Katalog CVE (hal. 757)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.065 (Critical 36.624 · High 106.293 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 31 Okt 2026, 12:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 37.801–37.850 dari 266.065 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2025-48505 Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to achieve privileged escalation, potentially resulti...	1.0 Low	—	0,15%	11 Agt 2026
CVE-2025-35987 Omission of security-relevant information for some Intel(R) Software Guard Extensions Data Center Attestation Primitives within Ring 0: Kernel may allow a denial of servi...	4.3 Medium	—	0,13%	11 Agt 2026
CVE-2025-35973 Improper handling of values for some Intel(R) Processors within Ring 0: Kernel, Hypervisor and Bare Metal OS may allow an escalation of privilege. Authorized adversary wi...	4.5 Medium	—	0,10%	11 Agt 2026
CVE-2025-31938 Insufficient granularity of access control in some subsystem for some Intel(R) Xeon(R) 6 Scalable processors with Intel(R) TDX may allow an information disclosure. Author...	4.3 Medium	—	0,09%	11 Agt 2026
CVE-2025-31936 intel xeon 6337p firmware, intel xeon 6349p firmware +58 lainnya Improper handling of overlap between protected memory ranges for some Intel(R) Xeon(R) 6 processors when using Intel(R) TDX within SMM may allow an escalation of privileg...	5.7 Medium	—	0,10%	11 Agt 2026
CVE-2025-31356 Insufficient verification of data authenticity for some Intel(R) Trust Domain Extensions (Intel(R) TDX) within Ring 0: Hypervisor may allow an information disclosure. A s...	5.7 Medium	—	0,07%	11 Agt 2026
CVE-2025-0041 Uncontrolled search paths in the Vitis™ Embedded Single File Download (SFD) for local Windows installation could allow a low-privileged user to create arbitrary code exec...	4.6 Medium	—	0,18%	11 Agt 2026
CVE-2026-9214 netgear r7000 firmware Insufficient input validation vulnerability in the NETGEAR R7000 models allows authenticated administrators connected to the local network to make unauthorized modifica...	4.5 Medium	—	0,23%	11 Agt 2026
CVE-2026-73080 SeaweedFS is a distributed storage system. Prior to 4.24, VolumeServer.FetchAndWriteNeedle in weed/server/volume_grpc_remote.go fetches a caller-supplied remote endpoint...	9.3 Critical	—	0,53%	11 Agt 2026
CVE-2026-73079 Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. From 0.1.135, to 0.1.168, platform API keys issued to te...	8.5 High	—	0,39%	11 Agt 2026
CVE-2026-73078 vim Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim construc...	8.8 High	—	0,31%	11 Agt 2026
CVE-2026-73077 vim Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins p...	7.8 High	—	0,14%	11 Agt 2026
CVE-2026-73076 vim Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the ins...	7.8 High	—	0,13%	11 Agt 2026
CVE-2026-73075 vim Vim is an open source, command line text editor. From 9.2.0469 until 9.2.0843, popup_mark_opacity_zindex() in src/popupwin.c can use a negative w_winrow for a text-proper...	3.9 Low	—	0,09%	11 Agt 2026
CVE-2026-73074 vim Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t...	6.7 Medium	—	0,10%	11 Agt 2026
CVE-2026-73072 vim Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(),...	7.3 High	—	0,12%	11 Agt 2026
CVE-2026-73071 vim Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invo...	3.3 Low	—	0,11%	11 Agt 2026
CVE-2026-73070 vim Vim is an open source, command line text editor. Prior to 9.2.0842, the socket server backend in src/socketserver.c accepts unbounded client connections in socketserver_a...	5.5 Medium	—	0,19%	11 Agt 2026
CVE-2026-73069 Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.15.0, Twenty allowed a workspace administrator with the DATA_MODEL permission to supp...	9.1 Critical	—	0,66%	11 Agt 2026
CVE-2026-73068 ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.207, the ToolJet Database HT...	5.9 Medium	—	0,27%	11 Agt 2026
CVE-2026-6727 A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with access to the TPM command interface may be able to...	5.9 Medium	—	0,15%	11 Agt 2026
CVE-2026-6726 An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from...	7.9 High	—	0,19%	11 Agt 2026
CVE-2026-67180 Google Turbinia allows arbitrary command execution via worker tasks. An attacker with privileges to submit a processing request or influence an evidence path/name obtains...	8.4 High	—	0,23%	11 Agt 2026
CVE-2026-67179 Genkit does not properly validate host request headers. Any host on the developer's network, and any website the developer visits (via DNS rebinding), can reach POST /api...	7.8 High	—	0,21%	11 Agt 2026
CVE-2026-56721 CamaleonCMS version 2.9.2 and earlier contains a privilege escalation vulnerability via insecure direct object reference (IDOR) that allows authenticated low-privileged a...	8.8 High	—	0,52%	11 Agt 2026
CVE-2026-56720 CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that allows any authenticated user to access any other...	4.3 Medium	—	0,34%	11 Agt 2026
