Katalog CVE (hal. 717)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 265.400 (Critical 36.562 · High 106.027 · KEV 1.764 · sejak 2020) · Pembaruan terakhir: 30 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 35.801–35.850 dari 265.400 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-66256 apache shindig UNSUPPORTED WHEN ASSIGNED Deserialization of Untrusted Data vulnerability in Apache Shindig. This issue affects Apache Shindig: all versions. Users with access to...	7.2 High	—	0,94%	13 Agt 2026
CVE-2026-65936 A malformed Bluetooth connection request message can cause the RS9116W/SiWx917 to leak potentially sensitive information. See vulnerability B-E4 in the related paper bel...	5.3 Medium	—	0,25%	13 Agt 2026
CVE-2026-65935 Passkey entry Bluetooth LE legacy pairing can be bypassed in the RS9116W and SiWx917 by manipulating the temporary key value. See vulnerability B-E3 in the related paper...	7.6 High	—	0,25%	13 Agt 2026
CVE-2026-65934 An unencrypted 'pause encryption request' message causes a denial of service in the BT122 module. See vulnerability B-E10 in the related paper below.	7.1 High	—	0,14%	13 Agt 2026
CVE-2026-65933 A malformed Bluetooth connection request message can cause the BT122 to leak potentially sensitive information. See vulnerability B-E4 in the related paper below.	5.3 Medium	—	0,25%	13 Agt 2026
CVE-2026-65932 The BT122 module stops advertising after receiving a plaintext 'pause enceryption response' message resulting in a denial of service. See vulnerability B-E2 in the relate...	5.3 Medium	—	0,25%	13 Agt 2026
CVE-2026-63426 lenovo dock manager During an internal security assessment, a potential vulnerability was discovered in Lenovo Dock Manager that could allow an authenticated local user to perform an arbitra...	7.1 High	—	0,16%	13 Agt 2026
CVE-2026-63425 lenovo dock manager During an internal security assessment, a potential improper permissions vulnerability was discovered in Lenovo Dock Manager that could allow a local authenticated user t...	7.8 High	—	0,15%	13 Agt 2026
CVE-2026-63424 lenovo dock manager During an internal security assessment, an improperly protected key was discovered in Lenovo Dock Manager that could allow a local authenticated user to escalate privileg...	7.3 High	—	0,13%	13 Agt 2026
CVE-2026-63423 During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise for Windows that could allow a l...	7.8 High	—	0,15%	13 Agt 2026
CVE-2026-53803 samba rsync rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files by placing a symlink at a predictable output path s...	7.8 High	—	0,23%	13 Agt 2026
CVE-2026-53802 samba rsync rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink followin...	7.1 High	—	0,24%	13 Agt 2026
CVE-2026-53801 samba rsync rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumerate and tra...	5.9 Medium	—	0,29%	13 Agt 2026
CVE-2026-53800 samba rsync rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to cause arbitr...	4.7 Medium	—	0,14%	13 Agt 2026
CVE-2026-53799 samba rsync rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply arbitrary ACLs or extended attributes to unintended...	6.3 Medium	—	0,12%	13 Agt 2026
CVE-2026-53798 samba rsync rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that allows local attackers to cause transferred files to...	5.3 Medium	—	0,43%	13 Agt 2026
CVE-2026-53797 samba rsync rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree traversal that allows an attacker who can manipulate a parent directory of...	4.7 Medium	—	0,14%	13 Agt 2026
CVE-2026-53796 rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the non-daemon receiver's destination directory handling that allows a...	6.3 Medium	—	0,13%	13 Agt 2026
CVE-2026-53795 samba rsync rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute pat...	8.1 High	—	0,40%	13 Agt 2026
CVE-2026-53794 rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration setting --max-alloc=0 to disable allocation sanity checks entirely...	5.3 Medium	—	0,51%	13 Agt 2026
CVE-2026-53793 rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths...	7.4 High	—	0,39%	13 Agt 2026
CVE-2026-53792 rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory access before t...	6.5 Medium	—	0,31%	13 Agt 2026
