Katalog CVE (hal. 712)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 265.369 (Critical 36.560 · High 106.018 · KEV 1.764 · sejak 2020) · Pembaruan terakhir: 30 Okt 2026, 12:27 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 35.551–35.600 dari 265.369 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-72677 elastic kibana Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user...	7.3 High	—	0,41%	13 Agt 2026
CVE-2026-72676 elastic kibana Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC...	9.1 Critical	—	0,55%	13 Agt 2026
CVE-2026-72675 elastic kibana Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse (CAPEC-122). Kibana Machin...	7.1 High	—	0,31%	13 Agt 2026
CVE-2026-72674 elastic kibana Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A user-supplied list of doc...	6.5 Medium	—	0,42%	13 Agt 2026
CVE-2026-72673 elastic kibana Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized deletion of Synthetics private locations via Accessing Functionality Not Properly Constrained by ACLs...	5.4 Medium	—	0,31%	13 Agt 2026
CVE-2026-72672 elastic kibana The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's interna...	7.7 High	—	0,38%	13 Agt 2026
CVE-2026-72671 elastic kibana A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the priv...	4.3 Medium	—	0,27%	13 Agt 2026
CVE-2026-72670 elastic kibana A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the...	6.5 Medium	—	0,48%	13 Agt 2026
CVE-2026-72669 elastic kibana The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not ver...	7.6 High	—	0,33%	13 Agt 2026
CVE-2026-72667 elastic kibana Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A specially crafted request...	6.5 Medium	—	0,42%	13 Agt 2026
CVE-2026-72666 elastic kibana Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space t...	6.8 Medium	—	0,37%	13 Agt 2026
CVE-2026-72665 elastic kibana Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality N...	8.1 High	—	0,47%	13 Agt 2026
CVE-2026-72664 elastic kibana Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly...	6.5 Medium	—	0,40%	13 Agt 2026
CVE-2026-72663 elastic kibana Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted, deeply nested expressio...	6.5 Medium	—	0,47%	13 Agt 2026
CVE-2026-72661 elastic kibana Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal Kibana da...	6.5 Medium	—	0,38%	13 Agt 2026
CVE-2026-72660 elastic kibana Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). An authe...	6.5 Medium	—	0,52%	13 Agt 2026
CVE-2026-72659 elastic kibana Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A specially crafted, malforme...	6.5 Medium	—	0,42%	13 Agt 2026
CVE-2026-72658 elastic kibana Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualization...	7.3 High	—	0,19%	13 Agt 2026
CVE-2026-72657 elastic fleet server Authorization Bypass Through User-Controlled Key (CWE-639) in Fleet Server can lead to information disclosure via Manipulating User-Controlled Variables (CAPEC-77). The a...	6.5 Medium	—	0,39%	13 Agt 2026
CVE-2026-72656 elasticsearch Memory Allocation with Excessive Size Value (CWE-789) in the ES\|QL query processing of Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A...	6.5 Medium	—	0,42%	13 Agt 2026
CVE-2026-72655 elastic kibana Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case management functionality of Elastic Security in Kibana can lead to un...	4.3 Medium	—	0,31%	13 Agt 2026
CVE-2026-72653 elastic kibana Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user who is...	6.5 Medium	—	0,42%	13 Agt 2026
CVE-2026-72651 elastic kibana Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with re...	6.5 Medium	—	0,42%	13 Agt 2026
CVE-2026-72650 elastic kibana Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPE...	4.3 Medium	—	0,34%	13 Agt 2026
CVE-2026-72648 elastic cloud on kubernetes Cleartext Storage of Sensitive Information in an Environment Variable (CWE-526) in Elastic Cloud on Kubernetes (ECK) can lead to information disclosure via Retrieve Embed...	6.5 Medium	—	0,43%	13 Agt 2026
CVE-2026-72647 elasticsearch Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An authenticated user holding only r...	6.5 Medium	—	0,42%	13 Agt 2026
