Katalog CVE (hal. 382)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 262.397 (Critical 36.228 · High 104.890 · KEV 1.754 · sejak 2020) · Pembaruan terakhir: 22 Okt 2026, 12:26 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 19.051–19.100 dari 262.397 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-92034 mozilla firefox, mozilla thunderbird Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.	9.1 Critical	—	0,27%	15 Sep 2026
CVE-2026-92033 mozilla firefox mobile Privilege escalation in Firefox for Android. This vulnerability was fixed in Firefox 156.	8.8 High	—	0,35%	15 Sep 2026
CVE-2026-92032 mozilla firefox, mozilla thunderbird Sandbox escape due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thun...	9.6 Critical	—	0,32%	15 Sep 2026
CVE-2026-92031 mozilla firefox, mozilla thunderbird Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbi...	6.5 Medium	—	0,31%	15 Sep 2026
CVE-2026-92030 mozilla firefox, mozilla thunderbird Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156,...	5.4 Medium	—	0,22%	15 Sep 2026
CVE-2026-92029 mozilla firefox, mozilla thunderbird Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird...	8.8 High	—	0,32%	15 Sep 2026
CVE-2026-92028 mozilla firefox, mozilla thunderbird Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156,...	8.8 High	—	0,32%	15 Sep 2026
CVE-2026-92027 mozilla firefox, mozilla thunderbird Use-after-free in the DOM: Streams component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thu...	8.8 High	—	0,32%	15 Sep 2026
CVE-2026-92026 mozilla firefox, mozilla thunderbird Use-after-free in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and T...	8.8 High	—	0,31%	15 Sep 2026
CVE-2026-92025 mozilla firefox, mozilla thunderbird Use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156,...	8.8 High	—	0,32%	15 Sep 2026
CVE-2026-92024 mozilla firefox, mozilla thunderbird Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird...	8.8 High	—	0,32%	15 Sep 2026
CVE-2026-92023 mozilla firefox, mozilla thunderbird Use-after-free in the XML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird...	8.8 High	—	0,32%	15 Sep 2026
CVE-2026-92022 mozilla firefox, mozilla thunderbird Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156,...	8.8 High	—	0,32%	15 Sep 2026
CVE-2026-92021 mozilla firefox, mozilla thunderbird Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 140.16 and Thunderbird 140.16.	8.8 High	—	0,28%	15 Sep 2026
CVE-2026-92020 mozilla firefox, mozilla thunderbird Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox E...	8.8 High	—	0,26%	15 Sep 2026
CVE-2026-92019 mozilla firefox, mozilla thunderbird Mitigation bypass in the Remote Settings Client component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunder...	8.1 High	—	0,31%	15 Sep 2026
CVE-2026-92018 mozilla firefox, mozilla thunderbird Sandbox escape in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156,...	9.6 Critical	—	0,33%	15 Sep 2026
CVE-2026-92017 mozilla firefox, mozilla thunderbird Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunde...	8.8 High	—	0,24%	15 Sep 2026
CVE-2026-92016 mozilla firefox, mozilla thunderbird Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 1...	8.8 High	—	0,31%	15 Sep 2026
CVE-2026-92015 mozilla firefox, mozilla thunderbird Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 1...	8.8 High	—	0,26%	15 Sep 2026
CVE-2026-92014 mozilla firefox, mozilla thunderbird Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox ESR 115.41, Firefox ESR 140.16, and Thunderbi...	8.8 High	—	0,24%	15 Sep 2026
CVE-2026-92013 mozilla firefox, mozilla thunderbird Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox...	8.8 High	—	0,26%	15 Sep 2026
CVE-2026-92012 mozilla firefox, mozilla thunderbird Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox...	8.8 High	—	0,26%	15 Sep 2026
CVE-2026-92011 mozilla firefox, mozilla thunderbird Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox...	8.8 High	—	0,26%	15 Sep 2026
CVE-2026-92010 mozilla firefox, mozilla thunderbird Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox...	8.8 High	—	0,26%	15 Sep 2026
CVE-2026-92009 mozilla firefox, mozilla thunderbird Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox...	8.8 High	—	0,26%	15 Sep 2026
