Katalog CVE (hal. 739)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.042 (Critical 36.621 · High 106.282 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 31 Okt 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 36.901–36.950 dari 266.042 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-18683 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to privilege escalation via Navigator for i. An authenticated user could elevate privileges to a root user to execute commands.	8.8 High	—	0,67%	12 Agt 2026
CVE-2026-18499 ibm websphere application server IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege escalation when using Liberty collectives.	8.1 High	—	0,42%	12 Agt 2026
CVE-2026-18246 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to an interpretation conflict in the multipart parser.	4.3 Medium	—	0,32%	12 Agt 2026
CVE-2026-18144 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization.	4.3 Medium	—	0,32%	12 Agt 2026
CVE-2026-18106 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied path input.	4.3 Medium	—	0,50%	12 Agt 2026
CVE-2026-18098 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and compromise system integrity due to an XML injection flaw.	8.1 High	—	0,25%	12 Agt 2026
CVE-2026-17095 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to unsafe reflection.	8.3 High	—	0,54%	12 Agt 2026
CVE-2026-17094 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and manipulate files due to a path traversal vulnerability.	7.1 High	—	0,54%	12 Agt 2026
CVE-2026-16694 ibm i IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web U...	5.4 Medium	—	0,23%	12 Agt 2026
CVE-2026-73325 Fujitsu Research's OneCompression library before 1.2.1 contains an unsafe deserialization vulnerability that allows attackers to execute arbitrary code by supplying a cra...	7.8 High	—	0,40%	12 Agt 2026
CVE-2026-73294 Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository git_url handling passes an attacker-controlled --upload-pack opti...	9.9 Critical	—	0,65%	12 Agt 2026
CVE-2026-73293 Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug...	8.8 High	—	0,57%	12 Agt 2026
CVE-2026-73292 Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/{id}/password endpoint accepts a cross-site request using the authenticated us...	8.3 High	—	0,23%	12 Agt 2026
CVE-2026-70547 jfrog artifactory An authenticated user without repository read permission may access package metadata under specific conditions.	4.3 Medium	—	0,28%	12 Agt 2026
CVE-2026-69107 jfrog artifactory An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions.	5.9 Medium	—	0,41%	12 Agt 2026
CVE-2026-69105 jfrog artifactory An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availability.	8.1 High	—	0,22%	12 Agt 2026
CVE-2026-68971 apache airflow Apache Airflow's asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materialize`) and the XCom result check on `wait_dag_run_until_finished` authorized the t...	6.5 Medium	—	0,33%	12 Agt 2026
CVE-2026-68970 apache airflow Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in th...	6.5 Medium	—	0,23%	12 Agt 2026
CVE-2026-68969 apache airflow Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they were submitted through the bulk endpoints (`PATCH /api/v2/var...	6.5 Medium	—	0,36%	12 Agt 2026
CVE-2026-68968 apache airflow Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backfill_id` path segment failed to parse. The authorization depe...	7.5 High	—	0,42%	12 Agt 2026
CVE-2026-68759 jfrog artifactory A holder of a valid integration credential may impersonate other users under specific conditions.	7.2 High	—	0,33%	12 Agt 2026
CVE-2026-68758 jfrog artifactory A low-privileged authenticated user may access restricted support information under specific conditions.	6.5 Medium	—	0,35%	12 Agt 2026
CVE-2026-68076 apache airflow Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran...	5.4 Medium	—	0,34%	12 Agt 2026
CVE-2026-67587 apache airflow Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Beca...	8.8 High	—	0,61%	12 Agt 2026
CVE-2026-67260 apache airflow Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swept by the scheduler. That sweep deserializes the task instan...	7.3 High	—	0,78%	12 Agt 2026
CVE-2026-66384 Advisory jfrog artifactory An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.	5.3 Medium	KEV	0,67%	12 Agt 2026
