Katalog CVE (hal. 803)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.205 (Critical 36.640 · High 106.361 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 1 Nov 2026, 12:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 40.101–40.150 dari 266.205 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-61515 Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vulnerability that allows remote attackers to execute arbitrary operating...	9.8 Critical	—	2,4%	4 Agt 2026
CVE-2026-61514 Puwell IP Camera firmware versions 2.x through 4.x contains an authentication bypass vulnerability that allows unauthenticated attackers to access device functions by sen...	9.8 Critical	—	0,83%	4 Agt 2026
CVE-2026-18770 A vulnerability has been found in vibesurf-ai VibeSurf up to cd6e519d507cdd4d63061300bf60fb176e1f57e0. Impacted is an unknown function of the file /code of the component...	7.3 High	—	0,37%	4 Agt 2026
CVE-2026-18766 A flaw has been found in chetans9 core-php-admin-panel up to 90d07ed5aac5e0f09b6a5828d7bb2eb83010763f. This issue affects some unknown processing of the file /Application...	6.3 Medium	—	0,32%	4 Agt 2026
CVE-2026-18650 Missing Authorization vulnerability in HAVELSAN Inc. Liman MYS allows Privilege Escalation. This issue affects Liman MYS: from 2.2.3 before 2.3.1.	8.8 High	—	0,42%	4 Agt 2026
CVE-2026-18401 The non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters). A...	6.9 Medium	—	0,41%	4 Agt 2026
CVE-2026-11368 zephyrproject zephyr The Bluetooth host ATT layer (subsys/bluetooth/host/att.c) associates each in-flight ATT TX buffer with its owning channel via the static tx_meta_data_storage[] array (da...	6.5 Medium	—	0,30%	4 Agt 2026
CVE-2026-70368 A stack-based out-of-bounds read vulnerability exists in the "s_vlog" function of stunnel, when handling oversized log messages via "vsnprintf". A remote attacker with ne...	6.5 Medium	—	0,35%	4 Agt 2026
CVE-2026-70367 A Server-Side Request Forgery (SSRF) bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass inte...	5.4 Medium	—	0,16%	4 Agt 2026
CVE-2026-17070 Missing Authorization vulnerability in HAVELSAN Inc. Liman MYS allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Liman MYS: from 2.2.3...	8.8 High	—	0,42%	4 Agt 2026
CVE-2026-14337 Pega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged...	4.6 Medium	—	0,42%	4 Agt 2026
CVE-2026-70373 Koha's reports/issues_stats.pl (the circulation statistics report) builds its calculation query in sub calculate by concatenating several user-controlled request paramete...	8.8 High	—	0,57%	4 Agt 2026
CVE-2026-70372 Koha's reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. An authen...	8.8 High	—	0,57%	4 Agt 2026
CVE-2026-70371 Koha's reports/issues_avg_stats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Lin...	8.8 High	—	0,57%	4 Agt 2026
CVE-2026-70370 Koha's reports/catalogue_stats.pl builds dynamic SQL in sub calculate by interpolating the user-controlled Line and Column request parameters directly into identifier pos...	8.8 High	—	0,57%	4 Agt 2026
CVE-2026-70369 Koha's reports/acquisitions_stats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WH...	8.8 High	—	0,57%	4 Agt 2026
CVE-2026-63252 eclipse milo In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel disconnects, allowing a remote...	7.5 High	—	0,58%	4 Agt 2026
CVE-2026-63248 eclipse milo In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An anonymous client can enable diagnostics over a None/...	6.5 Medium	—	0,26%	4 Agt 2026
CVE-2026-62927 eclipse milo In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an...	7.5 High	—	0,42%	4 Agt 2026
CVE-2026-61387 eclipse milo In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global res...	7.5 High	—	0,62%	4 Agt 2026
CVE-2026-60007 eclipse milo In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failur...	7.4 High	—	0,55%	4 Agt 2026
CVE-2026-58080 eclipse milo In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleMapper`. On servers that rely on role permissions and constru...	8.2 High	—	0,38%	4 Agt 2026
CVE-2026-18809 Information disclosure in Firefox for Android and Firefox Focus for Android. This vulnerability was fixed in Firefox 153.0.3.	6.5 Medium	—	0,36%	4 Agt 2026
CVE-2026-18806 External control of file name or path vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-image-writer allows Removing Important Client Functi...	7.1 High	—	0,15%	4 Agt 2026
