Katalog CVE (hal. 877)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.702 (Critical 36.692 · High 106.576 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 3 Nov 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 43.801–43.850 dari 266.702 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-64600 linux kernel In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK xfs_reflink_fill_{cow_hole,delalloc} are bot...	7.8 High	—	0,47%	23 Jul 2026
CVE-2026-63226 Printers and Multifunction Printers (MFPs) provided by Ricoh Company, Ltd. do not implement restrictions on SSH port forwarding, allowing to connect to arbitrary destinat...	6.9 Medium	—	0,38%	23 Jul 2026
CVE-2026-6390 A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted...	6.8 Medium	—	0,15%	23 Jul 2026
CVE-2026-7120 fastify-static @fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution. Versions up to...	5.3 Medium	—	0,37%	23 Jul 2026
CVE-2026-15074 fastify-static @fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the file-resolution stage. This is a bypass of the ea...	7.5 High	—	0,67%	23 Jul 2026
CVE-2026-21723 The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits. Mass-executing templates in...	5.3 Medium	—	0,22%	23 Jul 2026
CVE-2026-16653 A security flaw has been discovered in boazsegev facil.io up to 0.7.58. This affects the function http_sendfile2 of the file lib/facil/http/http.c of the component Public...	5.3 Medium	—	0,69%	23 Jul 2026
CVE-2026-16632 A flaw has been found in boazsegev facil.io up to 0.7.4. Affected is the function websocket_on_protocol_error in the library lib/facil/http/parsers/websocket_parser.h of...	7.3 High	—	0,52%	23 Jul 2026
CVE-2026-16631 A vulnerability was detected in publint up to 0.1.4. This impacts the function child_process.exec of the file src/node/pack.js of the component package-manager Command Ha...	5.3 Medium	—	1,1%	23 Jul 2026
CVE-2026-61246 oracle platform security for java Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected...	8.8 High	—	0,47%	22 Jul 2026
CVE-2026-60455 oracle platform security for java Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected...	8.8 High	—	0,43%	22 Jul 2026
CVE-2026-60439 oracle platform security for java Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected...	8.8 High	—	0,47%	22 Jul 2026
CVE-2026-60373 oracle platform security for java Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected...	8.8 High	—	0,47%	22 Jul 2026
CVE-2026-60372 oracle platform security for java Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected...	9.8 Critical	—	0,55%	22 Jul 2026
CVE-2026-60371 oracle platform security for java Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected...	8.0 High	—	0,27%	22 Jul 2026
CVE-2026-60370 oracle platform security for java Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected...	7.5 High	—	0,33%	22 Jul 2026
CVE-2026-60369 oracle platform security for java Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected...	9.9 Critical	—	0,47%	22 Jul 2026
CVE-2026-60368 oracle platform security for java Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected...	8.8 High	—	0,55%	22 Jul 2026
CVE-2026-60367 oracle platform security for java Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected...	9.8 Critical	—	0,55%	22 Jul 2026
CVE-2026-60366 oracle platform security for java Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected...	10.0 Critical	—	0,55%	22 Jul 2026
CVE-2026-38766 An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the sub_186f4 function	7.8 High	—	0,14%	22 Jul 2026
CVE-2026-38765 An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the kernel driver pgsecdl.sys	7.8 High	—	0,14%	22 Jul 2026
CVE-2026-38763 An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to cause a denial of service via the function sub_13828	5.5 Medium	—	0,14%	22 Jul 2026
CVE-2026-16630 A security vulnerability has been detected in syncfusion ej2-javascript-ui-controls up to 33.2.3. This affects the function child_process.exec of the file package.json. T...	5.3 Medium	—	1,1%	22 Jul 2026
CVE-2026-16629 A vulnerability was identified in danger danger-js up to 13.0.7. Impacted is the function danger.git.diffForFile of the file source/platforms/git/localGetFileAtSHA.ts of...	5.3 Medium	—	1,1%	22 Jul 2026
CVE-2026-16628 A vulnerability was detected in oclif up to 4.23.16. Affected by this vulnerability is the function child_process.exec of the component JIT Plugin Entry Handler. Performi...	5.3 Medium	—	1,1%	22 Jul 2026
