Katalog CVE (hal. 860)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.336 (Critical 36.667 · High 106.392 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 2 Nov 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 42.951–43.000 dari 266.336 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-64219 linux kernel In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async [Why&H...	7.0 High	—	0,17%	24 Jul 2026
CVE-2026-64218 linux kernel In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: fix report_work leak on backbone_gw purge batadv_bla_purge_backbone_gw() removes st...	7.8 High	—	0,13%	24 Jul 2026
CVE-2026-64217 linux kernel In the Linux kernel, the following vulnerability has been resolved: netfs: Fix overrun check in netfs_extract_user_iter() Fix netfs_extract_user_iter() so that if iov_i...	7.8 High	—	0,13%	24 Jul 2026
CVE-2026-64216 linux kernel In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() netfs_unlock_abandoned_read_pages(rr...	9.8 Critical	—	0,46%	24 Jul 2026
CVE-2026-64215 linux kernel In the Linux kernel, the following vulnerability has been resolved: drm/msm/a6xx: Check kzalloc return in a8xx_hfi_send_perf_table Check the return value of kzalloc() t...	5.5 Medium	—	0,14%	24 Jul 2026
CVE-2026-64214 linux kernel In the Linux kernel, the following vulnerability has been resolved: powerpc/time: Remove redundant preempt_disable\|enable() calls from arch_irq_work_raise() A kernel pa...	5.5 Medium	—	0,12%	24 Jul 2026
CVE-2026-64213 linux kernel In the Linux kernel, the following vulnerability has been resolved: hwmon: (lm90) Add lock protection to lm90_alert Sashiko reports: lm90_alert() executes in the smbus...	5.5 Medium	—	0,12%	24 Jul 2026
CVE-2026-64212 linux kernel In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it In iwl_mld_remove_link, the...	5.5 Medium	—	0,16%	24 Jul 2026
CVE-2026-64211 linux kernel In the Linux kernel, the following vulnerability has been resolved: srcu: Don't queue workqueue handlers to never-online CPUs While an srcu_struct structure is in the m...	5.5 Medium	—	0,14%	24 Jul 2026
CVE-2026-64210 linux kernel In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: xsk: Fix unlocked writing to ICOSQ During napi poll, when the affinity changes and there'...	7.5 High	—	0,37%	24 Jul 2026
CVE-2026-64209 linux kernel In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config swing_tbl and pre_emphasis_tb...	7.1 High	—	0,16%	24 Jul 2026
CVE-2026-64208 linux kernel In the Linux kernel, the following vulnerability has been resolved: crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks Change the krb5 crypto library...	7.5 High	—	0,61%	24 Jul 2026
CVE-2026-17039 A flaw was found in pki-core. The certificate authority (CA) renewal request path does not perform the realm-based authorization check that the enrollment path performs,...	3.1 Low	—	0,26%	24 Jul 2026
CVE-2026-8789 The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the `ea_...	8.1 High	—	0,40%	24 Jul 2026
CVE-2026-8308 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Polen Media Software and Information Services Website Template allow...	6.1 Medium	—	0,25%	24 Jul 2026
CVE-2026-7007 zephyrproject zephyr The Zephyr ext2 file system validates the on-disk superblock in ext2_verify_disk_superblock() (subsys/fs/ext2/ext2_impl.c) before completing a mount. The validator checke...	4.6 Medium	—	0,24%	24 Jul 2026
CVE-2026-66007 huggingface datasets Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not proper...	6.5 Medium	—	0,55%	24 Jul 2026
CVE-2026-66006 lakefs lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setup_comm_prefs endpoint that allows unauthenticated attackers to...	5.3 Medium	—	0,56%	24 Jul 2026
CVE-2026-66005 Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that allows network-adjacent attackers to bypass truste...	6.3 Medium	—	0,33%	24 Jul 2026
CVE-2026-66004 BlenderMCP before commit 30a3308 contains a path traversal vulnerability in the download_polyhaven_asset method that allows attackers to write arbitrary files by injectin...	5.3 Medium	—	0,30%	24 Jul 2026
CVE-2026-58630 microsoft azure app service for linux Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network.	9.8 Critical	—	0,87%	24 Jul 2026
CVE-2026-58586 Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of li...	9.8 Critical	—	0,65%	24 Jul 2026
CVE-2026-57106 microsoft purview data governance Server-side request forgery (ssrf) in Data Quality allows an unauthorized attacker to elevate privileges over a network.	10.0 Critical	—	0,90%	24 Jul 2026
CVE-2026-56163 microsoft azure kubernetes service Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network.	10.0 Critical	—	0,90%	24 Jul 2026
