Katalog CVE (hal. 517)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.280 (Critical 36.347 · High 105.266 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 25 Okt 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 25.801–25.850 dari 263.280 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-84330 google chrome UI misrepresentation in FullScreen in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium...	5.4 Medium	—	0,26%	2 Sep 2026
CVE-2026-84329 google chrome Confused deputy in CredentialProvider in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to leak sen...	5.3 Medium	—	0,27%	2 Sep 2026
CVE-2026-84328 google chrome Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origin policy...	3.1 Low	—	0,24%	2 Sep 2026
CVE-2026-84327 google chrome Incorrect authorization in Autofill in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to obtain sensitive info...	6.5 Medium	—	0,31%	2 Sep 2026
CVE-2026-84326 google chrome Uninitialized resource in V8 in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chro...	8.8 High	—	0,50%	2 Sep 2026
CVE-2026-84325 google chrome Improper input validation in DataTransfer in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass system access restrict...	9.8 Critical	—	0,40%	2 Sep 2026
CVE-2026-84324 google chrome Use after free in Proxy in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chro...	9.0 Critical	—	0,47%	2 Sep 2026
CVE-2026-84323 google chrome Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process and leveraged social engine...	5.3 Medium	—	0,27%	2 Sep 2026
CVE-2026-81928 Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record. sig_data sign...	7.5 High	—	0,59%	2 Sep 2026
CVE-2026-84483 WWBN AVideo through commit 9c39d8c8 contains an incomplete authentication bypass in encryptPass.json.php that allows unauthenticated attackers to compute valid HMAC token...	5.3 Medium	—	0,45%	1 Sep 2026
CVE-2026-84482 WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the get_domain() and isSameDomain() functions that fail to properly validate re...	8.8 High	—	0,21%	1 Sep 2026
CVE-2026-84481 WWBN AVideo through 30.0 contains an information disclosure vulnerability in the MobileManager plugin getConfiguration endpoint that returns sensitive configuration data...	6.9 Medium	—	0,45%	1 Sep 2026
CVE-2026-84480 WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account passwords inde...	9.8 Critical	—	0,51%	1 Sep 2026
CVE-2026-84479 WWBN AVideo (current e01e41ecc and earlier) makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder()/isAVide...	9.1 Critical	—	0,55%	1 Sep 2026
CVE-2026-84478 WWBN AVideo contains a path traversal vulnerability in the API get_api_login_code endpoint that allows unauthenticated attackers to delete arbitrary .log files by supplyi...	7.3 High	—	0,56%	1 Sep 2026
CVE-2026-84477 AVideo Live_schedule::setTitle() and setDescription() store POST input without sanitization, allowing users with streaming permission to inject malicious scripts. Unauthe...	5.4 Medium	—	0,29%	1 Sep 2026
CVE-2026-84476 WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers to spoof the client address used by enforceRateLi...	7.5 High	—	0,43%	1 Sep 2026
CVE-2026-84423 A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource API. Such man...	7.3 High	—	0,69%	1 Sep 2026
CVE-2026-84208 AVideo through version 29.0 contains an unauthenticated SQL injection vulnerability in the User_Location plugin's regions.json.php and cities.json.php endpoints. The coun...	7.5 High	—	0,46%	1 Sep 2026
CVE-2026-84642 mozilla thunderbird The values of the mail.allowed_attachment_hostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnames, this co...	7.5 High	—	0,42%	1 Sep 2026
CVE-2026-84641 mozilla thunderbird A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. Thi...	7.5 High	—	0,27%	1 Sep 2026
CVE-2026-84640 mozilla thunderbird A maliciously constructed mail header could lead to a one byte read past the end of a buffer. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thu...	7.5 High	—	0,26%	1 Sep 2026
CVE-2026-84639 mozilla thunderbird Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and...	9.1 Critical	—	0,32%	1 Sep 2026
