Katalog CVE (hal. 708)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 265.369 (Critical 36.560 · High 106.018 · KEV 1.764 · sejak 2020) · Pembaruan terakhir: 30 Okt 2026, 12:27 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 35.351–35.400 dari 265.369 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-13198 Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the event notifica...	5.9 Medium	—	0,13%	14 Agt 2026
CVE-2026-13197 Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the configuration...	7.3 High	—	0,13%	14 Agt 2026
CVE-2026-13196 Nozomi Networks Labs identified a CWE-787: Out-of-bounds Write vulnerability in the process-image management functionality of KUNBUS piControl in version 2.6.2 that allow...	7.3 High	—	0,14%	14 Agt 2026
CVE-2026-13002 redhat openshift container platform, redhat enterprise linux A flow has been identified into dnssec.c library, causing an infinite loop to dnsmasq service. An attacker who controls any DNSSEC-signed zone can hang the dnsmasq proces...	4.4 Medium	—	0,15%	14 Agt 2026
CVE-2026-69101 Datavane TIS v5.0.0 contains an XML external entity (XXE) injection vulnerability that allows authenticated attackers to perform server-side request forgery and out-of-ba...	7.7 High	—	0,43%	14 Agt 2026
CVE-2026-58224 samba, redhat enterprise linux A flaw was found in Samba's CTDB, the clustered database service used by Samba. Insufficient integrity validation of received CTDB protocol packets allows malformed packe...	6.5 Medium	—	0,34%	14 Agt 2026
CVE-2026-19880 Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discrim...	6.3 Medium	—	0,33%	14 Agt 2026
CVE-2026-19879 A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The `writeString()` method performs a silent narrowing cast from 16-bit Unicod...	5.3 Medium	—	0,39%	14 Agt 2026
CVE-2026-73633 apache struts Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts. When an application is configured to populate actions from a JSON request body, the p...	7.5 High	—	0,70%	14 Agt 2026
CVE-2026-53472 A flaw was found in migration-planner. Insufficient validation of the `AgentStatusUpdate.CredentialUrl` field allows an authenticated attacker to store a malicious `javas...	6.3 Medium	—	0,35%	14 Agt 2026
CVE-2026-19871 Use of Hard-coded Credentials in the human resources component in Roskus Prospero Flow CRM before 5.15.9 allows unauthenticated remote attackers to authenticate as any em...	9.3 Critical	—	0,53%	14 Agt 2026
CVE-2026-19830 A vulnerability was found in TRENDnet TEW-816DRM GURNC4.OT182B-C-TN-R1B028-US.EN. This impacts an unknown function of the file /etc/bftpd.conf of the component bftpd. The...	5.3 Medium	—	0,64%	14 Agt 2026
CVE-2026-19829 A security flaw has been discovered in 648540858 wvp-GB28181-pro 2.7.4-20260107. This vulnerability affects unknown code of the file LogController.java of the component L...	4.3 Medium	—	0,47%	14 Agt 2026
CVE-2026-1621 Authentication bypass by primary weakness vulnerability in Universal Software Inc. E-Municipality allows Exploitation of Trusted Identifiers. This issue affects E-Munici...	5.3 Medium	—	0,41%	14 Agt 2026
CVE-2026-19828 A vulnerability was identified in 648540858 wvp-GB28181-pro 2.7.4-20260107. This affects an unknown part of the file PlayController.java of the component Snapshot Endpoin...	6.3 Medium	—	0,43%	14 Agt 2026
CVE-2026-19827 A flaw has been found in alldatacenter alldata up to 0.6.8. This impacts the function FileInputStream of the file /admin/controller/JobLogController.java of the component...	5.3 Medium	—	0,69%	14 Agt 2026
CVE-2026-19768 Improper control of generation of code ('Code Injection') in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authenticated user wi...	8.1 High	—	0,39%	14 Agt 2026
CVE-2026-73673 Netis NC63 router firmware V3.0.0.3327 contains an unauthenticated firmware update vulnerability that allows unauthenticated attackers to submit unsigned firmware images...	8.8 High	—	0,54%	14 Agt 2026
CVE-2026-19870 Authorization Bypass Through User-Controlled Key in the payroll module in Roskus Prospero Flow CRM before 5.15.10 allows authenticated users holding the read payroll perm...	8.6 High	—	0,39%	14 Agt 2026
CVE-2026-19826 A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian2Input.readObject of the file /serialize/impl/HessianSerializer.java o...	7.3 High	—	0,56%	14 Agt 2026
CVE-2026-19825 A security vulnerability has been detected in SourceCodester Simple Client Management System 1.0. The impacted element is an unknown function of the file /classes/Master....	7.3 High	—	0,43%	14 Agt 2026
CVE-2026-19824 A weakness has been identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. The affected element is the function ipMacBindListStore of the file /goform/addIpMacBind. Ex...	8.8 High	—	0,85%	14 Agt 2026
