Katalog CVE (hal. 665)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 264.825 (Critical 36.490 · High 105.809 · KEV 1.762 · sejak 2020) · Pembaruan terakhir: 29 Okt 2026, 12:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 33.201–33.250 dari 264.825 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-54347 Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZones.php can contain HTML specia...	8.7 High	—	0,42%	18 Agt 2026
CVE-2026-53759 linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations. Prior to version 4.2.0, db_sqlite.py created SQLite databases...	2.0 Low	—	0,19%	18 Agt 2026
CVE-2026-53458 Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio backend API handlers in custom_components/blueprin...	5.3 Medium	—	0,45%	18 Agt 2026
CVE-2026-53457 Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, the legacy stateless terminal command execution path in custom_comp...	5.1 Medium	—	0,76%	18 Agt 2026
CVE-2026-53456 Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio terminal SSH key authentication in custom_componen...	5.6 Medium	—	0,21%	18 Agt 2026
CVE-2026-53455 Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio generated a shell-based Git credential helper in c...	8.6 High	—	0,50%	18 Agt 2026
CVE-2026-53454 Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio configured Git's credential.helper store when savi...	6.9 Medium	—	0,46%	18 Agt 2026
CVE-2026-53453 Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio exposed administrator-intended backend API actions...	8.7 High	—	0,45%	18 Agt 2026
CVE-2026-52817 Linuxfabrik Monitoring Plugins provides monitoring plugins for Icinga, Nagios, and related systems. Prior to version 5.1.0, the shipped assets/sudoers/Debian.sudoers poli...	7.0 High	—	0,18%	18 Agt 2026
CVE-2026-52793 Froxlor is open source server administration software. Prior to 2.3.7, the API authentication path in lib/Froxlor/Api/FroxlorRPC.php and FroxlorRPC::validateAuth accepts...	8.1 High	—	0,33%	18 Agt 2026
CVE-2026-41921 Koha before 26.05.02, 25.11.07, and 25.05.13 contains a stored cross-site scripting vulnerability in the purchase suggestion handler that allows authenticated staff users...	5.4 Medium	—	0,30%	18 Agt 2026
CVE-2026-18504 fastify fastify is a fast and low overhead web framework for Node.js. Versions of fastify before 5.12.1 are affected by a schema validation bypass when a request body schema targ...	5.3 Medium	—	0,28%	18 Agt 2026
CVE-2026-16732 fastify fastify is a fast and low overhead web framework for Node.js. Impact: the fix for CVE-2026-3635 added a guard on the forwarded-header reads used to derive the request hos...	6.1 Medium	—	0,16%	18 Agt 2026
CVE-2026-15571 A flaw was found in the legacy client-initiated account-linking endpoint of Keycloak, a widely used open-source identity and access management solution. The mechanism use...	7.3 High	—	0,43%	18 Agt 2026
CVE-2026-12632 Zephyr's Precision Time Protocol receive handler ptp_msg_post_recv() in subsys/net/lib/ptp/msg.c takes the 4-bit message type straight off the wire via ptp_msg_type() (ms...	6.5 Medium	—	0,29%	18 Agt 2026
CVE-2026-12631 The Zephyr kernel validates the k_thread_join() and k_thread_abort() system calls (declared __syscall in include/zephyr/kernel.h) through thread_obj_validate() in kernel/...	6.5 Medium	—	0,16%	18 Agt 2026
CVE-2026-76032 Pydio Cells 5.0.0 through 5.0.2 returns share-link details to any authenticated user. The REST handler for GET /a/share/link/{Uuid} in idm/share/rest/handler.go reads the...	4.3 Medium	—	0,38%	18 Agt 2026
CVE-2026-75936 Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service...	7.5 High	—	0,61%	18 Agt 2026
CVE-2026-75935 Uncontrolled memory allocation in the binary Ion stream cursor in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted Ion b...	7.5 High	—	0,61%	18 Agt 2026
CVE-2026-75877 A flaw has been found in TRENDnet TV-IP751WIC 11.03.03. This vulnerability affects the function SystemNetworkChanged/SystemDDNSChanged/SystemEmailChanged/SystemFTPChanged...	9.9 Critical	—	0,85%	18 Agt 2026
CVE-2026-75876 A security vulnerability has been detected in xianrendzw EasyReport up to 2.0.17.0522_Beta. Affected by this issue is some unknown functionality of the file ModuleControl...	6.3 Medium	—	0,33%	18 Agt 2026
CVE-2026-73529 Plainpad through 1.1.1, fixed in commit d3823fc, contains a missing rate limiting vulnerability that allows unauthenticated attackers to send unbounded login requests to...	5.3 Medium	—	0,41%	18 Agt 2026
CVE-2026-71676 Buffer Overflow vulnerability in Open5GS v.2.7.0 allows a remote attacker to cause a denial of service via the NAS 5GS decoder chain, triggered when the message type byte...	7.5 High	—	0,55%	18 Agt 2026
CVE-2026-71675 An issue in Open5GS v.2.7.0 allows a remote attacker to cause a denial of service via the ngap_send_to_nas() function in src/amf/ngap-path.c	7.5 High	—	0,55%	18 Agt 2026
CVE-2026-71417 Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/certificates/upload allowed a non-read-only user to create a duplicate row using another certificate b...	7.3 High	—	0,11%	18 Agt 2026
