Katalog CVE (hal. 979)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 267.603 (Critical 36.783 · High 106.969 · KEV 1.767 · sejak 2020) · Pembaruan terakhir: 4 Nov 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 48.901–48.950 dari 267.603 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-49488 apache openmeetings Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OpenMeetings. This issue affects Apache OpenMeetings: from 5.0.0 b...	6.5 Medium	—	0,70%	14 Jul 2026
CVE-2026-15719 mozilla firefox We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6,...	5.4 Medium	—	0,29%	14 Jul 2026
CVE-2026-15718 mozilla firefox We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6,...	4.3 Medium	—	0,32%	14 Jul 2026
CVE-2026-15692 A weakness has been identified in Tenda BE12 Pro 16.03.66.23. This vulnerability affects the function fromSafeUrlFilter of the file /goform/SafeUrlFilter. Executing a man...	8.8 High	—	0,85%	14 Jul 2026
CVE-2026-15691 A security flaw has been discovered in Tenda BE12 Pro 16.03.66.23. This affects the function fromSafeClientFilter of the file /goform/SafeClientFilter. Performing a manip...	8.8 High	—	0,85%	14 Jul 2026
CVE-2026-15305 Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The restriction was not enfo...	6.3 Medium	—	0,25%	14 Jul 2026
CVE-2026-12588 An attacker with access to an HX 10.0.0 and previous versions, may send specially-crafted data to the HX console. The malicious detection would then trigger decompressio...	6.0 Medium	—	0,33%	14 Jul 2026
CVE-2026-10577 A security issue exists within the 1715-AENTR EtherNet/IP Adapter. The affected product exposes a network-accessible debug port that does not enforce proper privilege con...	10.0 Critical	—	0,41%	14 Jul 2026
CVE-2026-9341 The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and i...	4.3 Medium	—	0,35%	14 Jul 2026
CVE-2026-15690 A vulnerability was identified in open62541 up to 1.5.5. Affected by this issue is the function responseReadNamespacesArray of the file src/client/ua_client_connect.c of...	3.1 Low	—	0,44%	14 Jul 2026
CVE-2026-62422 jetbrains youtrack In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access lead...	9.8 Critical	—	0,61%	14 Jul 2026
CVE-2026-15389 A vulnerability relating to insufficient access control has been identified in the session management of the Sesame Time web application and its REST v3 API. The flaw lie...	8.7 High	—	0,44%	14 Jul 2026
CVE-2026-58319 apache doris Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication. An unauthenticated attacker with network access to the FE HTTP servic...	9.1 Critical	—	0,75%	14 Jul 2026
CVE-2026-56451 A vulnerability has been identified in Opcenter X (All versions < V2604). Affected applications do not properly validate the algorithm specified in the JSON Web Token (JW...	10.0 Critical	—	0,50%	14 Jul 2026
CVE-2026-54429 A vulnerability has been identified in SIMATIC S7-PLCSIM Advanced (All versions). Affected devices do not properly handle high-volume multicast network traffic, which can...	7.4 High	—	0,27%	14 Jul 2026
CVE-2026-3014 Milestone has released a new version of XProtect® (and several cumulative patch updates) which fix security vulnerability in Management Server API. The vulnerability c...	9.1 Critical	—	0,78%	14 Jul 2026
CVE-2026-15043 DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text. DBI::SQL::Nano, DBI's built-in mini-SQL engine, evaluated WHERE pr...	9.8 Critical	—	0,67%	14 Jul 2026
CVE-2026-14852 Privilege escalation in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 (EOL) allows a local unprivileged user to execute a...	5.2 Medium	—	0,18%	14 Jul 2026
CVE-2026-12478 The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprote...	4.8 Medium	—	0,24%	14 Jul 2026
CVE-2025-40945 A vulnerability has been identified in COMOS V10.4.5 (All versions < V10.4.5.0.2), COMOS V10.6 (All versions < V10.6.1), Designcenter NX (All versions < V2512.7000), Simc...	6.7 Medium	—	0,16%	14 Jul 2026
CVE-2026-9561 eclipse kura Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the authoritative source of the client IP address in audit log entries. The...	8.2 High	—	0,28%	14 Jul 2026
CVE-2026-8384 eclipse jetty In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead o...	5.3 Medium	—	0,33%	14 Jul 2026
CVE-2026-6790 eclipse jetty In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if...	5.3 Medium	—	0,31%	14 Jul 2026
CVE-2026-59246 Allocation of resources without limits vulnerability in elixir-mint mint allows a remote HTTP/2 server to exhaust memory on the client host and cause a denial of service....	6.3 Medium	—	0,50%	14 Jul 2026
CVE-2026-59084 apache tomcat Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This...	9.1 Critical	—	0,51%	14 Jul 2026
CVE-2026-59083 apache tomcat Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue af...	9.1 Critical	—	0,52%	14 Jul 2026
