Katalog CVE (hal. 763)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.139 (Critical 36.631 · High 106.324 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 31 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 38.101–38.150 dari 266.139 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-66774 sap approuter SAP Approuter does not consistently handle certain error conditions. An attacker with low privileges could exploit this under a non-default configuration. Successful expl...	3.7 Low	—	0,35%	11 Agt 2026
CVE-2026-66773 A malicious or compromised OData service could disclose sensitive authentication information and inject untrusted data into the application, which may leads to a high imp...	5.9 Medium	—	0,31%	11 Agt 2026
CVE-2026-66772 SAP BusinessObjects Business Intelligence Platform (Admin Tools) does not perform sufficient authorization check on certain administrative functionality. An attacker aut...	4.3 Medium	—	0,31%	11 Agt 2026
CVE-2026-66771 SAPUI5 allows a key user with content adaptation privileges to inject malicious script content into persisted application changes. When another user subsequently opens th...	6.1 Medium	—	0,38%	11 Agt 2026
CVE-2026-66770 Due to an SQL Injection vulnerability in SAP Social intelligence, an authenticated attacker could directly inject an SQL DDL (Data Definition Language) string into the un...	6.3 Medium	—	0,27%	11 Agt 2026
CVE-2026-66764 Reprocess Bank Statement Items in SAP S/4HANA does not perform the necessary authorization checks for authenticated users, allowing them to use rules that have not been s...	4.3 Medium	—	0,28%	11 Agt 2026
CVE-2026-66763 SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key. An attacker wit...	7.9 High	—	0,20%	11 Agt 2026
CVE-2026-66761 sap approuter SAP Approuter does not enforce sufficient flow control in certain functionality. An attacker with low privileges could send high volumes of data without consuming respons...	4.3 Medium	—	0,38%	11 Agt 2026
CVE-2026-66760 sap approuter SAP Approuter does not correctly validate client certificates in certain callback flows. An attacker with low privileges, holding a certificate from the same trusted auth...	6.4 Medium	—	0,18%	11 Agt 2026
CVE-2026-58248 SAP BusinessObjects Business Intelligence Platform (Web Intelligence) allows a low-privileged attacker to upload a specially crafted spreadsheet file containing malicious...	6.5 Medium	—	0,44%	11 Agt 2026
CVE-2026-58247 SAP ABAP Platform allows an unauthenticated user to send a specially crafted request to an internal component. This could disclose limited, non-sensitive data from previo...	5.3 Medium	—	0,36%	11 Agt 2026
CVE-2026-58245 SAP Advanced Planning and Optimization (Model Mix Planning) contains a hardcoded credential within the source code of the application to perform authorization check to ac...	3.8 Low	—	0,29%	11 Agt 2026
CVE-2026-58244 SAP Manufacturing Integration and Intelligence (MII) does not perform necessary authorization check on certain application function, allowing a low-privileged authenticat...	4.3 Medium	—	0,28%	11 Agt 2026
CVE-2026-58243 SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthorized dat...	8.8 High	—	0,44%	11 Agt 2026
CVE-2026-58241 SAP NetWeaver and ABAP Platform (Change and Transport System - Customer Transport Integration Wizard) allows a low-privileged user to modify configuration tables that con...	4.2 Medium	—	0,25%	11 Agt 2026
CVE-2026-58239 sap approuter SAP Approuter does not sufficiently validate tenant context in inbound requests. An unauthenticated attacker could send specially crafted requests to spoof the tenant con...	3.7 Low	—	0,35%	11 Agt 2026
CVE-2026-58238 sap approuter SAP Approuter does not sufficiently handle certain requests under specific conditions. An unauthenticated attacker could send specially crafted input that causes the comp...	5.9 Medium	—	0,43%	11 Agt 2026
CVE-2026-58237 sap approuter WebSocket of SAP Approuter does not perform sufficient authorization checks in certain functionality. An attacker with low privileges could exploit this to access restric...	5.9 Medium	—	0,28%	11 Agt 2026
CVE-2026-58236 SAP NetWeaver Application Server ABAP and ABAP Platform allow an attacker with high privileges to bypass missing security controls on an internal code path leading to ope...	5.5 Medium	—	0,70%	11 Agt 2026
CVE-2026-58235 SAP NetWeaver Application Server Java (Adobe Document Service) uses outdated open source cryptographic and data transfer libraries that contain known vulnerabilities addr...	6.3 Medium	—	0,30%	11 Agt 2026
CVE-2026-58230 sap approuter SAP Approuter does not sufficiently validate certain token content under specific configurations. An unauthenticated attacker could send a specially crafted token to caus...	7.0 High	—	0,31%	11 Agt 2026
