Katalog CVE (hal. 950)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 267.603 (Critical 36.783 · High 106.969 · KEV 1.767 · sejak 2020) · Pembaruan terakhir: 4 Nov 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 47.451–47.500 dari 267.603 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-62208 openclaw OpenClaw before 2026.6.5 could forward Authorization headers during MCP SSE redirects. When the affected feature is enabled and reachable, a lower-trust caller or configu...	6.5 Medium	—	0,36%	17 Jul 2026
CVE-2026-62207 openclaw OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability that allows lower-trust callers to reach admin-scoped tools. Attackers can perform action...	8.8 High	—	0,57%	17 Jul 2026
CVE-2026-62206 openclaw OpenClaw versions before 2026.6.9 contain a missing authorization vulnerability in Discord moderation actions. In affected versions, a lower-trust caller or configured in...	7.1 High	—	0,36%	17 Jul 2026
CVE-2026-62205 openclaw OpenClaw versions 2026.4.12-beta.1 before 2026.6.6 contain a missing-authorization vulnerability in the MS Teams message actions feature. When the affected feature is ena...	7.1 High	—	0,36%	17 Jul 2026
CVE-2026-62203 openclaw OpenClaw versions before 2026.6.6 contain an environment variable filtering vulnerability in host exec that fails to properly sanitize rustup startup variables. Attackers...	8.8 High	—	0,53%	17 Jul 2026
CVE-2026-62202 openclaw OpenClaw versions 2026.6.1 before 2026.6.9 contain a privilege escalation vulnerability in isolated cron jobs that allows lower-trust callers to regain denied execution t...	8.8 High	—	0,54%	17 Jul 2026
CVE-2026-62201 openclaw OpenClaw versions before 2026.6.6 contain a network policy bypass vulnerability in the sandbox exec-server that allows lower-trust callers to reach internal network desti...	7.7 High	—	0,36%	17 Jul 2026
CVE-2026-44251 wazuh Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 3.0.0 and above, prior to 4.14.5, a size_t integer underflow in...	6.5 Medium	—	0,44%	17 Jul 2026
CVE-2026-40106 wazuh Wazuh is a free and open source platform used for threat prevention, detection, and response. Versions 4.6.0 and above prior to 4.14.5 contain a heap-based buffer overflo...	7.8 High	—	0,13%	17 Jul 2026
CVE-2026-2594 The Smart Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0.7. This is due to insufficient input sanit...	6.4 Medium	—	0,32%	17 Jul 2026
CVE-2026-14956 The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.8.6. This is due to improper validation of the fieldI...	9.8 Critical	—	0,51%	17 Jul 2026
CVE-2026-54340 h2o h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 9265bdd, there is an HTTP/2 state amplification issue that combines HPACK decompressio...	7.5 High	—	0,49%	17 Jul 2026
CVE-2026-39359 wazuh Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 4.0.0 through 4.10.3 and 4.11.0 through 4.14.4, a logic flaw aff...	7.5 High	—	0,36%	17 Jul 2026
CVE-2026-34150 wazuh Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 1.0.0 and above, prior to 4.14.5, a heap buffer overflow in wazu...	7.5 High	—	0,37%	17 Jul 2026
CVE-2026-33754 wazuh Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 3.9.0 and above, prior to 4.14.5, a remote attacker can trigger...	6.5 Medium	—	0,37%	17 Jul 2026
CVE-2026-33434 wazuh Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 4.6.0 and above, prior to 4.14.5, a logic error in CheckRateLimi...	7.1 High	—	0,40%	17 Jul 2026
CVE-2026-44453 h2o h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 6b5370d, h2o is vulnerable to a Denial of Service attack when calling alloca under cer...	7.5 High	—	0,49%	16 Jul 2026
CVE-2026-44452 h2o h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 8dc37cb, when h2o receives a ClientHello message over TLS or QUIC and it contains a ze...	5.9 Medium	—	0,41%	16 Jul 2026
CVE-2026-44436 h2o quicly Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 8b178e6, Quicly is vulnerable to a Denial of Service...	7.5 High	—	0,49%	16 Jul 2026
CVE-2026-44435 h2o quicly Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 937d0e9, an assertion failure is raised when the tot...	7.5 High	—	0,49%	16 Jul 2026
CVE-2026-44434 h2o quicly Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit dccf5d4, Quicly was vulnerable to stateless reset in...	5.3 Medium	—	0,21%	16 Jul 2026
CVE-2026-44433 h2o quicly Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 8b178e6, an adversarial peer could send a STREAM fra...	7.5 High	—	0,49%	16 Jul 2026
CVE-2026-44182 jupyter enterprise gateway Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. In versions prior to 3.3....	10.0 Critical	—	0,63%	16 Jul 2026
CVE-2026-44181 jupyter enterprise gateway Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. In versions 2.0.0rc2 and...	10.0 Critical	—	0,77%	16 Jul 2026
CVE-2026-43978 wger is a free, open-source workout and fitness manager. In versions prior to 2.6, a gym trainer can escalate their session to any higher-privileged account (gym manager,...	8.1 High	—	0,27%	16 Jul 2026
