Katalog CVE (hal. 733)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 265.720 (Critical 36.587 · High 106.162 · KEV 1.764 · sejak 2020) · Pembaruan terakhir: 31 Okt 2026, 00:26 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 36.601–36.650 dari 265.720 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-68971 apache airflow Apache Airflow's asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materialize`) and the XCom result check on `wait_dag_run_until_finished` authorized the t...	6.5 Medium	—	0,33%	12 Agt 2026
CVE-2026-68970 apache airflow Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in th...	6.5 Medium	—	0,23%	12 Agt 2026
CVE-2026-68969 apache airflow Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they were submitted through the bulk endpoints (`PATCH /api/v2/var...	6.5 Medium	—	0,36%	12 Agt 2026
CVE-2026-68968 apache airflow Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backfill_id` path segment failed to parse. The authorization depe...	7.5 High	—	0,42%	12 Agt 2026
CVE-2026-68759 jfrog artifactory A holder of a valid integration credential may impersonate other users under specific conditions.	7.2 High	—	0,33%	12 Agt 2026
CVE-2026-68758 jfrog artifactory A low-privileged authenticated user may access restricted support information under specific conditions.	6.5 Medium	—	0,35%	12 Agt 2026
CVE-2026-68076 apache airflow Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran...	5.4 Medium	—	0,34%	12 Agt 2026
CVE-2026-67587 apache airflow Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Beca...	8.8 High	—	0,61%	12 Agt 2026
CVE-2026-67260 apache airflow Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swept by the scheduler. That sweep deserializes the task instan...	7.3 High	—	0,78%	12 Agt 2026
CVE-2026-66384 Advisory jfrog artifactory An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.	5.3 Medium	KEV	0,67%	12 Agt 2026
CVE-2026-66016 jfrog artifactory Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users.	6.7 Medium	—	0,12%	12 Agt 2026
CVE-2026-65941 progress whatsup gold In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the contex...	8.8 High	—	0,68%	12 Agt 2026
CVE-2026-65940 progress whatsup gold In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible location on the host server.	6.8 Medium	—	0,35%	12 Agt 2026
CVE-2026-65939 progress whatsup gold In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root.	6.8 Medium	—	0,38%	12 Agt 2026
CVE-2026-65938 progress whatsup gold In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API allows any authenticated user to invoke restricted...	4.3 Medium	—	0,25%	12 Agt 2026
CVE-2026-65937 progress whatsup gold In WhatsUp Gold versions released before 2026.0.2, an authenticated attacker can bypass frontend controls and inject persistent script content.	8.0 High	—	0,41%	12 Agt 2026
CVE-2026-65926 An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is k...	3.1 Low	—	0,24%	12 Agt 2026
CVE-2026-65017 apache airflow Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and expos...	6.5 Medium	—	0,39%	12 Agt 2026
CVE-2026-64639 Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user (customer, reseller) to execute arbitrary code on beh...	9.3 Critical	—	0,55%	12 Agt 2026
CVE-2026-59244 apache airflow Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an `isinstance(str)` gu...	6.5 Medium	—	0,23%	12 Agt 2026
CVE-2026-59242 apache airflow Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal payload through `BaseXCom.deserialize_value` without the `_c...	5.4 Medium	—	0,53%	12 Agt 2026
CVE-2026-58076 apache airflow Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken from the serialized blob and instantiating it with a...	8.8 High	—	0,48%	12 Agt 2026
CVE-2026-54183 apache airflow Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into v...	4.3 Medium	—	0,42%	12 Agt 2026
CVE-2026-19548 redhat hardened images, redhat openshift container platform +1 lainnya Multiple Use-After-Free vulnerabilities were found in the add_archive_element function in ld/ldmain.c of the GNU linker (ld), a component of binutils. The root cause is t...	5.5 Medium	—	0,17%	12 Agt 2026
CVE-2026-15803 In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity (XXE) processing when parsing untrusted XML-based RDF data or query results, p...	8.7 High	—	0,47%	12 Agt 2026
CVE-2026-73432 Vulnerability-Lookup contains a server-side request forgery (SSRF) vulnerability in the remote-instance synchronization functionality. Remote instance addresses were vali...	5.1 Medium	—	0,39%	12 Agt 2026
