Katalog CVE (hal. 686)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 265.211 (Critical 36.541 · High 105.926 · KEV 1.762 · sejak 2020) · Pembaruan terakhir: 30 Okt 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 34.251–34.300 dari 265.211 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-53960 Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, hidden or otherwise unviewable first-post content was leaked as an e...	5.3 Medium	—	0,31%	17 Agt 2026
CVE-2026-40144 A memory-corruption vulnerability exists in a kernel-mode component of BeyondTrust Endpoint Privilege Management (Windows deployments) prior to version 26.1.2. Insufficie...	7.3 High	—	0,13%	17 Agt 2026
CVE-2025-27772 UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the `/new_run` endpoint is vulnerable to remote code ex...	7.4 High	—	0,83%	17 Agt 2026
CVE-2025-27771 UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the `/add_prompts` endpoint is vulnerable to remote cod...	7.4 High	—	0,83%	17 Agt 2026
CVE-2025-27770 UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the `/create_project` endpoint is vulnerable to remote...	7.4 High	—	0,83%	17 Agt 2026
CVE-2025-27621 UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the UpTrain backend creates a new default user with a s...	7.7 High	—	0,46%	17 Agt 2026
CVE-2026-73851 Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can s...	6.1 Medium	—	2,3%	17 Agt 2026
CVE-2026-71567 In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected without quoting them either into command lines or into...	7.7 High	—	0,34%	17 Agt 2026
CVE-2026-71566 FakeFish handles incoming credentials by passing them down to scripts. This works for real hardware because in the end it's up to the BMC to validate them. However, Kub...	9.3 Critical	—	0,37%	17 Agt 2026
CVE-2026-16049 Mattermost Plugins versions <=11.8 10.20.11 11.5.7.0 _The Mattermost GitLab plugin fails to verify channel permissions when processing API requests with a caller-supplied...	4.3 Medium	—	0,29%	17 Agt 2026
CVE-2026-16048 mattermost server Mattermost versions 11.8.x <= 11.8.2, 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to restrict channel member role assignment to channel-scoped roles which allows a channel...	6.3 Medium	—	0,26%	17 Agt 2026
CVE-2026-16047 mattermost server Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate that users have read access to a channel before linking a board to it, which...	4.3 Medium	—	0,27%	17 Agt 2026
CVE-2026-16046 mattermost server Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to enforce run-state validation on write operations for finished playbook runs which allows a run participa...	4.3 Medium	—	0,25%	17 Agt 2026
CVE-2026-16045 mattermost server Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 Mattermost failed to restrict OAuth deauthorization and personal access token management endpoints to direct use...	4.3 Medium	—	0,33%	17 Agt 2026
CVE-2026-16044 mattermost server Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to prevent guest users from receiving Board Admin privileges during board archive import which allows a boa...	5.4 Medium	—	0,29%	17 Agt 2026
CVE-2026-15754 mattermost server Mattermost versions 11.7.x <= 11.7.6, 11.8.x <= 11.8.3 The access control policy unassign endpoint fails to re-validate that each target channel still belongs to the requ...	4.2 Medium	—	0,25%	17 Agt 2026
CVE-2026-13202 A vulnerability in OpenText Opentext Directory Services allows Input Data Manipulation. This issue affects Opentext Directory Services: through 22.2.	7.3 High	—	0,44%	17 Agt 2026
CVE-2026-10527 mattermost server Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to reconcile SchemeAdmin flags with a user's current role which allows a user demoted to...	6.3 Medium	—	0,26%	17 Agt 2026
CVE-2026-59911 dell objectscale Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Insertion of Sensitive Information into Log File vulnerability in the svc_tools. A low privileged attacker with...	5.5 Medium	—	0,15%	17 Agt 2026
CVE-2026-59910 dell objectscale Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low...	7.8 High	—	0,65%	17 Agt 2026
CVE-2026-59909 dell objectscale Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability. A low privileged attacker with local access could potentially exploit this vulnera...	7.1 High	—	0,16%	17 Agt 2026
CVE-2026-56686 dell objectscale Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low...	7.8 High	—	0,65%	17 Agt 2026
CVE-2026-56685 dell objectscale Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low...	7.3 High	—	0,72%	17 Agt 2026
CVE-2026-56090 dell objectscale Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Uncontrolled Search Path Element vulnerability. A low privileged attacker with local access could potentially e...	7.3 High	—	0,17%	17 Agt 2026
