Katalog CVE (hal. 834)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.261 (Critical 36.656 · High 106.368 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 2 Nov 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 41.651–41.700 dari 266.261 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-5056 GStreamer qtdemux Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected instal...	7.8 High	—	0,34%	29 Jul 2026
CVE-2026-4672 gitlab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions co...	4.3 Medium	—	0,39%	29 Jul 2026
CVE-2026-3093 gitlab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions co...	4.7 Medium	—	0,29%	29 Jul 2026
CVE-2026-18266 Dify AI Workflow oauth_redirect_url Open Redirect Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of...	5.4 Medium	—	0,29%	29 Jul 2026
CVE-2026-18022 pgvector project pgvector Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allows a database user to write data out-of-bounds, which could lead to arbitrary code execution. Only...	8.8 High	—	0,60%	29 Jul 2026
CVE-2026-16553 gitlab GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could...	5.4 Medium	—	0,34%	29 Jul 2026
CVE-2026-15975 gitlab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions co...	7.5 High	—	0,51%	29 Jul 2026
CVE-2026-15831 gitlab GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allowed an auth...	4.3 Medium	—	0,30%	29 Jul 2026
CVE-2026-15077 gitlab GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allowed an auth...	4.3 Medium	—	0,31%	29 Jul 2026
CVE-2026-14351 gitlab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions cou...	4.3 Medium	—	0,40%	29 Jul 2026
CVE-2026-14341 gitlab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions co...	4.9 Medium	—	0,53%	29 Jul 2026
CVE-2026-13268 G DATA Total Security Backup Service Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected...	7.8 High	—	0,20%	29 Jul 2026
CVE-2026-13113 gitlab GitLab has remediated an issue in GitLab EE affecting all versions from 17.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could...	5.3 Medium	—	0,26%	29 Jul 2026
CVE-2026-12436 gitlab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions co...	8.4 High	—	0,46%	29 Jul 2026
CVE-2026-12357 Heimdall Data Database Proxy generateFileContent CRLF Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code...	7.2 High	—	1,1%	29 Jul 2026
CVE-2025-14562 gitlab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions co...	3.1 Low	—	0,28%	29 Jul 2026
CVE-2026-67429 Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, image.download and related file-writing modules use caller-controlled output_di...	10.0 Critical	—	0,58%	29 Jul 2026
CVE-2026-67428 Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, HTTP-emitting modules including src/core/modules/third_party/developer/http/req...	8.5 High	—	0,41%	29 Jul 2026
CVE-2026-67427 Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workflow engine variable resolver expands ${env.VAR} for any host environme...	8.6 High	—	0,45%	29 Jul 2026
CVE-2026-67426 Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the standalone flyto-verification service in src/core/verification_service.py e...	9.3 Critical	—	0,37%	29 Jul 2026
CVE-2026-67425 Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, llm.chat reads provider keys such as OPENAI_API_KEY and ANTHROPIC_API_KEY from...	8.6 High	—	0,41%	29 Jul 2026
CVE-2026-67424 Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the HTTP modules http.get, http.request, and http.batch in src/core/modules/ato...	8.5 High	—	0,29%	29 Jul 2026
CVE-2026-67201 V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery (SSRF) bypass vulnerability that allows attackers to circumvent host-based allowlists by...	8.6 High	—	0,53%	29 Jul 2026
CVE-2026-62995 joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. in versions 1.7.1 and prior, joserfc accepts...	2.3 Low	—	0,15%	29 Jul 2026
CVE-2026-59898 netty Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, ab attacker can force WebSocket upgrade via the l...	7.5 High	—	0,44%	29 Jul 2026
CVE-2026-2482 ibm websphere application server IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and un...	8.8 High	—	0,15%	29 Jul 2026
