Katalog CVE (hal. 456)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.042 (Critical 36.325 · High 105.117 · KEV 1.754 · sejak 2020) · Pembaruan terakhir: 24 Okt 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 22.751–22.800 dari 263.042 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-28638 google android In multiple functions of XmpDataParser.java, there is a possible improper data sanitization due to a logic error in the code. This could lead to local information disclos...	3.3 Low	—	0,09%	8 Sep 2026
CVE-2026-28639 google android In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write due to a logic error in the code. This could lead to local escalation of privilege with no...	7.8 High	—	0,10%	8 Sep 2026
CVE-2026-28642 google android In executeRequest of ActivityStarter.java, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privile...	7.8 High	—	0,10%	8 Sep 2026
CVE-2026-28644 google android In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of pr...	7.8 High	—	0,09%	8 Sep 2026
CVE-2026-28650 google android In setHiddenWhileSuspended of WindowState.java, there is a possible overlay bypass due to a logic error in the code. This could lead to local escalation of privilege with...	7.8 High	—	0,10%	8 Sep 2026
CVE-2026-28652 google android In multiple functions of RangingServiceImpl.java, there is a possible MITM due to a missing permission check. This could lead to remote information disclosure with no add...	3.1 Low	—	0,20%	8 Sep 2026
CVE-2026-28653 google android In multiple functions of rw_t3t.cc, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additiona...	7.8 High	—	0,10%	8 Sep 2026
CVE-2026-28655 google android In multiple functions of RemoteViews.java, there is a possible background activity launch bypass due to a logic error in the code. This could lead to local escalation of...	7.8 High	—	0,10%	8 Sep 2026
CVE-2026-28620 google android In multiple locations, there is a possible unauthorized URI access due to a permissions bypass. This could lead to local escalation of privilege with no additional execut...	7.8 High	—	0,09%	8 Sep 2026
CVE-2026-28622 google android In getQueryBuilderInternal of MediaProvider.java, there is a possible way to retrieve location metadata due to a permissions bypass. This could lead to local information...	3.3 Low	—	0,08%	8 Sep 2026
CVE-2026-28623 google android In writeToParcel of BleRssiRangingCapabilities.java, there is a possible way to obtain the Bluetooth MAC address due to a missing permission check. This could lead to loc...	3.3 Low	—	0,08%	8 Sep 2026
CVE-2026-28624 google android In multiple locations, there is a possible read/write access to files without the proper permissions due to a confused deputy. This could lead to local escalation of priv...	7.8 High	—	0,09%	8 Sep 2026
CVE-2026-28626 google android In onCreate of SetupPassthroughActivity.java, there is a possible way to launch arbitrary activity due to Intent redirection . This could lead to local escalation of priv...	7.3 High	—	0,09%	8 Sep 2026
CVE-2026-28627 google android In btm_sec_encrypt_change of btm_sec.cc, there is a possible downgrade attack due to a logic error in the code. This could lead to remote information disclosure with no a...	4.3 Medium	—	0,27%	8 Sep 2026
CVE-2026-28630 google android In onCreate of ContactsPickerActivity.kt, there is a possible misleading UI due to a tapjacking/overlay attack. This could lead to local information disclosure with no ad...	3.3 Low	—	0,08%	8 Sep 2026
CVE-2026-28631 google android In buildMiniResolver of IntentForwarderActivity.java, there is a possible consent bypass due to a tapjacking/overlay attack. This could lead to local escalation of privil...	7.8 High	—	0,09%	8 Sep 2026
CVE-2026-28633 google android In initForUserNoTracing of VoiceInteractionManagerService.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local deni...	5.5 Medium	—	0,09%	8 Sep 2026
CVE-2026-28609 google android In read of MatroskaExtractor.cpp, there is a possible out-of-bounds write due to improper casting. This could lead to remote code execution with no additional execution p...	8.8 High	—	0,37%	8 Sep 2026
CVE-2026-28611 google android In multiple functions of NfcService.java, there is a possible silent payment session hijacking enablement due to a missing permission check. This could lead to local esca...	7.8 High	—	0,09%	8 Sep 2026
CVE-2026-28612 google android In resolveActivity of ActivityStarter.java, there is a possible way to perform Intent Redirection attacks due to a logic error in the code. This could lead to local escal...	7.8 High	—	0,10%	8 Sep 2026
CVE-2026-28613 google android In initAppLinkTypeAndIntent of ChannelImpl.java, there is a possible launch an arbitrary intent due to improper input validation. This could lead to local escalation of p...	7.3 High	—	0,10%	8 Sep 2026
CVE-2026-28614 google android In onCreate of SlicePermissionActivity.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no addi...	7.8 High	—	0,09%	8 Sep 2026
CVE-2026-28616 google android In Setup Wizard, there is a possible way to force connection to a malicious network due to confused deputy. This could lead to local escalation of privilege with no addit...	7.8 High	—	0,09%	8 Sep 2026
CVE-2026-28617 google android In add of WifiNetworkSuggestionsManager.java, there is a possible persistent DOS due to resource exhaustion. This could lead to local denial of service with no additional...	5.5 Medium	—	0,09%	8 Sep 2026
