Katalog CVE (hal. 837)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.261 (Critical 36.656 · High 106.368 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 2 Nov 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 41.801–41.850 dari 266.261 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-58178 apache traffic server The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11,...	7.5 High	—	0,66%	29 Jul 2026
CVE-2026-58177 apache traffic server The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and use-after-free errors. This issue affects Apache Traffic Server: from 10.0.0 thr...	9.8 Critical	—	0,59%	29 Jul 2026
CVE-2026-58175 apache traffic server Apache Traffic Server leaks memory when handling HostDB SRV records. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, fr...	7.5 High	—	0,66%	29 Jul 2026
CVE-2026-58164 apache traffic server Apache Traffic Server has use-after-free and time-of-check/time-of-use errors in remap configuration handling. This issue affects Apache Traffic Server: from 8.0.0 thr...	7.5 High	—	0,66%	29 Jul 2026
CVE-2026-58163 apache traffic server Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing. This issue affects Apache Traffic Server: from 8.0.0 through...	9.1 Critical	—	0,70%	29 Jul 2026
CVE-2026-58162 apache traffic server The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI. This issue affects Apache Traffic Server: from 8.0.0 through...	10.0 Critical	—	0,36%	29 Jul 2026
CVE-2026-58161 apache traffic server Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. This issue affects Apache Traffic Server: from 8.0.0 through 8....	7.5 High	—	0,66%	29 Jul 2026
CVE-2026-58160 apache traffic server Apache Traffic Server reads out of bounds while parsing DNS answers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, fr...	6.5 Medium	—	0,58%	29 Jul 2026
CVE-2026-58159 apache traffic server Apache Traffic Server can bypass IP access controls on UDS listeners and through ACL matching errors. This issue affects Apache Traffic Server: from 8.0.0 through 8.1....	8.2 High	—	0,56%	29 Jul 2026
CVE-2026-58158 apache traffic server Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11,...	5.9 Medium	—	0,58%	29 Jul 2026
CVE-2026-58157 apache traffic server Apache Traffic Server can reuse server sessions and tunnels improperly, exposing data across client connections. This issue affects Apache Traffic Server: from 8.0.0 t...	8.7 High	—	0,49%	29 Jul 2026
CVE-2026-50622 apache atlas Description: Missing Authorization in Apache Atlas. A missing authorization vulnerability in Apache Atlas's admin endpoints allows any authenticated user, regardless of t...	8.8 High	—	0,58%	29 Jul 2026
CVE-2026-23904 apache kyuubi Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination. A remote requester with network access to the proxy ca...	7.3 High	—	0,85%	29 Jul 2026
CVE-2026-18207 redhat build of keycloak A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name instead of a unique identifier....	6.5 Medium	—	0,31%	29 Jul 2026
CVE-2026-18201 redhat build of keycloak Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to man...	5.5 Medium	—	0,38%	29 Jul 2026
CVE-2025-10656 The Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including,...	9.8 Critical	—	0,53%	29 Jul 2026
CVE-2026-9720 The Facturación Electrónica Costa Rica plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missin...	4.3 Medium	—	0,19%	29 Jul 2026
CVE-2026-65325 apache traffic server Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate covers the new request hostname. This issue affects Apache Tr...	4.8 Medium	—	0,28%	29 Jul 2026
CVE-2026-65324 apache traffic server Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server memory. This issue affects Apach...	7.5 High	—	0,66%	29 Jul 2026
CVE-2026-64557 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() l2cap_sock_new_connection_cb(...	8.8 High	—	0,29%	29 Jul 2026
CVE-2026-64556 In the Linux kernel, the following vulnerability has been resolved: perf/core: Detach event groups during remove_on_exec perf_event_remove_on_exec() removes events by c...	7.8 High	—	0,16%	29 Jul 2026
CVE-2026-58156 apache traffic server Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8....	4.9 Medium	—	0,39%	29 Jul 2026
CVE-2026-58155 apache traffic server Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. This issue affects Apache Traffic Server: from...	9.3 Critical	—	0,54%	29 Jul 2026
CVE-2026-58154 apache traffic server Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers. This issue affects Apache Traffic Server: from 8.0.0 through 8....	8.9 High	—	0,54%	29 Jul 2026