CVE-2026-53416 Path traversal in Zoom VDI Client and Plugins may allow an authenticated user to conduct information disclosure via local access.	7.1 High	—	0,21%	11 Agt 2026
CVE-2026-53415 Use after Free in the annotator function of Zoom Clients may allow a meeting participant to achieve remote code execution of another participant via network access.	8.3 High	—	0,49%	11 Agt 2026
CVE-2026-53414 Missing bounds check in the annotator function of Zoom Clients allows buffer over-read, which may allow a meeting participant to conduct a denial of service on another pa...	6.5 Medium	—	0,36%	11 Agt 2026
CVE-2026-53413 Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a meeting participant to achieve remote code execution of another...	8.3 High	—	0,49%	11 Agt 2026
CVE-2026-48766 TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to exfiltrate stored OpenAI-compatible API keys by invoking...	7.6 High	—	0,43%	11 Agt 2026
CVE-2026-48495 TypeBot is a chatbot builder tool. Prior to version 3.17.0, the Google Sheets OAuth callback decodes a base64-encoded JSON `state` parameter and trusts the embedded `work...	7.1 High	—	0,35%	11 Agt 2026
CVE-2026-42142 TypeBot is a chatbot builder tool. Prior to version 3.17.0, the `handleGetSheets` API handler (`POST /api/sheets/getSheets`) does not validate workspace membership, allow...	7.1 High	—	0,37%	11 Agt 2026
CVE-2026-19546 A flaw was found in DBI. This is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.z. For a detailed Statement, Description and Mitigation please reffer...	8.8 High	—	0,35%	11 Agt 2026
CVE-2026-19078 A flaw was found in the oauth-server component. This open redirect vulnerability occurs when the 'then' parameter in the grant approval handler is not properly validated....	4.3 Medium	—	0,36%	11 Agt 2026
CVE-2026-18640 The NewNotebook API does not sufficiently sanitize its parameters allowing an authenticated user with NOTEBOOK_EDIT permission to write the notebook record outside the or...	7.1 High	—	0,43%	11 Agt 2026
CVE-2026-18639 When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim with...	7.3 High	—	0,39%	11 Agt 2026
CVE-2026-18638 Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword wi...	6.5 Medium	—	0,41%	11 Agt 2026
CVE-2026-14180 A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs be...	5.3 Medium	—	1,0%	11 Agt 2026
CVE-2026-11814 netgear be9300 firmware, netgear mr60 firmware +24 lainnya A command injection vulnerability in the listed NETGEAR models allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker...	6.8 Medium	—	2,2%	11 Agt 2026
CVE-2026-11739 netgear ms90 firmware, netgear rax20 firmware +25 lainnya A command injection vulnerability in certain affected NETGEAR Nighthawk devices allows a network-adjacent attacker with the ability to intercept and modify local networ...	6.4 Medium	—	2,6%	11 Agt 2026
CVE-2026-11738 netgear be9300 firmware, netgear mr60 firmware +24 lainnya Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modificat...	4.4 Medium	—	0,40%	11 Agt 2026
CVE-2026-11737 netgear rax20 firmware, netgear rax41 firmware +11 lainnya Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modific...	4.5 Medium	—	0,33%	11 Agt 2026
CVE-2026-11736 netgear rax20 firmware, netgear rax35v2 firmware +17 lainnya A stack-based buffer overflow vulnerability affects certain NETGEAR models allowing an authenticated admin user to make unauthorized modification to router software and f...	4.9 Medium	—	0,77%	11 Agt 2026
CVE-2026-11735 netgear r7000 firmware, netgear rax20 firmware +18 lainnya A stack-based buffer overflow vulnerability affects the listed NETGEAR models allowing an authenticated admin user to make unauthorized modification to the router's softw...	4.9 Medium	—	0,77%	11 Agt 2026
CVE-2026-11734 netgear mr70 firmware, netgear mr90 firmware +13 lainnya A buffer overflow vulnerability in the listed NETGEAR models allows an authenticated admin user to cause the affected device to become temporarily unavailable.	2.7 Low	—	0,89%	11 Agt 2026
CVE-2026-11733 netgear rax41 firmware, netgear rax41v2 firmware +9 lainnya A buffer overflow vulnerability in the listed NETGEAR models allows a device administrator to temporarily interrupt the normal operation of the affected device.	4.9 Medium	—	0,78%	11 Agt 2026
CVE-2025-31114 Fooocus is an image generating software. In versions 2.5.5 and prior, the Fooocus web UI is vulnerable to remote code execution due to the unsafe use of eval when process...	9.3 Critical	—	0,88%	11 Agt 2026
CVE-2026-73067 Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata model loaded through TessBaseAPI::Init can cause SquishedDawg::read_squished_dawg in src/di...	6.7 Medium	—	0,13%	11 Agt 2026
CVE-2026-73066 Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata LSTM model component loaded through Tesseract's deserializer can cause an unchecked signed...	6.8 Medium	—	0,13%	11 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.