Katalog CVE
Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR · 27 kali dilihat
$ cat README.txt
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-19483
ibm storage scale
IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 Secrets may be disclosed in log files in IBM Storage Scale Management GUI The admin password is log...
|
5.5 Medium | — | 0,16% | 13 Agt 2026 |
|
CVE-2026-19297
langflow
IBM Langflow OSS 1.0.0 through 1.9.6 could allow a remote attacker to obtain unauthorized access to user accounts due to improper restriction of excessive authentication...
|
9.1 Critical | — | 0,61% | 13 Agt 2026 |
|
CVE-2026-18741
Worksuite SaaS versions prior to 6.0.14 contains a stored cross-site scripting vulnerability in the Asset Management module that allows authenticated administrators to in...
|
4.8 Medium | — | 0,25% | 13 Agt 2026 |
|
CVE-2026-18715
ibm i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper processing of XML external entities.
|
6.5 Medium | — | 0,42% | 13 Agt 2026 |
|
CVE-2026-18671
ibm i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated attacker to force a NetServer server thread exception, caused by an integer overflow during bounds checking in r...
|
5.3 Medium | — | 0,36% | 13 Agt 2026 |
|
CVE-2026-18511
ibm i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to generate a stack-based buffer overflow in the Native IBM i JSSE provider, caused by improper bo...
|
7.8 High | — | 0,30% | 13 Agt 2026 |
|
CVE-2026-18509
ibm i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to gain privilege escalation via the Navigator for i debugger. This could allow the attacker to ac...
|
7.1 High | — | 0,23% | 13 Agt 2026 |
|
CVE-2026-18249
ibm i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of pointers read from Java-controlled addr...
|
9.9 Critical | — | 0,39% | 13 Agt 2026 |
|
CVE-2026-18193
ibm i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to improper validation of user-controlled addresses.
|
10.0 Critical | — | 0,45% | 13 Agt 2026 |
|
CVE-2026-18101
ibm i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper management of thread authority swaps.
|
8.8 High | — | 0,14% | 13 Agt 2026 |
|
CVE-2026-18086
ibm i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary code or cause a denial of service due to improper bounds checking.
|
5.3 Medium | — | 0,12% | 13 Agt 2026 |
|
CVE-2026-18077
ibm i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a stack-based buffer overflow.
|
7.5 High | — | 0,55% | 13 Agt 2026 |
|
CVE-2026-18068
ibm i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to a byte-count and element-count confusion.
|
4.3 Medium | — | 0,37% | 13 Agt 2026 |
|
CVE-2026-18020
ibm i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an off-by-one error in bounds checking.
|
5.3 Medium | — | 0,49% | 13 Agt 2026 |
|
CVE-2026-17649
ibm i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read.
|
5.3 Medium | — | 0,40% | 13 Agt 2026 |
|
CVE-2026-17502
ibm i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an out-of-bounds write.
|
7.5 High | — | 0,43% | 13 Agt 2026 |
|
CVE-2026-17482
ibm documentation offline
IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper control of file paths.
|
9.8 Critical | — | 0,80% | 13 Agt 2026 |
|
CVE-2026-17481
ibm documentation offline
IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper output neutralization for logs.
|
9.8 Critical | — | 0,92% | 13 Agt 2026 |
|
CVE-2026-17476
ibm i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an improper buffer write.
|
5.3 Medium | — | 0,38% | 13 Agt 2026 |
|
CVE-2026-17473
ibm documentation offline
IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to read arbitrary files due to improper limitation of a pathname to a restricted directory.
|
7.5 High | — | 0,62% | 13 Agt 2026 |
|
CVE-2026-17468
ibm documentation offline
IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to forge valid session tokens due to the use of a hardcoded cryptographic key.
|
5.3 Medium | — | 0,36% | 13 Agt 2026 |
|
CVE-2026-17438
ibm i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to obtain sensitive information or modify data due to improper privilege management.
|
4.4 Medium | — | 0,12% | 13 Agt 2026 |
|
CVE-2026-17272
ibm i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a buffer overflow.
|
7.5 High | — | 0,48% | 13 Agt 2026 |
|
CVE-2026-17226
ibm i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information or cause a denial of service due to an out-of-bounds read.
|
5.4 Medium | — | 0,42% | 13 Agt 2026 |
|
CVE-2026-17216
ibm i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an integer error when processing DRDA large-object headers.
