Katalog CVE (hal. 725)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 265.400 (Critical 36.562 · High 106.027 · KEV 1.764 · sejak 2020) · Pembaruan terakhir: 30 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 36.201–36.250 dari 265.400 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-63298 canonical lxd An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configur...	9.9 Critical	—	0,69%	12 Agt 2026
CVE-2026-63297 canonical lxd An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restrictions duri...	9.9 Critical	—	0,34%	12 Agt 2026
CVE-2026-63296 canonical lxd An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration. When migrating an instance...	9.9 Critical	—	0,44%	12 Agt 2026
CVE-2026-63295 canonical lxd An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When a project is configured with...	4.3 Medium	—	0,35%	12 Agt 2026
CVE-2026-63294 canonical lxd A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image or backup a...	9.9 Critical	—	0,88%	12 Agt 2026
CVE-2026-63293 canonical lxd A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image arch...	9.9 Critical	—	0,59%	12 Agt 2026
CVE-2026-62420 canonical lxd An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. Whe...	9.9 Critical	—	0,54%	12 Agt 2026
CVE-2026-59917 dell display and peripheral manager Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain Improper Access Control vulnerability. A low privileged attacker with local access...	7.8 High	—	0,15%	12 Agt 2026
CVE-2026-59916 dell display and peripheral manager Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain Improper Access Control vulnerability. A low privileged attacker with local access...	7.8 High	—	0,15%	12 Agt 2026
CVE-2026-59914 dell display and peripheral manager Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with...	7.8 High	—	0,18%	12 Agt 2026
CVE-2026-49466 Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting (XSS) in the `[drafts]`...	6.5 Medium	—	0,29%	12 Agt 2026
CVE-2026-4879 gitlab GitLab has remediated an issue in GitLab EE affecting all versions from 16.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could...	4.3 Medium	—	0,33%	12 Agt 2026
CVE-2026-46731 dell display and peripheral manager Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with...	7.8 High	—	0,18%	12 Agt 2026
CVE-2026-19657 scada-lts ScadaLTS 2.7.8.1 reflects user-supplied input into an HTML response without sanitization. An unauthenticated attacker who lures a victim into visiting a crafted URL can e...	6.1 Medium	—	0,28%	12 Agt 2026
CVE-2026-19656 scada-lts ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenticated user (including one holding only low-privilege, read-only permis...	9.9 Critical	—	0,52%	12 Agt 2026
CVE-2026-19643 amazon aws software development kit An out-of-bounds read issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862, on some platforms, might allow a remote authenticated user to crash an applicatio...	5.3 Medium	—	0,57%	12 Agt 2026
CVE-2026-19642 amazon aws software development kit An out-of-bounds write issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862 might allow a remote authenticated user to cause a crash or heap memory corruptio...	5.9 Medium	—	0,50%	12 Agt 2026
CVE-2026-19228 gitlab GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an auth...	8.5 High	—	0,35%	12 Agt 2026
CVE-2026-18679 When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and th...	5.8 Medium	—	0,16%	12 Agt 2026
CVE-2026-18433 gitlab GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an auth...	4.3 Medium	—	0,39%	12 Agt 2026
CVE-2026-18150 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race condition.	5.3 Medium	—	0,28%	12 Agt 2026
CVE-2026-18148 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to inject arbitrary content into Navigator log files due to improper output neutralization for lo...	4.3 Medium	—	0,35%	12 Agt 2026
CVE-2026-18099 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary script code due to improper neutralization of user-controlled input.	5.4 Medium	—	0,33%	12 Agt 2026
CVE-2026-17642 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS co...	8.8 High	—	0,79%	12 Agt 2026
CVE-2026-17445 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of an attacker-supplied user profile n...	6.5 Medium	—	0,41%	12 Agt 2026
CVE-2026-17417 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of shell metacharacters.	8.8 High	—	0,79%	12 Agt 2026
CVE-2026-17111 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, mo...	9.8 Critical	—	0,45%	12 Agt 2026
CVE-2026-17083 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow.	9.8 Critical	—	0,80%	12 Agt 2026
CVE-2026-17082 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of a client-supplied profile name.	8.8 High	—	0,50%	12 Agt 2026
CVE-2026-16494 gitlab GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an auth...	7.1 High	—	0,43%	12 Agt 2026
CVE-2026-15217 gitlab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions co...	8.7 High	—	0,53%	12 Agt 2026
CVE-2026-15216 gitlab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions co...	8.7 High	—	0,53%	12 Agt 2026
CVE-2026-13361 ibm informix dynamic server IBM Informix oninit sq_sgkprepare RCE via unchecked SQL Interface length field.	8.8 High	—	0,49%	12 Agt 2026
CVE-2026-13267 ibm security verify access, ibm verify identity access +1 lainnya IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 could all...	8.1 High	—	0,35%	12 Agt 2026
CVE-2026-12618 ibm security verify access, ibm verify identity access +1 lainnya IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 could all...	7.2 High	—	0,54%	12 Agt 2026
CVE-2026-12359 ibm security verify access, ibm verify identity access +1 lainnya IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 could all...	8.1 High	—	0,45%	12 Agt 2026
CVE-2026-12005 ibm security verify access, ibm verify identity access +1 lainnya IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains...	7.2 High	—	0,54%	12 Agt 2026
CVE-2026-12004 ibm security verify access, ibm verify identity access +1 lainnya IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains...	8.7 High	—	0,49%	12 Agt 2026
CVE-2026-11937 ibm security verify access, ibm verify identity access +1 lainnya IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 and IBM S...	3.1 Low	—	0,29%	12 Agt 2026
CVE-2026-11923 ibm security verify access, ibm verify identity access +1 lainnya IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 Reverse P...	7.4 High	—	0,32%	12 Agt 2026
CVE-2025-9486 gitlab GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could...	3.3 Low	—	0,34%	12 Agt 2026
CVE-2026-73301 Budibase is an open-source low-code platform. Prior to 3.39.25, the GET /api/global/groups endpoint in packages/worker/src/api/routes/global/groups.ts omitted auth.builde...	4.3 Medium	—	0,34%	12 Agt 2026
CVE-2026-19311 Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index...	8.1 High	—	0,58%	12 Agt 2026
CVE-2026-18952 Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform server-sid...	8.1 High	—	0,52%	12 Agt 2026
CVE-2026-18678 When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unveri...	5.5 Medium	—	0,13%	12 Agt 2026
CVE-2026-18677 In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authenticator in kum...	6.0 Medium	—	0,58%	12 Agt 2026
CVE-2026-18676 The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable...	5.1 Medium	—	0,30%	12 Agt 2026
CVE-2026-18675 The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and trigge...	5.3 Medium	—	0,56%	12 Agt 2026
CVE-2026-18673 When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interfaces - forw...	5.3 Medium	—	0,46%	12 Agt 2026
CVE-2026-8667 gitlab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions c...	4.3 Medium	—	0,39%	12 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.