Shortcode Co...	8.5 High	—	0,46%	19 Agt 2026
CVE-2026-64850 Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData() in system/src/Grav/Common/Data/Blueprint.php sends an editor-controlled Class::method pro...	8.7 High	—	0,47%	19 Agt 2026
CVE-2026-63408 Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extr...	7.5 High	—	0,49%	19 Agt 2026
CVE-2026-63407 Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin CorsMiddleware returns...	8.2 High	—	0,38%	19 Agt 2026
CVE-2026-62673 Grav is a file-based Web platform. Prior to 2.0.4, the Grav .htaccess and webserver-configs/htaccess.txt security rules omit the Apache [NC] flag and therefore compare se...	8.2 High	—	0,54%	19 Agt 2026
CVE-2026-62672 Grav is a file-based Web platform. Prior to 2.0.4, Grav allowlists the regex_replace filter and function in system/config/security.yaml, and GravExtension::regexReplace()...	6.0 Medium	—	0,38%	19 Agt 2026
CVE-2026-62671 Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task accepts a top-level GET...	5.4 Medium	—	0,18%	19 Agt 2026
CVE-2026-62670 Grav Flex Objects Plugin allows you to build custom collections of objects. Prior to 1.4.3, the Grav Flex Objects Admin Next API requireFlexPermission() method in classes...	6.3 Medium	—	0,33%	19 Agt 2026
CVE-2026-62669 Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pen...	7.4 High	—	0,50%	19 Agt 2026
CVE-2026-62668 Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin WebhookController.php accepts...	9.4 Critical	—	0,45%	19 Agt 2026
CVE-2026-62667 Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin ApiKeyManager::generateKey()...	8.1 High	—	0,41%	19 Agt 2026
CVE-2026-62666 Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, Grav API plugin UsersController::createApiKey(),...	8.8 High	—	0,64%	19 Agt 2026
CVE-2026-61842 Grav is a file-based Web platform. Prior to 2.0.2, the Grav Twig content sandbox permits grav.offsetGet('config') to return the raw configuration object and permits json_...	6.5 Medium	—	0,44%	19 Agt 2026
CVE-2026-61690 Grav is a file-based Web platform. Prior to 2.0.1, Grav ZipArchiver::extract() in system/src/Grav/Common/Filesystem/ZipArchiver.php passes archives to ZipArchive::extract...	6.5 Medium	—	0,53%	19 Agt 2026
CVE-2026-61607 Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.2, the Grav API plugin POST /api/v1/media pipeline i...	4.6 Medium	—	0,29%	19 Agt 2026
CVE-2026-53654 Grav is a file-based Web platform. Prior to 3.8.5, the Login plugin twofa_cancel task accepts a client-controlled _redirect field without a nonce and allows an unauthenti...	5.3 Medium	—	0,53%	19 Agt 2026
CVE-2026-46343 wazuh Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, WazuhCommon.end_receiving_file() in...	7.2 High	—	0,42%	19 Agt 2026
CVE-2026-44254 wazuh Wazuh is a free and open source platform used for threat prevention, detection, and response. From 1.0.0 until 4.14.6 and 5.0.0-beta2, HandleSecureMessage() in src/remote...	5.3 Medium	—	0,50%	19 Agt 2026
CVE-2026-44253 wazuh Wazuh is a free and open source platform used for threat prevention, detection, and response. From 3.9.0 until 4.14.5 and 5.0.0-beta2, the Wazuh cluster protocol in frame...	4.9 Medium	—	0,61%	19 Agt 2026
CVE-2026-44252 wazuh Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.5, Wazuh Manager allows a low-privilege read-only API...	8.8 High	—	0,54%	19 Agt 2026
CVE-2026-19672 The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such a...	6.3 Medium	—	0,47%	19 Agt 2026
CVE-2026-18430 HumHub 1.18.4 contains a stored cross-site scripting vulnerability in the comment-deletion notification flow. A Space administrator can delete another user's comment, cho...	7.2 High	—	0,50%	19 Agt 2026
CVE-2026-16819 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service and compromise data integrity due to a time-of-check time-of-use r...	7.7 High	—	0,12%	19 Agt 2026
CVE-2026-76614 OpenEMR before 8.3.0 contains a path traversal vulnerability in the EDI archive restore function. The archrestore_sel POST parameter is passed to the archive restore hand...	4.3 Medium	—	0,40%	19 Agt 2026
CVE-2026-76203 Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force o...	5.1 Medium	—	0,40%	19 Agt 2026
CVE-2026-75956 Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory < 6.2.3 - Pagination values were not strictly typed. Array/non-numer...	8.7 High	—	0,43%	19 Agt 2026
CVE-2026-75955 Joomla Extension - cmsjunkie.com - Reflected XSS / XML injection in J-BusinessDirectory < 6.2.3 - companyName from the request was written unescaped into an XML attribute...	5.1 Medium	—	0,44%	19 Agt 2026
CVE-2026-75954 Advisory Joomla Extension - cmsjunkie.com - SQL injection in trips search in J-BusinessDirectory < 6.2.3 - Search keywords and ORDER BY were concatenated into SQL. 6.2.3 quotes k...	9.3 Critical	—	0,39%	19 Agt 2026
CVE-2026-75953 Joomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory < 6.2.3 - Recipient address was taken from the request (contact_id_offer / contact_id_event) in...	7.5 High	—	0,42%	19 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.