CVE-2026-58153 apache traffic server Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting HTTP/2 to HTTP/1. This issue affects Apache Traffi...	8.3 High	—	0,64%	29 Jul 2026
CVE-2026-58152 apache traffic server Apache Traffic Server mishandles integers while decoding HPACK/XPACK headers, corrupting memory. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, f...	5.9 Medium	—	0,58%	29 Jul 2026
CVE-2026-58151 apache traffic server Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing and flow-control. This issue affects Apache Traffic Server: from 8.0.0...	7.5 High	—	0,66%	29 Jul 2026
CVE-2026-13425 The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Array Form Field Values in all versions up to, and including, 1.2.6 due to insu...	7.2 High	—	0,43%	29 Jul 2026
CVE-2026-11973 The WP-Lister Lite for eBay plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to ins...	4.9 Medium	—	0,51%	29 Jul 2026
CVE-2026-58150 apache traffic server Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling. This issue affects Apache Traffic Server: from 8.0.0...	10.0 Critical	—	0,57%	29 Jul 2026
CVE-2026-57834 apache traffic server Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 throu...	10.0 Critical	—	0,61%	29 Jul 2026
CVE-2026-41920 apache traffic server Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through 10.1.3. Users a...	9.3 Critical	—	0,53%	29 Jul 2026
CVE-2026-35226 An out‑of‑bounds write vulnerability in the CODESYS PROFINET Controller allows an unauthenticated attacker on the same network segment to send malformed PROFINET communic...	6.5 Medium	—	0,28%	29 Jul 2026
CVE-2026-33930 apache traffic server Apache Traffic Server copies the client Host header into a fixed-size stack buffer without a bound during redirect handling, so an over-long Host header overflows the sta...	5.9 Medium	—	0,58%	29 Jul 2026
CVE-2026-33267 apache traffic server Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.14, from 10.1.0 through 10.1.3. Users...	9.1 Critical	—	0,60%	29 Jul 2026
CVE-2026-24033 apache traffic server Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 1...	5.3 Medium	—	0,57%	29 Jul 2026
CVE-2026-22068 apache traffic server Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X through 9.2.1...	5.3 Medium	—	0,61%	29 Jul 2026
CVE-2026-18197 ylefebvre link library Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Link Library allows Cross-Site Scripting (XSS). This issue affects...	6.1 Medium	—	0,28%	29 Jul 2026
CVE-2026-18192 VIN-DS783E-E6 developed by Vacron has an Arbitrary File Read vulnerability, allowing authenticated remote attackers to exploit Relative Path Traversal to download arbitra...	6.5 Medium	—	0,57%	29 Jul 2026
CVE-2026-18191 VIN-DS783E-E6 developed by Vacron has a Hidden Functionality vulnerability, allowing unauthenticated remote attackers to exploit a specific hidden function to obtain the...	9.8 Critical	—	0,69%	29 Jul 2026
CVE-2026-63242 A business logic vulnerability in Koollab LMS allowed an authenticated learner to set their lesson completion status to completed via the SCORM commit endpoint without vi...	4.3 Medium	—	0,25%	29 Jul 2026
CVE-2026-63241 An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user without authorisa...	3.1 Low	—	0,22%	29 Jul 2026
CVE-2026-63240 An information disclosure vulnerability in Koollab LMS allowed an authenticated learner to obtain correct quiz answers from the course status endpoint without completing...	4.3 Medium	—	0,30%	29 Jul 2026
CVE-2026-63239 A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed an attacker to access shared multi-tenant S3 buckets and SQS queues, exposing sensitive data and ena...	5.4 Medium	—	0,21%	29 Jul 2026
CVE-2026-63238 An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, including administrator accounts, by supplying a valid...	6.5 Medium	—	0,34%	29 Jul 2026
CVE-2026-63237 A TOTP two-factor authentication bypass vulnerability in Koollab LMS allowed an attacker to supply a client-controlled seed to generate a matching one-time password and b...	4.8 Medium	—	0,18%	29 Jul 2026
CVE-2026-63236 An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to read another user's name, internal identifier, scores, lesson status, lesso...	3.7 Low	—	0,26%	29 Jul 2026
CVE-2026-63235 An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to forcibly terminate the session of any user given their email address via th...	3.7 Low	—	0,31%	29 Jul 2026
CVE-2026-63234 A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark assessment endpoint, control d...	9.9 Critical	—	0,53%	29 Jul 2026
CVE-2026-63233 A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment overall answer endpoint, contro...	9.9 Critical	—	0,53%	29 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.