Katalog CVE (hal. 707)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 265.369 (Critical 36.560 · High 106.018 · KEV 1.764 · sejak 2020) · Pembaruan terakhir: 30 Okt 2026, 12:27 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 35.301–35.350 dari 265.369 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-48528 Metacat is data repository software that helps researchers preserve, share, and discover data. Metacat versions 2.0.0 through 3.4.0 contain an unauthenticated SQL injecti...	9.8 Critical	—	0,48%	14 Agt 2026
CVE-2026-19847 A security flaw has been discovered in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected is the function setWiFiWpsConfig of the file /cgi-bin/cstecgi.cgi of the component...	8.8 High	—	0,85%	14 Agt 2026
CVE-2026-19846 A vulnerability was identified in TOTOLINK A800R 4.1.2cu.5137_B20200730. This impacts the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi of the component fir...	8.8 High	—	0,85%	14 Agt 2026
CVE-2026-19682 tenable security center A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbitrary commands on the underly...	9.9 Critical	—	2,0%	14 Agt 2026
CVE-2026-19681 tenable security center An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading a speciall...	9.9 Critical	—	4,2%	14 Agt 2026
CVE-2026-19680 tenable security center A SQL injection vulnerability exists in Security Center that could allow an attacker to access unauthorized data from the application's database.	7.1 High	—	0,32%	14 Agt 2026
CVE-2026-19679 tenable security center An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of uploaded filenames could contribute to a downstream...	8.8 High	—	1,6%	14 Agt 2026
CVE-2026-19639 tenable security center An improper access control vulnerability exists where an authenticated non-administrative application user could potentially view settings outside of their assigned scope...	4.3 Medium	—	0,30%	14 Agt 2026
CVE-2026-19636 tenable security center An issue was identified in which CSRF tokens were generated using a predictable method, potentially reducing their effectiveness as a security control. This has been addr...	5.3 Medium	—	0,26%	14 Agt 2026
CVE-2026-19635 tenable security center A local privilege escalation vulnerability exists in Security Center. An attacker with write access to a specific configuration file could achieve arbitrary code executio...	8.8 High	—	0,19%	14 Agt 2026
CVE-2026-19631 tenable security center A SQL injection vulnerability exists in Security Center that could allow an authenticated administrator to execute arbitrary SQL queries, potentially resulting in unautho...	4.9 Medium	—	0,39%	14 Agt 2026
CVE-2026-19629 tenable security center A privilege escalation vulnerability exists in Tenable Security Center that allows a user with "Security Manager" role and "manage user" permission on a single group to m...	8.1 High	—	0,39%	14 Agt 2026
CVE-2026-12366 Zephyr's dynamic kernel-object disposal path unref_check() in kernel/userspace/userspace.c frees an object's storage (k_free(dyn->data)) once its reference count reaches...	8.8 High	—	0,17%	14 Agt 2026
CVE-2026-12365 A use-after-free exists in the Zephyr second-generation work queue (kernel/work.c) in the handling of delayable work timeouts. When a delayable work item's timeout has be...	5.8 Medium	—	0,13%	14 Agt 2026
CVE-2026-12364 The user-space system-call verifier z_vrfy_z_log_msg_static_create() in subsys/logging/log_msg.c was a pure pass-through: it forwarded the caller-supplied source, desc, p...	8.4 High	—	0,16%	14 Agt 2026
CVE-2026-12363 The LoRaWAN Fragmented Data Block Transport service (subsys/lorawan/services/frag_transport.c) does not validate the fragment counter in a received DATA_FRAGMENT command...	4.2 Medium	—	0,24%	14 Agt 2026
CVE-2026-73846 CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, canonicalizeParams in src/utils/cache.ts serializes request parameters with unescaped amp...	6.5 Medium	—	0,19%	14 Agt 2026
CVE-2026-73845 CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the ckan_get_mqa_quality and ckan_get_mqa_quality_details tools in src/tools/quality.ts u...	5.3 Medium	—	0,38%	14 Agt 2026
CVE-2026-73844 CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, error paths reflect raw upstream response bodies and internal exception messages back to...	3.7 Low	—	0,36%	14 Agt 2026
CVE-2026-49989 CrateDB is a distributed SQL database. Prior to versions 6.2.8 and 6.3.2, any authenticated user can read or delete any blob whose SHA-1 digest they know, and can plant n...	7.1 High	—	0,47%	14 Agt 2026
CVE-2026-49986 The Cortex MCP server (`neuro-cortex-memory`), a cross-platform persistent memory MCP, prior to version 3.17.1 treats the `CLAUDE_PROJECT_DIR` environment variable — auto...	7.1 High	—	0,16%	14 Agt 2026
CVE-2026-47766 crun is an open source OCI Container Runtime fully written in C. Prior to version 1.28, crun's default device setup opens the container rootfs `/dev` directory without `O...	5.1 Medium	—	0,20%	14 Agt 2026
CVE-2026-47192 kas is a setup tool for bitbake based projects. Starting in version 4.8 and prior to version 5.3, kas checks out and processes repositories regarding configuration includ...	2.1 Low	—	0,25%	14 Agt 2026
