Katalog CVE (hal. 716)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 265.400 (Critical 36.562 · High 106.027 · KEV 1.764 · sejak 2020) · Pembaruan terakhir: 30 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 35.751–35.800 dari 265.400 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-23603 Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim	3.1 Low	—	0,29%	13 Agt 2026
CVE-2026-13051 Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy diagnostic...	9.1 Critical	—	0,56%	13 Agt 2026
CVE-2026-13048 Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because load_lexicon interpolates the lang...	8.2 High	—	0,56%	13 Agt 2026
CVE-2022-4993 HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message...	9.1 Critical	—	0,63%	13 Agt 2026
CVE-2026-73671 Saurus CMS Community Edition contains an unauthenticated open redirect vulnerability in the logout handling code in classes/port.inc.php, where the url parameter supplied...	6.1 Medium	—	0,31%	13 Agt 2026
CVE-2026-73670 A CMS contains a SQL injection vulnerability in admin/db_data.php at line 509 that allows authenticated administrators to inject arbitrary SQL into a SHOW COLUMNS FROM st...	7.2 High	—	0,53%	13 Agt 2026
CVE-2026-73576 synacor zimbra collaboration suite In Zimbra Collaboration (ZCS) before 10.1.17, weak cryptographic key generation vulnerability exists in the OnlyOffice integration. The zimbraDocumentEditingJwtSecret is...	6.5 Medium	—	0,33%	13 Agt 2026
CVE-2026-73575 synacor zimbra collaboration suite In Zimbra Collaboration (ZCS) before 10.1.17, a Cross-Site Request Forgery (CSRF) vulnerability exists in the Exchange Web Services (EWS) endpoint of Zimbra Collaboration...	3.5 Low	—	0,15%	13 Agt 2026
CVE-2026-73574 synacor zimbra collaboration suite In Zimbra Collaboration before 10.1.17, a local file inclusion (LFI) vulnerability exists in the Zimbra Classic Web Client due to improper validation of the fu request pa...	6.5 Medium	—	0,33%	13 Agt 2026
CVE-2026-73573 synacor zimbra collaboration suite In Zimbra Collaboration (ZCS) before 10.1.17, a path traversal vulnerability exists in the Zimbra Briefcase document editing functionality due to improper validation of t...	6.5 Medium	—	0,45%	13 Agt 2026
CVE-2026-73572 synacor zimbra collaboration suite In Zimbra Collaboration (ZCS) before 10.1.17, a stored cross-site scripting (XSS) vulnerability exists in the Zimbra Classic Web Client due to insufficient sanitization o...	6.1 Medium	—	0,26%	13 Agt 2026
CVE-2026-73571 synacor zimbra collaboration suite An authorization bypass vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.17 due to improper authorization validation in delegated email sending functionalit...	4.3 Medium	—	0,26%	13 Agt 2026
CVE-2026-73570 Advisory synacor zimbra collaboration suite A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are en...	8.9 High	KEV	71,7%	13 Agt 2026
CVE-2026-73559 vllm vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.26.0, the /v1/completions CompletionRequest.prompt field in vllm/entrypoints/openai...	6.5 Medium	—	0,58%	13 Agt 2026
CVE-2026-73533 Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tamper...	9.8 Critical	—	0,65%	13 Agt 2026
CVE-2026-73532 Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampere...	9.8 Critical	—	0,67%	13 Agt 2026
CVE-2026-73515 PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeo...	8.1 High	—	0,57%	13 Agt 2026
CVE-2026-73514 The address_standardizer extension for PostGIS through 3.7.0, fixed in commit 423570b, contains an out-of-bounds write vulnerability that allows a database user with the...	8.8 High	—	0,82%	13 Agt 2026
CVE-2026-55401 absolute secure access CVE-2026-55401 is a null dereference vulnerability on the load-balancing sub-system of Secure Access servers prior to 14.57. Attackers can send an unauthenticated packe...	5.3 Medium	—	0,40%	13 Agt 2026
CVE-2026-55400 absolute secure access CVE-2026-55400 is an integer underflow in Secure Access servers prior to version 14.57. Attackers with an authenticated session can send specially crafted traffic to a...	6.5 Medium	—	0,37%	13 Agt 2026
CVE-2026-19744 Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via...	5.1 Medium	—	0,47%	13 Agt 2026
CVE-2026-19710 A vulnerability was found in SourceCodester Simple Student Information System. Affected by this vulnerability is an unknown functionality of the file app/admin/department...	7.3 High	—	0,43%	13 Agt 2026
CVE-2026-19487 Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass....	5.3 Medium	—	0,42%	13 Agt 2026
