Katalog CVE (hal. 866)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.527 (Critical 36.676 · High 106.475 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 3 Nov 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 43.251–43.300 dari 266.527 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-62825 microsoft azure key vault Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network.	9.8 Critical	—	0,92%	24 Jul 2026
CVE-2026-58275 microsoft azure dns Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network.	9.8 Critical	—	0,92%	24 Jul 2026
CVE-2026-56191 microsoft exchange online Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network.	10.0 Critical	—	0,90%	24 Jul 2026
CVE-2026-56167 microsoft azure ai search Server-side request forgery (ssrf) in Azure AI Search allows an authorized attacker to elevate privileges over a network.	8.8 High	—	0,55%	24 Jul 2026
CVE-2026-56165 microsoft account Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker to execute code over a network.	9.8 Critical	—	0,97%	24 Jul 2026
CVE-2026-56160 microsoft azure red hat openshift Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate privileges over a network.	9.9 Critical	—	0,79%	24 Jul 2026
CVE-2026-54120 microsoft surface management services Improper input validation in Microsoft Surface allows an authorized attacker to execute code over a network.	8.8 High	—	0,96%	24 Jul 2026
CVE-2026-50517 microsoft 365 copilot Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network.	9.9 Critical	—	1,7%	24 Jul 2026
CVE-2026-49159 microsoft graph Exposure of sensitive information to an unauthorized actor in Microsoft Graph allows an authorized attacker to disclose information over a network.	6.5 Medium	—	1,00%	24 Jul 2026
CVE-2026-35425 microsoft azure api management Improper access control in Azure API Management (APIM) allows an authorized attacker to execute code over a network.	7.2 High	—	0,70%	24 Jul 2026
CVE-2026-50044 Pronetiqs IntraVUE versions 3.2.1a14 and prior have an inadequate encryption strength vulnerability which could allow an attacker to steal admin credentials via weak hash...	6.8 Medium	—	0,13%	23 Jul 2026
CVE-2026-44955 Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to an unauthorized control sphere vulnerability which could allow for asse...	5.3 Medium	—	0,35%	23 Jul 2026
CVE-2026-42933 Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or intermediary vulnerability which could allow an attacker to use an active proxy, which would by...	10.0 Critical	—	0,51%	23 Jul 2026
CVE-2026-40430 Pronetiqs IntraVUE Versions 3.2.1a14 and prior have a plaintext storage of a password vulnerability that could expose cleartext credentials through the API.	7.5 High	—	0,39%	23 Jul 2026
CVE-2026-28698 Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to an unauthorized control sphere vulnerability which could expose the und...	8.6 High	—	0,42%	23 Jul 2026
CVE-2026-16767 A vulnerability was detected in Ne-Lexa php-zip up to 4.0.2. This affects the function ZipFile::extractTo of the file src/ZipFile.php of the component ZIP Handler. Perfor...	6.5 Medium	—	0,68%	23 Jul 2026
CVE-2026-65694 Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitrary files b...	7.5 High	—	3,4%	23 Jul 2026
CVE-2026-65604 Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence Rego policies. When a request body...	8.2 High	—	0,39%	23 Jul 2026
CVE-2026-63732 9router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcoded default password (123456) that authenticates any fresh installation, a bypass of the LOC...	9.9 Critical	—	1,0%	23 Jul 2026
CVE-2026-63313 9Router before 0.4.72 contains a server-side request forgery (SSRF) vulnerability in the /v1/web/fetch endpoint. The endpoint accepts a user-controlled url parameter and...	7.7 High	—	0,41%	23 Jul 2026
CVE-2026-16807 google chrome Out of bounds write in Codecs in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromiu...	8.8 High	—	0,35%	23 Jul 2026
CVE-2026-16806 google chrome Use after free in WebMCP in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium...	8.8 High	—	0,52%	23 Jul 2026
CVE-2026-16805 google chrome Use after free in Blink in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium s...	8.8 High	—	0,41%	23 Jul 2026
CVE-2026-16804 google chrome Use after free in Input in Google Chrome prior to 150.0.7871.186 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escap...	8.3 High	—	0,30%	23 Jul 2026
CVE-2026-16765 A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some unknown functionality of the file /OnlineClassroom/loginlinkadmin.php. Ex...	7.3 High	—	0,43%	23 Jul 2026
