Katalog CVE (hal. 736)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 265.720 (Critical 36.587 · High 106.162 · KEV 1.764 · sejak 2020) · Pembaruan terakhir: 31 Okt 2026, 00:26 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 36.751–36.800 dari 265.720 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-13612 The KiviCare WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed, allowing authenticated patient-level users to read o...	4.3 Medium	—	0,25%	12 Agt 2026
CVE-2026-13177 The Eventin WordPress plugin before 4.1.20 does not properly restrict access to individual order records, allowing users with contributor-level access and above to read...	4.3 Medium	—	0,25%	12 Agt 2026
CVE-2026-13171 The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to create Wor...	8.2 High	—	0,33%	12 Agt 2026
CVE-2026-13168 The Eventin WordPress plugin before 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-level access and above to read o...	6.5 Medium	—	0,37%	12 Agt 2026
CVE-2026-12976 The LearnPress WordPress plugin before 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's lesson con...	6.5 Medium	—	0,37%	12 Agt 2026
CVE-2026-64954 Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECT_CLIENT permission. However,...	8.2 High	—	0,31%	12 Agt 2026
CVE-2026-12235 The Linkable Loadable Extensions (llext) subsystem mis-handles PLT/RELA relocation entries when linking a relocatable (partially-linked) ELF extension. In llext_link_plt(...	6.3 Medium	—	0,14%	12 Agt 2026
CVE-2026-12234 The userspace syscall verifiers z_vrfy_zsock_sendmsg() and z_vrfy_zsock_recvmsg() in subsys/net/lib/sockets/sockets.c snapshot the caller-supplied struct net_msghdr into...	7.8 High	—	0,11%	12 Agt 2026
CVE-2026-12233 The PSA Protected Storage credential backend (subsys/net/lib/tls_credentials/tls_credentials_trusted.c) declared its credential-store mutex as a plain zero-filled static...	5.9 Medium	—	0,51%	12 Agt 2026
CVE-2026-12232 The Intel ALH digital-audio-interface driver function dai_alh_get_properties() in drivers/dai/intel/alh/alh.c used a caller-supplied int stream_id with no range validatio...	6.1 Medium	—	0,15%	12 Agt 2026
CVE-2025-15687 A security flaw has been discovered in Open5GS up to 2.7.6. Impacted is the function smf_gx_cca_cb of the component SMF Diameter Gx Credit-Control-Answer Handler. The man...	4.3 Medium	—	0,64%	12 Agt 2026
CVE-2026-9318 tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScript by embe...	5.4 Medium	—	0,30%	12 Agt 2026
CVE-2026-19588 samsung rlottie Integer Overflow to Buffer Overflow vulnerability in Samsung Open Source rlottie allows Overflow Buffers.	6.5 Medium	—	0,35%	12 Agt 2026
CVE-2026-19587 samsung rlottie Uncontrolled Resource Consumption vulnerability in Samsung Open Source rlottie allows Excessive Allocation.	6.5 Medium	—	0,36%	12 Agt 2026
CVE-2026-18961 The Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress is vulnerable to Authentication Bypass via Unverified Provid...	8.1 High	—	0,75%	12 Agt 2026
CVE-2025-15686 A vulnerability has been found in Open5GS up to 2.7.6. Affected by this issue is the function fd_msg_sess_get of the component HSS Service. Such manipulation of the argum...	4.3 Medium	—	0,53%	12 Agt 2026
CVE-2025-15685 A flaw has been found in Open5GS up to 2.7.1. Affected by this vulnerability is an unknown functionality of the component freeDiameter. This manipulation causes memory co...	6.3 Medium	—	0,28%	12 Agt 2026
CVE-2025-15684 A vulnerability was detected in Open5GS up to 2.7.6. Affected is the function diam_log_func of the file lib/diameter/common/init.c of the component CER Handler. The manip...	5.3 Medium	—	0,74%	12 Agt 2026
CVE-2026-73122 A flaw was found in the multicloud-operators-channel component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a compromised agent from a manage...	7.7 High	—	0,48%	12 Agt 2026
CVE-2026-72526 A flaw was found in the multicloud-integrations component. The Application propagation controller processes the `ocm-managed-cluster` annotation from an Application Custo...	9.9 Critical	—	0,71%	12 Agt 2026
CVE-2026-70398 A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows an authenticated user, referred to as a...	9.6 Critical	—	0,52%	12 Agt 2026
CVE-2026-66878 A flaw was found in multicloud-operators-subscription. A privileged user, specifically a namespace administrator capable of creating Channel and Subscription resources, c...	7.7 High	—	0,48%	12 Agt 2026
CVE-2026-64927 A flaw was found in the multicloud-operators-channel component. This vulnerability allows a user with specific permissions to manipulate how the system handles sensitive...	6.4 Medium	—	0,33%	12 Agt 2026
