Katalog CVE (hal. 633)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 264.414 (Critical 36.443 · High 105.610 · KEV 1.760 · sejak 2020) · Pembaruan terakhir: 28 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 31.601–31.650 dari 264.414 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-75952 Joomla Extension - cmsjunkie.com - Cross-site request forgery in J-BusinessDirectory < 6.2.3 - Tokens were missing on many AJAX/state-changing tasks: contact/quote forms...	4.6 Medium	—	0,21%	19 Agt 2026
CVE-2026-75951 Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference (multiple frontend/API actions) in J-BusinessDirectory < 6.2.3	6.9 Medium	—	0,41%	19 Agt 2026
CVE-2026-75950 Joomla Extension - cmsjunkie.com - Unauthenticated listing ownership takeover in J-BusinessDirectory < 6.2.3 - Ownership could be changed using attacker-supplied company...	6.9 Medium	—	0,41%	19 Agt 2026
CVE-2026-75949 Advisory Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion (path traversal) in J-BusinessDirectory < 6.2.3 - Upload/remove accepted a client-controlled root (_p...	10.0 Critical	—	0,43%	19 Agt 2026
CVE-2026-71961 Cudy WR3000 2.0 running firmware before 2.5.24 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary OS commands with ro...	8.8 High	—	2,7%	19 Agt 2026
CVE-2026-71960 Cudy WR3000 2.0 running firmware before 2.5.24 contains a hard-coded JWT HMAC signing secret vulnerability in the Mosquitto MQTT broker's authentication plugin that allow...	9.1 Critical	—	0,53%	19 Agt 2026
CVE-2026-71176 dell openmanage enterprise Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low...	8.8 High	—	0,44%	19 Agt 2026
CVE-2026-67268 dell command update Dell Command Update (DCU), versions prior to 5.7.1, contain an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with local a...	6.5 Medium	—	0,15%	19 Agt 2026
CVE-2026-67267 dell command update Dell Command Update (DCU), versions prior to 5.7.1, contain an Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability. A low privileged...	5.5 Medium	—	0,15%	19 Agt 2026
CVE-2026-67266 dell command update Dell Command Update (DCU), versions prior to 5.7.1, contain an Incorrect Authorization vulnerability. A low privileged attacker with local access could potentially exploi...	5.5 Medium	—	0,12%	19 Agt 2026
CVE-2026-58565 dell command update Dell Command Update (DCU), versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker with local access could potentially exploit t...	8.8 High	—	0,14%	19 Agt 2026
CVE-2026-58564 dell command update Dell Command Update (DCU), versions prior to 5.7.1, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially...	7.8 High	—	0,14%	19 Agt 2026
CVE-2026-58562 dell command update Dell Command Update (DCU), versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker with local access could potentially exploit t...	7.3 High	—	0,14%	19 Agt 2026
CVE-2026-56797 dell command update Dell Command Update (DCU), versions prior to 5.7.1, a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. A low privileged attacker with local access could p...	7.3 High	—	0,12%	19 Agt 2026
CVE-2026-56796 dell command update Dell Command Update (DCU), versions prior to 5.7.1, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker wit...	6.6 Medium	—	0,17%	19 Agt 2026
CVE-2026-54793 dell openmanage enterprise Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low...	5.4 Medium	—	0,23%	19 Agt 2026
CVE-2026-53477 dell command update Dell Command Update (DCU), versions prior to 5.7.1, contain a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. A low privileged attacker with local access...	7.8 High	—	0,12%	19 Agt 2026
CVE-2026-53452 Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding. Prior to version 0.4.13, the unauthenticated conf...	5.3 Medium	—	0,51%	19 Agt 2026
CVE-2026-53451 Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding. Prior to version 0.4.13, the unauthenticated save...	9.8 Critical	—	1,1%	19 Agt 2026
CVE-2026-52889 Formie is a Craft CMS plugin for creating forms. Prior to 3.1.27, Formie can pass request-derived Hidden field defaults such as HTTP User Agent, Referer URL, Current URL,...	9.8 Critical	—	1,3%	19 Agt 2026
CVE-2026-52834 jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculati...	7.3 High	—	0,17%	19 Agt 2026
CVE-2026-52792 Algernon is a small self-contained pure-Go web server. Prior to 1.17.9, Algernon on Windows selects a file handler in engine/handlers.go by calling filepath.Ext() without...	8.7 High	—	0,63%	19 Agt 2026
CVE-2026-50149 Contour is a Kubernetes ingress controller using Envoy proxy. In versions 1.23.0 through 1.33.4, when an `HTTPProxy` is configured with incompatible combination of both `...	6.5 Medium	—	0,19%	19 Agt 2026
