Katalog CVE (hal. 505)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.273 (Critical 36.346 · High 105.264 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 25 Okt 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 25.201–25.250 dari 263.273 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-85051 google chrome Type confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chr...	8.8 High	—	0,45%	3 Sep 2026
CVE-2026-85050 google chrome Out of bounds write in WebGL in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted H...	9.6 Critical	—	0,46%	3 Sep 2026
CVE-2026-85049 google chrome Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium s...	8.8 High	—	0,28%	3 Sep 2026
CVE-2026-85048 google chrome Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside...	8.3 High	—	0,40%	3 Sep 2026
CVE-2026-85047 google chrome Improper input validation in Transactions Platform in Google Chrome on on iOS prior to 152.0.7977.82 allowed a remote attacker to potentially execute arbitrary code outsi...	9.6 Critical	—	0,46%	3 Sep 2026
CVE-2026-85046 Advisory google chrome, google v8 Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium sec...	8.8 High	KEV	48,9%	3 Sep 2026
CVE-2026-85045 google chrome Race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium sec...	7.5 High	—	0,21%	3 Sep 2026
CVE-2026-85044 google chrome Use of released resource in Mobile in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker leveraging social engineering to bypass web origin poli...	6.5 Medium	—	0,31%	3 Sep 2026
CVE-2026-85043 google chrome Incomplete cleanup in Network in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromiu...	9.1 Critical	—	0,44%	3 Sep 2026
CVE-2026-85042 google chrome Use after free in DevTools in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chrom...	9.6 Critical	—	0,46%	3 Sep 2026
CVE-2026-82527 R2R through 3.6.6 contains a SQL injection vulnerability that allows unauthenticated attackers to inject SQL predicates into the chunks search query by manipulating the f...	7.5 High	—	0,46%	3 Sep 2026
CVE-2026-53728 Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identity provider callback at GET /auth/external accepts...	7.1 High	—	0,20%	3 Sep 2026
CVE-2026-44506 Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1.10 through 5.1.6, the /oauth2/register endpoint could return the clie...	8.2 High	—	0,35%	3 Sep 2026
CVE-2026-19795 Qiskit could allow a local attacker to cause a denial of service due to a stack overflow during deserialization of QPY payloads. A malicious QPY payload can trigger a seg...	6.2 Medium	—	0,11%	3 Sep 2026
CVE-2026-85396 rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract that fails to properly validate extraction paths using prefix comparison withou...	7.5 High	—	0,56%	3 Sep 2026
CVE-2026-85395 UnoPim before 2.1.3 fails to include integration store, update, and key-generation routes in its ACL map, allowing any admin user to bypass permission checks. Attackers w...	7.1 High	—	0,42%	3 Sep 2026
CVE-2026-85394 python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attack...	9.1 Critical	—	0,22%	3 Sep 2026
CVE-2026-85393 node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5 signature verification. Attackers can embed garbage by...	7.5 High	—	0,33%	3 Sep 2026
CVE-2026-85392 Peppermint through 0.5.5 contains an authorization bypass vulnerability in the GET /api/v1/auth/user/:id/logout endpoint that allows authenticated attackers to delete ses...	4.3 Medium	—	0,46%	3 Sep 2026
CVE-2026-85391 Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Atta...	9.8 Critical	—	0,64%	3 Sep 2026
CVE-2026-85390 Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform adm...	7.1 High	—	0,49%	3 Sep 2026
CVE-2026-85389 Worklenz before 3.0.0 fails to verify task ownership by organization when resolving task-scoped API endpoints, allowing authenticated users to access another tenant's tas...	6.5 Medium	—	0,45%	3 Sep 2026
CVE-2026-85388 Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated users to inject arbitrary PostgreS...	8.1 High	—	0,48%	3 Sep 2026
CVE-2026-85205 A vulnerability was determined in itsourcecode Online Medicine Delivery System 1.0. This issue affects the function addwishlist of the file /customer/controller.php?actio...	6.3 Medium	—	0,33%	3 Sep 2026
