Katalog CVE (hal. 978)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 267.603 (Critical 36.783 · High 106.969 · KEV 1.767 · sejak 2020) · Pembaruan terakhir: 4 Nov 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 48.851–48.900 dari 267.603 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-15697 A vulnerability was found in svgdotjs svg.js up to 3.2.5. This affects the function EventTarget.on of the file svgdotjs/svg.js of the component npm Package API. Performin...	6.3 Medium	—	0,45%	14 Jul 2026
CVE-2026-15392 DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location. The complete_table_name method builds the absolute table...	7.7 High	—	0,20%	14 Jul 2026
CVE-2026-14504 sonatype nexus repository manager An authorization bypass in Nexus Repository 3's component upload API allowed a user with only read/browse privileges on a Swift, Terraform, or Conda hosted repository to...	6.5 Medium	—	0,37%	14 Jul 2026
CVE-2026-12707 Summary Cloudflare quiche was discovered to be vulnerable to memory resource exhaustion due to unbounded queuing of post-handshake client migration events. Impact...	7.5 High	—	0,44%	14 Jul 2026
CVE-2026-12659 A denial-of-service security issue exists in the affected products. The security issue stems from improper handling of exceptional conditions when processing crafted CIP...	8.7 High	—	0,43%	14 Jul 2026
CVE-2026-12523 cloudflare quiche Summary Cloudflare quiche's HTTP/3 layer was discovered to be vulnerable to resource exhaustion (i.e., memory) by means of specially crafted HTTP/3 frames. Impact...	7.5 High	—	0,53%	14 Jul 2026
CVE-2026-11944 os4ed opensis openSIS Classic 9.3 contains an authenticated path traversal vulnerability in the legacy messaging sent-mail attachment download functionality that allows an authenticate...	6.5 Medium	—	0,48%	14 Jul 2026
CVE-2026-11917 A path traversal security issue exists within Rockwell Automation ThinManager® software due to improper limitation of file save operations within the API. An authenticate...	7.2 High	—	0,44%	14 Jul 2026
CVE-2026-11403 sonatype nexus repository manager A vulnerability in Sonatype Nexus Repository Manager's format-specific API key generation may allow a remote attacker to gain unauthorized access to repository operations...	7.5 High	—	0,53%	14 Jul 2026
CVE-2025-62826 fortinet fortiproxy, fortinet fortios An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, Fo...	4.3 Medium	—	0,37%	14 Jul 2026
CVE-2025-62675 fortinet fortiproxy, fortinet fortios An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, Fo...	4.3 Medium	—	0,27%	14 Jul 2026
CVE-2025-53379 fortinet fortiauthenticator A out-of-bounds read vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.2, FortiAuthenticator 6.5 all versions may allow a remote unauthenticated attacker to...	7.5 High	—	0,53%	14 Jul 2026
CVE-2025-43892 fortinet fortiproxy, fortinet fortios A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all...	4.3 Medium	—	0,38%	14 Jul 2026
CVE-2025-11698 A denial-of-service issue exists in 5380/5480/5580 controllers boot firmware lower than version 1.072. This vulnerability could potentially allow a malicious user to writ...	9.2 Critical	—	0,43%	14 Jul 2026
CVE-2026-9653 A denial-of-service security issue exists across all the 1756-EN2, EN3, and ENBT communication module due to improper validation of CIP Implicit Connection packets. An at...	8.7 High	—	0,23%	14 Jul 2026
CVE-2026-9140 A denial-of-service security issue exists in the 1719-AENTR. The security issue stems from improper handling of a UDP unicast network storm, which causes the device to be...	8.7 High	—	0,43%	14 Jul 2026
CVE-2026-8590 Vulnerability in Spotfire Spotfire Enterprise (Spotfire Server modules), Spotfire Spotfire Enterprise with External Consumers (Spotfire Server modules), Spotfire Spotfire...	8.7 High	—	0,43%	14 Jul 2026
CVE-2026-60114 dan-in-ca sustainable irrigation platform Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a path traversal vulnerability that allows attackers with access to the restore functionality to wri...	7.5 High	—	0,50%	14 Jul 2026
CVE-2026-58479 dan-in-ca sustainable irrigation platform Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a command injection vulnerability in the optional cli_control plugin that allows unauthenticated or...	9.8 Critical	—	4,4%	14 Jul 2026
CVE-2026-58478 dan-in-ca sustainable irrigation platform Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated attackers to make the...	6.5 Medium	—	0,38%	14 Jul 2026
CVE-2026-58477 dan-in-ca sustainable irrigation platform Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a mass assignment vulnerability that allows unauthenticated attackers to overwrite sensitive configu...	7.5 High	—	0,51%	14 Jul 2026
CVE-2026-58476 dan-in-ca sustainable irrigation platform Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-changing ad...	8.1 High	—	0,27%	14 Jul 2026
CVE-2026-58475 dan-in-ca sustainable irrigation platform Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrar...	6.1 Medium	—	0,31%	14 Jul 2026
CVE-2026-52837 Easy!Appointments is a self hosted appointment scheduler. In versions up to and including 1.5.2, the booking reschedule view at `/index.php/booking/reschedule/{appointmen...	6.9 Medium	—	0,46%	14 Jul 2026
CVE-2026-51105 Buffer Overflow vulnerability in aMULE-Project aMule v.2.3.3 allows a remote attacker to cause a denial of service via the OP_SERVERMESSAGE Handler.	7.5 High	—	0,37%	14 Jul 2026
