Katalog CVE (hal. 524)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.288 (Critical 36.348 · High 105.269 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 25 Okt 2026, 12:26 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 26.151–26.200 dari 263.288 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-84131 mozilla firefox, mozilla thunderbird Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 15...	8.8 High	—	0,34%	1 Sep 2026
CVE-2026-84130 mozilla firefox, mozilla thunderbird Information disclosure in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.	7.5 High	—	0,44%	1 Sep 2026
CVE-2026-84129 mozilla firefox, mozilla thunderbird Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.	9.8 Critical	—	0,19%	1 Sep 2026
CVE-2026-84128 mozilla firefox, mozilla thunderbird Privilege escalation in the WebDriver BiDi component. This vulnerability was fixed in Firefox 155 and Thunderbird 155.	8.8 High	—	0,44%	1 Sep 2026
CVE-2026-84127 mozilla firefox mobile Information disclosure in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 155.	4.3 Medium	—	0,26%	1 Sep 2026
CVE-2026-84126 mozilla firefox, mozilla thunderbird Incorrect boundary conditions in the Layout: Grid component. This vulnerability was fixed in Firefox 155 and Thunderbird 155.	4.3 Medium	—	0,31%	1 Sep 2026
CVE-2026-84125 mozilla firefox, mozilla thunderbird Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.	5.4 Medium	—	0,29%	1 Sep 2026
CVE-2026-84124 mozilla firefox, mozilla thunderbird Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15,...	5.4 Medium	—	0,17%	1 Sep 2026
CVE-2026-84123 mozilla firefox, mozilla thunderbird Privilege escalation due to use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunder...	8.8 High	—	0,44%	1 Sep 2026
CVE-2026-84122 mozilla firefox, mozilla thunderbird Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and...	5.4 Medium	—	0,21%	1 Sep 2026
CVE-2026-84121 mozilla firefox, mozilla thunderbird Sandbox escape due to use-after-free in the DOM: Security component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153....	9.6 Critical	—	0,32%	1 Sep 2026
CVE-2026-84120 mozilla firefox, mozilla thunderbird Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thun...	5.4 Medium	—	0,22%	1 Sep 2026
CVE-2026-84119 mozilla firefox, mozilla thunderbird Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 15...	9.6 Critical	—	0,32%	1 Sep 2026
CVE-2026-84118 mozilla firefox, mozilla thunderbird Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.	5.4 Medium	—	0,29%	1 Sep 2026
CVE-2026-84117 mozilla firefox mobile Privilege escalation in Firefox for Android. This vulnerability was fixed in Firefox 155.	8.8 High	—	0,35%	1 Sep 2026
CVE-2026-84061 A security flaw has been discovered in zhongyu09 OpenChatBI up to 0.3.0. Affected by this vulnerability is the function _validate_sql_safety of the file openchatbi/text2s...	6.3 Medium	—	0,32%	1 Sep 2026
CVE-2026-79683 dell powerstoreos Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to write...	8.8 High	—	0,49%	1 Sep 2026
CVE-2026-7877 The WP Recipe Maker Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wprm-call-to-action' shortcode in all versions up to, and...	6.4 Medium	—	0,26%	1 Sep 2026
CVE-2026-58575 dell powerstoreos Dell PowerStore contains an Authentication Bypass by Spoofing vulnerability. An authenticated attacker could potentially exploit this vulnerability to escalate privileges...	8.8 High	—	0,53%	1 Sep 2026
CVE-2026-53682 An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDomain/hosts and receive a structured response enumerating internal PKI/C...	5.3 Medium	—	0,21%	1 Sep 2026
CVE-2026-51747 Incorrect access control in the keepAlive function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to emit indirect mesh heartbeat information towar...	9.8 Critical	—	0,64%	1 Sep 2026
CVE-2026-51745 Incorrect access control in the updatePriStaList function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to refresh the primary station list via se...	5.3 Medium	—	0,40%	1 Sep 2026
CVE-2026-51744 Incorrect access control in the recv_mesh_info_sync function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to force mesh configuration synchroniza...	9.8 Critical	—	0,64%	1 Sep 2026
CVE-2026-51743 Incorrect access control in the guest_wifi_sync function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to disable guest virtual AP interfaces via...	9.1 Critical	—	0,51%	1 Sep 2026
CVE-2026-51742 Incorrect access control in the discoverWan function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger WAN discovery logic via sending a cr...	5.9 Medium	—	0,43%	1 Sep 2026
