Katalog CVE (hal. 839)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.261 (Critical 36.656 · High 106.368 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 2 Nov 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 41.901–41.950 dari 266.261 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-54621 datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, GraphQL Union description values in src/datamodel_code_generator/model/tem...	7.8 High	—	0,21%	28 Jul 2026
CVE-2026-6881 A SQL Injection in the Giving Reports functionality in Ellucian Advance Web and Legacy Advance allows an authenticated attacker to extract sensitive information from data...	9.4 Critical	—	0,34%	28 Jul 2026
CVE-2026-59943 dompdf project dompdf Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the...	5.3 Medium	—	0,42%	28 Jul 2026
CVE-2026-59942 dompdf project dompdf Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a Denial of Service (DoS) attack via resource exhaustion. An attacker can crash the...	7.5 High	—	0,90%	28 Jul 2026
CVE-2026-59941 dompdf project dompdf Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and...	7.5 High	—	0,64%	28 Jul 2026
CVE-2026-56722 dompdf project dompdf Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML input can bypass this restriction by embedding a target file pa...	5.3 Medium	—	0,45%	28 Jul 2026
CVE-2026-49447 Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. In 0.22.18, `GET /cosmos/api/con...	5.3 Medium	—	0,38%	28 Jul 2026
CVE-2026-16581 In igloohome Smart Lock Mobile App versions 3.2.3 and prior, an Inclusion of Sensitive Information in Source Code vulnerability could allow an unauthorized actor to acces...	5.3 Medium	—	0,38%	28 Jul 2026
CVE-2026-15328 ibm websphere application server IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP request smuggling.	8.1 High	—	0,39%	28 Jul 2026
CVE-2026-15325 ibm websphere application server IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP request smuggling due to improper handling of TRACE requests.	8.7 High	—	0,34%	28 Jul 2026
CVE-2026-15280 ibm websphere application server IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collective Controller is affected by a path-segment injection vulnerability in the collective rout...	7.5 High	—	0,50%	28 Jul 2026
CVE-2026-15064 ibm websphere application server IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP Response Smuggling due to improper handling of non-standard HTTP ver...	8.7 High	—	0,34%	28 Jul 2026
CVE-2026-15057 ibm websphere application server IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service due to uncontrolled heap allocation.	7.5 High	—	0,46%	28 Jul 2026
CVE-2026-14996 ibm aspera faspex IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 has addressed a vulnerability related to session management.	8.2 High	—	0,34%	28 Jul 2026
CVE-2026-14981 ibm websphere application server IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty are affected by a denial of service vulnerability in the HTTP channel due to unbounded all...	7.5 High	—	0,46%	28 Jul 2026
CVE-2026-14976 ibm websphere application server IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code execution with the collectiveController-1.0 feature enabled.	9.8 Critical	—	0,61%	28 Jul 2026
CVE-2026-14974 ibm websphere application server IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization of untrusted data.	9.8 Critical	—	0,68%	28 Jul 2026
CVE-2026-14973 ibm aspera IBM Aspera Desktop App 1.0.5 through 1.0.19 IBM Aspera for desktop can allow files to be written outside of the user's selected download destination.	9.3 Critical	—	0,45%	28 Jul 2026
CVE-2026-14959 ibm aspera faspex IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to shell command injection.	7.2 High	—	1,6%	28 Jul 2026
CVE-2026-14958 ibm aspera faspex IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation.	7.2 High	—	0,82%	28 Jul 2026
CVE-2026-14893 IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototype pollution...	7.3 High	—	0,33%	28 Jul 2026
CVE-2026-14528 ibm websphere application server IBM WebSphere Application Server 9.0, and 8.5 traditional could allow a remote attacker to obtain sensitive information.	7.5 High	—	0,45%	28 Jul 2026
CVE-2026-14515 ibm websphere application server IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to conduct a cross-site scripting attack.	6.1 Medium	—	0,30%	28 Jul 2026
CVE-2026-14512 ibm websphere application server IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypass authent...	9.8 Critical	—	0,97%	28 Jul 2026
CVE-2026-14446 ibm websphere application server IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console.	9.8 Critical	—	0,53%	28 Jul 2026
