Katalog CVE (hal. 583)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.973 (Critical 36.402 · High 105.447 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 27 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 29.101–29.150 dari 263.973 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-78899 google chrome Use after free in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium sec...	8.8 High	—	0,41%	25 Agt 2026
CVE-2026-78898 google chrome Incorrect authorization in Downloads in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions...	5.4 Medium	—	0,22%	25 Agt 2026
CVE-2026-78897 google chrome Missing authorization in BrowserTag in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain sensitive information via a...	6.5 Medium	—	0,30%	25 Agt 2026
CVE-2026-78896 google chrome Information leak in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium secu...	4.3 Medium	—	0,26%	25 Agt 2026
CVE-2026-78895 google chrome Information leak in Paint in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severi...	4.3 Medium	—	0,27%	25 Agt 2026
CVE-2026-78894 google chrome Race condition in Payments in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a craf...	3.1 Low	—	0,18%	25 Agt 2026
CVE-2026-78893 google chrome Information leak in QUIC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security sever...	6.5 Medium	—	0,32%	25 Agt 2026
CVE-2026-78892 google chrome Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 152.0.7977.65 allowed a local attacker to bypass system access restrictions via a local prog...	7.1 High	—	0,11%	25 Agt 2026
CVE-2026-78891 google chrome Buffer overflow in WebRTC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromiu...	8.8 High	—	0,57%	25 Agt 2026
CVE-2026-77680 An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification...	5.3 Medium	—	0,34%	25 Agt 2026
CVE-2026-77357 Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.3, applications running in debug mode expose a GET /hot-reload endpoint who...	8.7 High	—	0,53%	25 Agt 2026
CVE-2026-75465 The /api.php/user/get_list endpoint in Maccms v10 v2026.1000.4055 is vulnerable to an Incorrect Access Control issue. The interface fails to perform any authentication or...	7.5 High	—	0,75%	25 Agt 2026
CVE-2026-75421 aria2 <=1.37.0 has a stack-buffer-underflow vulnerability in the IOFile::getLine() function.	4.0 Medium	—	0,16%	25 Agt 2026
CVE-2026-72924 GitHub CLI (gh) is GitHub's official command line tool. Versions 2.28.0 through 2.97.0 bind the local listener created by gh codespace ports forward to all available netw...	2.1 Low	—	0,26%	25 Agt 2026
CVE-2026-65105 Advisory nvidia nemoclaw NVIDIA NemoClaw for Linux contains a vulnerability in its inference server setup, where a remote attacker may access the inference service without authentication. A succe...	8.1 High	—	0,49%	25 Agt 2026
CVE-2026-65099 Advisory nvidia nemoclaw NVIDIA NemoClaw for Linux contains a vulnerability in its command-line interface, where an attacker could cause OS command injection. A successful exploit of this vulnera...	7.8 High	—	1,3%	25 Agt 2026
CVE-2026-65098 Advisory nvidia nemoclaw NVIDIA NemoClaw for Linux contains a vulnerability in its remote-access helper workflow, where an attacker could cause weak authentication. A successful exploit of this v...	9.8 Critical	—	0,99%	25 Agt 2026
CVE-2026-65097 Advisory nvidia nemoclaw NVIDIA NemoClaw for Linux contains a vulnerability in its installation scripts, where an attacker could cause a download of code without integrity check. A successful exp...	8.8 High	—	0,32%	25 Agt 2026
CVE-2026-65096 Advisory nvidia nemoclaw NVIDIA NemoClaw for Linux contains a vulnerability in the Telegram bridge component, where an attacker could cause an OS command injection. A successful exploit of this v...	7.8 High	—	1,3%	25 Agt 2026
CVE-2026-65093 Advisory nvidia openshell NVIDIA OpenShell for Linux contains a vulnerability where an attacker could cause a sandbox escape. A successful exploit of this vulnerability might lead to code executio...	9.9 Critical	—	0,80%	25 Agt 2026
CVE-2026-65092 Advisory nvidia openshell NVIDIA OpenShell Sandbox for Linux contains a vulnerability where an attacker could cause a path traversal bypass of L7 REST network policy. A successful exploit of this...	8.5 High	—	0,63%	25 Agt 2026
CVE-2026-65091 Advisory nvidia openshell NVIDIA OpenShell for all platforms contains a vulnerability where a malicious gateway could cause OS command injection. A successful exploit of this vulnerability might l...	8.8 High	—	2,6%	25 Agt 2026
