Katalog CVE (hal. 732)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 265.720 (Critical 36.587 · High 106.162 · KEV 1.764 · sejak 2020) · Pembaruan terakhir: 31 Okt 2026, 00:26 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 36.551–36.600 dari 265.720 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-17419 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify SQL tables due to improper neutralization of special elements used in an SQL command.	6.5 Medium	—	0,42%	12 Agt 2026
CVE-2026-17418 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial of service due to improper neutralization of special elements used in an SQL com...	7.8 High	—	0,30%	12 Agt 2026
CVE-2026-17276 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to escalate privileges due to improper authorization in the handling of high-authority threads.	9.9 Critical	—	0,47%	12 Agt 2026
CVE-2026-17271 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper validation of input size.	7.5 High	—	0,55%	12 Agt 2026
CVE-2026-17268 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of a session token.	6.8 Medium	—	0,34%	12 Agt 2026
CVE-2026-17266 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted director...	6.5 Medium	—	0,66%	12 Agt 2026
CVE-2026-17248 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of special elements in an OS command.	6.5 Medium	—	0,47%	12 Agt 2026
CVE-2026-17222 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify data in certain SQL tables due to improper neutralization of special elements used in a...	4.3 Medium	—	0,35%	12 Agt 2026
CVE-2026-17218 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.	9.8 Critical	—	0,80%	12 Agt 2026
CVE-2026-17110 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands and obtain sensitive information due to improper privilege manageme...	8.8 High	—	0,75%	12 Agt 2026
CVE-2026-17109 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to add unexpected parameters to a command due to parameter injection.	4.3 Medium	—	0,45%	12 Agt 2026
CVE-2026-16956 ibm db2 mirror for i IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS comman...	9.8 Critical	—	0,86%	12 Agt 2026
CVE-2026-16931 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper handling of zero-length TCP options.	7.5 High	—	0,55%	12 Agt 2026
CVE-2026-16907 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to improper bounds checking.	7.6 High	—	0,58%	12 Agt 2026
CVE-2026-16906 ibm i IBM i 7.6, and 7.5 could allow a remote authenticated attacker to execute arbitrary commands with elevated privileges due to improper neutralization of special elements u...	8.8 High	—	0,79%	12 Agt 2026
CVE-2026-16904 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper privilege management during monitor owner reassignm...	8.1 High	—	0,52%	12 Agt 2026
CVE-2026-16863 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read.	7.7 High	—	0,47%	12 Agt 2026
CVE-2026-16860 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an uncontrolled search path element.	9.9 Critical	—	0,75%	12 Agt 2026
CVE-2026-16856 ibm i IBM i 7.6, and 7.5 could allow a local attacker to gain elevated privileges due to improper neutralization of special elements used in an OS command.	8.8 High	—	0,50%	12 Agt 2026
CVE-2026-16627 gitlab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with...	9.0 Critical	—	0,48%	12 Agt 2026
CVE-2026-15423 gitlab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions co...	8.5 High	—	0,40%	12 Agt 2026
CVE-2026-73297 Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, _is_blocked_ip in ufo/utils/url_security.py did not block NAT...	6.9 Medium	—	2,9%	12 Agt 2026
CVE-2026-73296 Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, create_mobile_data_collection_server and create_mobile_action...	9.4 Critical	—	3,7%	12 Agt 2026
CVE-2026-73295 Material for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2.0 until 9.7.7, the mountSearchSuggest function in src/templates/assets/javascri...	5.4 Medium	—	0,33%	12 Agt 2026
CVE-2026-73240 apache allura Specifically crafted inputs may lead to git argument injection in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to ve...	9.8 Critical	—	1,0%	12 Agt 2026
CVE-2026-73239 apache allura Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura. This issue affects Apache Allura: before 1.19.1....	6.5 Medium	—	0,62%	12 Agt 2026
CVE-2026-73238 apache allura XSS vulnerability in code display in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the...	6.1 Medium	—	0,79%	12 Agt 2026
CVE-2026-73237 apache allura XSS vulnerability in Markdown handling in Apache Allura. This issue affects Apache Allura: from 1.10.0 before 1.19.1. Users are recommended to upgrade to version 1.19.1...	6.1 Medium	—	0,79%	12 Agt 2026
CVE-2026-48554 Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via unfiltered NOTIFICATION-family macro substitution throug...	7.5 High	—	0,97%	12 Agt 2026
CVE-2026-48553 Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 are vulnerable to authenticated remote code execution via custom-variable macro injection through the Nagios Remot...	7.5 High	—	0,97%	12 Agt 2026
CVE-2026-48552 Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to DOM-based cross-site scripting in jsonquery.js. Unencoded JSON string values reflected from stor...	5.4 Medium	—	0,29%	12 Agt 2026
CVE-2026-48551 Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An attacker can s...	7.4 High	—	0,26%	12 Agt 2026
CVE-2026-48550 Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to reflected cross-site scripting in cmd.cgi via the NagFormId parameter. An unauthenticated remote...	6.1 Medium	—	0,44%	12 Agt 2026
CVE-2026-18847 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to harvest credentials due to spoofing of Navigator for i.	9.8 Critical	—	0,25%	12 Agt 2026
CVE-2026-18683 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to privilege escalation via Navigator for i. An authenticated user could elevate privileges to a root user to execute commands.	8.8 High	—	0,67%	12 Agt 2026
CVE-2026-18499 ibm websphere application server IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege escalation when using Liberty collectives.	8.1 High	—	0,42%	12 Agt 2026
CVE-2026-18246 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to an interpretation conflict in the multipart parser.	4.3 Medium	—	0,32%	12 Agt 2026
CVE-2026-18144 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization.	4.3 Medium	—	0,32%	12 Agt 2026
CVE-2026-18106 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied path input.	4.3 Medium	—	0,50%	12 Agt 2026
CVE-2026-18098 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and compromise system integrity due to an XML injection flaw.	8.1 High	—	0,25%	12 Agt 2026
CVE-2026-17095 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to unsafe reflection.	8.3 High	—	0,54%	12 Agt 2026
CVE-2026-17094 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and manipulate files due to a path traversal vulnerability.	7.1 High	—	0,54%	12 Agt 2026
CVE-2026-16694 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web U...	5.4 Medium	—	0,23%	12 Agt 2026
CVE-2026-73325 Fujitsu Research's OneCompression library before 1.2.1 contains an unsafe deserialization vulnerability that allows attackers to execute arbitrary code by supplying a cra...	7.8 High	—	0,40%	12 Agt 2026
CVE-2026-73294 Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository git_url handling passes an attacker-controlled --upload-pack opti...	9.9 Critical	—	0,65%	12 Agt 2026
CVE-2026-73293 Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug...	8.8 High	—	0,57%	12 Agt 2026
CVE-2026-73292 Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/{id}/password endpoint accepts a cross-site request using the authenticated us...	8.3 High	—	0,23%	12 Agt 2026
CVE-2026-70547 jfrog artifactory An authenticated user without repository read permission may access package metadata under specific conditions.	4.3 Medium	—	0,28%	12 Agt 2026
CVE-2026-69107 jfrog artifactory An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions.	5.9 Medium	—	0,41%	12 Agt 2026
CVE-2026-69105 jfrog artifactory An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availability.	8.1 High	—	0,22%	12 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.