CVE-2026-84637 mozilla thunderbird Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbird's normal executable attachme...	9.8 Critical	—	0,63%	1 Sep 2026
CVE-2026-84375 js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count emp...	7.5 High	—	0,54%	1 Sep 2026
CVE-2026-84374 Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, in src/Files/Disk.php the Maatwebsite\Excel\Files\Disk::copy() method r...	7.5 High	—	0,84%	1 Sep 2026
CVE-2026-84373 Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in packages/mocker...	5.9 Medium	—	0,53%	1 Sep 2026
CVE-2026-84372 Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, pipeline handling on aggregate cluster and replicat...	9.8 Critical	—	0,73%	1 Sep 2026
CVE-2026-84289 A vulnerability was found in NousResearch hermes-agent up to 0.18.2. This vulnerability affects the function list_tools of the file tools/mcp_tool.py of the component MCP...	4.3 Medium	—	0,47%	1 Sep 2026
CVE-2026-84288 A vulnerability has been found in NousResearch hermes-agent up to 0.18.2. This affects the function HermesACPAgent.prompt of the file acp_adapter/session.py of the compon...	4.3 Medium	—	0,47%	1 Sep 2026
CVE-2026-83549 Advisory sonicwall sma8200v, sonicwall sma6210 firmware +1 lainnya Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance...	7.8 High	KEV	9,9%	1 Sep 2026
CVE-2026-83548 Advisory sonicwall sma8200v, sonicwall sma6210 firmware +1 lainnya A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker...	10.0 Critical	KEV	8,0%	1 Sep 2026
CVE-2026-76851 github enterprise server A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed remote code execution on the instance. Insufficient network iso...	8.8 High	—	0,83%	1 Sep 2026
CVE-2026-75604 Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without...	9.0 Critical	—	2,1%	1 Sep 2026
CVE-2026-19118 github enterprise server A time-of-check time-of-use race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution. Exploitation required an authentic...	7.5 High	—	0,69%	1 Sep 2026
CVE-2026-18730 github enterprise server A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause the Manage API to send cra...	7.4 High	—	0,29%	1 Sep 2026
CVE-2023-54391 Advisory Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attacke...	9.8 Critical	—	3,1%	1 Sep 2026
CVE-2026-84470 A flaw was found in Ansible Automation Platform's automation-controller (AWX). The Bulk Job Launch API (POST /api/v2/bulk/job_launch/) authorizes the requested instance_g...	6.4 Medium	—	0,30%	1 Sep 2026
CVE-2026-84371 ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 until version 2...	5.4 Medium	—	0,30%	1 Sep 2026
CVE-2026-84370 SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the...	8.2 High	—	0,53%	1 Sep 2026
CVE-2026-84369 SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the...	6.1 Medium	—	0,43%	1 Sep 2026
CVE-2026-84368 joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi p...	3.7 Low	—	0,39%	1 Sep 2026
CVE-2026-84367 joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 and 18.2.4, joi's lib/types/keys.js internals.rename() implementation us...	3.7 Low	—	0,39%	1 Sep 2026
CVE-2026-84366 Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/core/downloader/handlers/s3.py, Scrapy's S3DownloadHandler converts an S...	7.4 High	—	0,25%	1 Sep 2026
CVE-2026-84365 Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-2026-39408 does not cover every...	6.5 Medium	—	0,44%	1 Sep 2026
CVE-2026-84364 Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody() expands dot-separated form field names into nested...	5.3 Medium	—	0,53%	1 Sep 2026
CVE-2026-84363 Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query helpers treat a question mark after a literal hash fra...	5.9 Medium	—	0,45%	1 Sep 2026
CVE-2026-84361 Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted...	7.7 High	—	0,50%	1 Sep 2026
CVE-2026-84311 pypdf project pypdf pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_page.py PageObject._extract_text and PageObject.e...	3.3 Low	—	0,14%	1 Sep 2026
CVE-2026-84310 pypdf project pypdf pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_doc_common.py _get_outline to consume long runtim...	3.3 Low	—	0,14%	1 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.