Katalog CVE (hal. 822)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.229 (Critical 36.653 · High 106.363 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 2 Nov 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 41.051–41.100 dari 266.229 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-53431 Authentication Bypass by Capture-replay vulnerability in malach-it Boruta allows an attacker who has obtained a previously valid JWT client assertion to authenticate as t...	9.1 Critical	—	0,51%	30 Jul 2026
CVE-2026-41187 tigera calico Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy,...	6.5 Medium	—	0,39%	30 Jul 2026
CVE-2026-41186 tigera calico When Calico's shared debug server is enabled (disabled by default), the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 with...	7.5 High	—	0,67%	30 Jul 2026
CVE-2026-16308 IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of service due to un...	7.5 High	—	0,55%	30 Jul 2026
CVE-2026-15435 ibm app connect enterprise IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to traverse directories on the system. An attacker cou...	9.8 Critical	—	0,73%	30 Jul 2026
CVE-2026-14980 ibm websphere application server IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF attacks wit...	8.8 High	—	0,43%	30 Jul 2026
CVE-2026-14522 ibm app connect enterprise IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to execute arbitrary commands due to improper neutrali...	9.8 Critical	—	1,0%	30 Jul 2026
CVE-2026-14519 ibm app connect enterprise IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to read arbitrary files due to a path traversal vulner...	7.5 High	—	0,62%	30 Jul 2026
CVE-2026-12947 ibm app connect enterprise IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 stores potentially sensitive information in log files that could be read by a local...	7.5 High	—	0,40%	30 Jul 2026
CVE-2026-11980 ibm aspera IBM Aspera Desktop App 1.0.5 through 1.0.19 can allow arbitrary code execution by loading DLL files at start-up.	7.3 High	—	0,17%	30 Jul 2026
CVE-2026-11897 ibm websphere application server IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacke...	7.5 High	—	0,53%	30 Jul 2026
CVE-2026-11707 ibm websphere application server, ibm tivoli system automation application manager IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by a cross-site scripting vulnerability in the administrative consol...	9.3 Critical	—	0,38%	30 Jul 2026
CVE-2026-11383 ibm websphere application server, ibm tivoli system automation application manager IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by cross-site scripting in the Administrative Console.	5.4 Medium	—	0,23%	30 Jul 2026
CVE-2025-36431 ibm sterling b2b integrator, ibm sterling file gateway IBM Sterling B2B Integrator 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.2.0 through 6.2.2.0_1 is vulnerable to cross-site scripting. This vulnerability al...	5.4 Medium	—	0,23%	30 Jul 2026
CVE-2025-36298 ibm sterling b2b integrator, ibm sterling file gateway IBM Sterling B2B Integrator 6.1.2.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6...	5.4 Medium	—	0,23%	30 Jul 2026
CVE-2026-67351 Serendipity before 2.6.1 contains an authentication context confusion vulnerability where password validation and session loading operate independently without ensuring b...	8.8 High	—	0,56%	30 Jul 2026
CVE-2026-60075 Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time. _parse_time removes a time...	7.5 High	—	0,37%	30 Jul 2026
CVE-2026-60074 Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check. The parse regexes capture year...	7.5 High	—	0,63%	30 Jul 2026
CVE-2026-5219 Cross-Site request forgery (CSRF) vulnerability in Softtr Information Technology Trade Ltd. Co. E-Commerce Pack allows Cross Site Request Forgery. This issue affects E-C...	8.3 High	—	0,18%	30 Jul 2026
CVE-2026-58218 A flaw was found in Samba's internal DNS server where unauthenticated TKEY registration requests were added to the TKEY name cache before being rejected. A remote, unauth...	5.3 Medium	—	0,78%	30 Jul 2026
CVE-2026-57859 e107 prior to version 2.3.8 contains a code execution vulnerability in the e_array deserialization handler that allows an attacker with out-of-band database write access...	7.5 High	—	0,51%	30 Jul 2026
CVE-2026-56428 The SSH service on BSH ELP (Electronic Platform) modules contains a platform-specific vulnerability due to an improperly secured default configuration. An insecure, non-r...	8.1 High	—	0,48%	30 Jul 2026
