Katalog CVE (hal. 713)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 265.369 (Critical 36.560 · High 106.018 · KEV 1.764 · sejak 2020) · Pembaruan terakhir: 30 Okt 2026, 12:27 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 35.601–35.650 dari 265.369 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-17223 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to a buffer overflow.	8.8 High	—	0,75%	13 Agt 2026
CVE-2026-17206 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to a buffer overflow.	9.8 Critical	—	0,67%	13 Agt 2026
CVE-2026-17199 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to unbounded resource allocation.	7.5 High	—	0,55%	13 Agt 2026
CVE-2026-17069 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of anti-CSRF tokens.	7.3 High	—	0,22%	13 Agt 2026
CVE-2026-17045 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform unauthorized operations and access sensitive information due to improper session manag...	8.1 High	—	0,43%	13 Agt 2026
CVE-2026-17043 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to delete arbitrary files due to path traversal.	3.8 Low	—	0,48%	13 Agt 2026
CVE-2026-17029 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary code due to an out-of-bounds write.	8.8 High	—	0,17%	13 Agt 2026
CVE-2026-17004 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an infinite loop.	7.5 High	—	0,55%	13 Agt 2026
CVE-2026-16987 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper validation of the LANG environment variable.	7.8 High	—	0,15%	13 Agt 2026
CVE-2026-16982 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a heap buffer overflow.	7.5 High	—	0,55%	13 Agt 2026
CVE-2026-16975 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to a heap-based buffer overflow.	8.8 High	—	0,75%	13 Agt 2026
CVE-2026-16967 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain unauthorized access to system objects due to a time-of-check to time-of-use (TOCTOU) race...	7.5 High	—	0,35%	13 Agt 2026
CVE-2026-16961 ibm i IBM i 7.6, 7.5, and 7.4 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify,...	9.8 Critical	—	0,45%	13 Agt 2026
CVE-2026-16929 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a buffer overflow.	6.5 Medium	—	0,44%	13 Agt 2026
CVE-2026-16908 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain unauthorized access to arbitrary objects due to a path traversal vulnerability.	8.8 High	—	0,58%	13 Agt 2026
CVE-2026-16898 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of arbitrary files due to improper validation of an attacker-controlled fi...	7.8 High	—	0,15%	13 Agt 2026
CVE-2026-16896 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to obtain unauthorized access to files due to a time-of-check time-of-use (TOCTOU) race condition.	4.7 Medium	—	0,10%	13 Agt 2026
CVE-2026-16887 ibm i IBM i 7.6 could allow a remote attacker to cause a denial of service due to an out-of-bounds write.	7.5 High	—	0,55%	13 Agt 2026
CVE-2026-16878 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read.	6.5 Medium	—	0,41%	13 Agt 2026
CVE-2026-16871 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a heap buffer overflow.	4.3 Medium	—	0,37%	13 Agt 2026
CVE-2026-16868 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to the use of uninitialized memory during ASN.1 length processing.	7.5 High	—	0,52%	13 Agt 2026
CVE-2026-16867 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to access server resources with the privileges of an authenticated user due to improper authentication during N...	9.8 Critical	—	0,62%	13 Agt 2026
CVE-2026-16861 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.	5.3 Medium	—	0,49%	13 Agt 2026
CVE-2026-16859 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read.	5.3 Medium	—	0,40%	13 Agt 2026
CVE-2026-16853 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read.	7.5 High	—	0,45%	13 Agt 2026
CVE-2026-16815 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and potentially obtain sensitive information due to a stack-based buffer overflow.	9.1 Critical	—	0,46%	13 Agt 2026
CVE-2026-16722 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain unauthorized privileges due to improper privilege management.	8.8 High	—	0,50%	13 Agt 2026
