Katalog CVE (hal. 977)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 267.603 (Critical 36.783 · High 106.969 · KEV 1.767 · sejak 2020) · Pembaruan terakhir: 4 Nov 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 48.801–48.850 dari 267.603 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-40378 microsoft windows 10 1607, microsoft windows 10 1809 +11 lainnya Memory allocation with excessive size value in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.	7.5 High	—	1,2%	14 Jul 2026
CVE-2026-36214 osTicket versions from 1.10 up to 1.17.7 and from 1.18.0 up to 1.18.3 are vulnerable to a stored XSS due to a vulnerable Bootstrap Tooltip component and insufficient HTML...	6.4 Medium	—	0,38%	14 Jul 2026
CVE-2026-34349 microsoft windows 10 1809, microsoft windows 10 21h2 +7 lainnya Exposure of sensitive information to an unauthorized actor in Windows Media allows an authorized attacker to disclose information locally.	5.5 Medium	—	0,48%	14 Jul 2026
CVE-2026-34348 microsoft windows 10 1809, microsoft windows 10 21h2 +8 lainnya Protection mechanism failure in Windows Event Logging Service allows an authorized attacker to disclose information over a network.	6.5 Medium	—	1,00%	14 Jul 2026
CVE-2026-34346 microsoft windows 10 1607, microsoft windows 10 1809 +11 lainnya Cleartext transmission of sensitive information in Windows Ancillary Function Driver for WinSock allows an authorized attacker to disclose information locally.	5.5 Medium	—	0,27%	14 Jul 2026
CVE-2026-34328 microsoft windows 10 1809, microsoft windows 10 21h2 +8 lainnya Exposure of sensitive information to an unauthorized actor in Windows Audio Service allows an authorized attacker to disclose information locally.	5.5 Medium	—	0,48%	14 Jul 2026
CVE-2026-33842 microsoft windows 10 1607, microsoft windows 10 1809 +11 lainnya Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.	5.5 Medium	—	0,48%	14 Jul 2026
CVE-2026-15703 A vulnerability was detected in SourceCodester Simple and Nice Shopping Cart Script 1.0. This vulnerability affects unknown code of the file /admin/userproductdeletequery...	7.3 High	—	0,43%	14 Jul 2026
CVE-2026-15702 A security vulnerability has been detected in tamagui up to 2.3.0. This affects the function updateConfig of the file code/core/web/src/config.ts. Such manipulation leads...	6.3 Medium	—	0,46%	14 Jul 2026
CVE-2026-15701 A weakness has been identified in Totolink NR1800X 9.1.0u.6279_B20210910. Affected by this issue is the function Form_Logout of the file /formLogout.htm of the component...	9.8 Critical	—	1,1%	14 Jul 2026
CVE-2026-15700 A security flaw has been discovered in DedeCMS 5.7.118. Affected by this vulnerability is the function ExtractFile of the file include/zip.class.php of the component Albu...	4.7 Medium	—	0,46%	14 Jul 2026
CVE-2026-15429 tp-link archer vx1800v firmware A privilege escalation vulnerability exists in the HTTP authentication component in Archer VX1800v v1. Improper handling of user-controlled input may allow newline charac...	8.8 High	—	1,4%	14 Jul 2026
CVE-2026-15428 tp-link archer vx1800v firmware An OS command injection vulnerability exists in Archer VX800v v1 due to insufficient input sanitization of the domain name parameter. An adjacent attacker who can access...	8.8 High	—	2,1%	14 Jul 2026
CVE-2026-15427 tp-link archer vx1800v firmware An OS command injection vulnerability exists in the TR-069 / CWMP management interface of Archer VX1800v v1 due to insufficient input validation and sanitization of param...	8.1 High	—	0,84%	14 Jul 2026
CVE-2026-14646 sonatype nexus repository manager Nexus Repository 3 did not apply its existing Server-Side Request Forgery (SSRF) protections to HTTP redirect targets returned by proxy repository upstream servers. Any u...	7.7 High	—	0,35%	14 Jul 2026
CVE-2026-14645 sonatype nexus repository manager Nexus Repository 3 does not validate the destination of the "Webhook: Global" capability's configured URL before making an outbound HTTP request, allowing a user holding...	5.5 Medium	—	0,36%	14 Jul 2026
CVE-2026-9636 A security issue exists within CompactLogix® 5380, ControlLogix® 5580, and EN4 communication modules related to CIP Security certificate revocation handling. The security...	8.2 High	—	0,22%	14 Jul 2026
CVE-2026-9292 A Stored Cross-Site Scripting security issue exists within FactoryTalk® DataMosaix™ Private Cloud. The vulnerability stems from improper neutralization of user-supplied i...	8.4 High	—	0,53%	14 Jul 2026
CVE-2026-9128 rockwellautomation studio 5000 logix designer A code execution security issue exists within Studio 5000 Logix Designer® due to an unquoted search path in the External Tools configuration. The executable paths specifi...	7.5 High	—	0,17%	14 Jul 2026
CVE-2026-9127 rockwellautomation studio 5000 logix designer A remote code execution security issue exists within Studio 5000 Logix Designer® due to incorrect authorization on a configuration file. This can allow any authenticated...	7.5 High	—	0,15%	14 Jul 2026
CVE-2026-9108 rockwellautomation studio 5000 logix designer A path traversal security issue exists within Studio 5000 Logix Designer® due to improper limitation of file paths within ACD project files. The software does not sanitiz...	7.5 High	—	0,18%	14 Jul 2026
CVE-2026-7494 sonatype nexus repository manager Nexus Repository 3 is vulnerable to Server-Side Request Forgery (SSRF) via the SSL Certificate Retrieval endpoint. A user holding the nexus:ssl-truststore:read permission...	5.0 Medium	—	0,19%	14 Jul 2026