CVE-2026-41709 vmware esxi VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.	2.7 Low	KEV	0,69%	30 Jul 2026
CVE-2026-12722 Missing authentication for critical function vulnerability in FTC Software IT Services FTC E-Commerce Management Panel allows Authentication Bypass. This issue affects F...	8.2 High	—	0,44%	30 Jul 2026
CVE-2026-59310 Advisory vmware vcenter server VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbit...	9.8 Critical	KEV · ransomware	2,6%	30 Jul 2026
CVE-2026-59309 vmware vcenter server VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to...	9.8 Critical	—	0,61%	30 Jul 2026
CVE-2026-54368 CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchExUnder() that allows authenticated attackers to execute arbitrary SQL...	8.8 High	—	0,71%	30 Jul 2026
CVE-2026-54367 CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to read, write, or delete arbitrary account settings by expl...	8.6 High	—	0,32%	30 Jul 2026
CVE-2026-54366 CentreStack before 17.4 contains an XML external entity (XXE) injection vulnerability that allows unauthenticated attackers to exfiltrate arbitrary files by supplying a m...	7.5 High	—	0,49%	30 Jul 2026
CVE-2026-54365 CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll that allows unauthenticated attackers to create arbitrary local OS us...	7.5 High	—	0,37%	30 Jul 2026
CVE-2026-54364 CentreStack before 17.4 contains a session variable injection vulnerability that allows unauthenticated attackers to inject arbitrary session variables by embedding newli...	6.5 Medium	—	0,43%	30 Jul 2026
CVE-2026-54363 CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unauthenticated attackers to forge arbitrary encrypted tokens by exploiting a sta...	9.1 Critical	—	0,69%	30 Jul 2026
CVE-2026-47876 VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machi...	9.3 Critical	—	0,19%	30 Jul 2026
CVE-2026-41703 VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor with VM deployment privileges could trigger an out-of-bounds read, pote...	7.6 High	—	0,43%	30 Jul 2026
CVE-2026-7260 php Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* before 8.2.33,...	5.5 Medium	—	0,11%	30 Jul 2026
CVE-2026-5582 The FuseWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.24.2. This is due to missing nonce verification on t...	4.3 Medium	—	0,20%	30 Jul 2026
CVE-2026-18382 redhat cost management metrics operator A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary OAuth toke...	6.8 Medium	—	0,52%	30 Jul 2026
CVE-2026-18381 redhat cost management metrics operator A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to speci...	7.6 High	—	0,38%	30 Jul 2026
CVE-2026-18378 redhat cost management metrics operator A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary upload URL....	6.8 Medium	—	0,47%	30 Jul 2026
CVE-2026-17544 php Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8....	9.8 Critical	—	0,42%	30 Jul 2026
CVE-2026-17543 php Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33,...	9.8 Critical	—	0,33%	30 Jul 2026
CVE-2026-15397 The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to the plugin not p...	7.2 High	—	0,58%	30 Jul 2026
CVE-2026-22622 Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could allow an authenticated user to elevate privileges re...	8.8 High	—	0,55%	30 Jul 2026
CVE-2026-22621 Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PADM firmware could allow an authenticated administrator to execute arbi...	8.3 High	—	0,58%	30 Jul 2026
CVE-2026-22620 Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow an unauthenticated remote attacker to bypass authenticati...	8.6 High	—	0,66%	30 Jul 2026
CVE-2026-18369 A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without va...	5.8 Medium	—	0,38%	30 Jul 2026
CVE-2026-18363 A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. During the password reset process,...	9.1 Critical	—	0,48%	30 Jul 2026
CVE-2026-18362 The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks.	5.9 Medium	—	0,37%	30 Jul 2026
CVE-2026-18361 The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the datastore upload function.	7.6 High	—	0,21%	30 Jul 2026
CVE-2026-18360 The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the custom attributes function.	7.6 High	—	0,28%	30 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.