CVE-2026-53791 samba rsync rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a craft...	9.1 Critical	—	0,50%	13 Agt 2026
CVE-2026-53790 rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input throug...	8.1 High	—	0,63%	13 Agt 2026
CVE-2026-53789 samba rsync rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destinat...	8.1 High	—	0,36%	13 Agt 2026
CVE-2026-53788 rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by cr...	6.5 Medium	—	0,27%	13 Agt 2026
CVE-2026-53786 samba rsync rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --fil...	6.5 Medium	—	0,40%	13 Agt 2026
CVE-2026-53785 rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relat...	7.1 High	—	0,19%	13 Agt 2026
CVE-2026-53784 samba rsync rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the...	7.1 High	—	0,24%	13 Agt 2026
CVE-2026-53783 rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients...	8.1 High	—	0,37%	13 Agt 2026
CVE-2026-49857 auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. Version 3.0.1 implements SSRF protection in `assertSafeUrl()` (`src/se...	7.4 High	—	0,49%	13 Agt 2026
CVE-2026-49856 @jshookmcp/jshook is an MCP server that gives AI agents tools for JavaScript analysis and security research. In version 0.3.1, he network domain has a central SSRF author...	4.3 Medium	—	0,28%	13 Agt 2026
CVE-2026-49820 Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Probo's `saferedirect` package validates redirect URLs...	4.7 Medium	—	0,42%	13 Agt 2026
CVE-2026-28154 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and...	7.1 High	—	0,26%	13 Agt 2026
CVE-2026-19734 Missing Authorization and Authorization Bypass Through User-Controlled Key in the product management component in Roskus Prospero Flow CRM before 5.4.7 allows authenticat...	8.6 High	—	0,59%	13 Agt 2026
CVE-2026-19293 SMP security request (from peripheral) does not include the maximum encryption key size supported. Using a key with less than the maximum keysize makes brute-forcing the...	8.8 High	—	0,20%	13 Agt 2026
CVE-2026-19292 Re-pairing with a legitimate device can use a lower security level than previous making brute-forcing the LTK easier. See V4 in the BLERP paper linked below.	8.8 High	—	0,35%	13 Agt 2026
CVE-2026-19291 Bluetooth re-pairing with an existing device can use a lower security level. RS9116W and SiWx91x impacted. See V3 in the BLERP paper linked below.	8.8 High	—	0,35%	13 Agt 2026
CVE-2026-16101 Spoofing an already bonded device can force either RS9116W or SiWx917 to re-pair/bond with a rogue device. See V1 in BLERP paper below	8.8 High	—	0,35%	13 Agt 2026
CVE-2026-15994 During an internal security assessment, an improper link following vulnerability was identified in Lenovo Vantage and Lenovo Commercial Vantage that could allow a local a...	7.0 High	—	0,16%	13 Agt 2026
CVE-2026-14456 Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue ne...	7.5 High	—	0,73%	13 Agt 2026
CVE-2026-14256 ELAN reported a potential out-of-bounds write vulnerability in the ELAN TrackPoint driver that, under certain circumstances, could allow a local authenticated user to cau...	4.7 Medium	—	0,11%	13 Agt 2026
CVE-2026-12036 An improper link following vulnerability was reported in the VantageCoreAddin for Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user...	7.1 High	—	0,16%	13 Agt 2026
CVE-2026-73403 Unauthenticated Broken Access Control in User Registration <= 5.2.6 versions.	5.3 Medium	—	0,29%	13 Agt 2026
CVE-2026-73401 Unauthenticated Broken Access Control in InstaWP Connect <= 0.1.3.7 versions.	5.3 Medium	—	0,29%	13 Agt 2026
CVE-2026-73357 Donor Cross Site Scripting (XSS) in GiveWP < 4.16.6 versions.	6.5 Medium	—	0,22%	13 Agt 2026
CVE-2026-73353 Unauthenticated Broken Access Control in Revolut Gateway for WooCommerce < 4.22.10 versions.	5.3 Medium	—	0,31%	13 Agt 2026
CVE-2026-73349 Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.	5.3 Medium	—	0,29%	13 Agt 2026
CVE-2026-73346 Administrator SQL Injection in MailChimp For WooCommerce < 6.2 versions.	7.6 High	—	0,38%	13 Agt 2026
CVE-2026-73344 Author Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions.	5.9 Medium	—	0,24%	13 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.