CVE-2026-73558 vllm vLLM is an inference and serving engine for large language models. Prior to 0.27.0, an integer overflow in blockIdx.x * 2 * d in activation_kernels.cu can cause act_and_m...	5.3 Medium	—	0,41%	13 Agt 2026
CVE-2026-73557 vllm vLLM is an inference and serving engine for large language models. From 0.20.2rc0 until 0.26.0, safe_load_prompt_embeds in vllm/renderers/embed_utils.py uses torch.sparse...	5.3 Medium	—	0,25%	13 Agt 2026
CVE-2026-73556 vllm vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structured_outputs.regex parameter in vllm/v1/structured_output/backend_lm_format_...	5.3 Medium	—	0,52%	13 Agt 2026
CVE-2026-73555 vllm vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the validation_exception_handler in vllm/entrypoints/openai/server_utils.py converts F...	5.3 Medium	—	0,41%	13 Agt 2026
CVE-2026-73509 OpenList a file list program that supports multiple storage. Prior to 4.2.4, the authenticated /api/fs/batch_rename handler in server/handles/fsbatch.go authorizes only t...	7.6 High	—	0,52%	13 Agt 2026
CVE-2026-73508 netty Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.dns.AbstractDnsRecord, io.netty.hand...	7.5 High	—	0,63%	13 Agt 2026
CVE-2026-73507 netty Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.xml.XmlFrameDecoder.decode() failed...	7.5 High	—	0,79%	13 Agt 2026
CVE-2026-73506 Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, write(s rune) in src/terminal/writer.go emitted attacker-contr...	6.1 Medium	—	0,18%	13 Agt 2026
CVE-2026-73505 Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle() function in src/segments/path.go passed pt.Path...	7.8 High	—	0,21%	13 Agt 2026
CVE-2026-70464 rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the...	7.5 High	—	0,57%	13 Agt 2026
CVE-2026-70463 samba rsync rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list...	8.1 High	—	0,36%	13 Agt 2026
CVE-2026-70462 rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeou...	6.5 Medium	—	0,45%	13 Agt 2026
CVE-2026-70461 samba rsync rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end...	8.2 High	—	0,57%	13 Agt 2026
CVE-2026-70460 rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tr...	8.1 High	—	0,45%	13 Agt 2026
CVE-2026-70459 samba rsync rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process that allows remote attackers to crash the daemon by sending a file...	5.3 Medium	—	0,72%	13 Agt 2026
CVE-2026-70458 rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt memory by triggering HLINK_BUMP processing on file entries with th...	8.2 High	—	0,40%	13 Agt 2026
CVE-2026-70457 samba rsync rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value of snprintf() is used directly as an index into a .bss-segment array w...	8.2 High	—	0,38%	13 Agt 2026
CVE-2026-70456 rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that allows a malicious sender to corrupt adjacent heap memory by sendi...	8.2 High	—	0,40%	13 Agt 2026
CVE-2026-70455 samba rsync rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compr...	7.5 High	—	0,57%	13 Agt 2026
CVE-2026-70454 rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a TLS certificate validation vulnerability that allows on-path attackers to in...	8.0 High	—	0,19%	13 Agt 2026
CVE-2026-70453 rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote attacker to cause a denial of service by delivering...	7.5 High	—	0,53%	13 Agt 2026
CVE-2026-70452 rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures d...	7.4 High	—	0,46%	13 Agt 2026
CVE-2026-68454 In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix handling of AIF enable without AISB When a guest seeks to register IRQs without...	8.8 High	—	0,13%	13 Agt 2026
CVE-2026-68453 In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix buffer over-read in cca_cipher2protkey Add validation of both the actual key buffer...	7.1 High	—	0,16%	13 Agt 2026
CVE-2026-6387 A potential authentication bypass vulnerability was reported in Lenovo System Update that could allow a local authenticated user to execute arbitrary code with elevated p...	7.0 High	—	0,18%	13 Agt 2026
CVE-2026-68452 In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Validate length for CCA AES cipher key requests cca_cipher2protkey() derives the copy l...	7.8 High	—	0,13%	13 Agt 2026
CVE-2026-68451 In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Validate length for CCA ECC private key requests cca_ecc2protkey() derives the copy len...	7.8 High	—	0,13%	13 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.