|
5.3 Medium | — | 0,49% | 13 Agt 2026 |
|
CVE-2026-17212
ibm i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.
|
5.3 Medium | — | 0,49% | 13 Agt 2026 |
|
CVE-2026-17101
ibm i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code or obtain sensitive information due to improper authentication.
|
9.6 Critical | — | 0,63% | 13 Agt 2026 |
|
CVE-2026-17099
ibm i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to improper authentication.
|
7.3 High | — | 0,46% | 13 Agt 2026 |
|
CVE-2026-17088
ibm i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability.
|
4.3 Medium | — | 0,50% | 13 Agt 2026 |
|
CVE-2026-17078
ibm i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to resource exhaustion.
|
5.3 Medium | — | 0,49% | 13 Agt 2026 |
|
CVE-2026-17077
ibm i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to the use of an uninitialized variable.
|
5.3 Medium | — | 0,49% | 13 Agt 2026 |
|
CVE-2026-17076
ibm i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper processing of DRDA and DDM resynchronization requests.
|
5.3 Medium | — | 0,49% | 13 Agt 2026 |
|
CVE-2026-17075
ibm i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information and perform unauthorized operations due to improper validation of authenticatio...
|
8.2 High | — | 0,44% | 13 Agt 2026 |
|
CVE-2026-17074
ibm i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper privilege management.
|
4.3 Medium | — | 0,29% | 13 Agt 2026 |
|
CVE-2026-17071
ibm i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform file manipulation due to path traversal.
|
2.7 Low | — | 0,44% | 13 Agt 2026 |
|
CVE-2026-73669
The Signify Philips Hue Bridge Pro firmware embeds a Mosquitto MQTT broker service that listens on all network interfaces without authentication. An unauthenticated attac...
|
7.3 High | — | 0,52% | 13 Agt 2026 |
|
CVE-2026-73656
Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.6, POST /api/v1/deployments/:deploymentId/background-workers call...
|
9.9 Critical | — | 0,50% | 13 Agt 2026 |
|
CVE-2026-73655
Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.2, addGoogleStrategy() in apps/webapp/app/services/googleAuth.ser...
|
7.4 High | — | 0,47% | 13 Agt 2026 |
|
CVE-2026-73654
Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 3.3.8 until 4.5.6, the PUT /api/v1/runs/:runId/metadata endpoint passes a...
|
8.5 High | — | 0,62% | 13 Agt 2026 |
|
CVE-2026-73531
django-helpdesk before 2.3.3 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by submitting HTML-...
|
6.1 Medium | — | 0,29% | 13 Agt 2026 |
|
CVE-2026-73530
Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vulnerability that allows attackers to reach internal services by supplying URLs using the u...
|
7.7 High | — | 0,43% | 13 Agt 2026 |
|
CVE-2026-72687
elasticsearch
A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier. Elasticsearch decodes and deser...
|
6.5 Medium | — | 0,42% | 13 Agt 2026 |
|
CVE-2026-72686
elasticsearch
A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A specific internal component vali...
|
6.5 Medium | — | 0,57% | 13 Agt 2026 |
|
CVE-2026-72685
elasticsearch
A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a crafted user-supplied input. Pro...
|
4.3 Medium | — | 0,37% | 13 Agt 2026 |
|
CVE-2026-72684
elasticsearch
A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input. Processing th...
|
6.5 Medium | — | 0,42% | 13 Agt 2026 |
|
CVE-2026-72683
elasticsearch
A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint (https://www.elastic.co/docs/api/doc/elasti...
|
6.5 Medium | — | 0,57% | 13 Agt 2026 |
|
CVE-2026-72681
elastic kibana
Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that...
|
8.8 High | — | 0,44% | 13 Agt 2026 |
|
CVE-2026-72680
elastic kibana
Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does...
|
5.4 Medium | — | 0,28% | 13 Agt 2026 |
|
CVE-2026-72679
elasticsearch
Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an intervals query. Compiling a deeply nested pattern drives...
|
6.5 Medium | — | 0,47% | 13 Agt 2026 |
|
CVE-2026-72678
elasticsearch
Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal data structure. An authenticated...
|
6.5 Medium | — | 0,47% | 13 Agt 2026 |
Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum
menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat
kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah
perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan
dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk
yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.