CVE-2026-16328 In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not restrict how the Consul backend address was supplied, allowing a connected client to override the server's config...	8.6 High	—	0,39%	29 Jul 2026
CVE-2026-16326 In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be...	10.0 Critical	—	0,54%	29 Jul 2026
CVE-2026-14529 ibm websphere application server IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 traditional is vulnerable to server-side request fo...	9.8 Critical	—	0,53%	29 Jul 2026
CVE-2026-13346 pypa pip pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. T...	6.5 Medium	—	0,29%	29 Jul 2026
CVE-2026-12935 The TL-WR940N v6 router contains a vulnerability in its RTSP connection tracking module that can lead to a stack-based buffer overflow. The issue occurs when a LAN client...	8.7 High	—	0,99%	29 Jul 2026
CVE-2026-10684 In subsys/debug/coredump/coredump_shell.c, print_coredump_hdr() used the 16-bit tgt_code field of a stored Zephyr coredump header directly as an index into coredump_targe...	3.0 Low	—	0,14%	29 Jul 2026
CVE-2026-8497 devolutions password manager Improper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager 2026.2.1.0 and earlier on Android, iOS, and macOS allows an...	7.4 High	—	0,13%	29 Jul 2026
CVE-2026-59920 netty Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's STOMP encoder ( StompSubframeEncoder )...	6.5 Medium	—	0,42%	29 Jul 2026
CVE-2026-59919 netty Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's HAProxy encoder ( HAProxyMessageEncoder...	5.5 Medium	—	0,17%	29 Jul 2026
CVE-2026-59901 netty Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in Netty's compression...	7.5 High	—	0,46%	29 Jul 2026
CVE-2026-59900 netty Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer (`Htt...	5.3 Medium	—	0,40%	29 Jul 2026
CVE-2026-59899 netty Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, `HttpContentEncoder` (the superclass of the produc...	7.5 High	—	0,61%	29 Jul 2026
CVE-2026-54705 MathLive provides web components for math display and input. Prior to 0.110.0, MathLive fails to escape text-mode content in \text{} and \mbox{} commands in Box.toMarkup...	6.3 Medium	—	0,30%	29 Jul 2026
CVE-2026-41939 Care Everywhere Gateway 14.3.10 contains a hard-coded credentials vulnerability in the bundled WildFly 8.2.0.Final management interface that allows unauthenticated remote...	9.8 Critical	—	1,1%	29 Jul 2026
CVE-2026-40272 Improper Input Validation in the decode() function of the traceparser library could allow an attacker with a corrupted kernel trace event log (.kev) file, to execute arbi...	7.0 High	—	0,16%	29 Jul 2026
CVE-2026-18236 A vulnerability in the Agent Development Kit (ADK) allows for continuation forgery in tool confirmations. An attacker who is able to manipulate or inject events into the...	9.3 Critical	—	0,22%	29 Jul 2026
CVE-2026-14266 7-zip 7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected in...	7.8 High	—	0,74%	29 Jul 2026
CVE-2026-13723 A vulnerability in the `zipx.Unzip` extraction routine of Develar's app-builder allows an attacker to overwrite arbitrary files on macOS APFS by exploiting a Unicode Norm...	6.5 Medium	—	0,48%	29 Jul 2026
CVE-2026-8339 A SQL injection vulnerability exists in the Coverity Connect SOAP API for versions between 2024.6.0 and 2026.3.0 (inclusive). A malicious, authenticated threat actor who...	8.7 High	—	0,34%	29 Jul 2026
CVE-2026-8338 A Spring Security authentication and authorization bypass exists in Coverity Connect versions between 2023.6.0 and 2026.3.0. An unauthenticated malicious threat actor tha...	9.2 Critical	—	0,50%	29 Jul 2026
CVE-2026-67194 Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2 allow authenticated IMAP users to crash the imapd process via deeply nested parenthesized SEARCH queries. T...	6.5 Medium	—	0,55%	29 Jul 2026
CVE-2026-64560 Advisory In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec() race Wongi and Jungwoo decoded and reporte...	7.8 High	—	0,50%	29 Jul 2026
CVE-2026-64559 In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in PKEY_VERIFYPROTK ioctl Explicitly check the buffer length request structu...	7.8 High	—	0,12%	29 Jul 2026
CVE-2026-64558 In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in pkey_pckmo handler implementation Explicitly check the length of the targ...	7.8 High	—	0,12%	29 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.