Katalog CVE
Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR · 32 kali dilihat
$ cat README.txt
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-49796
microsoft windows 10 1607, microsoft windows 10 1809 +10 lainnya
Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code locally.
|
7.8 High | — | 0,47% | 14 Jul 2026 |
|
CVE-2026-49795
microsoft windows 10 1809, microsoft windows 10 21h2 +7 lainnya
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
|
8.8 High | — | 0,33% | 14 Jul 2026 |
|
CVE-2026-49794
microsoft windows 10 1607, microsoft windows 10 1809 +10 lainnya
Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to disclose information with a physical attack.
|
4.6 Medium | — | 0,47% | 14 Jul 2026 |
|
CVE-2026-49793
microsoft windows 10 1607, microsoft windows 10 1809 +9 lainnya
Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.
|
7.8 High | — | 0,33% | 14 Jul 2026 |
|
CVE-2026-49792
microsoft windows 10 1607, microsoft windows 10 1809 +9 lainnya
Numeric truncation error in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.
|
7.8 High | — | 0,33% | 14 Jul 2026 |
|
CVE-2026-49791
microsoft windows 10 1607, microsoft windows 10 1809 +10 lainnya
Improper link resolution before file access ('link following') in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges loc...
|
7.8 High | — | 0,38% | 14 Jul 2026 |
|
CVE-2026-49790
microsoft windows 10 1607, microsoft windows 10 1809 +10 lainnya
Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
|
7.8 High | — | 0,36% | 14 Jul 2026 |
|
CVE-2026-49789
microsoft windows 10 1607, microsoft windows 10 1809 +10 lainnya
Stack-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.
|
7.8 High | — | 0,36% | 14 Jul 2026 |
|
CVE-2026-49788
microsoft windows 10 1607, microsoft windows 10 1809 +9 lainnya
Allocation of resources without limits or throttling in HTTP/2 allows an unauthorized attacker to deny service over a network.
|
7.5 High | — | 1,2% | 14 Jul 2026 |
|
CVE-2026-49787
microsoft windows 10 1607, microsoft windows 10 1809 +9 lainnya
Allocation of resources without limits or throttling in Windows HTTP.sys allows an unauthorized attacker to deny service over a network.
|
7.5 High | — | 1,2% | 14 Jul 2026 |
|
CVE-2026-49784
microsoft windows 10 1607, microsoft windows 10 1809 +9 lainnya
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Windows App Store allows an authorized attacker to elevate privil...
|
7.0 High | — | 0,20% | 14 Jul 2026 |
|
CVE-2026-49783
microsoft windows 10 1607, microsoft windows 10 1809 +9 lainnya
Improperly implemented security check for standard in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.
|
7.8 High | — | 0,33% | 14 Jul 2026 |
|
CVE-2026-49184
microsoft windows 10 1607, microsoft windows 10 1809 +10 lainnya
Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.
|
7.8 High | — | 0,34% | 14 Jul 2026 |
|
CVE-2026-49183
microsoft windows 10 1809, microsoft windows 10 21h2 +7 lainnya
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Clipboard Server allows an authorized attacker to elevate privilege...
|
7.0 High | — | 0,20% | 14 Jul 2026 |
|
CVE-2026-49181
microsoft windows 10 1607, microsoft windows 10 1809 +5 lainnya
Integer underflow (wrap or wraparound) in Windows DHCP Client allows an unauthorized attacker to elevate privileges over a network.
|
9.8 Critical | — | 1,2% | 14 Jul 2026 |
|
CVE-2026-49180
microsoft windows 10 1607, microsoft windows 10 1809 +10 lainnya
Improper link resolution before file access ('link following') in Universal Plug and Play (upnp.dll) allows an authorized attacker to disclose information locally.
|
5.5 Medium | — | 0,44% | 14 Jul 2026 |
|
CVE-2026-49178
microsoft windows 10 1607, microsoft windows 10 1809 +10 lainnya
Heap-based buffer overflow in Active Directory Domain Services allows an authorized attacker to execute code over a network.