CVE-2026-58229 Allocation of resources without limits vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory on the client host and cause a denial of service....	8.2 High	—	0,50%	14 Jul 2026
CVE-2026-57898 In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments using the MongoDB backend are vulnerable to an unauthenticated arbitrary f...	9.0 Critical	—	0,68%	14 Jul 2026
CVE-2026-15416 A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift GitOps, that could allow an unauthenticated attacker with network access to the Argo CD repo...	8.9 High	—	0,47%	14 Jul 2026
CVE-2026-15183 Multiple input validation vulnerabilities in the Snowflake Spark Connector (spark-snowflake) versions prior to 3.2.1 can allow attackers to exfiltrate OAuth client creden...	9.2 Critical	—	0,31%	14 Jul 2026
CVE-2026-15076 eclipse vert.x In versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession component of Eclipse Vert.x Web Client does not validate that the Domain...	7.5 High	—	0,20%	14 Jul 2026
CVE-2026-15075 eclipse vert.x In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates all request headers as-is across...	7.5 High	—	0,20%	14 Jul 2026
CVE-2026-13699 eclipse kuksa In Eclipse KUKSA Databroker version 0.6.1, the kuksa.val.v2.VAL/PublishValue gRPC handler fails to validate the existence of the optional data_point field in PublishValue...	6.5 Medium	—	0,39%	14 Jul 2026
CVE-2026-12606 eclipse grizzly Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line, which can be leveraged to perform HTTP request smu...	5.3 Medium	—	0,30%	14 Jul 2026
CVE-2026-10051 eclipse jetty In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection. Subsequent re...	7.5 High	—	0,43%	14 Jul 2026
CVE-2025-8412 A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in SUSE Virtual Machine Driver Pack allows an attacker with the ability to modify t...	2.0 Low	—	0,12%	14 Jul 2026
CVE-2024-7708 eclipse jetty For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. This is particularly the case for 100-Continue, but any request...	7.5 High	—	0,44%	14 Jul 2026
CVE-2026-6851 bitdefender internet security, bitdefender total security An Improper link resolution before file access ('link following') vulnerability in the File Shredder module as used in Bitdefender Total Security and Internet Security on...	7.0 High	—	0,15%	14 Jul 2026
CVE-2026-59674 A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed suricata package allows the suricata user to escalate to root. This issue affects open...	7.1 High	—	0,17%	14 Jul 2026
CVE-2026-15678 A security vulnerability has been detected in code-projects Online Job Portal 1.0. This impacts an unknown function of the file /Admin/DetailJob.php. The manipulation lea...	3.5 Low	—	0,35%	14 Jul 2026
CVE-2026-15677 A weakness has been identified in code-projects Online Job Portal 1.0. This affects an unknown function of the file /JobSeekerInsert.php. Executing a manipulation of the...	7.3 High	—	0,50%	14 Jul 2026
CVE-2026-15676 A security flaw has been discovered in code-projects Online Job Portal up to 1.0. The impacted element is an unknown function of the file /Admin/DeleteUser.php. Performin...	7.3 High	—	0,43%	14 Jul 2026
CVE-2026-15675 A vulnerability was identified in code-projects Online Job Portal 1.0. The affected element is an unknown function of the file /Admin/EditUser.php. Such manipulation of t...	7.3 High	—	0,43%	14 Jul 2026
CVE-2026-15672 A vulnerability was determined in itsourcecode Electronic Judging System 1.0. Impacted is an unknown function of the file /intrams/admin/add_judges.php. This manipulation...	6.3 Medium	—	0,33%	14 Jul 2026
CVE-2026-15669 A vulnerability was found in louisho5 picobot up to 0.2.0. This issue affects the function ExecTool.Execute of the file internal/agent/tools/exec.go of the component exec...	5.3 Medium	—	1,1%	14 Jul 2026
CVE-2026-12988 The WP 2FA WordPress plugin before 3.1.1.2 does not verify that the email address supplied during two-factor authentication setup belongs to the user, allowing an attack...	6.4 Medium	—	0,28%	14 Jul 2026
CVE-2026-12583 The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input that is stored through a public form, allowing unauthenticated attackers...	8.1 High	—	0,55%	14 Jul 2026
CVE-2026-12511 The AI Engine WordPress plugin before 3.5.5 does not sanitize a user-supplied filename before using it to write a downloaded file, allowing authenticated users with edit...	8.1 High	—	0,47%	14 Jul 2026
CVE-2026-12482 keras A vulnerability in keras-team/keras version 3.12.0 allows an attacker to craft a malicious tar archive that bypasses the `filter_safe_tarinfos` validation in `keras/src/u...	6.5 Medium	—	0,33%	14 Jul 2026
CVE-2026-11567 The SureForms WordPress plugin before 2.11.1 does not properly validate the payment amount on forms that use a dynamically-sourced (variable/hidden) payment amount, allo...	5.9 Medium	—	0,29%	14 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.