Katalog CVE (hal. 920)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 267.428 (Critical 36.758 · High 106.883 · KEV 1.767 · sejak 2020) · Pembaruan terakhir: 4 Nov 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 45.951–46.000 dari 267.428 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-64617 Data::PubSub::Shared versions before 0.07 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is created in pubsub.h...	3.8 Low	—	0,14%	21 Jul 2026
CVE-2026-64616 Data::NDArray::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is created in ndarray...	3.3 Low	—	0,14%	21 Jul 2026
CVE-2026-64615 Data::Graph::Shared versions before 0.04 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is created in graph.h w...	3.3 Low	—	0,14%	21 Jul 2026
CVE-2026-64614 Data::Deque::Shared versions before 0.06 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is created in deque.h w...	3.8 Low	—	0,14%	21 Jul 2026
CVE-2026-64613 Data::Buffer::Shared versions before 0.05 for Perl create a world-readable mmap backing file and open it without O_NOFOLLOW. The segment is created in buf_generic.h with...	6.2 Medium	—	0,18%	21 Jul 2026
CVE-2026-59147 Data::DisjointSet::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via an unvalidated parent index in dsu_find. The attach-time validator dsu_v...	9.8 Critical	—	0,55%	21 Jul 2026
CVE-2026-59146 Data::SpatialHash::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via unvalidated bucket, link and free-list indices in sph_walk_cell and sph_a...	7.8 High	—	0,17%	21 Jul 2026
CVE-2026-59145 Data::Intern::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated slot, reverse and arena indices in si_idx_find. The attach-time validator...	9.1 Critical	—	0,54%	21 Jul 2026
CVE-2026-59144 Data::RingBuffer::Shared versions before 0.04 for Perl allow a stack buffer overflow via an unvalidated elem_size in ring_read_seq. The attach-time validator ring_valida...	9.8 Critical	—	0,60%	21 Jul 2026
CVE-2026-59143 Data::RoaringBitmap::Shared versions before 0.02 for Perl allow an out-of-bounds read via an unvalidated container offset and cardinality in rb_contains_locked. The atta...	6.3 Medium	—	0,30%	21 Jul 2026
CVE-2026-56852 A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.	7.5 High	—	0,48%	21 Jul 2026
CVE-2026-56146 elastic kibana Improper Access Control (CWE-284) in Kibana can lead to unauthorized modification of Entity Analytics Watchlist configuration and potential information disclosure. A low-...	5.4 Medium	—	0,24%	21 Jul 2026
CVE-2026-56145 elasticsearch Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user with...	6.5 Medium	—	0,47%	21 Jul 2026
CVE-2026-56144 elasticsearch Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authorization controls in the ing...	6.5 Medium	—	0,32%	21 Jul 2026
CVE-2026-50759 An issue in exo-explore exo 1.0.69 allows a remote attacker to escalate privileges via the GET /state and DELETE /instance/{instance_id} endpoints with no authentication.	7.5 High	—	0,68%	21 Jul 2026
CVE-2026-50758 Cross Site Scripting vulnerability in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to execute arbitrary code via the mcp parameter	8.1 High	—	0,72%	21 Jul 2026
CVE-2026-50757 Directory Traversal vulnerability in DayuanJiang next-ai-draw-io 0.4.13 allowsa remote attacker to execute arbitrary code via the nex-ai-draw-io/mcp-server	7.8 High	—	0,63%	21 Jul 2026
CVE-2026-50756 An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitive information via the x-ai-provider component	7.5 High	—	0,51%	21 Jul 2026
CVE-2026-50755 An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitive information via the X-Forwarded-For header value	9.8 Critical	—	0,62%	21 Jul 2026
CVE-2026-49092 elastic kibana Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly Constraine...	4.3 Medium	—	0,28%	21 Jul 2026
CVE-2026-47671 nhost cli Nhost is an open source Firebase alternative with GraphQL. In versions of Nhost CLI prior to 1.46.0, the hidden `nhost configserver` used by `nhost dev` exposes the Mimir...	5.4 Medium	—	0,35%	21 Jul 2026
CVE-2026-47667 CImg Library is a C++ library for image processing. Prior to version 4.0.0 in `_load_analyze()`, the header_size field is read as an `unsigned int` from the first 4 bytes...	7.5 High	—	0,52%	21 Jul 2026
CVE-2026-46600 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.	7.5 High	—	0,55%	21 Jul 2026
CVE-2026-46403 Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, KVM exposes `ExecuteReadOnlyWithTypedArguments` as a read-only execution mechanism....	6.3 Medium	—	0,48%	21 Jul 2026
CVE-2026-42397 elastic kibana Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can s...	6.5 Medium	—	0,42%	21 Jul 2026
CVE-2026-30632 Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted folder name value to the create_doc tool.	7.5 High	—	0,89%	21 Jul 2026