CVE-2026-43977 wger is a free, open-source workout and fitness manager. In versions prior to 2.6, any authenticated user can read another user's private workout session notes, exercise...	7.5 High	—	0,29%	16 Jul 2026
CVE-2026-15997 Out-of-bounds write vulnerability in Legion of the Bouncy Castle Inc. BC-LTS bcprov-lts8on on ARM allows Overflow Buffers. This vulnerability is associated with program...	1.7 Low	—	0,14%	16 Jul 2026
CVE-2026-62826 microsoft sharepoint server Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over...	5.4 Medium	—	0,58%	16 Jul 2026
CVE-2026-59117 microsoft terminal Integer overflow or wraparound in Windows Terminal allows an unauthorized attacker to execute code over a network.	7.5 High	—	0,61%	16 Jul 2026
CVE-2026-58643 microsoft windows admin center Improper neutralization of input during web page generation ('cross-site scripting') in Windows Admin Center allows an unauthorized attacker to perform spoofing over a ne...	6.1 Medium	—	0,41%	16 Jul 2026
CVE-2026-58598 microsoft windows 10 21h2, microsoft windows 10 22h2 +3 lainnya Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Backup Engine allows an authorized attacker to elevate privileges l...	7.0 High	—	0,20%	16 Jul 2026
CVE-2026-57077 YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline_len. In the bundled libsyck newline_len and is_newline dere...	7.7 High	—	0,19%	16 Jul 2026
CVE-2026-57076 YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table key in syck_hdlr_add_anchor. In the bundled libsyck an...	7.8 High	—	0,17%	16 Jul 2026
CVE-2026-57075 YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in syck_base64dec. The base64 decoder in the bundled libsyck in...	9.1 Critical	—	0,63%	16 Jul 2026
CVE-2026-53412 zoom workplace desktop, zoom workplace virtual desktop infrastructure Improper Input Validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user to conduct a...	9.8 Critical	—	0,53%	16 Jul 2026
CVE-2026-53411 zoom workplace virtual desktop infrastructure A time-of-check to time-of-use (TOCTOU) race condition in the installation and uninstallation process of certain Zoom Clients for Windows could allow an authenticated loc...	7.0 High	—	0,14%	16 Jul 2026
CVE-2026-45368 Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the underlying URL methods for the KirbyTags and image blocks components did not...	8.4 High	—	0,53%	16 Jul 2026
CVE-2026-45334 Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the content-locking feature returned lock information without checking the reques...	5.3 Medium	—	0,36%	16 Jul 2026
CVE-2026-44180 jupyter enterprise gateway Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. Versions 2.0.0rc1 and abo...	9.8 Critical	—	0,72%	16 Jul 2026
CVE-2026-44177 Kirby is an open-source content management system. In versions 5.3.0 and above but prior to 5.4.1, Kirby did not correctly validate the provided user ID, resulting in a p...	8.8 High	—	1,8%	16 Jul 2026
CVE-2026-44176 Kirby is an open-source content management system. Versions prior to 4.9.1 and 5.4.1 do not check the `pages.access` permission during page draft rendering. Permissions...	6.0 Medium	—	0,36%	16 Jul 2026
CVE-2026-44175 Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, Kirby did not securely sanitize the contents of the list field on save, leaving i...	8.5 High	—	0,43%	16 Jul 2026
CVE-2026-44174 Kirby is an open-source content management system. Prior to 4.9.1 and 5.4.1, Kirby did not validate the model attributes that were used in its collection queries, allowin...	8.7 High	—	0,49%	16 Jul 2026
CVE-2026-14782 The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to SQL Injection via the Customer Import in all versions up to, and including...	4.9 Medium	—	0,41%	16 Jul 2026
CVE-2026-13713 YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack. In the bundled libsyck, w...	6.2 Medium	—	0,18%	16 Jul 2026
CVE-2026-61378 A divide-by-zero vulnerability in the Productivity Suite allows a local attacker to cause a division by zero leading to a system crash.	5.5 Medium	—	0,16%	16 Jul 2026
CVE-2026-60073 An out-of-bounds read in the Productivity Suite allows a physical attacker to control the length of data sent to a USB device. This can lead to a system crash or disclo...	5.9 Medium	—	0,25%	16 Jul 2026
CVE-2026-57896 An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a crafted IOCTL request. This could...	6.1 Medium	—	0,15%	16 Jul 2026
CVE-2026-55173 WWBN AVideo is an open source video platform. Versions 29.0 and below remain vulnerable to OS command injection because the fix for CVE-2026-33482 was incomplete and stil...	8.1 High	—	2,7%	16 Jul 2026
CVE-2026-53410 remote control for zoom contact center, zoom rooms +2 lainnya A time-of-check to time-of-use (TOCTOU) race condition in the installation and uninstallation process of certain Zoom Clients for Windows could allow an authenticated loc...	7.0 High	—	0,10%	16 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.