CVE-2026-66016 jfrog artifactory Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users.	6.7 Medium	—	0,12%	12 Agt 2026
CVE-2026-65941 progress whatsup gold In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the contex...	8.8 High	—	0,68%	12 Agt 2026
CVE-2026-65940 progress whatsup gold In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible location on the host server.	6.8 Medium	—	0,35%	12 Agt 2026
CVE-2026-65939 progress whatsup gold In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root.	6.8 Medium	—	0,38%	12 Agt 2026
CVE-2026-65938 progress whatsup gold In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API allows any authenticated user to invoke restricted...	4.3 Medium	—	0,25%	12 Agt 2026
CVE-2026-65937 progress whatsup gold In WhatsUp Gold versions released before 2026.0.2, an authenticated attacker can bypass frontend controls and inject persistent script content.	8.0 High	—	0,41%	12 Agt 2026
CVE-2026-65926 An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is k...	3.1 Low	—	0,24%	12 Agt 2026
CVE-2026-65017 apache airflow Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and expos...	6.5 Medium	—	0,39%	12 Agt 2026
CVE-2026-64639 Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user (customer, reseller) to execute arbitrary code on beh...	9.3 Critical	—	0,55%	12 Agt 2026
CVE-2026-59244 apache airflow Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an `isinstance(str)` gu...	6.5 Medium	—	0,23%	12 Agt 2026
CVE-2026-59242 apache airflow Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal payload through `BaseXCom.deserialize_value` without the `_c...	5.4 Medium	—	0,53%	12 Agt 2026
CVE-2026-58076 apache airflow Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken from the serialized blob and instantiating it with a...	8.8 High	—	0,48%	12 Agt 2026
CVE-2026-54183 apache airflow Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into v...	4.3 Medium	—	0,42%	12 Agt 2026
CVE-2026-19548 redhat hardened images, redhat openshift container platform +1 lainnya Multiple Use-After-Free vulnerabilities were found in the add_archive_element function in ld/ldmain.c of the GNU linker (ld), a component of binutils. The root cause is t...	5.5 Medium	—	0,17%	12 Agt 2026
CVE-2026-15803 In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity (XXE) processing when parsing untrusted XML-based RDF data or query results, p...	8.7 High	—	0,47%	12 Agt 2026
CVE-2026-73432 Vulnerability-Lookup contains a server-side request forgery (SSRF) vulnerability in the remote-instance synchronization functionality. Remote instance addresses were vali...	5.1 Medium	—	0,39%	12 Agt 2026
CVE-2026-73431 Vulnerability-Lookup contains an authentication weakness in its account activation and password-recovery mechanism. Activation and recovery links were generated using s...	8.8 High	—	0,35%	12 Agt 2026
CVE-2026-73405 An authorization bypass vulnerability in Vulnerability-Lookup allowed inactive or unconfirmed accounts to subscribe to Server-Sent Events (SSE) streams through the /pubsu...	5.3 Medium	—	0,50%	12 Agt 2026
CVE-2026-73374 A stored cross-site scripting (XSS) vulnerability existed in Vulnerability-Lookup in the render_tag_badges Jinja filter used to display reference tags associated with vul...	6.1 Medium	—	0,58%	12 Agt 2026
CVE-2026-73291 Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.4.0, Seerr's ImageProxy in server/lib/imageproxy.ts uses the...	7.1 High	—	0,39%	12 Agt 2026
CVE-2026-73290 RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, an anonymous ListObjectVersions request in rustfs/src/storage/access.rs that lacks a...	5.3 Medium	—	0,42%	12 Agt 2026
CVE-2026-73289 RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS evaluates the ForAllValues: and ForAnyValue: set qualifiers with the negated s...	8.1 High	—	0,41%	12 Agt 2026
CVE-2026-73288 RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-rc.1, RustFS Object Lock enforcement in crates/ecstore/src/bucket/object_lock/objectlock_sys.r...	6.1 Medium	—	0,39%	12 Agt 2026
CVE-2026-73287 RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS handles FTPS MKD in FtpsDriver::mkd in crates/protocols/src/ftps/driver.rs by...	5.4 Medium	—	0,37%	12 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.