Katalog CVE (hal. 951)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 267.603 (Critical 36.783 · High 106.969 · KEV 1.767 · sejak 2020) · Pembaruan terakhir: 4 Nov 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 47.501–47.550 dari 267.603 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-53409 zoom rooms Improper Privilege Management in Zoom Rooms for Windows before version 7.1.0 may allow an authenticated user to conduct an escalation of privilege via local access.	7.8 High	—	0,17%	16 Jul 2026
CVE-2026-44023 docling-core Docling Core defines core data types and transformations for the document processing application Docling. In versions 1.5.0 and above, prior to 2.74.1, docling-core did n...	8.6 High	—	0,43%	16 Jul 2026
CVE-2026-44019 Docling Core defines core data types and transformations for the document processing application Docling. In versions 2.5.0 and above, prior to 2.74.1, docling-core could...	8.1 High	—	0,42%	16 Jul 2026
CVE-2026-38158 A SQL injection vulnerability in the /ureport/datasource/previewData component of ureport v2.2.9 allows attackers to access sensitive database information via crafted SQL...	9.8 Critical	—	0,50%	16 Jul 2026
CVE-2026-36425 An issue in OPSWAT AppRemover Driver (ardrv.sys) v2017.10.02.1551 and earlier in IOCTL handler 0x2420031. Any local user can open the device and send process termination...	6.5 Medium	—	0,39%	16 Jul 2026
CVE-2026-33731 WWBN AVideo is an open source video platform. In versions prior to 29.0, the Authorize.Net webhook handler at plugin/AuthorizeNet/webhook.php contains a signature verific...	6.5 Medium	—	0,16%	16 Jul 2026
CVE-2026-33692 WWBN AVideo is an open source video platform. Versions prior to 29.0 expose .env files to unauthenticated users through the official Docker compose configuration. The off...	7.5 High	—	0,35%	16 Jul 2026
CVE-2026-11889 SALTO ProAccess Space software using the tenancy feature / logical partition is vulnerable to a privilege escalation attack that could allow an authorized attacker to a...	6.5 Medium	—	0,31%	16 Jul 2026
CVE-2024-34268 EQ-3 Eqiva CC-RT-BLE Bluetooth Smart Radiator Thermostat Firmware up to the latest version 1.46 was discovered to allow unsecured bluetooth connections. This vulnerabilit...	7.1 High	—	0,32%	16 Jul 2026
CVE-2024-32389 Buffer Overflow vulnerability in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote attacker to obtain sensitive information via the update...	3.5 Low	—	0,30%	16 Jul 2026
CVE-2024-32387 An issue in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote attacker to obtain sensitive information via the community string component.	5.7 Medium	—	0,30%	16 Jul 2026
CVE-2024-32386 Directory traversal vulnerability in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote attacker to obtain sensitive information via the SNM...	7.3 High	—	0,85%	16 Jul 2026
CVE-2024-32385 An issue in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote attacker to obtain sensitive information via a boardID and revisionID compone...	4.3 Medium	—	0,31%	16 Jul 2026
CVE-2026-63397 remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed to genql to inject arbitrary JavaScript or TypeScri...	6.4 Medium	—	0,48%	16 Jul 2026
CVE-2026-63089 WireGuard Easy through 15.3.0, fixed in commit 66b292b, contains a cryptographically weak one-time link token generation vulnerability that allows unauthenticated network...	9.3 Critical	—	0,41%	16 Jul 2026
CVE-2026-62994 coredns.io coredns CoreDNS is a DNS server written in Go. From 1.9.4 until 1.14.5, a network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is config...	3.7 Low	—	0,46%	16 Jul 2026
CVE-2026-62963 Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.4, Centrifugo unidirectional WebSocket transport with uni_websocket.compression enabled enf...	8.7 High	—	0,52%	16 Jul 2026
CVE-2026-62309 coredns.io coredns CoreDNS is a DNS server written in Go. Prior to 1.14.4, a single 28-byte UDP datagram can crash the CoreDNS process when the proxyproto plugin is enabled because plugin/p...	7.5 High	—	0,66%	16 Jul 2026
CVE-2026-62299 coredns.io coredns CoreDNS is a DNS server written in Go. Prior to 1.14.5, the CoreDNS rewrite plugin supports edns0 rewrite rules with an optional revert flag, and two response rules, edns...	5.3 Medium	—	0,54%	16 Jul 2026
CVE-2026-62290 linuxfoundation cert-manager cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the process of obtaining, renewing and using those certifi...	7.3 High	—	0,11%	16 Jul 2026
CVE-2026-61718 bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). From 1.6.2 until 1.6.12, the BunkerWeb web UI BiscuitMiddleware authorization bypass list...	5.4 Medium	—	0,43%	16 Jul 2026
CVE-2026-61389 An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IOCTL request, potentially resu...	7.0 High	—	0,15%	16 Jul 2026
CVE-2026-60140 An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a crafted IOCTL request. This can l...	6.1 Medium	—	0,15%	16 Jul 2026