CVE-2026-71322 Lemur manages TLS certificate creation. Prior to 1.9.3, CertificateExport placed its CertificatePermission ownership check inside the plugin.requires_key branch for POST...	4.3 Medium	—	0,23%	18 Agt 2026
CVE-2026-71317 Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/authorities with type=subca did not require AuthorityPermission on the parent authority when ADMIN_ONL...	6.5 Medium	—	0,11%	18 Agt 2026
CVE-2026-71308 Lemur manages TLS certificate creation. From 0.5.0 until 1.9.3, certificate create, upload, and edit requests accepted replaces[] or replacements identifiers that Associa...	8.1 High	—	0,32%	18 Agt 2026
CVE-2026-71307 Lemur manages TLS certificate creation. Prior to 1.9.3, GET /api/1/destinations and GET /api/1/destinations/ relied only on authentication while sibling write handlers re...	7.7 High	—	0,31%	18 Agt 2026
CVE-2026-71303 Lemur manages TLS certificate creation. Prior to 1.9.3, _validate_acme_url enforced ACME_DIRECTORY_HOST_ALLOWLIST when an authority was created, but PUT /api/1/authoritie...	7.7 High	—	0,28%	18 Agt 2026
CVE-2026-70666 Lemur manages TLS certificate creation. Prior to 1.9.3, an authority-role member could update acme_url through PUT /api/1/authorities/ without revalidation and direct set...	7.4 High	—	0,22%	18 Agt 2026
CVE-2026-67443 FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the allowDashboard authorization gate in server/integrations/node-red/inde...	9.2 Critical	—	0,69%	18 Agt 2026
CVE-2026-67440 FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the DEVICE_BROWSE, DEVICE_NODE_ATTRIBUTE, HOST_INTERFACES, and DEVICE_TAGS...	6.9 Medium	—	0,54%	18 Agt 2026
CVE-2026-65985 FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the device-webapi-request Socket.IO handler in server/runtime/index.js per...	6.0 Medium	—	0,47%	18 Agt 2026
CVE-2026-65984 FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, POST /api/refresh in server/api/auth/index.js falls back from current user...	7.5 High	—	0,52%	18 Agt 2026
CVE-2026-59915 Dell Alienware Command Center (AWCC), versions prior to 6.14.20.0, contain a Least Privilege Violation vulnerability. A low privileged attacker with local access could po...	7.3 High	—	0,14%	18 Agt 2026
CVE-2026-57826 An issue was discovered in openHiTLS 0.2.0 through 0.3.2. In the X.509 certificate chain verification, the basic constraints extension and CA flag processing of intermedi...	6.8 Medium	—	0,27%	18 Agt 2026
CVE-2026-52829 ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an unauthenticated IPv4 peer can deterministically terminate a synced Zebra node using the default Linux d...	7.5 High	—	0,61%	18 Agt 2026
CVE-2026-52739 ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a malicious block producer can terminate zebrad by placing the same shielded transaction in a non-finalize...	5.9 Medium	—	0,52%	18 Agt 2026
CVE-2026-52738 ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a consensus-valid block containing a long chain of transparent self-spends to one address can permanently...	6.9 Medium	—	0,51%	18 Agt 2026
CVE-2026-52737 ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a malicious unauthenticated P2P peer can answer Zebra's outbound getblocks or FindBlocks request with a sm...	5.3 Medium	—	0,26%	18 Agt 2026
CVE-2026-52736 ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a remote unauthenticated P2P peer can stall a Zebra node by racing an invalid block body against the valid...	8.7 High	—	0,61%	18 Agt 2026
CVE-2026-52735 ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, Zebra can accept a block that zcashd rejects because the P2SH signature-operation counter undercounts rede...	9.3 Critical	—	0,51%	18 Agt 2026
CVE-2026-52734 ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an unauthenticated P2P peer can cause the mempool download pipeline to retain transactions after verificat...	5.3 Medium	—	0,51%	18 Agt 2026
CVE-2026-52733 ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a natural or attacker-influenced chain fork can leave stale Sapling and Orchard note-commitment subtree ro...	6.5 Medium	—	0,44%	18 Agt 2026
CVE-2026-52732 ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, one unauthenticated P2P peer can monopolize all 25 MAX_INBOUND_CONCURRENCY slots in Zebra's inbound mempoo...	5.3 Medium	—	0,51%	18 Agt 2026
CVE-2026-52731 ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an attacker authenticated to an enabled Zebra RPC endpoint can terminate zebrad by supplying a getblocktem...	6.5 Medium	—	0,53%	18 Agt 2026
CVE-2026-52481 An issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote attacker to obtain sensitive information via the tcp_actions() function	7.5 High	—	0,52%	18 Agt 2026
CVE-2026-52480 An issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote attacker to obtain sensitive information via the inetd service	6.5 Medium	—	0,33%	18 Agt 2026
CVE-2026-49500 Dell Alienware Command Center (AWCC), versions prior to 6.14.20.0, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileg...	6.0 Medium	—	0,10%	18 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.