CVE-2026-56089 dell objectscale Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability. A low privileged attacker with local access could potentially exploit this vulnera...	3.3 Low	—	0,18%	17 Agt 2026
CVE-2026-19693 extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two...	8.1 High	—	0,45%	17 Agt 2026
CVE-2026-16471 Missing Authorization vulnerability in Dolusoft Software Technologies Sonlogger allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Sonlo...	7.5 High	—	0,39%	17 Agt 2026
CVE-2026-16139 progress sharefile storage zones controller In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zone administrator can exploit improper validation in the download prepar...	7.2 High	—	0,94%	17 Agt 2026
CVE-2026-16138 progress sharefile storage zones controller In Progress ShareFile Storage Zones Controller v5.12.5 and below versions, unsafe deserialization of untrusted file metadata can allow a user with write access to a Netwo...	8.0 High	—	0,83%	17 Agt 2026
CVE-2026-16137 progress sharefile storage zones controller In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credentials can perform path traversal using resumable upload initiation endpoin...	7.2 High	—	0,74%	17 Agt 2026
CVE-2026-15218 A flaw was found in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI. These ServiceAccounts are granted cluster-wide permissions that exceed t...	7.9 High	—	0,71%	17 Agt 2026
CVE-2026-75010 roundcube webmail In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a user-controlled ho...	4.3 Medium	—	0,39%	17 Agt 2026
CVE-2026-75007 roundcube webmail In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to injection via unescaped %u/%fu/%d substitution, which may lead to informa...	8.8 High	—	0,50%	17 Agt 2026
CVE-2026-75006 roundcube webmail In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information...	5.8 Medium	—	0,42%	17 Agt 2026
CVE-2026-75004 roundcube webmail In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesieve_disabled_actions setting bypass via a crafted rule name in...	4.3 Medium	—	0,37%	17 Agt 2026
CVE-2026-75003 roundcube webmail In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in a FuncIRI attribute of an SVG image could evade the remote image blocking, which may lead...	9.8 Critical	—	0,58%	17 Agt 2026
CVE-2026-75002 roundcube webmail In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization could lead to information disclosure or privilege escalat...	7.1 High	—	2,3%	17 Agt 2026
CVE-2026-75000 roundcube webmail In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image blocking bypass, whic...	5.8 Medium	—	0,47%	17 Agt 2026
CVE-2026-74999 roundcube webmail In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subject to stored XSS.	5.4 Medium	—	0,36%	17 Agt 2026
CVE-2026-74998 roundcube webmail In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were not validated, which may result in information discl...	7.2 High	—	0,44%	17 Agt 2026
CVE-2026-74997 roundcube webmail In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder repla...	8.8 High	—	1,1%	17 Agt 2026
CVE-2026-70412 Dell iDRAC9, versions prior to 7.20.30.50, and Dell iDRAC10, version prior to 1.20.60.50, contain a Remanent Data Readable after Memory Erase vulnerability. A low privile...	3.5 Low	—	0,27%	17 Agt 2026
CVE-2026-18674 On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rathe...	7.0 High	—	0,56%	17 Agt 2026
CVE-2026-16467 Missing Authorization vulnerability in Dolusoft Software Technologies Fortilogger allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects For...	7.5 High	—	0,39%	17 Agt 2026
CVE-2026-14564 Insufficiently Protected Credentials vulnerability in Innotim Software Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Retrieve Embedded Sensitive Da...	9.0 Critical	—	0,41%	17 Agt 2026
CVE-2026-74843 A vulnerability was determined in Wavlink WN531P3 and WN535M1 V250922. Affected by this vulnerability is the function strcpy of the file /etc/lighttpd/www/cgi-bin/export_...	10.0 Critical	—	1,0%	17 Agt 2026
CVE-2026-40126 OutSystems Service Center is vulnerable to a DOM-based Cross-Site Scripting (XSS) attack that can be exploited by a low-privileged attacker via the upload of a file with...	4.8 Medium	—	0,63%	17 Agt 2026
CVE-2026-74901 Advisory jahlives openssl encrypt openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in pqc.py where AES-GCM decryption failures trigger fallback to unauthenticated AES-C...	9.8 Critical	—	0,41%	17 Agt 2026
CVE-2026-74900 Advisory jahlives openssl encrypt openssl_encrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsulation failures silently fall back to simulation mode, generating a dete...	9.8 Critical	—	0,56%	17 Agt 2026
CVE-2026-74899 Advisory jahlives openssl encrypt openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in IsolatedPluginExecutor that exposes Python type objects in restricted exec() builtins. Att...	9.8 Critical	—	0,75%	17 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.