CVE-2026-64798 Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension - Persistent URL login keys were also generated using a non-cryptographic random genera...	9.1 Critical	—	0,43%	22 Jul 2026
CVE-2026-64797 Joomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension - IP Login trusted forwarded client-IP headers without requiring a configured trusted...	7.5 High	—	0,35%	22 Jul 2026
CVE-2026-64796 Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not require both the article creator and last modifier to be Super U...	9.8 Critical	—	0,51%	22 Jul 2026
CVE-2026-64795 Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions - Tag-provided custom HTML, module content/title overrides and...	5.4 Medium	—	0,23%	22 Jul 2026
CVE-2026-64794 Joomla Extension - regularlabs.com - restricted user-data exposure in Users Anywhere and Articles Anywhere extensions - User tags, filters and conditions allowed access t...	6.5 Medium	—	0,42%	22 Jul 2026
CVE-2026-64793 Joomla Extension - regularlabs.com - Content access and publication bypass in Articles Anywhere and Modules Anywhere extensions - Content tags could use ignore flags or p...	9.1 Critical	—	0,43%	22 Jul 2026
CVE-2026-64792 Joomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs extensions - Smart Search indexing could render generated c...	7.5 High	—	0,42%	22 Jul 2026
CVE-2026-64791 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs Extension Manager - Administrator routes and install/update/uninsta...	8.8 High	—	0,20%	22 Jul 2026
CVE-2026-63685 Joomla Extension - regularlabs.com - Authorization bypass in DB Replacer extension - Administrator routes and replacement requests did not consistently require Super User...	8.8 High	—	0,42%	22 Jul 2026
CVE-2026-63684 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various admin/import/export actions of multiple Regular Labs extension - Adminis...	8.8 High	—	0,20%	22 Jul 2026
CVE-2026-63683 Joomla Extension - regularlabs.com - Client IP spoofing vulnerability in Regular Labs conditions manager - IP and GeoIP conditions trusted spoofable forwarded headers, al...	7.5 High	—	0,39%	22 Jul 2026
CVE-2026-63281 Joomla Extension - regularlabs.com - XSS vulnerability in Regular Labs conditions manager - Stored condition values could also execute HTML/JavaScript in administrator su...	4.8 Medium	—	0,24%	22 Jul 2026
CVE-2026-63280 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs conditions manager - Conditions administration did not consistently...	8.8 High	—	0,20%	22 Jul 2026
CVE-2026-63265 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpoints - Privileged Regular Labs AJAX end...	8.0 High	—	0,18%	22 Jul 2026
CVE-2026-13089 OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorithm allowlist in verify. When the caller does not p...	7.5 High	—	0,37%	22 Jul 2026
CVE-2025-60835 An issue in the unrar.dll component of IZArc v4.6 allows attackers to execute a path traversal.	7.8 High	—	0,19%	22 Jul 2026
CVE-2025-50330 An issue in ZipGenius Team ZipGenius v.6.3.2.3116 and before allows a remote attacker to escalate privileges and execute arbitrary code via the zipgenius.exe.	8.8 High	—	0,67%	22 Jul 2026
CVE-2025-50329 An issue in ConeXware, Inc Power Archiver v.22.00.11 and before allows a remote attacker to escalate privileges and execute arbitrary code via the powerarc.exe.	9.8 Critical	—	1,1%	22 Jul 2026
CVE-2025-50327 An issue in Franco Corbelli ZPAQFRANZ v.61.3 and before allows a remote attacker to escalate privileges and execute arbitrary code via a bypass of the Mark-of-the-Web pro...	8.8 High	—	0,71%	22 Jul 2026
CVE-2025-50325 BandiZip v.7.37 is affected by a Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on aff...	5.4 Medium	—	0,51%	22 Jul 2026
CVE-2025-50324 An issue in Milos Paripovic OneCommander v.3.96.0.0 allows a remote attacker to execute arbitrary code via the OneCommander.exe component.	8.8 High	—	0,67%	22 Jul 2026
CVE-2025-44090 An issue in OhSoft CoffeeZip v4.8.0.0 allows attackers to execute arbitrary code via downloading and executing a crafted archive file.	8.8 High	—	0,54%	22 Jul 2026
CVE-2025-44089 An issue in NCH Software ExpressZip v11.29 allows attackers to execute arbitrary code via downloading and executing a crafted archive file.	8.8 High	—	0,53%	22 Jul 2026
CVE-2026-9737 mongodb During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case. This may lead to incorrect tr...	6.5 Medium	—	0,42%	22 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.