Katalog CVE (hal. 858)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.336 (Critical 36.667 · High 106.392 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 2 Nov 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 42.851–42.900 dari 266.336 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-64272 linux kernel In the Linux kernel, the following vulnerability has been resolved: Input: mms114 - fix touch indexing for MMS134S and MMS136 The MMS134S and MMS136 touch controllers h...	7.8 High	—	0,17%	25 Jul 2026
CVE-2026-64271 linux kernel In the Linux kernel, the following vulnerability has been resolved: Input: touchwin - reset the packet index on every complete packet tw_interrupt() accumulates each no...	7.8 High	—	0,17%	25 Jul 2026
CVE-2026-64270 linux kernel In the Linux kernel, the following vulnerability has been resolved: Input: mms114 - reject an oversized device packet size mms114_interrupt() reads a packet of touch da...	7.8 High	—	0,17%	25 Jul 2026
CVE-2026-64269 linux kernel In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg When the server answers an RTR...	9.1 Critical	—	0,71%	25 Jul 2026
CVE-2026-64268 linux kernel In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: bound Read Response placement to the RREAD length In drivers/infiniband/sw/siw/siw_qp_rx.c...	9.8 Critical	—	0,71%	25 Jul 2026
CVE-2026-64267 linux kernel In the Linux kernel, the following vulnerability has been resolved: fuse: avoid 32-bit prune notification count wrap FUSE_NOTIFY_PRUNE validates the nodeid payload leng...	5.5 Medium	—	0,16%	25 Jul 2026
CVE-2026-64266 linux kernel In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before returning from fuse_ref_folio() fuse_ref_folio() unlocks the request bu...	7.8 High	—	0,13%	25 Jul 2026
CVE-2026-64265 linux kernel In the Linux kernel, the following vulnerability has been resolved: fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req When fuse_resend() moves a request...	7.8 High	—	0,17%	25 Jul 2026
CVE-2026-64264 linux kernel In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix EFAULT clobber in fuse_uring_commit copy_from_user() returns the number of bytes not...	5.5 Medium	—	0,16%	25 Jul 2026
CVE-2026-64263 linux kernel In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix moving cancelled entry to ent_in_userspace list fuse_uring_cancel() moves entries th...	5.5 Medium	—	0,16%	25 Jul 2026
CVE-2026-64262 linux kernel In the Linux kernel, the following vulnerability has been resolved: fuse-uring: end fuse_req on io-uring cancel task work When io_uring delivers task work with tw.cance...	5.5 Medium	—	0,16%	25 Jul 2026
CVE-2026-64261 linux kernel In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues fuse_uring_async_stop_queues() migh...	7.8 High	—	0,17%	25 Jul 2026
CVE-2026-64260 linux kernel In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid queue->stopped races and set/read that value under lock There are several readers...	7.8 High	—	0,13%	25 Jul 2026
CVE-2026-64259 linux kernel In the Linux kernel, the following vulnerability has been resolved: fuse-uring: make a fuse_req on SQE commit only findable after memcpy Bad userspace might try to tric...	7.8 High	—	0,17%	25 Jul 2026
CVE-2026-64258 linux kernel In the Linux kernel, the following vulnerability has been resolved: fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref If a copy into the us...	5.5 Medium	—	0,16%	25 Jul 2026
CVE-2026-64257 linux kernel In the Linux kernel, the following vulnerability has been resolved: smb: client: reject overlapping data areas in SMB2 responses Commit 53b7c271f06b ("smb: client: rest...	9.1 Critical	—	0,70%	25 Jul 2026
CVE-2026-64256 linux kernel In the Linux kernel, the following vulnerability has been resolved: xfs: don't wrap around quota ids in dqiterate LOLLM noticed that q_id is an unsigned 32-bit variable...	5.5 Medium	—	0,16%	25 Jul 2026
CVE-2026-16766 Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options. Options are passed directly to the wkhtmltopdf com...	9.8 Critical	—	2,6%	25 Jul 2026
CVE-2026-15425 The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Slug (post_name) in all ve...	6.4 Medium	—	0,35%	25 Jul 2026
CVE-2026-14955 The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.7.7 via the 'thwcfe_lega...	6.5 Medium	—	0,79%	25 Jul 2026
