Katalog CVE (hal. 922)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 267.428 (Critical 36.758 · High 106.883 · KEV 1.767 · sejak 2020) · Pembaruan terakhir: 4 Nov 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 46.051–46.100 dari 267.428 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-28321 solarwinds serv-u SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary file read and write, which can then be used to escalate privileges and e...	9.1 Critical	—	0,58%	21 Jul 2026
CVE-2026-28317 solarwinds serv-u SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation. This issue requires domain administrator...	9.1 Critical	—	0,50%	21 Jul 2026
CVE-2026-28316 solarwinds serv-u SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation to a system administrator with the ability...	9.1 Critical	—	2,1%	21 Jul 2026
CVE-2026-28315 solarwinds serv-u SolarWinds Serv-U was found to be affected by a stored cross-site scripting vulnerability that could lead to session hijacking or information disclosure from an administr...	6.2 Medium	—	0,52%	21 Jul 2026
CVE-2026-28314 solarwinds serv-u SolarWinds Serv-U is affected by an insecure direct object reference vulnerability that leads to an account takeover. User authentication is required. The impact is lower...	9.1 Critical	—	0,62%	21 Jul 2026
CVE-2026-28313 solarwinds serv-u SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to SMTP hijacking leading to arbitrary account takeover. The impac...	9.1 Critical	—	0,50%	21 Jul 2026
CVE-2026-28312 solarwinds serv-u SolarWinds Serv-U is affected by a privilege escalation vulnerability. This would elevate a group’s access to system administrator and allow code execution as root. The i...	9.1 Critical	—	0,58%	21 Jul 2026
CVE-2026-28310 solarwinds serv-u SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to escalate their user type to that of a system administrator. Th...	9.1 Critical	—	0,50%	21 Jul 2026
CVE-2026-28309 solarwinds serv-u SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administrator to create system administrator accounts. The impact is lower in...	9.1 Critical	—	0,50%	21 Jul 2026
CVE-2026-28308 solarwinds serv-u SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution. Domain administrator access is required....	9.1 Critical	—	0,79%	21 Jul 2026
CVE-2026-28307 solarwinds serv-u SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain user group to be elevated into an administrator group. The impact is lower in W...	9.1 Critical	—	0,50%	21 Jul 2026
CVE-2026-28306 solarwinds serv-u SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to elevate their privileges to a system administrator. The impact...	9.1 Critical	—	0,50%	21 Jul 2026
CVE-2026-28305 solarwinds serv-u SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution as root. A domain account with admin priv...	9.1 Critical	—	0,79%	21 Jul 2026
CVE-2026-28304 solarwinds serv-u SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can allow the arbitrary execution of code remotely as root. The impact is low...	9.1 Critical	—	0,79%	21 Jul 2026
CVE-2026-28302 solarwinds serv-u SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote code execution as root. This is...	9.1 Critical	—	0,79%	21 Jul 2026
CVE-2026-16450 A vulnerability was identified in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. This affects the function getTenantId of the file /api/system/sys/d...	4.3 Medium	—	0,37%	21 Jul 2026
CVE-2026-16449 A vulnerability was determined in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. The impacted element is the function OrderItem.asc/OrderItem.desc o...	6.3 Medium	—	0,32%	21 Jul 2026
CVE-2026-8933 A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by Canonical snapd to construct the secure execution...	7.8 High	—	0,18%	21 Jul 2026
CVE-2026-65052 Ninja Forms WordPress plugin version 3.14.8 and prior contains an improper input validation vulnerability that allows unauthenticated attackers to inject arbitrary numeri...	7.5 High	—	0,58%	21 Jul 2026
CVE-2026-65051 Ninja Forms WordPress plugin version 3.14.8 contains a client-side enforcement of server-side security vulnerability that allows unauthenticated attackers to bypass all f...	6.5 Medium	—	0,49%	21 Jul 2026
CVE-2026-65050 Ninja Forms WordPress plugin version 3.14.8 and prior contains a missing authorization vulnerability in the render callback of the `ninja-forms/submissions-table` Gutenbe...	6.5 Medium	—	0,44%	21 Jul 2026
CVE-2026-65049 Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite contains an incorrect authorization vulnerability that allows a subsite Administrator to trigger netwo...	9.3 Critical	—	0,44%	21 Jul 2026
CVE-2026-65048 Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored cross-site scripting vulnerability in the Repeatable Fieldset feature w...	9.3 Critical	—	0,54%	21 Jul 2026
