Katalog CVE (hal. 848)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.301 (Critical 36.664 · High 106.384 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 2 Nov 2026, 12:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 42.351–42.400 dari 266.301 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-43672 apple macos An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A malicious appli...	7.1 High	—	0,16%	27 Jul 2026
CVE-2026-43665 apple macos This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. A local attacker may be able to determine t...	5.5 Medium	—	0,13%	27 Jul 2026
CVE-2026-39877 apple macos A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7...	7.8 High	—	0,17%	27 Jul 2026
CVE-2026-39875 apple macos A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A malicious app may be...	7.8 High	—	0,15%	27 Jul 2026
CVE-2026-39874 apple macos A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A malicious app may be...	7.8 High	—	0,15%	27 Jul 2026
CVE-2026-39873 apple macos The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. Connecting to a malicious SMB s...	9.8 Critical	—	0,59%	27 Jul 2026
CVE-2026-28982 apple macos A race condition was addressed with improved locking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A remote user may be able to cau...	9.8 Critical	—	0,56%	27 Jul 2026
CVE-2026-28981 apple macos A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. Processing a maliciousl...	7.8 High	—	0,20%	27 Jul 2026
CVE-2026-28973 apple ipados, apple iphone os +2 lainnya An integer overflow was addressed with improved input validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, m...	8.6 High	—	0,17%	27 Jul 2026
CVE-2026-28945 apple macos A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be...	7.1 High	—	0,16%	27 Jul 2026
CVE-2026-28932 apple macos A logic issue existed resulting in memory corruption. This was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8,...	5.5 Medium	—	0,16%	27 Jul 2026
CVE-2026-28931 apple ipados, apple iphone os +3 lainnya A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, watchOS 26.6. Connecting to a...	8.8 High	—	0,50%	27 Jul 2026
CVE-2026-28928 apple ipados, apple iphone os +3 lainnya A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, watchOS 26.6. An app m...	9.8 Critical	—	0,59%	27 Jul 2026
CVE-2026-28926 apple macos A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.4. An app may be able to ele...	7.0 High	—	0,12%	27 Jul 2026
CVE-2026-28912 apple macos A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.7, macOS Tahoe 26.6. A user may be able to elevate...	7.8 High	—	0,17%	27 Jul 2026
CVE-2026-28911 apple macos The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.8.8, macOS Tahoe 26.6. A malicious app may be able to corrupt memory of a sy...	9.8 Critical	—	0,50%	27 Jul 2026
CVE-2026-28900 apple macos A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5. A maliciously crafted Z...	5.5 Medium	—	0,16%	27 Jul 2026
CVE-2026-28896 apple macos The issue was addressed with improved memory handling. This issue is fixed in iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.4, tvOS...	7.7 High	—	0,19%	27 Jul 2026
CVE-2026-28849 apple macos The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5. A maliciously crafted ZIP archive may by...	5.5 Medium	—	0,16%	27 Jul 2026
CVE-2026-20672 apple macos An information disclosure issue was addressed with improved privacy controls. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.3. An app m...	5.5 Medium	—	0,17%	27 Jul 2026
CVE-2026-12001 A hardcoded credential vulnerability exists in the firmware of multiple TP-Link routers (TL-WR845N v4, TL-WR850N v3, TL-WR902AC v4, Archer C20 v6 & Archer MR200 v5). Aut...	5.2 Medium	—	0,34%	27 Jul 2026
CVE-2026-66018 jfrog artifactory Build readers can access another repository's environment properties. A caller with read access to an ordinary repository can select a readable repository parameter while...	6.5 Medium	—	0,45%	27 Jul 2026
CVE-2026-66015 jfrog artifactory An authenticated privilege-escalation vulnerability in JFrog Platform may be exploited under admin-provisioned account conditions. Successful exploitation may grant tempo...	7.2 High	—	0,57%	27 Jul 2026
CVE-2026-66014 jfrog artifactory JFrog Artifactory contains an authentication handling weakness in internal request processing that, under specific conditions, may allow an attacker to escalate privilege...	8.8 High	—	0,64%	27 Jul 2026
CVE-2026-65925 jfrog artifactory A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response.	6.5 Medium	—	0,40%	27 Jul 2026
