Katalog CVE (hal. 964)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 267.603 (Critical 36.783 · High 106.969 · KEV 1.767 · sejak 2020) · Pembaruan terakhir: 4 Nov 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 48.151–48.200 dari 267.603 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-48260 adobe experience manager Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to...	5.4 Medium	—	0,36%	14 Jul 2026
CVE-2026-48259 adobe experience manager Adobe Experience Manager is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the current use...	9.6 Critical	—	0,90%	14 Jul 2026
CVE-2026-48257 adobe experience manager Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to...	5.4 Medium	—	0,36%	14 Jul 2026
CVE-2026-48255 adobe experience manager Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to...	5.4 Medium	—	0,36%	14 Jul 2026
CVE-2026-48254 adobe experience manager Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to...	5.4 Medium	—	0,36%	14 Jul 2026
CVE-2026-48253 adobe experience manager Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to...	5.4 Medium	—	0,36%	14 Jul 2026
CVE-2026-48252 adobe experience manager Adobe Experience Manager is affected by a Missing Authentication for Critical Function vulnerability that could result in a Security feature bypass. An attacker could lev...	8.6 High	—	0,89%	14 Jul 2026
CVE-2026-48069 @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invali...	7.5 High	—	0,88%	14 Jul 2026
CVE-2026-48068 @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invali...	7.5 High	—	0,88%	14 Jul 2026
CVE-2026-48038 joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception in services...	5.3 Medium	—	0,52%	14 Jul 2026
CVE-2026-48001 adobe commerce Adobe Commerce is affected by an Information Exposure vulnerability that could lead to a limited disclosure of sensitive information. Exploit depends on conditions beyond...	3.7 Low	—	0,51%	14 Jul 2026
CVE-2026-48000 adobe commerce Adobe Commerce is affected by an Improper Redirect (Open Redirect) vulnerability that could result in a Security feature bypass. An attacker could construct a malicious U...	6.1 Medium	—	0,46%	14 Jul 2026
CVE-2026-47999 adobe commerce Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulner...	4.8 Medium	—	0,41%	14 Jul 2026
CVE-2026-47998 adobe commerce Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to by...	5.9 Medium	—	0,71%	14 Jul 2026
CVE-2026-47997 adobe commerce Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to by...	5.9 Medium	—	0,71%	14 Jul 2026
CVE-2026-47996 adobe commerce Adobe Commerce is affected by an Incorrect Authorization vulnerability that could lead to arbitrary file system read. A high-privileged attacker could exploit this vulner...	6.8 Medium	—	0,88%	14 Jul 2026
CVE-2026-47995 adobe commerce Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulner...	8.1 High	—	0,71%	14 Jul 2026
CVE-2026-47994 adobe commerce Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnera...	8.7 High	—	0,70%	14 Jul 2026
CVE-2026-47992 adobe commerce Adobe Commerce is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code ex...	7.2 High	—	0,99%	14 Jul 2026
CVE-2026-47988 adobe commerce Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to by...	8.6 High	—	0,76%	14 Jul 2026
CVE-2026-47984 adobe commerce Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to by...	8.2 High	—	0,73%	14 Jul 2026
CVE-2026-47737 Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when set_remote_address proxy_protocol: :...	7.5 High	—	0,18%	14 Jul 2026
CVE-2026-47736 Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, when PROXY protocol v1 support is enabled, Puma reads incoming bytes into an inter...	7.5 High	—	0,35%	14 Jul 2026
CVE-2026-47482 NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause missing release of memory after effective lifetime. A successful exploit of...	7.5 High	—	0,49%	14 Jul 2026
CVE-2026-47481 NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause an authentication bypass through an alternative path or channel. A successfu...	6.5 Medium	—	0,44%	14 Jul 2026
CVE-2026-47480 NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause an uncaught exception. A successful exploit of this vulnerability might lead...	7.5 High	—	0,49%	14 Jul 2026
