Katalog CVE (hal. 729)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 265.720 (Critical 36.587 · High 106.162 · KEV 1.764 · sejak 2020) · Pembaruan terakhir: 31 Okt 2026, 00:26 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 36.401–36.450 dari 265.720 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-73491 Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.a...	2.3 Low	—	0,39%	12 Agt 2026
CVE-2026-73490 Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applie...	4.7 Medium	—	0,30%	12 Agt 2026
CVE-2026-73430 Russh is a Rust SSH client & server library. Prior to 0.62.4, an unauthenticated SSH client can cause a denial of service by sending SSH_MSG_KEX_ECDH_INIT with a 32-byte...	5.3 Medium	—	0,60%	12 Agt 2026
CVE-2026-73429 Russh is a Rust SSH client & server library. Prior to 0.62.4, a malicious SSH server can crash a russh client session with a malformed KEX_ECDH_REPLY containing a server...	5.3 Medium	—	0,51%	12 Agt 2026
CVE-2026-73427 Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to cross-site scripting when a crafted application/x-tri...	2.1 Low	—	0,58%	12 Agt 2026
CVE-2026-73425 Astro is a web framework for content-driven websites. Prior to 8.1.2, the Astro Netlify adapter converts each image.remotePatterns entry into a regular expression written...	3.7 Low	—	0,27%	12 Agt 2026
CVE-2026-73423 Astro is a web framework for content-driven websites. From 7.0.0 until 7.0.6, the composable astro/hono pipeline installs security.checkOrigin only through the middleware...	5.1 Medium	—	0,26%	12 Agt 2026
CVE-2026-73422 Astro is a web framework for content-driven websites. From 2.9.0 until 7.1.0, Astro's server-side View Transition CSS generator interpolates animation properties into an...	5.3 Medium	—	0,55%	12 Agt 2026
CVE-2026-73419 NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth.js stores the OAuth/OIDC anti-CSRF checks state,...	6.8 Medium	—	0,25%	12 Agt 2026
CVE-2026-73418 NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken() helper in the next-auth/jwt a...	7.5 High	—	0,88%	12 Agt 2026
CVE-2026-66898 canonical lxd A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup...	9.9 Critical	—	0,59%	12 Agt 2026
CVE-2026-65370 apple servicetalk ServiceTalk HTTP/1.x incorrectly handles malformed Transfer-Encoding which could result in request smuggling attacks. This vulnerability is addressed in servicetalk versi...	7.5 High	—	0,34%	12 Agt 2026
CVE-2026-64826 rConfig before 8.2.13 contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying unsanitized directory traversal seq...	6.5 Medium	—	0,48%	12 Agt 2026
CVE-2026-19654 rsyslog, redhat enterprise linux A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an...	7.5 High	—	0,57%	12 Agt 2026
CVE-2026-19503 mongodb odbc driver, mongodb sql schema builder cli MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's discovery docume...	6.5 Medium	—	0,20%	12 Agt 2026
CVE-2026-19502 mongodb sql schema builder cli MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings...	5.5 Medium	—	0,18%	12 Agt 2026
CVE-2026-19130 A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). An attacker with specific permissions on the hub cluster, and knowledge of...	5.8 Medium	—	0,40%	12 Agt 2026
CVE-2026-19004 mongodb bi connector odbc driver An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing output parameters from a stored procedure. Triggering this...	8.1 High	—	0,50%	12 Agt 2026
CVE-2026-19002 mongodb bi connector odbc driver A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Driver can result in an out-of-bounds write in the client applica...	8.1 High	—	0,40%	12 Agt 2026
CVE-2026-19001 mongodb bi connector odbc driver The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application supplies an unusually long catalog, schema, or object name to...	9.8 Critical	—	0,54%	12 Agt 2026
CVE-2026-18888 mongodb bi connector odbc driver The MongoDB BI Connector ODBC Driver converts floating point column values into text without checking that the result fits within the destination buffer. When an applicat...	6.5 Medium	—	0,42%	12 Agt 2026
CVE-2026-18097 ibm db2 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to obtain sensitive inform...	5.5 Medium	—	0,15%	12 Agt 2026
CVE-2026-18096 ibm db2 IBM Db2 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to cause a denial of service due to a memory leak.	3.3 Low	—	0,13%	12 Agt 2026
CVE-2026-17616 ibm security verify access, ibm security verify access container +2 lainnya IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 Reverse P...	9.8 Critical	—	0,40%	12 Agt 2026
CVE-2026-16695 ibm i access client solutions IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 could allow a local attacker to execute arbitrary code due to improper neutralization of special elements used in a...	7.8 High	—	0,21%	12 Agt 2026