CVE-2026-92008 mozilla firefox, mozilla thunderbird Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox...	8.8 High	—	0,26%	15 Sep 2026
CVE-2026-92007 mozilla firefox, mozilla thunderbird Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox...	8.8 High	—	0,26%	15 Sep 2026
CVE-2026-92006 mozilla firefox, mozilla thunderbird Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox...	8.8 High	—	0,33%	15 Sep 2026
CVE-2026-92005 mozilla firefox, mozilla thunderbird Use-after-free in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird...	5.3 Medium	—	0,36%	15 Sep 2026
CVE-2026-15609 The Bridge - Creative Multipurpose WordPress Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'circle_line' Shortcode Attribute in all versions...	6.4 Medium	—	0,19%	15 Sep 2026
CVE-2026-14805 The Consulting theme for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 6.7.16. This is due to a combination of two flaws: (1) the mast...	8.8 High	—	0,31%	15 Sep 2026
CVE-2026-92003 Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle. Two API authentication failure branches wrote directly to the...	6.9 Medium	—	0,57%	15 Sep 2026
CVE-2026-92002 Affected versions of MISP use Redis to throttle repeated authentication-failure log entries. The intent is to avoid excessive duplicate logs while still recording failed...	5.1 Medium	—	0,53%	15 Sep 2026
CVE-2026-91998 Casdoor through 4.4.0 contains an authorization bypass vulnerability in the /api/mcp endpoint that allows attackers with any application's clientId and clientSecret to ga...	9.9 Critical	—	0,59%	15 Sep 2026
CVE-2026-91997 evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, allowing unauthenticated access to...	5.3 Medium	—	0,45%	15 Sep 2026
CVE-2026-91996 lamp-cloud through 5.10.0 whitelists the path pattern //anno/* for anonymous access, allowing unauthenticated attackers to read the server's full JVM system property ma...	7.5 High	—	0,50%	15 Sep 2026
CVE-2026-91995 pig before 4.1.0 contains an authentication bypass vulnerability in the /register/password endpoint where password verification results are discarded, allowing any value...	9.1 Critical	—	0,88%	15 Sep 2026
CVE-2026-91994 Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or task_runner roles can...	6.5 Medium	—	0,42%	15 Sep 2026
CVE-2026-91993 Jpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list endpoint, allowing authenticated users to access reposito...	4.3 Medium	—	0,34%	15 Sep 2026
CVE-2026-91926 A flaw was found in gss-ntlmssp. A memory leak occurs in the NTLM target-info parser when a crafted NTLM CHALLENGE message contains duplicated string-valued AV_PAIR entri...	3.7 Low	—	0,37%	15 Sep 2026
CVE-2026-89308 An unauthenticated OS command injection vulnerability exists in the ping.php endpoint, allowing remote attackers to execute arbitrary commands on the underlying operating...	9.3 Critical	—	2,1%	15 Sep 2026
CVE-2026-91925 Polyaxon through 2.16.4 renders operation specification fields with an unsandboxed Jinja2 environment during server-side run preparation, allowing authenticated users to...	8.8 High	—	0,78%	15 Sep 2026
CVE-2026-91924 pgweb through 0.17.0 leaves the POST /api/connect endpoint unguarded when connect-backend authorization is configured, allowing attackers to supply arbitrary database con...	8.5 High	—	0,42%	15 Sep 2026
CVE-2026-91923 KubeSphere through 4.1.3 contains a server-side request forgery vulnerability in the git credential verification endpoint that accepts unvalidated caller-supplied URLs wi...	7.7 High	—	0,45%	15 Sep 2026
CVE-2026-91922 Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to properly escape q...	6.1 Medium	—	0,34%	15 Sep 2026
CVE-2026-91786 A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the ac...	6.1 Medium	—	0,13%	15 Sep 2026
CVE-2026-86818 fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. In versions 4.1.3 and 4.1.4, t...	4.8 Medium	—	0,25%	15 Sep 2026
CVE-2026-86472 fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4,...	4.8 Medium	—	0,25%	15 Sep 2026
CVE-2026-80489 Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the...	5.9 Medium	—	0,36%	15 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.