CVE-2026-10710 autodesk fbx software development kit A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::ExtractDrive. A malicious actor c...	7.8 High	—	0,21%	4 Agt 2026
CVE-2026-10709 autodesk fbx software development kit A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::FbxIO::BinaryReadSectionHeader. A...	7.8 High	—	0,21%	4 Agt 2026
CVE-2026-66884 Cross-Site Request Forgery vulnerability in Erlang Ecosystem Foundation oidcc_plug (Oidcc.Plug.AuthorizationCallback module) allows an attacker to make a victim's browser...	2.1 Low	—	0,26%	4 Agt 2026
CVE-2026-66883 Improper Handling of Case Sensitivity vulnerability in Erlang Ecosystem Foundation oidcc_plug (Oidcc.Plug.Authorize module) renders the user agent session binding inert,...	6.3 Medium	—	0,37%	4 Agt 2026
CVE-2026-10050 eclipse jetty In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for...	9.1 Critical	—	0,63%	4 Agt 2026
CVE-2026-18772 samsung rlottie Improperly controlled sequential memory allocation vulnerability in Samsung Open Source rlottie allows Exponential Data Expansion.	6.5 Medium	—	0,36%	4 Agt 2026
CVE-2026-15721 Cleartext storage of sensitive information vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows SQL Injection. This i...	9.8 Critical	—	0,29%	4 Agt 2026
CVE-2026-14838 Use of GET request method with sensitive query strings vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Session Hi...	7.4 High	—	0,34%	4 Agt 2026
CVE-2026-14804 Use of hard-coded cryptographic key vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Read Sensitive Constants With...	9.1 Critical	—	0,40%	4 Agt 2026
CVE-2026-14465 Insufficient session expiration vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Reusing Session IDs (aka Session...	6.5 Medium	—	0,35%	4 Agt 2026
CVE-2026-14219 URL redirection to untrusted site ('open redirect') vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Phishing. Th...	5.4 Medium	—	0,21%	4 Agt 2026
CVE-2026-14202 Observable response discrepancy vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Account Footprinting. This issue...	5.3 Medium	—	0,33%	4 Agt 2026
CVE-2026-14194 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Res...	6.5 Medium	—	0,44%	4 Agt 2026
CVE-2026-14192 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Hum...	5.4 Medium	—	0,23%	4 Agt 2026
CVE-2026-14175 Unrestricted upload of file with dangerous type vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Upload a Web Shel...	9.8 Critical	—	0,52%	4 Agt 2026
CVE-2026-67243 freo2 provided by refirio contains an unrestricted upload of file with dangerous type vulnerability. A user with the highest-level administrative privileges for the produ...	8.6 High	—	0,54%	4 Agt 2026
CVE-2026-18759 The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication (IPC) mechanism protected by AES encryption. Beca...	8.5 High	—	0,17%	4 Agt 2026
CVE-2026-18755 A DLL hijacking vulnerability in GeoVision GV-ASManager allows a local attacker with write access to an unsafe search directory to execute arbitrary code. By placing a cr...	7.3 High	—	0,19%	4 Agt 2026
CVE-2026-18754 The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious a...	9.1 Critical	—	0,44%	4 Agt 2026
CVE-2026-18753 The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious a...	9.1 Critical	—	0,44%	4 Agt 2026
CVE-2026-64564 In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() caches the tr...	9.8 Critical	—	1,4%	4 Agt 2026
CVE-2026-64563 In the Linux kernel, the following vulnerability has been resolved: rhashtable: clear stale iter->p on table restart rhashtable_walk_start_check() has two restart paths...	7.8 High	—	0,17%	4 Agt 2026
CVE-2026-64562 In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Hide shadow VMCS right after VMCLEAR free_nested() frees the shadow VMCS while vmcs01 sti...	8.8 High	—	0,16%	4 Agt 2026
CVE-2026-64561 Advisory In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Check for invalid/obsolete root after making MMU pages available Check for a "stale" pag...	8.8 High	—	0,27%	4 Agt 2026
CVE-2026-16623 The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite su...	8.0 High	—	0,46%	4 Agt 2026
CVE-2026-16618 The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-su...	9.8 Critical	—	0,83%	4 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.