CVE-2026-73431 Vulnerability-Lookup contains an authentication weakness in its account activation and password-recovery mechanism. Activation and recovery links were generated using s...	8.8 High	—	0,35%	12 Agt 2026
CVE-2026-73405 An authorization bypass vulnerability in Vulnerability-Lookup allowed inactive or unconfirmed accounts to subscribe to Server-Sent Events (SSE) streams through the /pubsu...	5.3 Medium	—	0,50%	12 Agt 2026
CVE-2026-73374 A stored cross-site scripting (XSS) vulnerability existed in Vulnerability-Lookup in the render_tag_badges Jinja filter used to display reference tags associated with vul...	6.1 Medium	—	0,58%	12 Agt 2026
CVE-2026-73291 Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.4.0, Seerr's ImageProxy in server/lib/imageproxy.ts uses the...	7.1 High	—	0,39%	12 Agt 2026
CVE-2026-73290 RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, an anonymous ListObjectVersions request in rustfs/src/storage/access.rs that lacks a...	5.3 Medium	—	0,42%	12 Agt 2026
CVE-2026-73289 RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS evaluates the ForAllValues: and ForAnyValue: set qualifiers with the negated s...	8.1 High	—	0,41%	12 Agt 2026
CVE-2026-73288 RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-rc.1, RustFS Object Lock enforcement in crates/ecstore/src/bucket/object_lock/objectlock_sys.r...	6.1 Medium	—	0,39%	12 Agt 2026
CVE-2026-73287 RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS handles FTPS MKD in FtpsDriver::mkd in crates/protocols/src/ftps/driver.rs by...	5.4 Medium	—	0,37%	12 Agt 2026
CVE-2026-73286 RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS get_condition_values folds attacker-controlled request headers from HeaderMap...	8.1 High	—	0,43%	12 Agt 2026
CVE-2026-73285 RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by RUSTFS_POLICY_PLUGIN_URL i...	7.5 High	—	0,47%	12 Agt 2026
CVE-2026-73284 RustFS is a distributed object storage system built in Rust. RustFS AddServiceAccount in rustfs/src/admin/handlers/service_account.rs accepts an attacker-controlled targe...	8.8 High	—	0,52%	12 Agt 2026
CVE-2026-73265 RustFS is a distributed object storage system built in Rust. RustFS authorizes explicit versionId reads in GetObject, CopyObject sources, and UploadPartCopy sources with...	6.5 Medium	—	0,42%	12 Agt 2026
CVE-2026-73264 Prowler is a cloud security platform. Prior to 5.33.1, an authenticated user with Lighthouse provider configuration access could supply an unvalidated base_url for the op...	7.6 High	—	0,44%	12 Agt 2026
CVE-2026-73263 Prowler is a cloud security platform. Prior to 5.36.0, the Kubernetes provider connection test accepted kubeconfig_content containing a legacy gcp auth-provider with conf...	9.9 Critical	—	0,65%	12 Agt 2026
CVE-2026-73262 Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/lib/outputs/html/html.py inserted finding.resource_tags, assembled by un...	5.4 Medium	—	0,30%	12 Agt 2026
CVE-2026-68760 jfrog artifactory An unauthenticated user may bypass authentication under specific cache conditions.	5.3 Medium	—	0,46%	12 Agt 2026
CVE-2026-68757 jfrog artifactory A user with access to a valid SAML response may impersonate another user under specific conditions.	7.5 High	—	0,27%	12 Agt 2026
CVE-2026-68756 jfrog artifactory A party with write access to stored session data may affect JFrog Artifactory under specific conditions.	6.6 Medium	—	0,47%	12 Agt 2026
CVE-2026-68755 jfrog artifactory A bundle writer may create misleading release promotion information under specific conditions.	4.3 Medium	—	0,26%	12 Agt 2026
CVE-2026-68754 jfrog artifactory A repository publisher without delete permission may modify protected package content under specific conditions.	6.5 Medium	—	0,31%	12 Agt 2026
CVE-2026-68753 jfrog artifactory An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way.	5.3 Medium	—	0,31%	12 Agt 2026
CVE-2026-68752 jfrog artifactory A Project Resource Manager may gain broader administrative privileges under specific conditions.	7.2 High	—	0,49%	12 Agt 2026
CVE-2026-67287 Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder < 6.8.0 - An unauthenticated attacker can create comments on instances with disabl...	6.3 Medium	—	0,42%	12 Agt 2026
CVE-2026-67286 Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder < 6.8.0 - An unauthenticated attacker can create arbitr...	6.3 Medium	—	0,52%	12 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.