CVE-2026-15736 Snowflake SQLAlchemy versions prior to 1.11.0 contain several security vulnerabilities, including: Improper handling of user-supplied column identifiers in merge operatio...	8.3 High	—	0,38%	14 Jul 2026
CVE-2026-15696 A vulnerability has been found in Tenda BE12 Pro 16.03.66.23. The impacted element is the function fromVirtualSer of the file /goform/VirtualSer. Such manipulation of the...	8.8 High	—	0,85%	14 Jul 2026
CVE-2026-15695 A flaw has been found in Tenda BE12 Pro 16.03.66.23. The affected element is the function fromDhcpListClient of the file /goform/DhcpListClient. This manipulation of the...	8.8 High	—	0,85%	14 Jul 2026
CVE-2026-15694 A vulnerability was detected in Tenda BE12 Pro 16.03.66.23. Impacted is the function fromSetIpBind of the file /goform/SetIpBind. The manipulation of the argument page re...	8.8 High	—	0,85%	14 Jul 2026
CVE-2026-15265 tenable nessus agent A path traversal vulnerability in Tenable Agent 11.2.0 and 11.1.3 and lower allows a privileged attacker to write arbitrary files outside the intended plugin directory, p...	9.1 Critical	—	0,56%	14 Jul 2026
CVE-2026-14903 ivanti xtraction Path traversal in Ivanti Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web root.	6.5 Medium	—	1,2%	14 Jul 2026
CVE-2026-14902 ivanti xtraction An open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary external URLs.	6.1 Medium	—	0,71%	14 Jul 2026
CVE-2026-10714 A security issue exists within FactoryTalk® Services Platform (FTSP), allowing an attacker to bypass JWT signature validation during Okta Web Authentication. The vulnerab...	8.8 High	—	0,15%	14 Jul 2026
CVE-2026-10672 zephyrproject zephyr subsys/net/lib/lwm2m/lwm2m_pull_context.c copied the firmware-update Package URI into a fixed static buffer (context.uri, size CONFIG_LWM2M_SWMGMT_PACKAGE_URI_LEN, defaul...	9.1 Critical	—	0,58%	14 Jul 2026
CVE-2026-10671 zephyrproject zephyr In Zephyr's kernel pipe implementation, the userspace syscall verifier z_vrfy_k_pipe_init() in kernel/pipe.c used K_SYSCALL_OBJ() (which requires the kernel object to alr...	7.1 High	—	0,16%	14 Jul 2026
CVE-2026-10670 zephyrproject zephyr The CONFIG_USERSPACE verification handler for the k_thread_name_copy() system call (z_vrfy_k_thread_name_copy() in kernel/thread.c) calls k_object_find() on the caller-su...	5.5 Medium	—	0,15%	14 Jul 2026
CVE-2026-10669 zephyrproject zephyr On Xtensa SoCs built with CONFIG_XTENSA_MPU and CONFIG_USERSPACE, arch_buffer_validate() in arch/xtensa/core/mpu.c — the architecture hook that verifies a user-mode-suppl...	7.8 High	—	0,18%	14 Jul 2026
CVE-2026-10573 A denial-of-service security issue exists in 1734 POINT I/O™ module. The security issue stems from improper handling of crafted CIP messages, which can cause the module t...	6.3 Medium	—	0,33%	14 Jul 2026
CVE-2025-12012 A denial-of-service issue exists in 5380/5480/5580 controllers. This vulnerability could potentially allow a malicious user to write invalid file data to the controller,...	9.2 Critical	—	0,43%	14 Jul 2026
CVE-2025-12011 A denial-of-service issue exists in 5370/5570 controllers. This vulnerability could potentially allow a remote user to load an invalid project, causing the device to ent...	9.2 Critical	—	0,43%	14 Jul 2026
CVE-2026-53566 Out-of-bounds read vulnerability in Citrix Citrix Secure Access Client for Windows. This issue affects Citrix Secure Access Client for Windows: before 26.6.1.20.	6.8 Medium	—	0,18%	14 Jul 2026
CVE-2026-15693 A security vulnerability has been detected in Tenda BE12 Pro 16.03.66.23. This issue affects the function fromSafeMacFilter of the file /goform/SafeMacFilter. The manipul...	8.8 High	—	0,85%	14 Jul 2026
CVE-2026-8314 rockwellautomation arena A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the siman.exe (Siman) component. The vulnerability stems from improper valida...	7.3 High	—	0,27%	14 Jul 2026
CVE-2026-8313 rockwellautomation arena A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the linker.exe (Siman) component. The vulnerability stems from improper valid...	7.3 High	—	0,27%	14 Jul 2026
CVE-2026-8312 rockwellautomation arena A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the expmt.exe (Siman) component. The vulnerability stems from improper valida...	7.3 High	—	0,27%	14 Jul 2026
CVE-2026-8085 rockwellautomation arena A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the model.exe (Siman) component. The vulnerability stems from improper valida...	7.3 High	—	0,27%	14 Jul 2026
CVE-2026-62393 apache kylin Improper Handling of Insufficient Permissions or Privileges vulnerability in Apache Kylin. Improper authorization in job information retrieval, where an attacker may get...	4.3 Medium	—	0,45%	14 Jul 2026
CVE-2026-62392 apache kylin Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. A backend API may bring job config parameters to...	9.8 Critical	—	2,5%	14 Jul 2026
CVE-2026-62390 apache kylin Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. A backend API refreshing table catalog may cause the i...	9.8 Critical	—	0,69%	14 Jul 2026
CVE-2026-53565 Improper Privilege Management vulnerability in Citrix Secure Access Client for Windows, Citrix Citrix Endpoint Analysis Client for Windows. This issue affects Secure Acc...	8.5 High	—	0,17%	14 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.