CVE-2026-16764 A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/api_v2/serializers.py of the component API/Web....	6.3 Medium	—	0,41%	23 Jul 2026
CVE-2026-16763 A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element is an unknown function of the file src/index.js of the component Conf...	5.3 Medium	—	1,2%	23 Jul 2026
CVE-2025-71389 Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Components (RSC) r...	10.0 Critical	—	1,4%	23 Jul 2026
CVE-2024-58355 Cal.com (calcom/cal.diy) versions through 4.7.15 contain a stored cross-site scripting vulnerability. The single booking view (e.g., https://app.cal.com/booking/<id>) ren...	8.9 High	—	0,42%	23 Jul 2026
CVE-2024-58354 cal.com (calcom repository, later renamed cal.diy) is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pull_r...	9.9 Critical	—	0,49%	23 Jul 2026
CVE-2024-58353 Cal.com (repository calcom/cal.diy) in versions <= 4.7.15 is vulnerable to cross-site scripting (XSS) on the publicly accessible single booking view (e.g., /booking/<id>)...	8.9 High	—	0,42%	23 Jul 2026
CVE-2026-6924 A bug in the entropy initialization for SiWx917 causes the DRBG to use a predictable seed. As such, all random numbers generated in the Matter code use the same stream of...	8.7 High	—	0,45%	23 Jul 2026
CVE-2026-52439 An issue in xiandafu beetl 3.20.2 allows a remote attacker to execute arbitrary code via the type.new function and the property reflection mechanism	9.8 Critical	—	0,68%	23 Jul 2026
CVE-2026-50103 A NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser, which may allow a network-adjacent attacker to crash a subscribing application by sending a crafted...	6.5 Medium	—	0,27%	23 Jul 2026
CVE-2026-50039 The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to cause a memory corruption via a Read Request.	7.5 High	—	0,46%	23 Jul 2026
CVE-2026-50032 A NULL pointer dereference in the MMS Write Named Variable List handler, which may allow a network adjacent attacker to crash the server by sending a WriteRequest with an...	7.5 High	—	0,46%	23 Jul 2026
CVE-2026-49035 The affected product is vulnerable to a heap-based buffer overflow via a crafted MMS Initiate request. Remote code execution (RCE) has been demonstrated when ASLR is disa...	8.1 High	—	0,61%	23 Jul 2026
CVE-2026-47724 nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the `/api/v1/*` route surface trusts the bearer token al...	9.9 Critical	—	0,48%	23 Jul 2026
CVE-2026-47723 nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.1, none of the response paths in `internal/web/` or `intern...	7.1 High	—	0,53%	23 Jul 2026
CVE-2026-39155 Knot DNS before 3.4.10 and 3.5.x before 3.5.4 contains a vulnerability in mod-onlinesign where the next NSEC owner name can be computed incorrectly. This can create an ov...	6.5 Medium	—	0,22%	23 Jul 2026
CVE-2026-38764 An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the kernel driver pgsecdl.sys	7.8 High	—	0,15%	23 Jul 2026
CVE-2026-34496 Cwe-269 vulnerability in Johnson Controls victor Web on Windows allows capec-233. This issue affects victor Web: before 7.1.	7.1 High	—	0,33%	23 Jul 2026
CVE-2026-21655 Deserialization of untrusted data vulnerability in Johnson Control victor on Windows, Johnson Controls CCure 9000, and Johnson Controls Victor Application Server allows c...	8.7 High	—	0,49%	23 Jul 2026
CVE-2026-21653 Victor SSRF vulnerability in Johnson Controls CCure 9000 and victor application server allows Server Side Request Forgery. This issue affects CCure 9000 and victor appli...	7.2 High	—	0,39%	23 Jul 2026
CVE-2026-16796 Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock AgentCore Python SDK before 1.18.1 might allow a remote authenticated user...	7.3 High	—	0,73%	23 Jul 2026
CVE-2026-16002 The affected product is vulnerable to an Out-of-bounds read, which may allow an attacker to crash the parsing process and cause a denial of service.	8.2 High	—	0,43%	23 Jul 2026
CVE-2026-15981 The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. This is due to the mo_saml_va...	9.8 Critical	—	1,3%	23 Jul 2026
CVE-2026-15968 progress moveit transfer Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: befor...	5.4 Medium	—	0,33%	23 Jul 2026
CVE-2026-15967 progress moveit transfer Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.	9.8 Critical	—	0,37%	23 Jul 2026
CVE-2026-15966 progress moveit transfer Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026....	9.8 Critical	—	0,37%	23 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.