CVE-2026-59851 libssh, redhat hardened images +1 lainnya A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized fo...	8.8 High	—	0,49%	21 Jul 2026
CVE-2026-59850 libssh, redhat hardened images +1 lainnya A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been free...	7.5 High	—	0,35%	21 Jul 2026
CVE-2026-59849 libssh, redhat hardened images +9 lainnya A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured certificat...	7.5 High	—	0,44%	21 Jul 2026
CVE-2026-56587 hcltech intelliops event management HCL IEM was affected with Strict transport security not enforced. It may enable attackers to perform SSL stripping or man-in-the-middle attacks and compromise secure comm...	3.7 Low	—	0,24%	21 Jul 2026
CVE-2026-56584 hcltech intelliops event management HCL IEM was affected with the Information disclosure nginx server. It may enable attackers to identify outdated software versions and target known vulnerabilities or publ...	5.3 Medium	—	0,29%	21 Jul 2026
CVE-2026-47122 sparkle-project sparkle Sparkle is a software update framework for macOS. In versions up to and including 2.9.1, `Autoupdate/AppInstaller.m`'s `shouldAcceptNewConnection:` only enforces `SUCodeS...	4.2 Medium	—	0,11%	21 Jul 2026
CVE-2026-46681 @nevware21/ts-utils is a comprehensive TypeScript/JavaScript utility library. Prior to version 0.14.0, the _copyProps function in lib/src/object/copy.ts uses for...in to...	7.2 High	—	0,36%	21 Jul 2026
CVE-2026-16448 A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L,...	6.3 Medium	—	1,9%	21 Jul 2026
CVE-2026-15226 A sandbox confinement bypass vulnerability exists in Canonical snapd within its internal execution environment compiler (snap-confine). The default seccomp security templ...	8.4 High	—	0,18%	21 Jul 2026
CVE-2026-11876 In zenml-io/zenml version 0.94.2, the `GET /api/v1/stack-deployment/stack` endpoint (`get_deployed_stack`) lacks proper RBAC authorization checks, allowing any authentica...	5.0 Medium	—	0,23%	21 Jul 2026
CVE-2024-5300 An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction rules loc...	5.6 Medium	—	0,13%	21 Jul 2026
CVE-2026-9499 An out-of-bounds read (buffer over-read) vulnerability exists in QTextCodec::codecForName() in Qt. When the function is called with a QByteArray that is not NUL-terminate...	6.3 Medium	—	0,30%	21 Jul 2026
CVE-2026-59848 libssh, redhat hardened images +1 lainnya A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory grow...	5.3 Medium	—	0,34%	21 Jul 2026
CVE-2026-59847 libssh, redhat hardened images +1 lainnya A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path att...	7.5 High	—	0,33%	21 Jul 2026
CVE-2026-47121 sparkle-project sparkle Sparkle is a software update framework for macOS. Prior to version 2.9.2, `Autoupdate/SUBinaryDeltaApply.m` enforces `relativePath.pathComponents containsObject:@".."` an...	6.1 Medium	—	0,34%	21 Jul 2026
CVE-2026-16447 A vulnerability has been found in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /web/jquery/uploader/multi_uploadify.php. The manipulation of the argu...	7.3 High	—	1,6%	21 Jul 2026
CVE-2025-66390 In Microsoft Azure API Management through 2025-10-17, when self-service signup (username/password Basic Authentication) is enabled in Tenant A, an attacker can reuse the...	9.8 Critical	—	0,44%	21 Jul 2026
CVE-2026-8285 Improper restriction of excessive authentication attempts vulnerability in Universal Software Inc. FlexCity allows Excessive Allocation. This issue affects FlexCity: fro...	4.3 Medium	—	0,41%	21 Jul 2026
CVE-2026-8284 URL redirection to untrusted site ('open redirect') vulnerability in Universal Software Inc. FlexCity allows Input Data Manipulation. This issue affects FlexCity: from 5...	6.1 Medium	—	0,24%	21 Jul 2026
CVE-2026-6792 Missing Authorization vulnerability in Universal Software Inc. FlexCity allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects FlexC...	6.5 Medium	—	0,34%	21 Jul 2026
CVE-2026-59846 libssh, redhat hardened images +1 lainnya A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing...	3.9 Low	—	0,12%	21 Jul 2026
CVE-2026-16445 A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root...	7.5 High	—	3,2%	21 Jul 2026
CVE-2026-16412 mozilla firefox Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s...	9.8 Critical	—	0,61%	21 Jul 2026
CVE-2026-16411 mozilla firefox Memory safety bugs present in Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have bee...	9.8 Critical	—	0,49%	21 Jul 2026
CVE-2026-16410 mozilla firefox, mozilla thunderbird JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.	9.8 Critical	—	0,55%	21 Jul 2026
CVE-2026-16409 mozilla firefox, mozilla thunderbird Invalid pointer in the Security: PSM component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.	7.5 High	—	0,52%	21 Jul 2026
CVE-2026-16408 mozilla firefox Integer overflow in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.	9.8 Critical	—	0,62%	21 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.