|
8.8 High | — | 0,91% | 14 Jul 2026 |
|
CVE-2026-49176
microsoft windows 10 1607, microsoft windows 10 1809 +9 lainnya
Improper privilege management in Windows WalletService allows an authorized attacker to elevate privileges locally.
|
7.8 High | — | 0,33% | 14 Jul 2026 |
|
CVE-2026-49175
microsoft windows 10 21h2, microsoft windows 10 22h2 +5 lainnya
Heap-based buffer overflow in Windows DNS allows an authorized attacker to elevate privileges locally.
|
7.8 High | — | 0,33% | 14 Jul 2026 |
|
CVE-2026-49174
microsoft windows 10 1809, microsoft windows 10 21h2 +7 lainnya
Missing authentication for critical function in Microsoft Windows DNS allows an authorized attacker to perform tampering locally.
|
6.1 Medium | — | 0,27% | 14 Jul 2026 |
|
CVE-2026-49173
microsoft windows 11 26h1
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
|
7.8 High | — | 0,33% | 14 Jul 2026 |
|
CVE-2026-49172
microsoft windows 10 1607, microsoft windows 10 1809 +9 lainnya
Heap-based buffer overflow in Windows FTP Service allows an unauthorized attacker to execute code over a network.
|
9.8 Critical | — | 0,97% | 14 Jul 2026 |
|
CVE-2026-49171
microsoft windows 10 1607, microsoft windows 10 1809 +9 lainnya
Use after free in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally.
|
7.8 High | — | 0,30% | 14 Jul 2026 |
|
CVE-2026-49170
microsoft windows 10 1809, microsoft windows 10 21h2 +7 lainnya
Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
|
7.8 High | — | 0,30% | 14 Jul 2026 |
|
CVE-2026-49169
microsoft windows server 2025
Use after free in DNS Server allows an authorized attacker to execute code over a network.
|
8.8 High | — | 0,75% | 14 Jul 2026 |
|
CVE-2026-49168
microsoft windows 10 1607, microsoft windows 10 1809 +9 lainnya
Integer overflow or wraparound in Windows Storage Spaces Direct allows an unauthorized attacker to elevate privileges with a physical attack.
|
6.8 Medium | — | 0,44% | 14 Jul 2026 |
|
CVE-2026-49167
microsoft windows 10 1809, microsoft windows 10 21h2 +7 lainnya
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
|
7.8 High | — | 0,35% | 14 Jul 2026 |
|
CVE-2026-49166
microsoft windows 11 24h2, microsoft windows 11 25h2 +2 lainnya
Use after free in Microsoft Printer Drivers allows an authorized attacker to elevate privileges locally.
|
7.8 High | — | 0,33% | 14 Jul 2026 |
|
CVE-2026-49165
microsoft windows 10 1607, microsoft windows 10 1809 +9 lainnya
Use of uninitialized resource in Microsoft Windows App Store allows an authorized attacker to disclose information locally.
|
7.1 High | — | 0,34% | 14 Jul 2026 |
|
CVE-2026-49164
microsoft windows 10 1607, microsoft windows 10 1809 +10 lainnya
Heap-based buffer overflow in Active Directory Domain Services allows an unauthorized attacker to execute code over a network.
|
9.8 Critical | — | 0,79% | 14 Jul 2026 |
|
CVE-2026-49162
microsoft windows 11 24h2, microsoft windows 11 25h2 +2 lainnya
Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.
|
7.0 High | — | 0,26% | 14 Jul 2026 |
|
CVE-2026-48581
microsoft surface go 2 1901 firmware, microsoft surface go 2 1926 firmware +25 lainnya
Insufficient granularity of access control in Microsoft Surface allows an authorized attacker to elevate privileges locally.
|
7.8 High | — | 0,30% | 14 Jul 2026 |
|
CVE-2026-48572
microsoft windows 11 23h2, microsoft windows 11 24h2 +3 lainnya
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows App Installer allows an authorized attacker to elevate privileges l...
