Katalog CVE (hal. 634)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 264.414 (Critical 36.443 · High 105.610 · KEV 1.760 · sejak 2020) · Pembaruan terakhir: 28 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 31.651–31.700 dari 264.414 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-16690 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.	7.5 High	—	0,55%	19 Agt 2026
CVE-2026-16686 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to access NFS-exported filesystems due to improper authentication.	8.2 High	—	0,50%	19 Agt 2026
CVE-2026-16656 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to gain root privileges due to improper authentication.	9.8 Critical	—	0,72%	19 Agt 2026
CVE-2026-15961 ibm power system s1122 (9824-22a) firmware, ibm power system s1124 (9824-42a) firmware +17 lainnya IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 IBM PowerVM could allow a local attacker to obtain sensitive information or...	6.0 Medium	—	0,13%	19 Agt 2026
CVE-2026-15078 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to gain unauthorized access to AIX systems due to improper validation of TLS certificates.	8.1 High	—	0,32%	19 Agt 2026
CVE-2026-15068 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elem...	9.9 Critical	—	0,79%	19 Agt 2026
CVE-2026-15065 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to bypass security restrictions due to the exposure of intermediate certificate authority...	9.1 Critical	—	0,63%	19 Agt 2026
CVE-2026-15061 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 's nimesis registration service could allow a remote attacker to overwrite files due to path traversal.	8.2 High	—	0,59%	19 Agt 2026
CVE-2026-14970 ibm vios, ibm aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM server process is crashing during client registration due to buffer overflow.	7.5 High	—	0,46%	19 Agt 2026
CVE-2026-76245 stigmem (pip package stigmem-node) version 0.9.0a1 contains a timestamp-handling mismatch in federation peer-token validation that can cause valid peer tokens to be incor...	7.1 High	—	0,24%	19 Agt 2026
CVE-2026-76244 stigmem-node contains an insecure default configuration vulnerability that allows federation traffic to traverse networks without mTLS protection when non-loopback endpoi...	9.1 Critical	—	0,27%	19 Agt 2026
CVE-2026-76243 stigmem versions before 0.9.0a2 allow unauthenticated access when authentication is disabled on non-loopback deployments. Attackers can perform read, write, and federatio...	9.2 Critical	—	0,56%	19 Agt 2026
CVE-2026-76242 stigmem-node 0.9.0a1 accepts federation peer key material during peer registration without a separate administrator out-of-band fingerprint approval step. On nodes that a...	9.1 Critical	—	0,35%	19 Agt 2026
CVE-2026-76241 stigmem-node 0.9.0a1 allows plugin signature enforcement to be disabled via a single configuration flag without a second explicit acknowledgment. If that setting is carri...	7.3 High	—	0,12%	19 Agt 2026
CVE-2026-76240 stigmem-node 0.9.0a1 interpolates Postgres backend schema identifiers into SQL strings without defensive quoting. In the affected code path the schema value is operator-c...	7.5 High	—	0,38%	19 Agt 2026
CVE-2026-76239 Stigmem before 0.9.0a11 fails to validate the delivery_address parameter when creating webhook subscriptions, allowing authenticated users to specify internal loopback an...	6.3 Medium	—	0,32%	19 Agt 2026
CVE-2026-76238 stigmem versions before 0.9.0a12 contain a broken object level authorization vulnerability in the decay sweep endpoint that allows authenticated attackers with write cred...	7.2 High	—	0,36%	19 Agt 2026
CVE-2026-76237 stigmem-node before 0.9.0a12 contains a broken object level authorization (cross-tenant BOLA) vulnerability in the quarantine review endpoints. On multi-tenant deployment...	8.6 High	—	0,36%	19 Agt 2026
CVE-2026-76236 stigmem-node before 0.9.0a12 contains a cross-tenant broken object level authorization (BOLA) flaw in the RTBF (right-to-be-forgotten) tombstone mechanism. issue_tombston...	7.2 High	—	0,36%	19 Agt 2026
CVE-2026-76234 libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check length and cla...	7.5 High	—	0,31%	19 Agt 2026
CVE-2026-76233 Renovate versions from 39.53.0 before 40.33.0 contain a command injection vulnerability in the gleam manager where the depName parameter is appended to gleam deps update...	6.7 Medium	—	1,0%	19 Agt 2026
CVE-2026-76232 Renovate versions from 31.51.0 before 40.33.0 contain a command injection vulnerability in the helmv3 manager where the repository parameter is appended to helm registry...	6.7 Medium	—	1,0%	19 Agt 2026
CVE-2026-76231 Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appended to instal...	6.7 Medium	—	1,0%	19 Agt 2026
CVE-2026-76230 Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended to npm inst...	6.7 Medium	—	1,0%	19 Agt 2026
CVE-2026-76229 Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names are appended...	6.7 Medium	—	1,0%	19 Agt 2026