CVE-2026-6484 In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution.	8.2 High	—	0,37%	12 Agt 2026
CVE-2026-68447 In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size CRIU checkpoint copies the MQD co...	7.1 High	—	0,16%	12 Agt 2026
CVE-2024-14044 A vulnerability was identified in Open5GS up to 2.7.1. This issue affects the function pcrf_rx_aar_cb of the file src/pcrf/pcrf-rx-path.c of the component Diameter Rx Han...	6.3 Medium	—	0,50%	12 Agt 2026
CVE-2026-68446 In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate vmw_surface_metadata::array_size This field comes from userspace and should be...	7.8 High	—	0,12%	12 Agt 2026
CVE-2026-68445 In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Prevent shader BO mappings from becoming writable vc4_gem_object_mmap() rejects a writable...	7.8 High	—	0,13%	12 Agt 2026
CVE-2026-68442 In the Linux kernel, the following vulnerability has been resolved: btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps When btrfs_drop_extent_map_range() s...	7.8 High	—	0,15%	12 Agt 2026
CVE-2026-68440 In the Linux kernel, the following vulnerability has been resolved: net: txgbe: fix heap overflow when reading module EEPROM txgbe_read_eeprom_hostif() always copies ro...	7.8 High	—	0,12%	12 Agt 2026
CVE-2026-68433 In the Linux kernel, the following vulnerability has been resolved: libceph: bound get_version reply decode to front len handle_get_version_reply() uses msg->front_allo...	8.6 High	—	0,36%	12 Agt 2026
CVE-2026-68432 In the Linux kernel, the following vulnerability has been resolved: vxlan: require CAP_NET_ADMIN in the device netns for changelink A tunnel changelink() operates on at...	8.8 High	—	0,15%	12 Agt 2026
CVE-2026-68431 In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate minimum PDU size for transform requests The receive path applies the minimum SMB2 PD...	9.1 Critical	—	0,37%	12 Agt 2026
CVE-2024-14043 A vulnerability was determined in Open5GS up to 2.7.1. This vulnerability affects the function mme_s6a_subscription_data_from_avp of the file src/mme/mme-fd-path.c of the...	6.3 Medium	—	0,50%	12 Agt 2026
CVE-2026-73250 Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the Notepad++ Windows 11 x64 and ARM64 installer passes the attacker-influenced installation direc...	5.4 Medium	—	0,19%	11 Agt 2026
CVE-2026-73249 calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt} in src/calibre/srv/books.py...	7.5 High	—	0,44%	11 Agt 2026
CVE-2026-73248 calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled composite_template metadata from a malicious EPUB, OPF, PDF, or similar file through...	8.5 High	—	0,20%	11 Agt 2026
CVE-2026-73247 Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passe...	8.6 High	—	0,41%	11 Agt 2026
CVE-2026-73246 Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET...	7.5 High	—	0,60%	11 Agt 2026
CVE-2026-73245 Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's cli/src/main/resources/application.yml serves Micronaut management endpoints o...	6.5 Medium	—	0,33%	11 Agt 2026
CVE-2026-68067 The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching the suppli...	9.8 Critical	—	0,51%	11 Agt 2026
CVE-2026-67568 The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could result in forge...	9.1 Critical	—	0,42%	11 Agt 2026
CVE-2026-67558 The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryp...	7.4 High	—	0,27%	11 Agt 2026
CVE-2026-66875 In the Mira hormone monitor device firmware v1.7.1.47 build 01070147, a remote unauthenticated attacker within BLE range (approximately 10–30 meters) can silently rebind...	8.8 High	—	0,41%	11 Agt 2026
CVE-2026-66340 The Mira cloud authentication endpoints do not enforce per-account rate limiting, per-IP throttling, or account lockout after repeated failed login attempts. An attacker...	5.3 Medium	—	0,40%	11 Agt 2026
CVE-2026-66098 The Mira hormone monitor device firmware accepts a 0x01 write from any BLE central without authentication, causing the device to reboot into bootloader mode. An attacker...	6.5 Medium	—	0,32%	11 Agt 2026
CVE-2026-64934 The Mira cloud API accepts the firmware version reported by the companion app as authoritative for a given device, without independently attesting the version from the de...	4.3 Medium	—	0,31%	11 Agt 2026
CVE-2026-5917 libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows remo...	8.8 High	—	1,4%	11 Agt 2026
CVE-2026-29036 cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decode_pointer_inplace() function within cJSON_Utils.c that all...	7.5 High	—	0,44%	11 Agt 2026
CVE-2026-19560 google chrome Use after free in Blink in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium s...	8.8 High	—	0,41%	11 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.