|
7.0 High | — | 0,20% | 14 Jul 2026 |
|
CVE-2026-48571
microsoft windows 11 23h2, microsoft windows 11 24h2 +3 lainnya
Use after free in Windows App Installer allows an authorized attacker to elevate privileges locally.
|
7.0 High | — | 0,26% | 14 Jul 2026 |
|
CVE-2026-48564
microsoft windows 10 1607, microsoft windows 10 1809 +5 lainnya
Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over a network.
|
8.8 High | — | 0,91% | 14 Jul 2026 |
|
CVE-2026-48561
microsoft 365 copilot
Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to execute code over...
|
9.6 Critical | — | 0,86% | 14 Jul 2026 |
|
CVE-2026-47632
microsoft azure connected machine agent
Improper certificate validation in Azure Connected Machine Agent allows an unauthorized attacker to elevate privileges over an adjacent network.
|
8.8 High | — | 0,50% | 14 Jul 2026 |
|
CVE-2026-47296
microsoft sql server 2016, microsoft sql server 2017 +3 lainnya
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
|
7.5 High | — | 0,69% | 14 Jul 2026 |
|
CVE-2026-47282
microsoft visual studio code
Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.
|
6.5 Medium | — | 0,87% | 14 Jul 2026 |
|
CVE-2026-45646
microsoft asp.net core odata, microsoft odata web api
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
|
7.5 High | — | 1,2% | 14 Jul 2026 |
|
CVE-2026-45496
microsoft visual studio code
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
|
5.5 Medium | — | 0,48% | 14 Jul 2026 |
|
CVE-2026-44806
microsoft windows 10 1607, microsoft windows 10 1809 +10 lainnya
Missing release of memory after effective lifetime in Windows Cryptographic Services allows an unauthorized attacker to deny service over a network.
|
7.5 High | — | 1,2% | 14 Jul 2026 |
|
CVE-2026-44800
microsoft windows 11 23h2, microsoft windows 11 24h2 +3 lainnya
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privile...
|
7.8 High | — | 0,20% | 14 Jul 2026 |
|
CVE-2026-42990
microsoft windows 10 1607, microsoft windows 10 1809 +10 lainnya
Heap-based buffer overflow in SQL Server ODBC driver allows an unauthorized attacker to execute code over a network.
|
9.8 Critical | — | 0,97% | 14 Jul 2026 |
|
CVE-2026-42982
microsoft windows 10 1607, microsoft windows 10 1809 +10 lainnya
Improper validation of consistency within input in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.
|
7.8 High | — | 0,33% | 14 Jul 2026 |
|
CVE-2026-42975
microsoft windows 10 1607, microsoft windows 10 1809 +10 lainnya
Heap-based buffer overflow in Windows Bluetooth Port Driver allows an unauthorized attacker to execute code over an adjacent network.
|
8.8 High | — | 0,54% | 14 Jul 2026 |
|
CVE-2026-42900
microsoft windows 10 1607, microsoft windows 10 1809 +9 lainnya
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows App Store allows an unauthorized attacker to elevate privileges ove...
|
8.1 High | — | 0,54% | 14 Jul 2026 |
|
CVE-2026-41087
microsoft windows 10 1607, microsoft windows 10 1809 +9 lainnya
Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.
|
5.5 Medium | — | 0,48% | 14 Jul 2026 |
|
CVE-2026-40422
microsoft windows 10 1607, microsoft windows 10 1809 +9 lainnya
Use of uninitialized resource in Windows File Explorer allows an authorized attacker to disclose information locally.
|
5.5 Medium | — | 0,40% | 14 Jul 2026 |
|
CVE-2026-40400
microsoft windows 10 1607, microsoft windows 10 1809 +10 lainnya
Relative path traversal in Windows PowerShell allows an authorized attacker to execute code over a network.
|
8.0 High | — | 0,87% | 14 Jul 2026 |
Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum
menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat
kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah
perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan
dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk
yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.