CVE-2026-13463 ibm cloud pak system IBM Cloud Pak System 2.3.5.0 could allow a local attacker to obtain sensitive information due to the insertion of credentials into log files.	7.5 High	—	0,38%	28 Jul 2026
CVE-2026-13442 langflow IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to reuse another user's FAISS namespace to access owner-only vector content and influence later query results....	7.1 High	—	0,30%	28 Jul 2026
CVE-2026-57511 SuperPlane before 0.30.0 contains an SMTP header injection vulnerability that allows unauthenticated attackers to inject arbitrary SMTP headers by including CRLF sequence...	5.4 Medium	—	0,40%	28 Jul 2026
CVE-2026-57510 SuperPlane before 0.27.0 contains a broken object-level authorization vulnerability in the CanvasService gRPC handlers that allows authenticated users with viewer-level a...	8.8 High	—	0,62%	28 Jul 2026
CVE-2026-55555 dompdf project dompdf Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face direct...	7.5 High	—	0,51%	28 Jul 2026
CVE-2026-55554 dompdf project dompdf Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri() method enforces chroot boundaries with a strpos() prefix check after normal...	7.5 High	—	0,45%	28 Jul 2026
CVE-2026-48060 Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF pr...	8.1 High	—	0,35%	28 Jul 2026
CVE-2026-3158 ibm sterling b2b integrator, ibm sterling file gateway IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.5_2, 6...	4.3 Medium	—	0,30%	28 Jul 2026
CVE-2026-3157 ibm sterling b2b integrator, ibm sterling file gateway IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.5_2, 6...	4.3 Medium	—	0,30%	28 Jul 2026
CVE-2026-1918 ibm sterling b2b integrator, ibm sterling file gateway IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.5_2, 6...	4.9 Medium	—	0,40%	28 Jul 2026
CVE-2026-16347 MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts. The system does not enforce mea...	8.8 High	—	0,39%	28 Jul 2026
CVE-2026-16192 ibm websphere application server IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service vulnerability when the restConnector-2.0 feature is enabled.	6.5 Medium	—	0,37%	28 Jul 2026
CVE-2026-16184 ibm websphere application server IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication by sending a crafted unauthenticated request.	9.8 Critical	—	0,47%	28 Jul 2026
CVE-2026-16107 IBM TS4500 CLI tool Versions: 0.1.31 through 1.12.0.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensi...	5.9 Medium	—	0,20%	28 Jul 2026
CVE-2026-11391 Tanium addressed a SQL injection vulnerability in Patch.	6.3 Medium	—	0,26%	28 Jul 2026
CVE-2026-7769 ibm sterling b2b integrator, ibm sterling file gateway IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.5_2, 6...	8.1 High	—	0,48%	28 Jul 2026
CVE-2026-7362 ibm sterling b2b integrator, ibm sterling file gateway IBM Sterling B2B Integrator 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_...	6.5 Medium	—	0,30%	28 Jul 2026
CVE-2026-66745 Artica Proxy before 4.50.000000 Service Pack 7 (fixed in hotfix 20260724-02) contains a session fixation vulnerability that allows unauthenticated attackers to hijack adm...	7.5 High	—	0,55%	28 Jul 2026
CVE-2026-59932 PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through...	7.5 High	—	0,46%	28 Jul 2026
CVE-2026-5114 The SpeedyCache plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in all versions up to, and including, 1.3.8. This is due to a mismatch betwee...	4.9 Medium	—	0,50%	28 Jul 2026
CVE-2026-50738 enterprisedb pglogical A use-after-free condition exists in pglogical's worker signaling code, where a worker structure can be dereferenced after the underlying slot has been freed or recycled...	5.3 Medium	—	0,51%	28 Jul 2026
CVE-2026-50737 enterprisedb pglogical When applying replicated changes for a row that is missing one or more columns, pglogical evaluates the affected table's default expressions on the subscriber. Because th...	7.5 High	—	0,40%	28 Jul 2026
CVE-2026-50736 enterprisedb pglogical The pglogical queue mechanism, used to convey out-of-band commands such as replicated DDL from a publisher to a subscriber, executes message payloads on the subscriber at...	7.5 High	—	0,41%	28 Jul 2026
CVE-2026-50735 enterprisedb pglogical pglogical's apply worker does not sufficiently validate the length of certain fields in incoming replication protocol messages before copying them, resulting in an out-of...	6.8 Medium	—	0,38%	28 Jul 2026
CVE-2026-4932 ibm power system s1122 (9824-22a) firmware, ibm power system s1124 (9824-42a) firmware +15 lainnya IBM PowerVM Hypervisor FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 could allow an attacker with physical access to the Transparent Memory Encryption (TME...	4.6 Medium	—	0,11%	28 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.