CVE-2026-76228 Renovate versions >=32.124.0 and before 42.68.5 (and Mend renovate-ce/renovate-ee before 13.3.0) contain a command injection vulnerability in Gradle Wrapper artifact hand...	6.7 Medium	—	0,96%	19 Agt 2026
CVE-2026-76227 Renovate versions from 42.68.1 before 42.96.3 and from 43.0.0 before 43.4.4, including the renovate/renovate Docker images, and Mend Renovate CE/EE images (renovate-ce, r...	5.5 Medium	—	0,15%	19 Agt 2026
CVE-2026-76226 Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attack...	6.3 Medium	—	0,29%	19 Agt 2026
CVE-2026-76225 ArcadeDB before 26.8.1 contains a server-side request forgery vulnerability in the OpenCypher LOAD CSV implementation that fails to validate HTTP/HTTPS URLs. Authenticate...	7.7 High	—	0,35%	19 Agt 2026
CVE-2026-76224 ArcadeDB before 26.8.1 (arcadedb-gremlin, affected <= 26.7.3) contains a remote code execution vulnerability in its Gremlin query engine. Although the engine defaults to...	8.8 High	—	0,85%	19 Agt 2026
CVE-2026-76223 ArcadeDB (com.arcadedb) versions 26.7.3 and earlier fail to enforce the UPDATE_SCHEMA permission check when a DEFINE FUNCTION statement targets an already-existing functi...	7.1 High	—	0,35%	19 Agt 2026
CVE-2026-76222 gitpython project gitpython GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths outside the...	8.2 High	—	0,42%	19 Agt 2026
CVE-2026-76221 gitpython project gitpython GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by inje...	8.8 High	—	0,77%	19 Agt 2026
CVE-2026-76220 gitpython project gitpython GitPython before 3.1.58 contains a command execution vulnerability in the check_unsafe_options guard that can be bypassed by combining a single-character kwarg with split...	8.8 High	—	0,91%	19 Agt 2026
CVE-2026-76219 gitpython project gitpython GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.from_tree, IndexFile.reset, and IndexFile.merge_tree methods that append c...	8.1 High	—	0,54%	19 Agt 2026
CVE-2026-76218 gitpython project gitpython GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template p...	8.8 High	—	0,83%	19 Agt 2026
CVE-2026-76217 gitpython project gitpython GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove() and Head.checkout(). Attackers can supply --pat...	6.5 Medium	—	0,41%	19 Agt 2026
CVE-2026-76216 Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three...	7.5 High	—	0,36%	19 Agt 2026
CVE-2026-76215 phpmyfaq phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments and attachments. Unauthenticated attackers can retri...	5.3 Medium	—	0,35%	19 Agt 2026
CVE-2026-76214 phpmyfaq phpMyFAQ before 4.1.7 fails to persist the WebAuthn login challenge generated by prepareForLogin, because neither WebAuthn controller saves the mutated key objects back t...	7.4 High	—	0,39%	19 Agt 2026
CVE-2026-76213 phpmyfaq phpMyFAQ before 4.1.7 contains a brute-force vulnerability in the two-factor authentication step where the failure counter is session-scoped and reset on each successful...	7.4 High	—	0,45%	19 Agt 2026
CVE-2026-76212 phpmyfaq phpMyFAQ before 4.1.7, when configured to use PostgreSQL via the native pgsql PHP extension, declares an incorrect LIKE ESCAPE character ('=') in the Search/Database/Pgsq...	5.3 Medium	—	0,43%	19 Agt 2026
CVE-2026-76211 phpmyfaq phpMyFAQ before 4.1.7 fails to properly enforce CONFIGURATION_EDIT permission on admin API read endpoints for LDAP, Elasticsearch, OpenSearch, and dashboard configuration...	4.3 Medium	—	0,29%	19 Agt 2026
CVE-2026-76210 phpmyfaq phpMyFAQ before 4.1.6 does not adequately sanitize HTML in FAQ answers before generating PDFs via TCPDF. An attacker with permission to create or edit FAQ content can emb...	6.5 Medium	—	0,42%	19 Agt 2026
CVE-2026-76209 phpmyfaq phpMyFAQ versions before v4.1.6 fail to validate the security.enableRegistration setting in API endpoints, allowing attackers to create user accounts when registration is...	4.3 Medium	—	0,29%	19 Agt 2026
CVE-2026-76208 phpmyfaq phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass vulnerability in AuthLdap::create(). When LDAP authentication is enabled, after a successful LDAP b...	8.2 High	—	0,44%	19 Agt 2026
CVE-2026-76207 phpmyfaq phpMyFAQ before 4.1.7 contains a two-factor authentication bypass vulnerability where remember-me tokens are issued before 2FA verification completes. Attackers with vali...	8.1 High	—	0,46%	19 Agt 2026
CVE-2026-76206 phpmyfaq phpMyFAQ versions before 4.1.7 fail to validate active status in the PDF export endpoint, allowing unauthenticated attackers to retrieve draft FAQ metadata. Attackers can...	5.3 Medium	—	0,36%	19 Agt 2026
CVE-2026-76205 phpmyfaq phpMyFAQ before 4.1.7 contains a SQL injection vulnerability in the glossary create and update endpoints caused by truncating an escaped string before embedding it in a S...	8.1 High	—	0,43%	19 Agt 2026
CVE-2026-75920 phpmyfaq phpMyFAQ before v4.1.6 writes content backup ZIP archives to the web-accessible document root at content.zip, exposing sensitive files including database credentials. Una...	5.3 Medium	—	0,36%	19 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.