Katalog CVE (hal. 720)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 265.400 (Critical 36.562 · High 106.027 · KEV 1.764 · sejak 2020) · Pembaruan terakhir: 30 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 35.951–36.000 dari 265.400 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-27535 Subscriber Broken Access Control in Solace Extra <= 1.6.0 versions.	7.1 High	—	0,32%	13 Agt 2026
CVE-2026-27380 Editor PHP Object Injection in Car Rental Manager <= 1.3.9 versions.	7.2 High	—	0,54%	13 Agt 2026
CVE-2026-27345 Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce <= 2.0.3 versions.	7.5 High	—	0,35%	13 Agt 2026
CVE-2026-21832 HCL AION is affected by a vulnerability where indirect prompt injection can lead to HTML injection in rendered output. Injected markup may be displayed to users, potentia...	4.3 Medium	—	0,30%	13 Agt 2026
CVE-2026-19716 Stored Cross-site Scripting (CWE-79) in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript...	5.1 Medium	—	0,47%	13 Agt 2026
CVE-2025-62318 HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages, potentially allowing sensitive information to be...	3.7 Low	—	0,12%	13 Agt 2026
CVE-2025-62315 HCL AION is affected by a vulnerability where certain input fields do not enforce sufficient server-side input validation. Unexpected or crafted input may be accepted by...	3.4 Low	—	0,21%	13 Agt 2026
CVE-2025-62314 HCL AION is affected by a vulnerability where certain endpoints lack sufficient anti-automation controls. Automated or scripted requests may be submitted without adequate...	5.6 Medium	—	0,15%	13 Agt 2026
CVE-2026-73585 redhat enterprise linux A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a local unprivileged user to perform a symlink attack. B...	6.3 Medium	—	0,14%	13 Agt 2026
CVE-2026-73584 redhat enterprise linux A flaw was found in sblim-sfcb. A local, low-privileged attacker can exploit a race condition during privileged instance migration by manipulating a temporary file in the...	6.3 Medium	—	0,13%	13 Agt 2026
CVE-2026-73583 redhat enterprise linux A flaw was found in sblim-sfcb. A local attacker with access to the system can exploit an unsafe deserialization vulnerability in the provider-manager's inter-process com...	6.6 Medium	—	0,13%	13 Agt 2026
CVE-2026-6471 postgresql Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account runni...	7.2 High	—	0,53%	13 Agt 2026
CVE-2026-6470 postgresql Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on th...	4.3 Medium	—	0,33%	13 Agt 2026
CVE-2026-6469 postgresql Incorrect ownership assignment in PostgreSQL ALTER TABLE ALTER TYPE command reassigns ownership of dependent statistics objects to the current user. This wrongly allows...	3.8 Low	—	0,32%	13 Agt 2026
CVE-2026-6464 postgresql Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY F...	8.1 High	—	0,36%	13 Agt 2026
CVE-2026-49827 WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP f...	9.8 Critical	—	0,86%	13 Agt 2026
CVE-2026-49478 Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Versions through 1.8.5 improperly follow cross-host redirec...	8.7 High	—	0,28%	13 Agt 2026
CVE-2026-19385 postgresql Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pg_dum...	8.8 High	—	0,43%	13 Agt 2026
CVE-2026-18408 postgresql Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client oper...	8.8 High	—	0,36%	13 Agt 2026
CVE-2026-18024 postgresql Buffer over-read in PostgreSQL ascii() SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a crafted text value. This is the...	4.3 Medium	—	0,30%	13 Agt 2026
CVE-2026-16241 postgresql Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via sending a bytea value lacki...	3.8 Low	—	0,34%	13 Agt 2026
CVE-2026-16239 postgresql Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cur...	8.8 High	—	0,68%	13 Agt 2026
CVE-2026-16238 postgresql Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via confla...	8.8 High	—	0,41%	13 Agt 2026
CVE-2026-15742 postgresql Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running...	8.8 High	—	0,60%	13 Agt 2026
CVE-2026-15741 postgresql SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression d...	8.8 High	—	0,44%	13 Agt 2026
CVE-2026-14681 postgresql Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct TLS connection....	4.2 Medium	—	0,08%	13 Agt 2026
CVE-2026-14680 postgresql Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to fu...	8.8 High	—	0,42%	13 Agt 2026
CVE-2026-14679 postgresql Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT parameter count. The attack can write only 0x0 and...	8.2 High	—	0,29%	13 Agt 2026
CVE-2026-14678 postgresql Buffer over-read in PostgreSQL pg_trgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory values, via...	4.3 Medium	—	0,30%	13 Agt 2026
CVE-2026-14677 postgresql Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via cra...	8.8 High	—	0,41%	13 Agt 2026
CVE-2026-14676 postgresql Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operating system user running the database, via crafted que...	8.8 High	—	0,44%	13 Agt 2026
CVE-2026-14673 postgresql Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that...	3.8 Low	—	0,27%	13 Agt 2026
CVE-2026-14672 postgresql Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count....	5.3 Medium	—	0,39%	13 Agt 2026
CVE-2026-14671 postgresql Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerg...	8.8 High	—	0,42%	13 Agt 2026
CVE-2026-14670 postgresql Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via...	8.8 High	—	0,44%	13 Agt 2026
CVE-2026-14669 postgresql Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the database...	8.8 High	—	0,66%	13 Agt 2026
CVE-2026-14668 postgresql Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the value of an arbitrary 4-...	8.1 High	—	0,33%	13 Agt 2026
CVE-2026-14666 postgresql Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security polici...	4.2 Medium	—	0,21%	13 Agt 2026
CVE-2026-14664 postgresql Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pas...	8.8 High	—	0,44%	13 Agt 2026
CVE-2026-14663 postgresql Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and Op...	6.5 Medium	—	0,11%	13 Agt 2026
CVE-2026-14662 postgresql Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write ou...	8.8 High	—	0,46%	13 Agt 2026
CVE-2025-52640 HCL AION is affected by a vulnerability where the shared storage used by product components is architected without sufficient access separation. Processes sharing the sto...	4.7 Medium	—	0,11%	13 Agt 2026
CVE-2026-73629 Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the serendipity_url_allowed() filter that fails to block hex-encoded IPv4 addresses, IPv6...	8.5 High	—	0,32%	13 Agt 2026
CVE-2026-73628 Serendipity versions >= 2.3.5 and <= 2.6.0 contain a reflected cross-site scripting vulnerability in the search clean-URL route (/search/<term>). In include/functions_rou...	6.1 Medium	—	0,26%	13 Agt 2026
CVE-2026-73627 JupyterLab (pip package 'jupyterlab') versions >=4.1.0,<=4.5.9 and >=4.6.0,<=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps...	6.0 Medium	—	0,42%	13 Agt 2026
CVE-2026-73626 JupyterLab versions >=4.6.0,<=4.6.1 and <=4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install(). A missing 'await' caused the is_install_...	7.5 High	—	0,36%	13 Agt 2026
CVE-2026-73625 gitpython project gitpython GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options guard that can be bypassed by smuggling git options inside sing...	8.8 High	—	0,92%	13 Agt 2026
CVE-2026-73624 gitpython project gitpython GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that fails to validate git options passed through kwargs. A...	8.1 High	—	0,55%	13 Agt 2026
CVE-2026-73623 gitpython project gitpython GitPython before 3.1.54 contains an incomplete denylist in unsafe_git_clone_options that omits --template, allowing attackers to achieve arbitrary command execution durin...	8.8 High	—	0,84%	13 Agt 2026
CVE-2026-73622 gitpython project gitpython GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by s...	7.5 High	—	0,51%	13 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.