CVE-2026-10818 The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajax_chunk_upload_finalize function. Th...	8.1 High	—	2,5%	25 Jul 2026
CVE-2026-66374 Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow in the DoQ (DNS-over-QUIC) receive path.	8.1 High	—	0,62%	25 Jul 2026
CVE-2026-66373 Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pendi...	7.5 High	—	0,87%	25 Jul 2026
CVE-2026-66339 gnome libsoup, redhat enterprise linux A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS...	6.5 Medium	—	0,25%	24 Jul 2026
CVE-2026-66338 gnome libsoup, redhat enterprise linux A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accepts inputs violating RFC 9112, incl...	7.2 High	—	0,29%	24 Jul 2026
CVE-2026-66337 gnome libsoup, redhat enterprise linux A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing multipart HTT...	6.5 Medium	—	0,25%	24 Jul 2026
CVE-2026-61892 Weintek cMT3092X HMI allows a non-privileged user to modify tokens to escalate privileges.	8.8 High	—	0,51%	24 Jul 2026
CVE-2026-61886 Weintek cMT3092X HMI stores user account passwords in plaintext.	6.5 Medium	—	0,40%	24 Jul 2026
CVE-2026-60135 An attacker can modify data that should be restricted to read‑only access.	6.5 Medium	—	0,38%	24 Jul 2026
CVE-2026-60134 Weintek cMT3092X HMI allows a non-privileged user to modify cookies to gain elevated privileges.	8.8 High	—	0,58%	24 Jul 2026
CVE-2026-16280 imaginationtech ddk An integer overflow when calculating physical offsets for sparse PMRs may result in 32-bit truncation of address computations for PMRs larger than 4 GB. This can lead to...	9.8 Critical	—	0,53%	24 Jul 2026
CVE-2026-61884 The Tycon Systems TPDIN-Monitor-WEB2 ships without HTTP credentials configured, intended for an installer to set them on first use. On firmware 2.4.4 and earlier, a unit...	9.8 Critical	—	0,56%	24 Jul 2026
CVE-2026-55985 The web management interface in Tycon Systems TPDIN-Monitor-WEB2 stores and displays system credentials in cleartext on a certain configuration page accessible to authen...	4.3 Medium	—	0,20%	24 Jul 2026
CVE-2025-71408 nltk NLTK (Natural Language Toolkit) before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command...	7.8 High	—	0,27%	24 Jul 2026
CVE-2026-66041 ffmpeg FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory...	7.8 High	—	0,49%	24 Jul 2026
CVE-2026-66040 ffmpeg FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corru...	8.8 High	—	0,78%	24 Jul 2026
CVE-2026-66039 ffmpeg FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by...	7.8 High	—	0,31%	24 Jul 2026
CVE-2026-66038 ffmpeg FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialize...	6.5 Medium	—	0,24%	24 Jul 2026
CVE-2026-66037 ffmpeg FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to...	5.5 Medium	—	0,35%	24 Jul 2026
CVE-2026-66036 ffmpeg FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by s...	8.8 High	—	0,40%	24 Jul 2026
CVE-2026-62835 microsoft azure portal Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network.	7.5 High	—	0,97%	24 Jul 2026
CVE-2026-57531 Milkdown before 7.21.3 contains a DOM cross-site scripting vulnerability in the @milkdown/plugin-emoji package that allows unauthenticated attackers to execute arbitrary...	5.4 Medium	—	0,41%	24 Jul 2026
CVE-2026-57530 Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-commonmark and @milkdown/components packages that allows attackers wit...	5.4 Medium	—	0,31%	24 Jul 2026
CVE-2026-54342 In epa4all, prior to version 2026-05-20, an attacker on the network path between epa4all and any backend (ePA Aktensystem, Konnektor, IDP, TSS) can present a self-signed...	8.1 High	—	0,20%	24 Jul 2026
CVE-2026-48037 Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, AccountFoundation reuse pat...	6.3 Medium	—	0,45%	24 Jul 2026
CVE-2026-48036 Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift det...	8.4 High	—	0,51%	24 Jul 2026
CVE-2026-48035 Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers using AccountFoun...	7.1 High	—	0,45%	24 Jul 2026
CVE-2026-48034 Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, there is a bypass via decoy...	8.5 High	—	0,45%	24 Jul 2026
CVE-2026-48033 Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, policy packs can be bypasse...	8.4 High	—	0,48%	24 Jul 2026
CVE-2026-48032 Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, IAM-role policy checks can...	8.3 High	—	0,54%	24 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.