CVE-2026-16713 ibm documentation offline IBM Documentation Offline 1.0.0 through 1.4.1 IBM Documentation could allow a remote attacker to obtain sensitive information due to a security misconfiguration where the...	5.3 Medium	—	0,46%	13 Agt 2026
CVE-2026-16692 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a stack-based buffer overflow.	6.5 Medium	—	0,50%	13 Agt 2026
CVE-2026-16674 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an untrusted search path.	8.8 High	—	0,75%	13 Agt 2026
CVE-2026-14875 ibm i access client solutions IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to arbitrary code execution on Windows when installed for all users due to publicly writeable directo...	7.8 High	—	0,17%	13 Agt 2026
CVE-2026-14525 ibm websphere application server IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when the rtcomm-1....	9.4 Critical	—	0,55%	13 Agt 2026
CVE-2026-13460 ibm storage scale IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 GUI contains a hardcoded token in the source code, which was used for inter-node cluster communicat...	7.5 High	—	0,49%	13 Agt 2026
CVE-2026-13365 ibm planning analytics local IBM Planning Analytics 2.0, and 2.1 Local is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmit...	6.5 Medium	—	0,17%	13 Agt 2026
CVE-2026-10571 ibm websphere application server IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure deserialization. A low-privileged, administrati...	5.3 Medium	—	0,59%	13 Agt 2026
CVE-2026-73653 Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screens...	9.4 Critical	—	0,79%	13 Agt 2026
CVE-2026-73652 vantage6 is an open-source infrastructure for privacy preserving analysis. In version 5.0.2 and earlier, the algorithm-store edit permission lacks an ownership check, all...	7.1 High	—	0,35%	13 Agt 2026
CVE-2026-73651 TypeORM is a TypeScript and JavaScript ORM for Node.js that supports PostgreSQL, MySQL, MariaDB, SQLite, SQL Server, Oracle, and other databases. Prior to versions 0.3.31...	5.7 Medium	—	0,39%	13 Agt 2026
CVE-2026-73650 SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the...	8.2 High	—	0,44%	13 Agt 2026
CVE-2026-73482 phpList before 3.7.0-RC5 contains a cross-site request forgery (CSRF) vulnerability in lists/admin/admins.php. The administrator deletion action is triggered via an unaut...	8.1 High	—	0,34%	13 Agt 2026
CVE-2026-73481 phpList before 3.7.0-RC5 fail to enforce CSRF token validation on the bounce rule deletion endpoint (bouncerules.php / bouncerule.php). The deletion is performed via a GE...	5.4 Medium	—	0,22%	13 Agt 2026
CVE-2026-73038 NodeBB before 4.15.0 contains a stored cross-site scripting vulnerability in the renderEmoji function that fails to escape tag.icon.url and tag.name attributes. Attackers...	6.1 Medium	—	0,25%	13 Agt 2026
CVE-2026-73037 Next AI Draw.io 0.2.1 through 0.4.16 contains a reflected cross-site scripting vulnerability in the mcp query parameter that is interpolated without escaping into HTML an...	6.1 Medium	—	0,26%	13 Agt 2026
CVE-2026-72777 Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api/parse-url endpoint due to hostname validation that only checks string...	8.6 High	—	0,44%	13 Agt 2026
CVE-2026-18071 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper privilege management.	7.8 High	—	0,14%	13 Agt 2026
CVE-2026-17220 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and modify authentication metadata due to a buffer overflow.	8.2 High	—	0,56%	13 Agt 2026
CVE-2026-17197 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to improper validation of client-asserted identity.	9.8 Critical	—	0,50%	13 Agt 2026
CVE-2026-73649 Velocity.js is a JavaScript implementation of the Apache Velocity template engine. Prior to 2.1.7, the earlier fix for CVE-2026-44966 filtered constructor, __proto__, and...	9.8 Critical	—	0,73%	13 Agt 2026
CVE-2026-73648 rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elem...	5.1 Medium	—	0,55%	13 Agt 2026
CVE-2026-73647 Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend() utility in ui/src/utils/extend/extend.js recurs...	5.6 Medium	—	0,39%	13 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.