Katalog CVE (hal. 731)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 265.720 (Critical 36.587 · High 106.162 · KEV 1.764 · sejak 2020) · Pembaruan terakhir: 31 Okt 2026, 00:26 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 36.501–36.550 dari 265.720 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-19656 scada-lts ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenticated user (including one holding only low-privilege, read-only permis...	9.9 Critical	—	0,52%	12 Agt 2026
CVE-2026-19643 amazon aws software development kit An out-of-bounds read issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862, on some platforms, might allow a remote authenticated user to crash an applicatio...	5.3 Medium	—	0,57%	12 Agt 2026
CVE-2026-19642 amazon aws software development kit An out-of-bounds write issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862 might allow a remote authenticated user to cause a crash or heap memory corruptio...	5.9 Medium	—	0,50%	12 Agt 2026
CVE-2026-19228 gitlab GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an auth...	8.5 High	—	0,35%	12 Agt 2026
CVE-2026-18679 When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and th...	5.8 Medium	—	0,16%	12 Agt 2026
CVE-2026-18433 gitlab GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an auth...	4.3 Medium	—	0,39%	12 Agt 2026
CVE-2026-18150 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race condition.	5.3 Medium	—	0,28%	12 Agt 2026
CVE-2026-18148 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to inject arbitrary content into Navigator log files due to improper output neutralization for lo...	4.3 Medium	—	0,35%	12 Agt 2026
CVE-2026-18099 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary script code due to improper neutralization of user-controlled input.	5.4 Medium	—	0,33%	12 Agt 2026
CVE-2026-17642 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS co...	8.8 High	—	0,79%	12 Agt 2026
CVE-2026-17445 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of an attacker-supplied user profile n...	6.5 Medium	—	0,41%	12 Agt 2026
CVE-2026-17417 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of shell metacharacters.	8.8 High	—	0,79%	12 Agt 2026
CVE-2026-17111 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, mo...	9.8 Critical	—	0,45%	12 Agt 2026
CVE-2026-17083 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow.	9.8 Critical	—	0,80%	12 Agt 2026
CVE-2026-17082 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of a client-supplied profile name.	8.8 High	—	0,50%	12 Agt 2026
CVE-2026-16494 gitlab GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an auth...	7.1 High	—	0,43%	12 Agt 2026
CVE-2026-15217 gitlab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions co...	8.7 High	—	0,53%	12 Agt 2026
CVE-2026-15216 gitlab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions co...	8.7 High	—	0,53%	12 Agt 2026
CVE-2026-13361 ibm informix dynamic server IBM Informix oninit sq_sgkprepare RCE via unchecked SQL Interface length field.	8.8 High	—	0,49%	12 Agt 2026
CVE-2026-13267 ibm security verify access, ibm verify identity access +1 lainnya IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 could all...	8.1 High	—	0,35%	12 Agt 2026
CVE-2026-12618 ibm security verify access, ibm verify identity access +1 lainnya IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 could all...	7.2 High	—	0,54%	12 Agt 2026
CVE-2026-12359 ibm security verify access, ibm verify identity access +1 lainnya IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 could all...	8.1 High	—	0,45%	12 Agt 2026
CVE-2026-12005 ibm security verify access, ibm verify identity access +1 lainnya IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains...	7.2 High	—	0,54%	12 Agt 2026
CVE-2026-12004 ibm security verify access, ibm verify identity access +1 lainnya IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains...	8.7 High	—	0,49%	12 Agt 2026
CVE-2026-11937 ibm security verify access, ibm verify identity access +1 lainnya IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 and IBM S...	3.1 Low	—	0,29%	12 Agt 2026
CVE-2026-11923 ibm security verify access, ibm verify identity access +1 lainnya IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 Reverse P...	7.4 High	—	0,32%	12 Agt 2026
CVE-2025-9486 gitlab GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could...	3.3 Low	—	0,34%	12 Agt 2026
CVE-2026-73301 Budibase is an open-source low-code platform. Prior to 3.39.25, the GET /api/global/groups endpoint in packages/worker/src/api/routes/global/groups.ts omitted auth.builde...	4.3 Medium	—	0,34%	12 Agt 2026
CVE-2026-19311 Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index...	8.1 High	—	0,58%	12 Agt 2026
CVE-2026-18952 Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform server-sid...	8.1 High	—	0,52%	12 Agt 2026
CVE-2026-18678 When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unveri...	5.5 Medium	—	0,13%	12 Agt 2026
CVE-2026-18677 In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authenticator in kum...	6.0 Medium	—	0,58%	12 Agt 2026
CVE-2026-18676 The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable...	5.1 Medium	—	0,30%	12 Agt 2026
CVE-2026-18675 The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and trigge...	5.3 Medium	—	0,56%	12 Agt 2026
CVE-2026-18673 When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interfaces - forw...	5.3 Medium	—	0,46%	12 Agt 2026
CVE-2026-8667 gitlab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions c...	4.3 Medium	—	0,39%	12 Agt 2026
CVE-2026-7427 gitlab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions co...	7.5 High	—	0,62%	12 Agt 2026
CVE-2026-73300 Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true, enabling execution...	9.6 Critical	—	0,57%	12 Agt 2026
CVE-2026-73299 Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the TypeScript Nunjucks renderer evaluated untrusted .prompty template bodi...	10.0 Critical	—	1,8%	12 Agt 2026
CVE-2026-73298 The Microsoft Container Migration Solution Accelerator is a multi-service application that provides a multi-agent, AI-driven migration solution for moving container servi...	8.7 High	—	0,97%	12 Agt 2026
CVE-2026-69106 jfrog artifactory A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content.	8.8 High	—	0,52%	12 Agt 2026
CVE-2026-49467 Pingvin Share X is a secure and easy self-hosted file sharing platform. A vulnerability in versions 1.5.0 through 1.18.0 allow an attacker to bypass password verification...	8.8 High	—	0,62%	12 Agt 2026
CVE-2026-44741 Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Versions prior to 2.3.6 and 1.7.18 have a SQL injection vulnerability in Pimcore's translation grid date...	8.8 High	—	0,50%	12 Agt 2026
CVE-2026-42018 Advisory jfrog artifactory JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.	7.5 High	KEV	9,8%	12 Agt 2026
CVE-2026-18713 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to privilege escalation via Navigator for i. An authenticated user could elevate privileges to a root user to execute commands.	8.8 High	—	0,52%	12 Agt 2026
CVE-2026-18669 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to a privilege escalation as the result of a remote code execution vulnerability in the activation engine component. An authent...	8.8 High	—	0,75%	12 Agt 2026
CVE-2026-18250 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions due to a race condition.	5.0 Medium	—	0,27%	12 Agt 2026
CVE-2026-18244 gitlab GitLab has remediated an issue in GitLab EE affecting all versions from 17.7 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could...	4.3 Medium	—	0,28%	12 Agt 2026
CVE-2026-18235 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary Control Language commands due to insufficient input validation.	8.3 High	—	0,54%	12 Agt 2026
CVE-2026-17420 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper neutralization of special elements in an SQL para...	6.3 Medium	—	0,37%	12 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.