CVE-2026-19823 A security flaw has been discovered in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. Impacted is the function formQOSRuleDel of the file /goform/delQos of the component QoS...	8.8 High	—	0,85%	14 Agt 2026
CVE-2026-73630 SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFilePublishAccess endpoint, which is registered with CheckAuth only and is...	5.8 Medium	—	0,34%	14 Agt 2026
CVE-2026-73051 actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encod...	6.3 Medium	—	0,57%	14 Agt 2026
CVE-2026-73049 SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint that consults the forbidden access list instead of...	5.8 Medium	—	0,33%	14 Agt 2026
CVE-2026-73048 SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getRefIDsByFileAnnotationID endpoint that returns block identifiers citing PDF annota...	5.8 Medium	—	0,33%	14 Agt 2026
CVE-2026-72859 Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject presigned U...	7.7 High	—	0,22%	14 Agt 2026
CVE-2026-72838 FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint, allowing authenticated users to write arbitrary...	6.5 Medium	—	0,53%	14 Agt 2026
CVE-2026-72837 File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-aut...	8.8 High	—	0,56%	14 Agt 2026
CVE-2026-72836 FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and CreateUserDi...	8.1 High	—	0,55%	14 Agt 2026
CVE-2026-72835 filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules us...	6.8 Medium	—	0,50%	14 Agt 2026
CVE-2026-72834 filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum (?checksum=) branch of resourceGetHandler reads the entire file to co...	4.3 Medium	—	0,39%	14 Agt 2026
CVE-2026-72833 The Grav API plugin (getgrav/grav-plugin-api) versions >= 1.0.6 and <= 1.0.11 contain a privilege escalation vulnerability. A scoped API key minted on a super-admin accou...	8.8 High	—	0,47%	14 Agt 2026
CVE-2026-72832 Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Security.php). T...	5.4 Medium	—	0,31%	14 Agt 2026
CVE-2026-72831 The Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an incorrect authorization vulnerability in its Flex Objects API. FlexApiController::update() ch...	8.8 High	—	0,56%	14 Agt 2026
CVE-2026-72830 Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. Th...	8.8 High	—	0,74%	14 Agt 2026
CVE-2026-72829 The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope-cap bypass in UsersController's create() and update() methods. These methods enforce...	8.8 High	—	0,47%	14 Agt 2026
CVE-2026-72828 Grav Plugin API (getgrav/grav-plugin-api) before 1.0.13 fails to enforce API-key scope caps in InvitationsController. The strip-super and accept-groups decisions are gate...	7.2 High	—	0,49%	14 Agt 2026
CVE-2026-72827 Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute arbitrary ope...	8.8 High	—	0,85%	14 Agt 2026
CVE-2026-72826 The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. The sel...	8.8 High	—	0,47%	14 Agt 2026
CVE-2026-72825 The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/allowlist endpoint (ReportsController). The endpoi...	7.6 High	—	0,35%	14 Agt 2026
CVE-2026-72824 The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API key scope-cap bypass in PagesController::guardTwigContent(). The Twig-toggle check uses a bare...	8.8 High	—	0,73%	14 Agt 2026
CVE-2026-72823 The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope cap bypass in DemoController. Its private requireSuper() method checks isSuperAdmin(...	5.4 Medium	—	0,33%	14 Agt 2026
CVE-2026-72822 The getgrav/grav-plugin-api Composer package before 1.0.13 (affected <= 1.0.12) fails to enforce API key scope caps on the disable2fa endpoint. Unlike the sibling generat...	8.8 High	—	0,56%	14 Agt 2026
CVE-2026-72821 Grav Form plugin versions before 9.1.15 contain a stored cross-site scripting vulnerability in radio and toggle field option labels rendered with the Twig \|raw filter. At...	5.4 Medium	—	0,24%	14 Agt 2026
CVE-2026-72820 Grav versions before 2.0.13 fail to properly validate backup profile root paths, allowing attackers to archive directories outside GRAV_ROOT when not in the hard-coded de...	4.9 Medium	—	0,50%	14 Agt 2026
CVE-2026-72819 Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary...	8.8 High	—	0,90%	14 Agt 2026
CVE-2026-72817 go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request.RemoteAddr) using the...	6.5 Medium	—	0,24%	14 Agt 2026
CVE-2026-72816 go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go). The realIP() function reads client-controlled headers (Tru...	6.5 Medium	—	0,30%	14 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.