CVE-2026-28618 google android In dec_frm_prepare of oapv.c, there is a possible OOB write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privilege...	8.8 High	—	0,44%	8 Sep 2026
CVE-2026-28593 google android In getItemList of SettingsFragment.java, there is a possible user interaction bypass due to misleading or insufficient UI. This could lead to local escalation of privileg...	7.8 High	—	0,10%	8 Sep 2026
CVE-2026-28594 google android In multiple locations, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution...	7.8 High	—	0,10%	8 Sep 2026
CVE-2026-28596 google android In parseInterventionFromXml of GameManagerService.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of ser...	5.5 Medium	—	0,09%	8 Sep 2026
CVE-2026-28599 google android In addCreatorToken of ActivityManagerService.java, there is a possible Intent Redirection Bypass due to a logic error in the code. This could lead to local escalation of...	7.8 High	—	0,10%	8 Sep 2026
CVE-2026-28600 google android In onCreate of PaymentDefaultDialog.java, there is a possible way to change default payment app due to a confused deputy. This could lead to local escalation of privilege...	7.8 High	—	0,09%	8 Sep 2026
CVE-2026-28602 google android In setClipboardAccessNotificationsEnabledForUser of ClipboardService.java, there is a possible mult-iuser isolation due to a logic error in the code. This could lead to l...	7.8 High	—	0,09%	8 Sep 2026
CVE-2026-28603 google android In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible read/write access to private files due to a confused deputy. This could lead to lo...	7.8 High	—	0,09%	8 Sep 2026
CVE-2026-28604 google android In multiple locations, there is a possible use after free due to a race condition. This could lead to remote code execution with no additional execution privileges needed...	7.5 High	—	0,26%	8 Sep 2026
CVE-2026-28606 google android In handleBondStateChanged of AdapterService.java, there is a possible way to skip pairing due to a logic error in the code. This could lead to remote escalation of privil...	9.8 Critical	—	0,39%	8 Sep 2026
CVE-2026-28607 google android In multiple functions in multiple locations, there is a possible background activity launch bypass due to a confused deputy. This could lead to local escalation of privil...	7.8 High	—	0,09%	8 Sep 2026
CVE-2026-28572 google android In onCreate of InstallLaunch.kt, there is a possible misleading UI due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional...	7.8 High	—	0,09%	8 Sep 2026
CVE-2026-28582 google android In onCreate of ConfirmDeviceCredentialActivity.java, there is a possible unauthorized access to and modification of device credentials due to a missing permission check....	3.3 Low	—	0,08%	8 Sep 2026
CVE-2026-28583 google android In validate_camera_metadata_structure of camera_metadata.c, there is a possible out of bounds write due to a logical error in the code. This could lead to local escalatio...	7.8 High	—	0,10%	8 Sep 2026
CVE-2026-28584 google android In createSessionInternal of PackageInstallerService.java, there is a possible way to permanently DoS the device due to a logic error in the code. This could lead to local...	5.5 Medium	—	0,09%	8 Sep 2026
CVE-2026-28590 google android In multiple locations, there is a possible improper encryption key validation due to a logic error in the code. This could lead to local escalation of privilege with no a...	7.8 High	—	0,05%	8 Sep 2026
CVE-2026-0084 google android In multiple functions of HostEmulationManager.java, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation o...	7.8 High	—	0,08%	8 Sep 2026
CVE-2026-0054 google android In isCallerAllowed of WalletContextualLocationsService.kt, there is a possible way to get wallet information due to a missing permission check. This could lead to local i...	3.3 Low	—	0,07%	8 Sep 2026
CVE-2026-0065 google android In areBackgroundActivityStartsAllowed of BackgroundLaunchProcessController.java, there is a possible unintended way to launch activities in the background due to a logic...	7.8 High	—	0,08%	8 Sep 2026
CVE-2026-9216 netgear rax30 firmware, netgear rax35 firmware +3 lainnya An insufficient input validation vulnerability in the listed NETGEAR RAX series models allows a network-adjacent attacker having network access (such as WiFi credentials)...	3.5 Low	—	0,36%	8 Sep 2026
CVE-2026-9215 netgear xr1000 firmware, netgear xr1000v2 firmware +1 lainnya A cross site request forgery (CSRF) vulnerability in the listed NETGEAR models allows an attacker who can leverage social engineering techniques on a router administrator...	6.7 Medium	—	0,19%	8 Sep 2026
CVE-2026-86669 A vulnerability was detected in aircheng-org iWebShop-5 up to 5.15. This affects the function Login of the file controllers/systemseller.php. Performing a manipulation of...	7.3 High	—	0,69%	8 Sep 2026
CVE-2026-86670 A flaw has been found in aircheng-org iWebShop-5 up to 5.15. This impacts an unknown function of the file controllers/admin.php of the component Authentication Storage. E...	3.7 Low	—	0,38%	8 Sep 2026
CVE-2026-86672 A vulnerability has been found in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected is an unknown function of the file example...	5.3 Medium	—	0,48%	8 Sep 2026
CVE-2026-86673 A vulnerability was determined in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this issue is the function mysqli_conne...	7.3 High	—	0,47%	8 Sep 2026
CVE-2026-85880 Advisory microsoft windows 10 1607, microsoft windows 10 1809 +6 lainnya Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.	7.8 High	KEV	3,6%	8 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.