CVE-2026-47479 NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause uncontrolled resource consumption. A successful exploit of this vulnerabilit...	7.5 High	—	0,49%	14 Jul 2026
CVE-2026-47478 NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause the use of an expired file descriptor. A successful exploit of this vulnerab...	7.5 High	—	0,53%	14 Jul 2026
CVE-2026-47477 NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause a stack-based buffer overflow. A successful exploit of this vulnerability mi...	7.5 High	—	0,53%	14 Jul 2026
CVE-2026-47476 nvidia triton inference server NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause uncontrolled resource consumption. A successful exploit of this vulnerabilit...	7.5 High	—	0,54%	14 Jul 2026
CVE-2026-47429 vitest.dev vitest Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachmen...	5.9 Medium	—	1,0%	14 Jul 2026
CVE-2026-47428 Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Browser Mode served /__vitest_test__/ with the otelCarrier query parameter...	9.6 Critical	—	0,58%	14 Jul 2026
CVE-2026-47423 cure53 dompurify DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. In 3.4.4, DOMPurify allowed selectedcontent by default, allowing browsers to re-clone an...	8.2 High	—	0,41%	14 Jul 2026
CVE-2026-47212 sensiolabs symfony Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, TwilioRequestParser::doParse() rece...	5.3 Medium	—	1,5%	14 Jul 2026
CVE-2026-45071 sensiolabs symfony Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Crawler::addXmlContent() se...	7.5 High	—	0,57%	14 Jul 2026
CVE-2026-45068 sensiolabs symfony Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, SendmailTransport in -t mod...	7.5 High	—	0,52%	14 Jul 2026
CVE-2026-15714 An out-of-bounds read vulnerability was found in libsoup's multipart processing subsystem. The flaw exists in the soup_multipart_input_stream_read_headers() function insi...	6.5 Medium	—	0,39%	14 Jul 2026
CVE-2026-15713 A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under specific stream termination cond...	5.9 Medium	—	0,35%	14 Jul 2026
CVE-2026-15711 A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 §5.5, which mandates that...	7.5 High	—	0,75%	14 Jul 2026
CVE-2026-15709 A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop (inflate()) processes data in chunk...	7.5 High	—	0,88%	14 Jul 2026
CVE-2026-15410 sonicwall sma6210 firmware, sonicwall sma7210 firmware +1 lainnya Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in...	7.2 High	KEV · ransomware	11,8%	14 Jul 2026
CVE-2026-15409 sonicwall sma6210 firmware, sonicwall sma7210 firmware +1 lainnya A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially...	10.0 Critical	KEV · ransomware	6,8%	14 Jul 2026
CVE-2026-13001 The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'podlove_handle_cache_files' functio...	9.8 Critical	—	3,8%	14 Jul 2026
CVE-2026-5040 tp-link deco m5 firmware TP-Link Deco M5 v1 uses a weak password hashing mechanism to store user credentials. An attacker who obtains the password hash through system compromise or privileged ac...	6.7 Medium	—	0,13%	14 Jul 2026
CVE-2026-47767 sensiolabs symfony Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.46 until 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the CVE-2024-50340...	9.8 Critical	—	0,72%	14 Jul 2026
CVE-2026-47305 microsoft visual studio 2022, microsoft visual studio 2026 Protection mechanism failure in Visual Studio allows an unauthorized attacker to execute code locally.	7.8 High	—	0,47%	14 Jul 2026
CVE-2026-47304 microsoft .net framework, microsoft .net +4 lainnya Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.	9.8 Critical	—	0,29%	14 Jul 2026
CVE-2026-47303 microsoft .net, microsoft visual studio 2022 +1 lainnya Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.	8.8 High	—	0,84%	14 Jul 2026
CVE-2026-47302 microsoft .net framework, microsoft .net +2 lainnya Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.	7.5 High	—	1,2%	14 Jul 2026
CVE-2026-47301 microsoft configuration manager 2503, microsoft configuration manager 2509 +1 lainnya Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network.	8.8 High	—	0,78%	14 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.