CVE-2026-51741 Incorrect access control in the clearDiagnosisLog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase diagnosis logs via sending a cra...	9.8 Critical	—	0,64%	1 Sep 2026
CVE-2026-19472 A denial-of-service security issue exists within ArmorStart® LT. The security issue stems from improper handling of a crafted HTTP PUT request sent to the embedded web se...	8.7 High	—	0,32%	1 Sep 2026
CVE-2026-19471 Multiple stored cross-site scripting security issues exist within ArmorStart® LT. Stored XSS occurs when user input is not properly sanitized and is stored on the server,...	6.9 Medium	—	0,28%	1 Sep 2026
CVE-2026-18765 Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Teracity Software Technologies Inc. E-OSB allows SQL Injection. Thi...	9.8 Critical	—	0,26%	1 Sep 2026
CVE-2026-84200 Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyExceptions, the less restrictiv...	9.0 Critical	—	0,27%	1 Sep 2026
CVE-2026-84199 Kyverno before 1.16.2 contains a server-side request forgery (SSRF) vulnerability in the APICall feature. The URL field in a Policy's ServiceCall configuration is not val...	7.7 High	—	0,36%	1 Sep 2026
CVE-2026-84196 Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injec...	7.7 High	—	0,35%	1 Sep 2026
CVE-2026-84195 Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorizat...	7.7 High	—	0,39%	1 Sep 2026
CVE-2026-84194 LibreNMS versions >= 23.10.0 and < 26.2.0 (fixed in 26.4.0) contain an authenticated OS command injection vulnerability in libvirt discovery. When libvirt support is enab...	8.6 High	—	1,5%	1 Sep 2026
CVE-2026-84193 LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render unescaped SNMP-sourced data fields including BGP pee...	5.8 Medium	—	0,35%	1 Sep 2026
CVE-2026-84192 LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data without escaping. An...	7.1 High	—	0,33%	1 Sep 2026
CVE-2026-84191 LibreNMS before 26.5.0 contains stored cross-site scripting vulnerabilities in VRF display pages where mplsVpnVrfDescription, vrf_name, and mplsVpnVrfRouteDistinguisher f...	6.1 Medium	—	0,26%	1 Sep 2026
CVE-2026-84190 LibreNMS versions before 26.5.0 contain a remote code execution vulnerability in the AboutController where the snmpget configuration parameter is passed to shell_exec() w...	7.2 High	—	0,86%	1 Sep 2026
CVE-2026-84189 LibreNMS through 26.4.0 renders JSON fields (name, ip, model, author, commit message) returned by the admin-configurable Oxidized integration URL (oxidized.url) into the...	8.1 High	—	0,38%	1 Sep 2026
CVE-2026-84188 LibreNMS versions <= 26.4.0 contain a stored cross-site scripting vulnerability in the graph_descr.<graphtype> configuration settings, which are echoed verbatim without H...	4.8 Medium	—	0,25%	1 Sep 2026
CVE-2026-84187 AVideo contains a missing authentication vulnerability in plugin/Live/on_publish.php that allows unauthenticated attackers to mark arbitrary scheduled broadcasts as faile...	8.2 High	—	0,51%	1 Sep 2026
CVE-2026-83595 AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php that allows attackers to perform state-changing actions by crafting GET requests tha...	8.1 High	—	0,23%	1 Sep 2026
CVE-2026-77194 The Simple Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in versions up to, and including, 4.8.0. This...	5.3 Medium	—	0,58%	1 Sep 2026
CVE-2026-76111 dell powerstoreos Dell PowerStore contains an Incorrect Authorization vulnerability. An authenticated attacker with low privileges could potentially exploit this vulnerability to invoke ad...	8.8 High	—	0,42%	1 Sep 2026
CVE-2026-18550 The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.6.6. This is due to...	9.8 Critical	—	0,33%	1 Sep 2026
CVE-2026-11873 An Apache-proxied Dogtag CA REST endpoint exposed by IdM (POST /ca/rest/certrequests) returns HTTP 500 with internal Java stack traces for unauthenticated malformed reque...	6.5 Medium	—	0,32%	1 Sep 2026
CVE-2026-10420 Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation. This issue affects mTower: before 102d3dc75cf8e58e68e4bea54ae3c803...	5.5 Medium	—	0,11%	1 Sep 2026
CVE-2025-15613 Kyverno before v1.13.4 is vulnerable to server-side request forgery (SSRF) via its Service Call functionality. An attacker with permission to create Kyverno (Cluster)Poli...	6.5 Medium	—	0,27%	1 Sep 2026
CVE-2023-54356 Kyverno versions 1.9.4 and earlier support insecure 3DES cipher suites (TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA and TLS_RSA_WITH_3DES_EDE_CBC_SHA) on their TLS endpoints. The...	3.7 Low	—	0,15%	1 Sep 2026
CVE-2026-84165 A vulnerability relating to incorrect access control in OpenNebula by OpenNebula Systems, affecting all versions prior to 7.4. This vulnerability could allow an authentic...	8.7 High	—	0,44%	1 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.