CVE-2026-62644 roundcube webmail In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via session data, which could lea...	9.8 Critical	—	0,26%	14 Jul 2026
CVE-2026-62643 roundcube webmail In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information...	10.0 Critical	—	0,30%	14 Jul 2026
CVE-2026-62642 roundcube webmail In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the TNEF decoder, which may lead to denial of service upon opening an email...	6.5 Medium	—	0,28%	14 Jul 2026
CVE-2026-62641 roundcube webmail In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the TNEF decoder was subject to denial of service via a crafted compressed-RTF size.	6.5 Medium	—	0,25%	14 Jul 2026
CVE-2026-60119 Hi.Events before 1.11.0 contains a cross-site scripting vulnerability that allows authenticated attackers with event creation or edit permissions to inject arbitrary HTML...	5.4 Medium	—	0,30%	14 Jul 2026
CVE-2026-60118 Hi.Events before 1.11.0 contains a missing server-side visibility enforcement vulnerability that allows unauthenticated attackers to purchase hidden tickets by referencin...	5.3 Medium	—	0,30%	14 Jul 2026
CVE-2026-60082 DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row. When the statement handle had no fields but the source row was non-empty, th...	9.1 Critical	—	0,65%	14 Jul 2026
CVE-2026-60081 DBI::ProfileData versions before 1.651 for Perl do not limit the path index. The path index column of profile dump files is used to allocate an array of data for the par...	7.5 High	—	0,63%	14 Jul 2026
CVE-2026-59841 fortinet fortisiem A improper restriction of communication channel to intended endpoints vulnerability in Fortinet FortiSIEMWindowsAgent 7.4.0 through 7.4.1 may allow attacker to escalation...	7.5 High	—	0,24%	14 Jul 2026
CVE-2026-59840 fortinet fortiproxy, fortinet fortios A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all...	4.3 Medium	—	0,31%	14 Jul 2026
CVE-2026-59839 fortinet fortiproxy, fortinet fortios +1 lainnya A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4.0 through 7.4.9, Forti...	5.5 Medium	—	0,25%	14 Jul 2026
CVE-2026-59837 fortinet fortiproxy, fortinet fortios +1 lainnya A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPA...	6.6 Medium	—	0,67%	14 Jul 2026
CVE-2026-59836 fortinet forticlientems A improper certificate validation vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.5, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2 all versions may al...	9.8 Critical	—	0,22%	14 Jul 2026
CVE-2026-59835 fortinet fortisandbox A exposure of resource to wrong sphere vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.3 through 4.4.8 may allow an unauthenticated attacker...	8.6 High	—	0,40%	14 Jul 2026
CVE-2026-59205 python pillow Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption when the calle...	7.5 High	—	0,39%	14 Jul 2026
CVE-2026-59204 python pillow Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000 image inste...	7.5 High	—	0,39%	14 Jul 2026
CVE-2026-59203 python pillow Pillow is a Python imaging library. From 12.0.0 through 12.2.0, Pillow's EPS parser in PIL/EpsImagePlugin.py accepts a negative byte count in the %%BeginBinary directive,...	7.5 High	—	0,40%	14 Jul 2026
CVE-2026-59199 python pillow Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the sig...	7.5 High	—	0,39%	14 Jul 2026
CVE-2026-59198 python pillow Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE compression...	7.5 High	—	0,31%	14 Jul 2026
CVE-2026-55954 Authentication Bypass by Spoofing vulnerability in ueberauth ueberauth_apple allows account takeover via unvalidated ID token claims. The Ueberauth.Strategy.Apple.Token....	9.1 Critical	—	0,51%	14 Jul 2026
CVE-2026-55651 Easy!Appointments is a self hosted appointment scheduler. In version 1.5.2, an Excessive Data Exposure vulnerability in the customers search endpoint allows an authentica...	7.1 High	—	0,23%	14 Jul 2026
CVE-2026-52841 Easy!Appointments is a self hosted appointment scheduler. In versions prior to 1.6.0, `Google::oauth` at `application/controllers/Google.php:278` stores its URL-supplied...	3.1 Low	—	0,21%	14 Jul 2026
CVE-2026-52840 Easy!Appointments is a self hosted appointment scheduler. In versions prior to 1.6.0, `Caldav::connect_to_server` at `application/controllers/Caldav.php:60` hands the req...	2.7 Low	—	0,23%	14 Jul 2026
CVE-2026-52839 Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 correctly filter provider-scoped appointments in the `appointments/search` response, pro...	3.3 Low	—	0,18%	14 Jul 2026
CVE-2026-52838 Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 allow administrators to define a custom "booking disabled" message through the booking s...	2.6 Low	—	0,22%	14 Jul 2026
CVE-2026-23573 fortinet fortiproxy, fortinet fortios +1 lainnya An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, Fort...	6.1 Medium	—	0,39%	14 Jul 2026
CVE-2026-15699 A vulnerability was identified in spencermountain compromise up to 14.15.1. Affected is the function nlp.extend of the file src/API/extend.js of the component Public Root...	6.3 Medium	—	0,45%	14 Jul 2026
CVE-2026-15698 A vulnerability was determined in kofrasa mingo up to 7.2.1. This impacts the function update/updateOne/updateMany of the component Update API. Executing a manipulation o...	6.3 Medium	—	0,46%	14 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.