CVE-2026-49817 dell command update Dell Command Update (DCU), versions prior to 5.7.1, contain a Deserialization of Untrusted Data vulnerability. A low privileged attacker with local access could potential...	7.8 High	—	0,31%	19 Agt 2026
CVE-2026-49816 dell command update Dell Command Update (DCU), versions prior to 5.7.1, contain a Deserialization of Untrusted Data vulnerability. A low privileged attacker with local access could potential...	7.8 High	—	0,31%	19 Agt 2026
CVE-2026-49289 The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. In 4.19.2 and 4.20.2, the library permits attacker-controlled XPath transforms while pro...	7.5 High	—	0,78%	19 Agt 2026
CVE-2026-49283 The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.19.3, 4.20.2, 5.0.6, and 6.2.1, the HTTPArtifact::receive() flow can...	8.7 High	—	0,47%	19 Agt 2026
CVE-2026-49255 electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm constructs operating system commands in src/app/lib/f...	8.8 High	—	0,79%	19 Agt 2026
CVE-2026-49253 electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm uses remote-supplied filenames directly with path.joi...	7.1 High	—	0,44%	19 Agt 2026
CVE-2026-48711 SSHFS is a network filesystem client for connecting to SSH servers. From version 1.4 until 3.7.6, SSHFS accepts a bracketed mount source such as [-oProxyCommand=CMD]:/pat...	7.0 High	—	0,24%	19 Agt 2026
CVE-2026-47187 SSHFS is a network filesystem client for connecting to SSH servers. Prior to version 3.7.6, a rogue SFTP server can return absolute symlink targets or relative targets co...	9.3 Critical	—	0,50%	19 Agt 2026
CVE-2026-45742 Gotenberg is a Docker-powered stateless API for PDF files. From 8.10.0 until 8.33.0, the newContext function in pkg/modules/api/context.go starts one errgroup.Go goroutin...	7.5 High	—	0,71%	19 Agt 2026
CVE-2026-45741 Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, the IsPublicIP function in pkg/gotenberg/outbound.go does not reject the 2002::/16 6to4...	7.5 High	—	0,37%	19 Agt 2026
CVE-2026-45274 MyBooks is anebook management web server also known as Talebook. In 3.41.2 and earlier, the SignUp.post handler for POST /api/user/sign_up in webserver/handlers/user.py d...	6.9 Medium	—	0,71%	19 Agt 2026
CVE-2026-45273 MyBooks is an ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler for POST /api/admin/settings in webserver/handlers...	8.7 High	—	0,45%	19 Agt 2026
CVE-2026-45272 MyBooks is an enhanced and easy-to-use personal ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler in webserver/han...	9.4 Critical	—	0,50%	19 Agt 2026
CVE-2026-44829 Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, filename handling in pkg/modules/api/context.go uses filepath.Base on Linux, which does...	8.8 High	—	0,50%	19 Agt 2026
CVE-2026-40509 OpenEMR before 8.3.0 contains a cross-site request forgery vulnerability in the DICOM viewer. The web_path GET parameter in the DICOM viewer page is embedded unsanitized...	4.3 Medium	—	0,19%	19 Agt 2026
CVE-2026-40508 OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the patient portal template import handler that allows authenticated attackers with Forms Adm...	5.4 Medium	—	0,30%	19 Agt 2026
CVE-2026-40507 OpenEMR before 8.3.0 contains a reflected cross-site scripting vulnerability in the patient portal template import handler. The templateHtml GET parameter is reflected in...	6.1 Medium	—	0,34%	19 Agt 2026
CVE-2026-32802 Dell PowerPath, version 7.2 through to 8.0 SP1, contains an Improper Privilege Management vulnerability. A low privileged attacker with local access could potentially exp...	5.3 Medium	—	0,12%	19 Agt 2026
CVE-2026-23501 Dell RecoverPoint for VMs, versions 6.0.3 and 6.0.3.1, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerabilit...	7.2 High	—	2,0%	19 Agt 2026
CVE-2026-18756 HumHub Community Edition 1.18.4 contains a reflected cross-site scripting vulnerability in the Space membership-request workflow. An attacker can place attacker-controlle...	7.2 High	—	0,47%	19 Agt 2026
CVE-2026-18526 HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting (XSS) vulnerability in the oEmbed confirmation rendering workflow.	7.4 High	—	0,46%	19 Agt 2026
CVE-2026-16818 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.	7.5 High	—	0,55%	19 Agt 2026
CVE-2026-16817 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a NULL pointer dereference.	7.5 High	—	0,55%	19 Agt 2026
CVE-2026-16816 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements...	9.9 Critical	—	0,79%	19 Agt 2026
CVE-2026-16814 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a heap buffer overflow.	8.8 High	—	0,41%	19 Agt 2026
CVE-2026-16706 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an out-of-bounds write.	7.5 High	—	0,55%	19 Agt 2026
CVE-2026-16703 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper privilege management.	7.8 High	—	0,14%	19 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.