CVE-2026-85028 Creation of a temporary file in a directory with insecure permissions in the FPGA management tool installation component in AWS FPGA Development Kit (aws-fpga) before 2.3...	7.8 High	—	0,17%	3 Sep 2026
CVE-2026-82526 R2R through 3.6.6 contains a stacked SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL statements by manipulating the index name...	9.8 Critical	—	0,71%	3 Sep 2026
CVE-2026-82302 Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured Access Control Security Levels (CAPE...	8.1 High	—	0,39%	3 Sep 2026
CVE-2026-82299 Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).	6.5 Medium	—	0,38%	3 Sep 2026
CVE-2026-82298 Incorrect Authorization (CWE-863) in Kibana can lead to denial of service via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).	4.3 Medium	—	0,37%	3 Sep 2026
CVE-2026-78596 Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization (CWE-862) in Kibana can lead to unauthorized modification of data via...	4.3 Medium	—	0,27%	3 Sep 2026
CVE-2026-78595 Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization (CWE-862) in the Kibana Fleet feature can lead to information disclosure via Pri...	4.3 Medium	—	0,28%	3 Sep 2026
CVE-2026-78593 An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-c...	4.3 Medium	—	0,29%	3 Sep 2026
CVE-2026-78583 elastic kibana Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege declarations origina...	8.1 High	—	0,39%	3 Sep 2026
CVE-2026-49456 Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstable_redirect() helper exported from waku/router/server (packages/waku/src/router/define-route...	3.1 Low	—	0,40%	3 Sep 2026
CVE-2026-49455 Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origin (or Sec-F...	6.5 Medium	—	0,17%	3 Sep 2026
CVE-2026-33630 c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's c...	7.5 High	—	0,85%	3 Sep 2026
CVE-2026-15431 A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.53.2.0. The vulnerability could potentially all...	7.3 High	—	0,09%	3 Sep 2026
CVE-2026-85187 A security vulnerability has been detected in itsourcecode Online Medicine Delivery System 1.0. Affected by this issue is the function Order::pupdate of the file /rider/o...	7.3 High	—	0,43%	3 Sep 2026
CVE-2026-85012 Improper neutralization of special elements used in an OS command (CWE-78) in the blueprint resynthesis framework in Amazon Web Services codecatalyst-blueprints before 0....	8.0 High	—	2,3%	3 Sep 2026
CVE-2026-84968 mongodb php driver An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amou...	5.3 Medium	—	0,20%	3 Sep 2026
CVE-2026-83959 Advisory adobe substance 3d sampler Substance3D - Sampler is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploita...	7.8 High	—	0,34%	3 Sep 2026
CVE-2026-82024 LearnPress WordPress Plugin before 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers with the Instructor role to inject persi...	5.4 Medium	—	0,24%	3 Sep 2026
CVE-2026-82023 LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor role to add an...	4.3 Medium	—	0,30%	3 Sep 2026
CVE-2026-63219 GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the API endpoint for creating a new formatter via file...	8.6 High	—	0,47%	3 Sep 2026
CVE-2026-58400 GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is c...	9.1 Critical	—	1,2%	3 Sep 2026
CVE-2026-85309 Missing Authorization vulnerability in Supsystic Ultimate Maps by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects U...	5.3 Medium	—	0,29%	3 Sep 2026
CVE-2026-85308 Authorization Bypass Through User-Controlled Key vulnerability in Brainstorm Force SureForms allows Exploiting Incorrectly Configured Access Control Security Levels. Thi...	5.3 Medium	—	0,34%	3 Sep 2026
CVE-2026-85307 Insertion of Sensitive Information Into Sent Data vulnerability in Kevin Pirnie KP Agent Ready allows Retrieve Embedded Sensitive Data. This issue affects KP Agent Ready...	5.3 Medium	—	0,33%	3 Sep 2026
CVE-2026-85306 Missing Authorization vulnerability in Cascadia Web Services MountDev AI MCP Connector for WordPress allows Exploiting Incorrectly Configured Access Control Security Leve...	6.5 Medium	—	0,33%	3 Sep 2026
CVE-2026-85305 Server-Side Request Forgery (SSRF) vulnerability in SEOPress allows Server Side Request Forgery. This issue affects SEOPress: from n/a through 10.1.	5.4 Medium	—	0,21%	3 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.