CVE-2026-44765 Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated remote attacker could access scheduling-related a...	7.3 High	—	0,38%	11 Agt 2026
CVE-2026-44764 Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated attacker could send crafted requests to the Cost...	7.3 High	—	0,32%	11 Agt 2026
CVE-2026-44763 SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain functions using specially crafted inpu...	7.6 High	—	0,40%	11 Agt 2026
CVE-2026-44762 SAP Data Services Management Console allows an overly permissive Content Security Policy (CSP) configuration and lacks certain restrictive directives, which could enable...	3.7 Low	—	0,19%	11 Agt 2026
CVE-2026-44758 SAP Manufacturing Integration and Intelligence (MII) allows an attacker with high privileges to submit specially crafted input to certain affected functionality, which is...	9.1 Critical	—	0,77%	11 Agt 2026
CVE-2026-40130 SAP SAPSPrint Service has memory corruption vulnerabilities in the handling of certain commands. An unauthenticated attacker could send specially crafted requests that tr...	5.3 Medium	—	0,47%	11 Agt 2026
CVE-2026-34265 SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting in memory corruption. This vulnerab...	9.8 Critical	—	0,64%	11 Agt 2026
CVE-2026-8718 tls_opt_dtls_peer_connection_id_value_get() in subsys/net/lib/sockets/sockets_tls.c, which handles getsockopt(SOL_TLS, TLS_DTLS_PEER_CID_VALUE), passed the caller-supplie...	8.4 High	—	0,17%	10 Agt 2026
CVE-2026-48161 react18-use is a React 19 use hook shim. Between 2026-05-19 01:07:01 and 2026-05-19 15:20:43, the default branch contained malicious commits 7b79148d1495a2505f9277da295a9...	9.3 Critical	—	0,67%	10 Agt 2026
CVE-2026-11812 The UpdateHub management subsystem (subsys/mgmt/updatehub/updatehub.c) drives every update operation through a single file-scope ctx structure that holds the CoAP block c...	2.5 Low	—	0,10%	10 Agt 2026
CVE-2026-11811 The UpdateHub over-the-air update client's start_coap_client() in subsys/mgmt/updatehub/updatehub.c leaks the CoAP/DTLS socket descriptor on its connection-setup failure...	3.7 Low	—	0,41%	10 Agt 2026
CVE-2025-30241 Certain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before passing it to system-level command ex...	8.6 High	—	0,41%	10 Agt 2026
CVE-2025-30240 The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage devices. By placing a crafted symbolic link on supported stora...	5.1 Medium	—	0,23%	10 Agt 2026
CVE-2025-30239 In affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive configuration data may allow an attacker who has acc...	8.5 High	—	0,20%	10 Agt 2026
CVE-2025-30238 In affected TP-Link Aginet devices, insufficient authorization validation allows authenticated low-privileged users to execute higher-privileged operations. An attac...	8.6 High	—	0,20%	10 Agt 2026
CVE-2025-30237 The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced on certain endpoints. An atta...	8.7 High	—	0,33%	10 Agt 2026
CVE-2026-72919 Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1, the channels.con...	4.3 Medium	—	0,33%	10 Agt 2026
CVE-2026-72918 Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1, the stream-notif...	5.4 Medium	—	0,23%	10 Agt 2026
CVE-2026-72917 AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenti...	5.9 Medium	—	0,35%	10 Agt 2026
CVE-2026-72916 Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, PrivateAddressCheck.private_address? in app/...	6.3 Medium	—	0,59%	10 Agt 2026
CVE-2026-72915 Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use the show ac...	7.5 High	—	0,48%	10 Agt 2026
CVE-2026-72914 Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints hand...	7.5 High	—	0,83%	10 Agt 2026
CVE-2026-6426 A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64_t but read by the VMS_VBUFF...	4.4 Medium	—	0,39%	10 Agt 2026
CVE-2025-32736 Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actions via spec...	4.9 Medium	—	0,22%	10 Agt 2026
CVE-2026-73035 npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitrary terminal...	4.3 Medium	—	0,37%	10 Agt 2026
CVE-2026-73033 Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmission() method in src/integrity.lib.php that allow...	6.5 Medium	—	0,93%	10 Agt 2026
CVE-2026-73030 unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_directory function that fails to normalize paths before validati...	8.1 High	—	0,59%	10 Agt 2026
CVE-2026-72913 Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shel...	7.3 High	—	0,21%	10 Agt 2026
CVE-2026-72912 CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-recipe parser in src/core/Utils.mjs can exhaust clien...	4.3 Medium	—	0,32%	10 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.