Katalog CVE (hal. 738)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.042 (Critical 36.621 · High 106.282 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 31 Okt 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 36.851–36.900 dari 266.042 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-18673 When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interfaces - forw...	5.3 Medium	—	0,46%	12 Agt 2026
CVE-2026-8667 gitlab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions c...	4.3 Medium	—	0,39%	12 Agt 2026
CVE-2026-7427 gitlab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions co...	7.5 High	—	0,62%	12 Agt 2026
CVE-2026-73300 Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true, enabling execution...	9.6 Critical	—	0,57%	12 Agt 2026
CVE-2026-73299 Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the TypeScript Nunjucks renderer evaluated untrusted .prompty template bodi...	10.0 Critical	—	1,8%	12 Agt 2026
CVE-2026-73298 The Microsoft Container Migration Solution Accelerator is a multi-service application that provides a multi-agent, AI-driven migration solution for moving container servi...	8.7 High	—	0,97%	12 Agt 2026
CVE-2026-69106 jfrog artifactory A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content.	8.8 High	—	0,52%	12 Agt 2026
CVE-2026-49467 Pingvin Share X is a secure and easy self-hosted file sharing platform. A vulnerability in versions 1.5.0 through 1.18.0 allow an attacker to bypass password verification...	8.8 High	—	0,62%	12 Agt 2026
CVE-2026-44741 Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Versions prior to 2.3.6 and 1.7.18 have a SQL injection vulnerability in Pimcore's translation grid date...	8.8 High	—	0,50%	12 Agt 2026
CVE-2026-42018 Advisory jfrog artifactory JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.	7.5 High	KEV	9,8%	12 Agt 2026
CVE-2026-18713 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to privilege escalation via Navigator for i. An authenticated user could elevate privileges to a root user to execute commands.	8.8 High	—	0,52%	12 Agt 2026
CVE-2026-18669 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to a privilege escalation as the result of a remote code execution vulnerability in the activation engine component. An authent...	8.8 High	—	0,75%	12 Agt 2026
CVE-2026-18250 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions due to a race condition.	5.0 Medium	—	0,27%	12 Agt 2026
CVE-2026-18244 gitlab GitLab has remediated an issue in GitLab EE affecting all versions from 17.7 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could...	4.3 Medium	—	0,28%	12 Agt 2026
CVE-2026-18235 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary Control Language commands due to insufficient input validation.	8.3 High	—	0,54%	12 Agt 2026
CVE-2026-17420 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper neutralization of special elements in an SQL para...	6.3 Medium	—	0,37%	12 Agt 2026
CVE-2026-17419 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify SQL tables due to improper neutralization of special elements used in an SQL command.	6.5 Medium	—	0,42%	12 Agt 2026
CVE-2026-17418 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial of service due to improper neutralization of special elements used in an SQL com...	7.8 High	—	0,30%	12 Agt 2026
CVE-2026-17276 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to escalate privileges due to improper authorization in the handling of high-authority threads.	9.9 Critical	—	0,47%	12 Agt 2026
CVE-2026-17271 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper validation of input size.	7.5 High	—	0,55%	12 Agt 2026
CVE-2026-17268 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of a session token.	6.8 Medium	—	0,34%	12 Agt 2026
CVE-2026-17266 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted director...	6.5 Medium	—	0,66%	12 Agt 2026
CVE-2026-17248 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of special elements in an OS command.	6.5 Medium	—	0,47%	12 Agt 2026
CVE-2026-17222 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify data in certain SQL tables due to improper neutralization of special elements used in a...	4.3 Medium	—	0,35%	12 Agt 2026
CVE-2026-17218 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.	9.8 Critical	—	0,80%	12 Agt 2026
CVE-2026-17110 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands and obtain sensitive information due to improper privilege manageme...	8.8 High	—	0,75%	12 Agt 2026
CVE-2026-17109 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to add unexpected parameters to a command due to parameter injection.	4.3 Medium	—	0,45%	12 Agt 2026
CVE-2026-16956 ibm db2 mirror for i IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS comman...	9.8 Critical	—	0,86%	12 Agt 2026
CVE-2026-16931 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper handling of zero-length TCP options.	7.5 High	—	0,55%	12 Agt 2026
CVE-2026-16907 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to improper bounds checking.	7.6 High	—	0,58%	12 Agt 2026
CVE-2026-16906 ibm i IBM i 7.6, and 7.5 could allow a remote authenticated attacker to execute arbitrary commands with elevated privileges due to improper neutralization of special elements u...	8.8 High	—	0,79%	12 Agt 2026
CVE-2026-16904 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper privilege management during monitor owner reassignm...	8.1 High	—	0,52%	12 Agt 2026
CVE-2026-16863 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read.	7.7 High	—	0,47%	12 Agt 2026
CVE-2026-16860 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an uncontrolled search path element.	9.9 Critical	—	0,75%	12 Agt 2026
CVE-2026-16856 ibm i IBM i 7.6, and 7.5 could allow a local attacker to gain elevated privileges due to improper neutralization of special elements used in an OS command.	8.8 High	—	0,50%	12 Agt 2026
CVE-2026-16627 gitlab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with...	9.0 Critical	—	0,48%	12 Agt 2026
CVE-2026-15423 gitlab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions co...	8.5 High	—	0,40%	12 Agt 2026
CVE-2026-73297 Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, _is_blocked_ip in ufo/utils/url_security.py did not block NAT...	6.9 Medium	—	2,9%	12 Agt 2026
CVE-2026-73296 Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, create_mobile_data_collection_server and create_mobile_action...	9.4 Critical	—	3,7%	12 Agt 2026
CVE-2026-73295 Material for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2.0 until 9.7.7, the mountSearchSuggest function in src/templates/assets/javascri...	5.4 Medium	—	0,33%	12 Agt 2026
CVE-2026-73240 apache allura Specifically crafted inputs may lead to git argument injection in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to ve...	9.8 Critical	—	1,0%	12 Agt 2026
CVE-2026-73239 apache allura Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura. This issue affects Apache Allura: before 1.19.1....	6.5 Medium	—	0,62%	12 Agt 2026
CVE-2026-73238 apache allura XSS vulnerability in code display in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the...	6.1 Medium	—	0,79%	12 Agt 2026
CVE-2026-73237 apache allura XSS vulnerability in Markdown handling in Apache Allura. This issue affects Apache Allura: from 1.10.0 before 1.19.1. Users are recommended to upgrade to version 1.19.1...	6.1 Medium	—	0,79%	12 Agt 2026
CVE-2026-48554 Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via unfiltered NOTIFICATION-family macro substitution throug...	7.5 High	—	0,97%	12 Agt 2026
CVE-2026-48553 Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 are vulnerable to authenticated remote code execution via custom-variable macro injection through the Nagios Remot...	7.5 High	—	0,97%	12 Agt 2026
CVE-2026-48552 Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to DOM-based cross-site scripting in jsonquery.js. Unencoded JSON string values reflected from stor...	5.4 Medium	—	0,29%	12 Agt 2026
CVE-2026-48551 Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An attacker can s...	7.4 High	—	0,26%	12 Agt 2026
CVE-2026-48550 Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to reflected cross-site scripting in cmd.cgi via the NagFormId parameter. An unauthenticated remote...	6.1 Medium	—	0,44%	12 Agt 2026
CVE-2026-18847 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to harvest credentials due to spoofing of Navigator for i.	9.8 Critical	—	0,25%	12 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.