Katalog CVE (hal. 315)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 260.253 (Critical 36.047 · High 103.974 · KEV 1.748 · sejak 2020) · Pembaruan terakhir: 21 Okt 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 15.701–15.750 dari 260.253 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-92234 QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Reservation System feature management page. Authentic...	5.4 Medium	—	0,31%	15 Sep 2026
CVE-2026-92000 adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attackers can craft malicious ZIP ar...	7.5 High	—	0,68%	15 Sep 2026
CVE-2026-91939 Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without allowed_classes restriction, allowing unauthenticated attackers to instantiate arbitrar...	9.8 Critical	—	0,98%	15 Sep 2026
CVE-2026-91749 google chrome Use after free in Workers in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML p...	9.6 Critical	—	0,38%	15 Sep 2026
CVE-2026-91748 google chrome Race condition in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social eng...	8.3 High	—	0,23%	15 Sep 2026
CVE-2026-91747 google chrome Use after free in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafte...	3.1 Low	—	0,25%	15 Sep 2026
CVE-2026-91746 google chrome Integer overflow in Compositing in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security...	4.3 Medium	—	0,23%	15 Sep 2026
CVE-2026-91745 google chrome Use after free in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium sec...	8.8 High	—	0,34%	15 Sep 2026
CVE-2026-91744 google chrome Race condition in PlatformIntegration in Google Chrome on on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged s...	5.3 Medium	—	0,23%	15 Sep 2026
CVE-2026-91743 google chrome Race condition in Core in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code ou...	8.3 High	—	0,25%	15 Sep 2026
CVE-2026-91742 google chrome Confused deputy in PriceTracking in Google Chrome on on iOS prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to bypass system access restric...	4.8 Medium	—	0,19%	15 Sep 2026
CVE-2026-91741 google chrome Type confusion in CacheStorage in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Ch...	8.8 High	—	0,44%	15 Sep 2026
CVE-2026-91740 google chrome Uninitialized resource in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security s...	4.3 Medium	—	0,25%	15 Sep 2026
CVE-2026-91739 google chrome Missing authorization in Transactions Platform in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to spoof UI elem...	4.2 Medium	—	0,19%	15 Sep 2026
CVE-2026-91738 google chrome Improper input validation in ANGLE in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a craft...	9.6 Critical	—	0,34%	15 Sep 2026
CVE-2026-91737 google chrome Use after free in PDF in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium se...	8.8 High	—	0,34%	15 Sep 2026
CVE-2026-91736 google chrome Use after free in DOM in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium se...	8.8 High	—	0,34%	15 Sep 2026
CVE-2026-91735 google chrome Incorrect authorization in WebUI in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitra...	8.3 High	—	0,31%	15 Sep 2026
CVE-2026-91734 google chrome Incorrect authorization in Core in Google Chrome on on Windows prior to 153.0.8010.47 allowed a local attacker to execute arbitrary code outside the sandbox via a local p...	7.4 High	—	0,10%	15 Sep 2026
CVE-2026-91733 google chrome Improper state validation in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to read memory outside the sa...	8.3 High	—	0,32%	15 Sep 2026
CVE-2026-91732 google chrome Missing authorization in AppManifest in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social engin...	8.1 High	—	0,26%	15 Sep 2026
CVE-2026-91731 google chrome Type confusion in Compositing in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chr...	8.8 High	—	0,44%	15 Sep 2026
CVE-2026-91730 google chrome Incomplete cleanup in GetUserMedia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social enginee...	3.1 Low	—	0,23%	15 Sep 2026
CVE-2026-91729 google chrome Use after free in DigitalCredentials in Google Chrome prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the...	9.6 Critical	—	0,34%	15 Sep 2026
CVE-2026-91728 google chrome Integer overflow in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium s...	9.6 Critical	—	0,41%	15 Sep 2026
CVE-2026-91727 google chrome Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a local attacker who had compromised the renderer process to execut...	8.1 High	—	0,11%	15 Sep 2026
CVE-2026-91726 google chrome Out of bounds read in WebGL in Google Chrome on on Android prior to 153.0.8010.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (C...	4.7 Medium	—	0,27%	15 Sep 2026
CVE-2026-91725 google chrome Observable discrepancy in CSS in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security...	5.3 Medium	—	0,24%	15 Sep 2026
CVE-2026-91724 google chrome Use after free in Input in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code o...	8.3 High	—	0,34%	15 Sep 2026
CVE-2026-91723 google chrome Race condition in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severi...	3.1 Low	—	0,17%	15 Sep 2026
CVE-2026-91722 google chrome Use after free in Input in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML pag...	8.8 High	—	0,31%	15 Sep 2026
CVE-2026-91721 google chrome Use after free in Internals in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML...	8.8 High	—	0,39%	15 Sep 2026
CVE-2026-91720 google chrome Uninitialized resource in ANGLE in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium se...	4.7 Medium	—	0,28%	15 Sep 2026
CVE-2026-91719 google chrome Code injection in XML in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity:...	8.1 High	—	0,23%	15 Sep 2026
CVE-2026-91718 google chrome Use after free in Core in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium...	9.6 Critical	—	0,33%	15 Sep 2026
CVE-2026-91717 google chrome Missing authorization in Android in Google Chrome on on Android prior to 153.0.8010.47 allowed a local attacker to obtain sensitive information via a co-installed app. (C...	5.1 Medium	—	0,09%	15 Sep 2026
CVE-2026-91716 google chrome Use after free in Auth in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium...	9.6 Critical	—	0,31%	15 Sep 2026
CVE-2026-91715 google chrome Type confusion in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (C...	8.8 High	—	0,33%	15 Sep 2026
CVE-2026-91714 google chrome Observable discrepancy in Fonts in Google Chrome prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafte...	5.3 Medium	—	0,24%	15 Sep 2026
CVE-2026-91713 google chrome Missing authorization in Browser in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a cra...	4.2 Medium	—	0,19%	15 Sep 2026
CVE-2026-91712 google chrome Race condition in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute a...	8.3 High	—	0,27%	15 Sep 2026
CVE-2026-91711 google chrome Out of bounds write in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML pag...	8.8 High	—	0,31%	15 Sep 2026
CVE-2026-91710 google chrome Use after free in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page....	9.6 Critical	—	0,31%	15 Sep 2026
CVE-2026-91709 google chrome Type confusion in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (C...	8.8 High	—	0,41%	15 Sep 2026
CVE-2026-91708 google chrome Race condition in Network in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a cra...	3.1 Low	—	0,16%	15 Sep 2026
CVE-2026-88065 `tts-be` is a backend for a timetable selector that aims to help students better choose their class schedules. Versions prior to 2.1.0 have a Broken Access Control vulner...	7.5 High	—	0,51%	15 Sep 2026
CVE-2026-81927 concretecms concrete cms Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processing was set to the non-default "Reject files contain...	5.4 Medium	—	0,24%	15 Sep 2026
CVE-2026-81926 concretecms concrete cms Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's duplicate-path confirmation dialog. The panel's check e...	6.1 Medium	—	0,26%	15 Sep 2026
CVE-2026-79994 The guest-to-host Unix-domain socket relay in Docker Sandboxes validates that a socket path is inside an authorized workspace, but later reconnects using the pathname. A...	8.7 High	—	0,14%	15 Sep 2026
CVE-2026-68953 The affected products are vulnerable to an authentication bypass that allows unauthenticated remote attackers to disclose sensitive device information, including administ...	6.5 Medium	—	0,56%	15 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.