CVE-2026-65924 jfrog artifactory JFrog Artifactory support for Terraform remote repositories was found to be susceptible to Server-Side Request Forgery (SSRF). An authenticated user - or, if anonymous ac...	6.5 Medium	—	0,41%	27 Jul 2026
CVE-2026-65923 jfrog artifactory A URL validation weakness in JFrog Artifactory Ansible repository handling could allow a user, under specific repository access conditions, to cause unintended server-sid...	6.8 Medium	—	0,35%	27 Jul 2026
CVE-2026-65922 jfrog artifactory An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metadata areas...	5.4 Medium	—	0,34%	27 Jul 2026
CVE-2026-65921 jfrog artifactory A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended build artifacts location.	8.8 High	—	0,59%	27 Jul 2026
CVE-2026-65618 jfrog artifactory Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog Artifactory, potentially expos...	6.5 Medium	—	0,35%	27 Jul 2026
CVE-2026-65617 jfrog artifactory A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and availability under specific r...	8.8 High	—	0,65%	27 Jul 2026
CVE-2026-65616 jfrog artifactory Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token.	8.8 High	—	0,37%	27 Jul 2026
CVE-2026-64649 vercel next.js Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action forwards or red...	6.5 Medium	—	0,46%	27 Jul 2026
CVE-2026-64648 vercel next.js Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request...	5.4 Medium	—	0,34%	27 Jul 2026
CVE-2026-59729 Astro is a web framework for content-driven websites. Versions prior to 7.0.6 are vulnerable to XSS through unescaped spread attribute names in renderHTMLElement. The fix...	5.1 Medium	—	0,47%	27 Jul 2026
CVE-2026-59727 Astro is a web framework for content-driven websites. In versions 3.10.0 through 7.0.3, when a transition:persist, transition:scope, or transition:persist-props directive...	2.1 Low	—	0,39%	27 Jul 2026
CVE-2026-56748 cribl stream Improper validation of symbolic links in the Pack Git import feature in Cribl Stream before 4.18.2 allows a remote authenticated attacker with Pack import and pipeline pr...	8.8 High	—	0,92%	27 Jul 2026
CVE-2026-56747 cribl stream Improper control of generation of code in the JSON Pointer-to-accessor compiler in Cribl Stream before 4.18.2 allows a remote authenticated attacker with edit privileges...	8.8 High	—	0,67%	27 Jul 2026
CVE-2026-42017 jfrog artifactory An event-handling weakness in JFrog Artifactory could expose privileged authorization material to a lower-privileged user under specific conditions.	8.8 High	—	0,52%	27 Jul 2026
CVE-2026-42016 Advisory jfrog artifactory JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not t...	8.8 High	KEV	8,6%	27 Jul 2026
CVE-2026-66759 gimp, redhat enterprise linux A flaw was found in the file-icns plugin in GIMP. When applying a decompressed mask during ICNS image processing, the plugin reads from the mask data buffer without verif...	7.1 High	—	0,31%	27 Jul 2026
CVE-2026-66758 gimp, redhat enterprise linux A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers for width...	7.8 High	—	0,30%	27 Jul 2026
CVE-2026-66757 gimp, redhat enterprise linux A flaw was found in the file-sgi plugin in GIMP. When processing an RLE-compressed SGI image, the plugin allocates memory for a row table. The image header dimensions (ys...	5.5 Medium	—	0,23%	27 Jul 2026
CVE-2026-66031 Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and J...	5.4 Medium	—	0,29%	27 Jul 2026
CVE-2026-64647 vercel next.js Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request b...	5.4 Medium	—	0,32%	27 Jul 2026
CVE-2026-64646 vercel next.js Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.js applicati...	5.3 Medium	—	0,52%	27 Jul 2026
CVE-2026-17612 Honeywell S35 Series 3M/5M/8M/PinHole Cameras, all versions prior to and including version HC5.26.1.14.20260207 contains an audit log disclosure Vulnerability that could...	6.9 Medium	—	0,54%	27 Jul 2026
CVE-2026-16481 google mcp toolbox for databases A Server-Side Request Forgery (SSRF) and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-toolbox. The tool ta...	7.5 High	—	0,19%	27 Jul 2026
CVE-2026-12383 A flaw was found in the Event-Driven Ansible (EDA) server. The ExternalEventStreamViewSet uses permissive access controls (permission_classes=[AllowAny], authentication_c...	7.5 High	—	0,28%	27 Jul 2026
CVE-2026-10683 zephyrproject zephyr In the Synopsys DesignWare I2C driver (drivers/i2c/i2c_dw.c) operating in target/slave mode, the rx_full interrupt handler gates the write_requested() callback on dw->sta...	4.6 Medium	—	0,24%	27 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.