CVE-2026-15957 Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and cus...	7.5 High	—	0,41%	21 Jul 2026
CVE-2026-64877 tenable security center An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database.	8.4 High	—	0,32%	21 Jul 2026
CVE-2026-63454 hpe arubaos-cx An authenticated path traversal vulnerability exists in AOS-CX. Successful exploitation of this vulnerability allows an attacker to copy arbitrary files to a user readabl...	7.2 High	—	0,87%	21 Jul 2026
CVE-2026-63453 hpe arubaos-cx Buffer overflow vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities could allow a remote high-privileged user...	7.2 High	—	0,62%	21 Jul 2026
CVE-2026-59142 Data::HashMap::Shared versions before 0.14 for Perl allow an out-of-bounds read via an unvalidated arena offset and length in shm_str_copy. The attach-time validator shm...	9.1 Critical	—	0,54%	21 Jul 2026
CVE-2026-59141 Data::RadixTree::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated node and arena indices in rdx_find_locked. The attach-time validator rd...	9.1 Critical	—	0,54%	21 Jul 2026
CVE-2026-59140 Data::SortedSet::Shared versions before 0.03 for Perl allow an out-of-bounds read via unvalidated node indices in the rank and min/max query paths. The attach-time valid...	9.1 Critical	—	0,54%	21 Jul 2026
CVE-2026-59139 Data::ReqRep::Shared versions before 0.05 for Perl allow an out-of-bounds read via an unvalidated arena offset and length in reqrep_recv_locked. The attach-time validato...	9.1 Critical	—	0,54%	21 Jul 2026
CVE-2026-55084 DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. A SQL injection vulnerability was identified in the SqlView...	8.8 High	—	0,46%	21 Jul 2026
CVE-2026-55082 DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. DHIS2 SQL View data endpoints allowed authenticated users wi...	8.7 High	—	0,58%	21 Jul 2026
CVE-2026-55081 DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. The DHIS2 OpenAPI HTML endpoint reflected values from the `s...	7.3 High	—	0,44%	21 Jul 2026
CVE-2026-16441 eclipse openj9 In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is incorrectly...	9.6 Critical	—	0,53%	21 Jul 2026
CVE-2026-12548 gnome libsoup, redhat enterprise linux A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause...	4.2 Medium	—	0,25%	21 Jul 2026
CVE-2026-12547 SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the proxy configuration changes (e.g., via system se...	3.4 Low	—	0,23%	21 Jul 2026
CVE-2016-20096 Linknat VOS3000 and VOS2009 through version 2.1.2.0 contain an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands...	9.8 Critical	—	0,67%	21 Jul 2026
CVE-2026-56583 hcltech dryice mycloud HCL MyCloud was affected with Concurrent Login Vulnerability. It may increase the risk of unauthorized access, session hijacking, and account misuse.	3.1 Low	—	0,22%	21 Jul 2026
CVE-2026-56582 hcltech dryice mycloud HCL MyCloud was affected by the SSL/TLS LUCKY13 Vulnerability. An attacker may exploit this vulnerability to decrypt sensitive information through a TLS/SSL padding oracl...	3.1 Low	—	0,16%	21 Jul 2026
CVE-2026-56581 hcltech dryice mycloud HCL MyCloud was affected with Cookie Attribute Path Not Set. It may increase the risk of unauthorized access to session data or authentication tokens.	2.6 Low	—	0,15%	21 Jul 2026
CVE-2026-56580 hcltech dryice mycloud HCL MyCloud was affected by Using Components with Known Vulnerability ( IIS Server ). It may allow attackers to exploit publicly disclosed weaknesses and compromise the s...	2.2 Low	—	0,28%	21 Jul 2026
CVE-2026-56579 hcltech dryice mycloud HCL MyCloud was affected with License Key Revealed in HTTP Response. It may enable attackers to misuse the exposed information and compromise the application's security.	3.1 Low	—	0,25%	21 Jul 2026
CVE-2026-56578 hcltech dryice mycloud HCL MyCloud was affected by Server Version Disclosure. It may help attackers identify and exploit known vulnerabilities affecting the disclosed software versions.	2.2 Low	—	0,26%	21 Jul 2026
CVE-2026-56577 hcltech dryice mycloud HCL MyCloud was affected with Weak Password Policy. It may increase the risk of account compromise through brute-force or credential-based attacks.	6.5 Medium	—	0,28%	21 Jul 2026
CVE-2026-47657 HumHub is an Open Source Enterprise Social Network. In versions 1.13.0 through 1.18.2, a missing authorization check in the Space member management controller allowed any...	7.1 High	—	0,36%	21 Jul 2026
CVE-2026-47425 Rattler is a library that provides common functionality used within the conda ecosystem. Prior to version 0.43.2, `EntryPoint::FromStr` in `rattler_conda_types` performs...	6.9 Medium	—	0,20%	21 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.