CVE-2026-47191 kas is a setup tool for bitbake based projects. Prior to version 5.3, when relying solely on a git commit ID (SHA-1 or SHA-256) to qualify if a checkout of a repository i...	2.1 Low	—	0,25%	14 Agt 2026
CVE-2026-46603 VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree groups. This...	7.5 High	—	0,41%	14 Agt 2026
CVE-2026-46439 compliance-trestle is a tooling platform for managing compliance as code. Versions prior to 3.12.2 and 4.0.3 have a Server-Side Template Injection (SSTI) vulnerability ex...	7.8 High	—	0,27%	14 Agt 2026
CVE-2026-46380 compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the HTTPSFetcher._do_fetch() method passes a user-supplied U...	6.7 Medium	—	0,14%	14 Agt 2026
CVE-2026-19845 A vulnerability was determined in TOTOLINK A800R 4.1.2cu.5137_B20200730. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the component l...	8.8 High	—	0,85%	14 Agt 2026
CVE-2026-19844 A vulnerability was found in TOTOLINK A800R 4.1.2cu.5137_B20200730. The impacted element is the function setRadvdCfg of the file /cgi-bin/cstecgi.cgi of the component ipv...	8.8 High	—	0,85%	14 Agt 2026
CVE-2026-19841 A flaw has been found in TRENDNET TEW-813DRU 1.01b01. Impacted is an unknown function of the file /etc/vsftpd.conf of the component vsftpd. This manipulation causes incor...	3.1 Low	—	0,30%	14 Agt 2026
CVE-2026-19839 A vulnerability was detected in SourceCodester Simple Doctors Appointment System 1.0. This issue affects the function save_doctor of the file /save_file.php. The manipula...	4.7 Medium	—	0,40%	14 Agt 2026
CVE-2026-19838 A security vulnerability has been detected in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the file /admin/reporting/sales/ of the component Bac...	4.3 Medium	—	0,41%	14 Agt 2026
CVE-2026-19628 tenable security center A command injection vulnerability exists in Tenable Security Center. An authenticated administrator could modify application configuration values to achieve arbitrary com...	7.2 High	—	2,1%	14 Agt 2026
CVE-2026-19626 tenable security center A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could exploit this is...	9.9 Critical	—	1,7%	14 Agt 2026
CVE-2026-66272 dell wyse management suite Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remot...	5.3 Medium	—	0,39%	14 Agt 2026
CVE-2026-66271 dell wyse management suite Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attacker with re...	7.2 High	—	0,76%	14 Agt 2026
CVE-2026-66270 dell wyse management suite Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attacker with re...	7.2 High	—	0,76%	14 Agt 2026
CVE-2026-63702 dell wyse management suite Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain a Use of Hard-coded Credentials vulnerability. A low privileged attacker with local access could pot...	5.5 Medium	—	0,12%	14 Agt 2026
CVE-2026-63701 dell wyse management suite Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Improper Deserialization of Untrusted Data vulnerability. A low privileged attacker with local ac...	7.8 High	—	0,12%	14 Agt 2026
CVE-2026-63700 dell wyse management suite Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Incorrect Default Permission vulnerability. A low privileged attacker with local access could pot...	7.8 High	—	0,12%	14 Agt 2026
CVE-2026-57472 Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the file management functionalit...	6.9 Medium	—	0,17%	14 Agt 2026
CVE-2026-57471 Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the file management functionalit...	6.8 Medium	—	0,17%	14 Agt 2026
CVE-2026-57469 Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery (CSRF) vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that...	5.1 Medium	—	0,32%	14 Agt 2026
CVE-2026-53970 ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to execute arbitrary...	7.5 High	—	0,25%	14 Agt 2026
CVE-2026-19884 In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affect...	8.4 High	—	0,23%	14 Agt 2026
CVE-2026-19837 A weakness has been identified in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /admin/customers/search of the component Customer Search. Executing...	2.7 Low	—	0,41%	14 Agt 2026
CVE-2026-19836 A security flaw has been discovered in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/customers/view of the component...	4.3 Medium	—	0,41%	14 Agt 2026
CVE-2026-19835 A vulnerability was identified in Webkul Bagisto up to 2.4.4. Affected by this vulnerability is an unknown functionality of the component Customer Item Deletion Endpoint....	3.8 Low	—	0,45%	14 Agt 2026
CVE-2026-19834 A vulnerability was determined in Webkul Bagisto up to 2.4.4. Affected is an unknown function of the file /admin/customers/login-as-customer/ of the component Admin Custo...	4.7 Medium	—	0,43%	14 Agt 2026
CVE-2026-16772 In Akaunting versions <= 3.1.21, low‑privileged authenticated users can modify their own account to assign themselves the admin role ID, granting full administrator privi...	8.1 High	—	0,35%	14 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.