Katalog CVE (hal. 575)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.917 (Critical 36.380 · High 105.432 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 27 Okt 2026, 12:31 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 28.701–28.750 dari 263.917 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-68525 apache tomcat Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resour...	9.1 Critical	—	0,49%	25 Agt 2026
CVE-2026-66422 apache tomcat Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the...	8.1 High	—	0,43%	25 Agt 2026
CVE-2026-65927 apache tomcat Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first...	7.5 High	—	0,68%	25 Agt 2026
CVE-2026-65905 Advisory apache tomcat Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST aut...	9.8 Critical	—	0,56%	25 Agt 2026
CVE-2026-65637 Advisory apache tomcat Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from...	9.8 Critical	—	0,61%	25 Agt 2026
CVE-2026-65183 apache tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix do...	8.1 High	—	0,40%	25 Agt 2026
CVE-2026-65182 apache tomcat Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before...	9.1 Critical	—	0,54%	25 Agt 2026
CVE-2026-63404 Faktory is a language-agnostic background job server. In versions prior to 1.10.0, the embedded Redis bootstrapper is vulnerable to an insecure temporary file flaw that l...	7.3 High	—	0,16%	25 Agt 2026
CVE-2026-63403 Faktory is a language-agnostic background job server. In versions prior to 1.10.0, the server is vulnerable to an unauthenticated denial of service in which a single malf...	8.7 High	—	0,45%	25 Agt 2026
CVE-2026-62865 Typebot is an open-source chatbot builder. In self-hosted versions prior to 3.18.0, the server-side Send Email integration block allows arbitrary reading of local files o...	8.7 High	—	0,32%	25 Agt 2026
CVE-2026-62862 Typebot is an open-source chatbot builder. In self-hosted versions up to and including 3.17.1, the default passwordless email magic-link authentication is vulnerable to l...	9.1 Critical	—	0,53%	25 Agt 2026
CVE-2026-62861 TypeBot is a chatbot builder tool. Prior to 3.18.0, any authenticated non-guest workspace member can remove another workspace's public custom domain and make typebots on...	6.4 Medium	—	0,41%	25 Agt 2026
CVE-2026-38474 GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 suffers from a Broken access control vulnerability in the IP lock manager, which allows remo...	5.4 Medium	—	0,37%	25 Agt 2026
CVE-2026-38473 A Stored XSS vulnerability in the subtitle deletion flow in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated user...	5.4 Medium	—	0,36%	25 Agt 2026
CVE-2026-38472 A Stored XSS vulnerability in forum reward comments in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote attackers to inject arb...	6.1 Medium	—	0,40%	25 Agt 2026
CVE-2026-38470 A Broken access control vulnerability in the API user endpoint in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows unprivileged, authe...	4.3 Medium	—	0,34%	25 Agt 2026
CVE-2026-38469 A Stored XSS vulnerability in the custom bonus title feature in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated...	5.4 Medium	—	0,36%	25 Agt 2026
CVE-2026-38468 A SQL injection vulnerability in the country-code lookup endpoint in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authentic...	4.3 Medium	—	0,41%	25 Agt 2026
CVE-2026-38467 A SQL injection vulnerability in the tags manager in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users with...	5.4 Medium	—	0,31%	25 Agt 2026
CVE-2026-38466 A Stored XSS vulnerability in the torrent remaster custom title feature in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote aut...	5.4 Medium	—	0,38%	25 Agt 2026
CVE-2026-38465 A Stored XSS vulnerability in the donor avatar mouse-over text feature in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote auth...	5.4 Medium	—	0,36%	25 Agt 2026
CVE-2026-32637 Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1, an attacker who compromises t...	5.9 Medium	—	0,54%	25 Agt 2026
CVE-2026-80104 DB-GPT builds the destination path for an uploaded skill from the multipart filename without constraining it to the upload directory. skill_upload in packages/dbgpt-app/s...	9.8 Critical	—	1,1%	25 Agt 2026
CVE-2026-80101 gimp, redhat enterprise linux A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file, the plugin validates the image width and bytes-per-line parameters in...	4.4 Medium	—	0,23%	25 Agt 2026
CVE-2026-79793 A vulnerability has been found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/sumit_form.php....	4.3 Medium	—	0,47%	25 Agt 2026
CVE-2026-79792 A flaw has been found in zackees transcribe-anything up to 4.1.0. Affected is the function ytdlp_download of the file src/transcribe_anything/ytldp_download.py of the com...	5.6 Medium	—	1,6%	25 Agt 2026
CVE-2026-79293 google chrome Information leak in Animation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium securit...	6.5 Medium	—	0,32%	25 Agt 2026
CVE-2026-79292 google chrome Integer overflow in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary...	8.3 High	—	0,40%	25 Agt 2026
CVE-2026-79291 google chrome Information leak in CSS in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security seve...	6.5 Medium	—	0,32%	25 Agt 2026
CVE-2026-79290 google chrome Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium...	9.6 Critical	—	0,46%	25 Agt 2026
CVE-2026-79289 google chrome Improper control of a resource through its lifetime in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process...	3.1 Low	—	0,28%	25 Agt 2026
CVE-2026-79288 google chrome Improper input validation in Autofill in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML p...	6.5 Medium	—	0,32%	25 Agt 2026
CVE-2026-79287 google chrome Observable discrepancy in Forms in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium secur...	5.3 Medium	—	0,28%	25 Agt 2026
CVE-2026-79286 google chrome Missing authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to potentially execute arbitrary code outside the sandb...	7.4 High	—	0,11%	25 Agt 2026
CVE-2026-79285 google chrome Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chro...	6.5 Medium	—	0,37%	25 Agt 2026
CVE-2026-79284 google chrome UI misrepresentation in Core in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to spoof UI elements via...	4.3 Medium	—	0,25%	25 Agt 2026
CVE-2026-79283 google chrome UI misrepresentation in Geometry in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severi...	5.4 Medium	—	0,26%	25 Agt 2026
CVE-2026-79282 google chrome Use after free in ANGLE in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML p...	9.6 Critical	—	0,48%	25 Agt 2026
CVE-2026-79276 google chrome Improper privilege management in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restri...	4.3 Medium	—	0,28%	25 Agt 2026
CVE-2026-79275 google chrome Use after free in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium...	9.6 Critical	—	0,48%	25 Agt 2026
CVE-2026-79274 google chrome Information leak in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity...	4.3 Medium	—	0,26%	25 Agt 2026
CVE-2026-79273 google chrome Incorrect reference resolution in WebView in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy via a cr...	4.3 Medium	—	0,33%	25 Agt 2026
CVE-2026-79272 google chrome Improper input validation in FindInPage in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to leak cross-origin da...	3.1 Low	—	0,25%	25 Agt 2026
CVE-2026-79271 google chrome Information leak in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML...	6.5 Medium	—	0,32%	25 Agt 2026
CVE-2026-79270 google chrome Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium se...	6.5 Medium	—	0,39%	25 Agt 2026
CVE-2026-79269 google chrome Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromi...	4.3 Medium	—	0,29%	25 Agt 2026
CVE-2026-79267 google chrome Race condition in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a cra...	4.3 Medium	—	0,21%	25 Agt 2026
CVE-2026-79266 google chrome Use after free in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox vi...	8.8 High	—	0,38%	25 Agt 2026
CVE-2026-79265 google chrome Incomplete cleanup in GetUserMedia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social enginee...	5.3 Medium	—	0,31%	25 Agt 2026
CVE-2026-79264 google chrome Incorrect reference resolution in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium...	4.3 Medium	—	0,33%	25 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.