CVE-2026-55732 Out-of-bounds Read (CWE-125) in BACnet packet parsing (`bacdt_datetime_to_tod`) in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.18...	8.7 High	—	0,54%	24 Jul 2026
CVE-2026-55731 Unchecked input for loop condition (CWE-606) in the SNMP agent in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allow...	6.6 Medium	—	0,54%	24 Jul 2026
CVE-2026-55730 Reflected Cross-Site Scripting (CWE-79) in LWEB802 in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to execute arbitrary JavaScr...	8.7 High	—	0,61%	24 Jul 2026
CVE-2026-55729 Exposure of Sensitive Information (CWE-200) in LWEB802 browser `localStorage` in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker t...	7.7 High	—	0,54%	24 Jul 2026
CVE-2026-55728 Stack-based Buffer Overflow (CWE-121) in `/usr/bin/ltsudo` `cmd_ipaddr_conflict` in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.1...	3.8 Low	—	0,16%	24 Jul 2026
CVE-2026-49326 apache hbase Missing Authorization vulnerability in Apache HBase thrift and rest delegation service. A scan operation in thrift/rest service has 3 steps, open, fetch(possible multipl...	6.5 Medium	—	0,49%	24 Jul 2026
CVE-2026-17059 redhat build of keycloak A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The iss...	6.5 Medium	—	0,41%	24 Jul 2026
CVE-2026-16802 devolutions powershell universal Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor with file system access...	6.5 Medium	—	0,10%	24 Jul 2026
CVE-2026-16801 devolutions powershell universal Improper control of generation of code ('Code Injection') in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user w...	8.8 High	—	0,53%	24 Jul 2026
CVE-2026-16800 devolutions powershell universal Improper control of generation of code ('Code Injection') in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user wi...	8.8 High	—	0,53%	24 Jul 2026
CVE-2026-16799 devolutions powershell universal Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the...	5.0 Medium	—	0,25%	24 Jul 2026
CVE-2026-16798 devolutions powershell universal Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with sc...	6.5 Medium	—	0,38%	24 Jul 2026
CVE-2026-12504 Improper Authentication (CWE-287) in the PAM configuration in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a...	8.4 High	—	0,19%	24 Jul 2026
CVE-2026-12503 Improper Link Resolution (CWE-59) in `/usr/bin/larm_starter` in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an authentic...	9.2 Critical	—	0,18%	24 Jul 2026
CVE-2026-12502 Improper Privilege Management (CWE-269) in `/usr/bin/ltsudo` in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows...	8.4 High	—	0,15%	24 Jul 2026
CVE-2026-12496 Stored Cross-Site Scripting (CWE-79) in the OPC XML-DA server statistics in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX...	8.7 High	—	0,61%	24 Jul 2026
CVE-2026-17048 redhat build of keycloak A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated clie...	4.9 Medium	—	0,42%	24 Jul 2026
CVE-2026-9765 Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue. Access Controls are “Broken” when a user can access resources they are...	7.1 High	—	0,40%	24 Jul 2026
CVE-2026-7484 External control of Assumed-Immutable web parameter vulnerability in ABIS Technology Ltd. Co. AVESİS allows Accessing Functionality Not Properly Constrained by ACLs. Thi...	5.3 Medium	—	0,33%	24 Jul 2026
CVE-2026-66144 apache neethi Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the API it can cause a denial of service attack if a h...	7.5 High	—	0,74%	24 Jul 2026
CVE-2026-66143 apache neethi It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain crafted policies, which may lead to a...	7.5 High	—	0,85%	24 Jul 2026
CVE-2026-66142 apache neethi Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to a denial of service a...	7.5 High	—	0,74%	24 Jul 2026
CVE-2026-66010 cure53 dompurify DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOM_ELEMENT_HANDLING.tagNameCheck, allowing attributes to bypass ap...	6.1 Medium	—	0,22%	24 Jul 2026
CVE-2026-66009 Parse Server versions >= 9.0.0 before 9.10.0-alpha.5 and >= 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when...	6.3 Medium	—	0,45%	24 Jul 2026
CVE-2026-66008 Parse Server versions >= 9.0.0 before 9.10.0-alpha.6 and >= 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation and input-coer...	6.3 Medium	—	0,56%	24 Jul 2026
CVE-2026-46452 apache nimble Improper Input Validation vulnerability in Apache NimBLE in Mesh Proxy SAR reassembly could result in passing broken data toward application resulting in memory pressure...	5.3 Medium	—	0,91%	24 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.