CVE-2026-60063 An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IOCTL request, potentially resu...	7.0 High	—	0,15%	16 Jul 2026
CVE-2026-55629 Whistle is an HTTP, HTTP2, HTTPS, and WebSocket debugging proxy. Prior to 2.10.3, lib/service/service.js handles GET /cgi-bin/temp/get by reading req.query.filename, join...	8.7 High	—	0,55%	16 Jul 2026
CVE-2026-54728 bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). Prior to BunkerWeb 1.6.12 and BunkerWeb PRO 0.57, authenticated Host header handling in th...	6.1 Medium	—	0,38%	16 Jul 2026
CVE-2026-49998 Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic JWKS endpoint verification could reuse a key for one allowed issuer t...	8.2 High	—	0,22%	16 Jul 2026
CVE-2026-44982 CrowdSec offers crowdsourced protection against malicious IPs. From 1.5.0 until 1.7.8, pkg/appsec/request.go NewParsedRequestFromRequest allocated a request body buffer f...	7.2 High	—	0,37%	16 Jul 2026
CVE-2026-44981 CrowdSec offers crowdsourced protection against malicious IPs. From 1.7.0 until 1.7.8, the LAPI router used gin-contrib/gzip with DefaultDecompressHandle globally in pkg/...	8.2 High	—	0,51%	16 Jul 2026
CVE-2026-15449 A time-of-check to time-of-use (TOCTOU) flaw in the illumos data-link pseudo-driver (dld) affects handling of the DLDIOC_GETMACPROP and DLDIOC_SETMACPROP ioctls on /dev/d...	5.8 Medium	—	0,12%	16 Jul 2026
CVE-2026-15422 The illumos SCTP inbound path performs association lookup for INIT ACK chunks without adequately validating the address parameters carried in the chunk. Since this lookup...	9.1 Critical	—	0,88%	16 Jul 2026
CVE-2026-15352 A vulnerability exists in the Health & Safety (HS) application of NASA's Core Flight System (cFS). The flaw allows the application to crash via segmentation fault when pr...	7.5 High	—	0,61%	16 Jul 2026
CVE-2026-54526 argoproj argo workflows Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 3.7.15 and 4.0.6, the allow-list fix for CVE-202...	9.9 Critical	—	0,55%	16 Jul 2026
CVE-2026-53536 Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /v1/step-files/signed download endpoint verified the supplied JWT against the shared...	5.3 Medium	—	0,24%	16 Jul 2026
CVE-2026-53535 Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the git-sync feature clones a user-configured Git repository into a temporary directory o...	5.9 Medium	—	0,84%	16 Jul 2026
CVE-2026-47089 An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin access. An authenticated user could call IMAP LISTRIGHT...	4.3 Medium	—	0,28%	16 Jul 2026
CVE-2026-47088 An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is heap exposure in nested MIME comment parsing. An authenticated IMAP user could craft an emai...	3.1 Low	—	0,27%	16 Jul 2026
CVE-2026-47087 An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had acces...	3.5 Low	—	0,29%	16 Jul 2026
CVE-2026-47086 An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token (via the...	3.5 Low	—	0,27%	16 Jul 2026
CVE-2026-47085 An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victi...	4.0 Medium	—	0,30%	16 Jul 2026
CVE-2026-47084 An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The LOCALDELETE command bypassed ACL checks. An authenticated but non-admin user could invoke the adm...	6.5 Medium	—	0,35%	16 Jul 2026
CVE-2026-47083 An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an ESEARCH cross-user content oracle. By using the ESEARCH command, an authenticated IMAP us...	4.3 Medium	—	0,31%	16 Jul 2026
CVE-2026-47082 An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation "fcc" feature skips the destination-mailbox ACL. A user whose vacation Sieve script used...	5.4 Medium	—	0,30%	16 Jul 2026
CVE-2026-47081 An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an XAPPLEPUSHSERVICE folder existence oracle and push hijack. An authenticated IMAP user cou...	3.1 Low	—	0,24%	16 Jul 2026
CVE-2026-46515 Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.3, PERM_READ access was sufficient to call fm_list_managers, fm_list_pinsets, fm_show_context...	9.3 Critical	—	0,57%	16 Jul 2026
CVE-2026-46514 Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_reset_password in Tools/ResetPassword.php:48-53 returned a plaintext password and fm_ad...	6.5 Medium	—	0,45%	16 Jul 2026
CVE-2026-46513 Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, Frogman stored API tokens generated by Tools/CreateApiToken.php:33-36 as raw bin2hex(rando...	7.4 High	—	0,43%	16 Jul 2026
CVE-2026-46512 Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_dialplan_apply accepted template parameters including greeting, dest, url, extension, c...	9.9 Critical	—	0,65%	16 Jul 2026
CVE-2026-46404 BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, the presentation URL validation did not properly restrict access to site local and link local addresse...	6.8 Medium	—	0,44%	16 Jul 2026
CVE-2026-46378 Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the selector lexer matchRegexPattern closure...	6.2 Medium	—	0,16%	16 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.