CVE-2026-72645 elasticsearch Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding o...	6.5 Medium	—	0,42%	13 Agt 2026
CVE-2026-72643 elastic kibana Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparison of the...	7.1 High	—	0,38%	13 Agt 2026
CVE-2026-72642 elasticsearch The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset...	8.8 High	—	0,60%	13 Agt 2026
CVE-2026-72640 elastic cloud on kubernetes The Elastic Cloud on Kubernetes (ECK) operator reads a list of secret references from an annotation on secrets it manages, and it accepts the namespace recorded in each r...	6.5 Medium	—	0,38%	13 Agt 2026
CVE-2026-72639 elasticsearch Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that count is not account...	6.5 Medium	—	0,42%	13 Agt 2026
CVE-2026-72638 elasticsearch Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low-privileged...	6.5 Medium	—	0,42%	13 Agt 2026
CVE-2026-72636 elasticsearch Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation (CAPEC-130). The matcher used to r...	6.5 Medium	—	0,42%	13 Agt 2026
CVE-2026-72632 elastic kibana Observable Discrepancy (CWE-203) in Kibana Fleet can lead to information disclosure via Excavation (CAPEC-116). Fleet removes the Elasticsearch API key value of an enroll...	7.1 High	—	0,35%	13 Agt 2026
CVE-2026-72631 elastic kibana Improper Privilege Management (CWE-269) in Kibana Fleet can lead to privilege escalation via Privilege Escalation (CAPEC-233). An integration policy may optionally declar...	6.5 Medium	—	0,33%	13 Agt 2026
CVE-2026-72630 elastic kibana Incorrect Authorization (CWE-863) in Kibana Fleet can lead to privilege escalation via Privilege Abuse (CAPEC-122). Fleet restricts some callers to managing integration p...	7.1 High	—	0,31%	13 Agt 2026
CVE-2026-72629 elastic kibana Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly Constrained by A...	7.1 High	—	0,42%	13 Agt 2026
CVE-2026-59714 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a mess...	7.1 High	—	0,48%	13 Agt 2026
CVE-2026-49864 wetty provides terminal access in browser over http/https. Prior to version 3.0.4, the wetty client decodes a base64 filename from the file-download escape sequence and i...	8.6 High	—	0,44%	13 Agt 2026
CVE-2026-49096 elastic kibana Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comment was not...	3.5 Low	—	0,29%	13 Agt 2026
CVE-2026-49089 elastic kibana Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A query expression accepted b...	6.5 Medium	—	0,47%	13 Agt 2026
CVE-2026-48099 WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDAV 4.3.3 and prior can allow a WebDAV request path containing an encoded parent-directory segment to...	7.1 High	—	0,33%	13 Agt 2026
CVE-2026-45774 compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the compliance-trestle library's profile import mechanism re...	6.9 Medium	—	0,54%	13 Agt 2026
CVE-2026-45725 compliance-trestle is a tooling platform for managing compliance as code. Prior to versiions 3.12.2 and 4.0.3, the compliance-trestle library's remote fetching cache mech...	7.1 High	—	0,47%	13 Agt 2026
CVE-2026-19747 A weakness has been identified in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. This impacts the function CAte::HandleCm...	9.8 Critical	—	3,1%	13 Agt 2026
CVE-2026-19746 A vulnerability has been found in Calix GigaSpire 26.1.0. The affected element is an unknown function of the file traceroute.cmd. The manipulation leads to denial of serv...	4.3 Medium	—	0,47%	13 Agt 2026
CVE-2026-19745 A flaw has been found in Calix GigaSpire 26.1.0. Impacted is an unknown function of the file utilities_configurationsave.cgi of the component Web Management Interface. Ex...	4.3 Medium	—	0,47%	13 Agt 2026
CVE-2026-18846 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to a buffer overflow from improperly validating client data. By sending malformed requests to one of the host servers, a remote...	7.5 High	—	0,55%	13 Agt 2026
CVE-2026-18164 An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. This allows an attacker within Bluetooth range to arbitrarily m...	8.1 High	—	0,39%	13 Agt 2026
CVE-2026-17229 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an infinite loop.	7.5 High	—	0,55%	13 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.