CVE-2026-16480 ibm db2 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is affected by an improper authorization vulnerability in the certain command, allowing a non-privileged user to...	7.1 High	—	0,34%	12 Agt 2026
CVE-2026-16033 canonical lxd A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD...	8.5 High	—	0,47%	12 Agt 2026
CVE-2026-14866 ibm i access client solutions IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to injection of rogue certificate authority due to publicly writeable truststore.	7.1 High	—	0,11%	12 Agt 2026
CVE-2026-13622 A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-laun...	8.8 High	—	0,20%	12 Agt 2026
CVE-2026-13476 ibm informix dynamic server IBM Informix Dynamic Server 14.10, 15.0, and 12.10 could allow an unauthenticated user to execute arbitrary commands with service account privileges on the system due to...	7.3 High	—	0,43%	12 Agt 2026
CVE-2026-13433 ibm i access client solutions IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 (ACS) is vulnerable to downloading unverified product code when configured to update from an IBM i. A bad actor cou...	9.6 Critical	—	0,17%	12 Agt 2026
CVE-2026-13367 ibm informix dynamic server IBM Informix Dynamic Server 14.10, and 15.0 contain a local privilege escalation vulnerability in the oninit setuid-root utility.	7.8 High	—	0,14%	12 Agt 2026
CVE-2026-13105 ibm i access client solutions IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to zip slip path traversal exploit when importing a configuration.	8.8 High	—	0,50%	12 Agt 2026
CVE-2026-13094 ibm i access client solutions IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to arbitrary code execution on Windows when installed for all users due to publicly writeable configu...	7.8 High	—	0,20%	12 Agt 2026
CVE-2026-11932 ibm security verify access, ibm security verify access container +2 lainnya IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 is vulne...	7.5 High	—	0,46%	12 Agt 2026
CVE-2026-10543 ibm db2 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation with a specially crafted query.	9.8 Critical	—	0,39%	12 Agt 2026
CVE-2026-73434 gstreamer, redhat enterprise linux A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculate...	6.1 Medium	—	0,15%	12 Agt 2026
CVE-2026-73433 gstreamer, redhat enterprise linux A flaw was found in GStreamer gst-plugins-good (avidemux). When parsing FUJIFILM metadata in an AVI strd chunk, gst_avi_demux_parse_strd() decrements a remaining-length c...	6.6 Medium	—	0,15%	12 Agt 2026
CVE-2026-73415 jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/ima...	7.5 High	—	0,74%	12 Agt 2026
CVE-2026-73414 Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/win/cmd.js does not escape `(` and `)` when applica...	9.2 Critical	—	0,89%	12 Agt 2026
CVE-2026-73413 Shescape is a simple shell escape library for JavaScript. From 2.1.11 until 2.1.14 and 3.0.1, the flag-protection loop in compose in src/internal/compose.js repeatedly jo...	8.7 High	—	0,59%	12 Agt 2026
CVE-2026-73412 Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, this impacts users of Shescape on Unix systems that explicitly configure shell to Zsh...	6.3 Medium	—	0,61%	12 Agt 2026
CVE-2026-73411 Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/unix/dash.js fails to escape ~ after : or = when ap...	6.3 Medium	—	0,59%	12 Agt 2026
CVE-2026-73409 Budibase is an open-source low-code platform. Prior to 3.40.1, packages/server/src/integrations/mongodb.ts passed builder-controlled tlsCertificateKeyFile and tlsCAFile v...	5.1 Medium	—	0,32%	12 Agt 2026
CVE-2026-73407 Budibase is an open-source low-code platform. Prior to 3.40.1, RestIntegration._req in packages/server/src/integrations/rest.ts attached credentials from getAuthHeaders a...	9.0 Critical	—	0,54%	12 Agt 2026
CVE-2026-73406 Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was listed in PUBLIC_ENDPOINTS in packages/worker/src/api/index.ts, and t...	7.5 High	—	0,51%	12 Agt 2026
CVE-2026-73332 CamaleonCMS contains a stored cross-site scripting vulnerability in the cama_contact_form plugin that allows low-privileged authenticated attackers to inject arbitrary HT...	8.7 High	—	0,42%	12 Agt 2026
CVE-2026-73331 CamaleonCMS 2.9.1 contains an authenticated SQL injection vulnerability that allows authenticated attackers with post creation or editing privileges to submit a crafted s...	7.1 High	—	0,36%	12 Agt 2026
CVE-2026-73330 CamaleonCMS 2.9.1 contains a server-side template injection vulnerability that allows authenticated administrators to execute arbitrary commands by embedding ERB tags in...	6.6 Medium	—	0,79%	12 Agt 2026
CVE-2026-73329 CamaleonCMS contains a stored cross-site scripting vulnerability that allows authenticated low-privileged users to execute arbitrary JavaScript in an administrator's brow...	8.7 High	—	0,42%	12 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.