CVE-2026-65090 Advisory nvidia nemoclaw NVIDIA NemoClaw for Linux contains a vulnerability in its NIM management component, where an attacker could cause OS command injection. A successful exploit of this vulne...	7.8 High	—	1,3%	25 Agt 2026
CVE-2026-65089 Advisory nvidia nemoclaw NVIDIA NemoClaw for Linux contains a vulnerability in its status and logs plugin commands, where an attacker could cause OS command injection. A successful exploit of thi...	7.8 High	—	1,3%	25 Agt 2026
CVE-2026-65088 Advisory nvidia nemoclaw NVIDIA NemoClaw contains a vulnerability where an attacker could cause invocation of process using visible sensitive information. A successful exploit of this vulnerabili...	5.5 Medium	—	0,17%	25 Agt 2026
CVE-2026-65087 Advisory nvidia nemoclaw NVIDIA NemoClaw contains a vulnerability where an attacker could cause insufficiently protected credentials . A successful exploit of this vulnerability might lead to inf...	6.1 Medium	—	0,15%	25 Agt 2026
CVE-2026-65086 Advisory nvidia openshell NVIDIA OpenShell for Linux contains a vulnerability in its sandbox exec handler, where an attacker could cause an OS command injection. A successful exploit of this vulne...	6.8 Medium	—	2,4%	25 Agt 2026
CVE-2026-65085 Advisory nvidia openshell NVIDIA OpenShell for Linux contains a vulnerability in its inference proxy, where an attacker could cause an improper encoding or escaping of output. A successful exploit...	5.2 Medium	—	0,17%	25 Agt 2026
CVE-2026-65084 Advisory nvidia nemoclaw NVIDIA NemoClaw for Linux contains a vulnerability in its deployment process, where an attacker could cause improper certificate validation. A successful exploit of this...	9.8 Critical	—	0,51%	25 Agt 2026
CVE-2026-65083 Advisory nvidia openshell NVIDIA OpenShell for Linux contains a vulnerability in its sandbox provisioning API, where an attacker could cause an incomplete list of disallowed inputs. A successful e...	9.9 Critical	—	0,86%	25 Agt 2026
CVE-2026-65082 Advisory nvidia nemoclaw NVIDIA NemoClaw for Linux contains a vulnerability in its migration command, where a local attacker could cause code injection. A successful exploit of this vulnerability...	7.8 High	—	0,22%	25 Agt 2026
CVE-2026-65081 Advisory nvidia nemoclaw NVIDIA NemoClaw for Linux contains a vulnerability in its installation process, where an attacker could cause execution of untrusted code. A successful exploit of this vu...	9.8 Critical	—	0,41%	25 Agt 2026
CVE-2026-55588 ORAS (OCI Registry As Storage) is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer trave...	6.5 Medium	—	0,54%	25 Agt 2026
CVE-2026-53965 The MCP PHP SDK (Composer package mcp/sdk) is the official Model Context Protocol SDK for PHP. In versions 0.5.0 through 0.7.0, the HTTP client transport reads a Server-S...	6.9 Medium	—	0,62%	25 Agt 2026
CVE-2026-52491 An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the libtiff/tools/thumbnail.c: main() component	8.4 High	—	0,19%	25 Agt 2026
CVE-2026-52489 Buffer Overflow vulnerability in gpac 31becc9e08b88e525a4a62013a4000de1c0f8fd9 allows an attacker to execute arbitrary code via the svgNameToImplementationName() function	7.8 High	—	0,19%	25 Agt 2026
CVE-2026-51368 An issue in Beijing Tongtech Co., Ltd tongweb v.7.0.24 in the Spring HttpInovkerServiceExporter component allows a remote attacker to execute arbitrary code via a crafted...	9.8 Critical	—	0,88%	25 Agt 2026
CVE-2026-39113 Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d...	4.0 Medium	—	0,19%	25 Agt 2026
CVE-2026-77585 The Okta Privileged Access client does not reject a leading hyphen in the username portion of an SSH target. As a result, the value may be interpreted as a command-line o...	5.3 Medium	—	0,14%	25 Agt 2026
CVE-2026-74932 The WP Fastest Cache WordPress plugin before 1.5.1 does not validate the Host header before using it to build the URLs of the asset files it embeds in the pages it caches...	7.5 High	—	0,37%	25 Agt 2026
CVE-2026-68515 OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions before 3.2.11, 3.3.0 through 3...	7.1 High	—	0,19%	25 Agt 2026
CVE-2026-68514 OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions 3.3.0 through 3.3.12 and...	5.5 Medium	—	0,18%	25 Agt 2026
CVE-2026-68513 OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions 3.3.0 through 3.3.12 and 3.4.0 th...	7.1 High	—	0,19%	25 Agt 2026
CVE-2026-66153 Advisory The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows an attacker to manipulate file paths.	7.0 High	—	0,24%	25 Agt 2026
CVE-2026-66152 Advisory A Path traversal vulnerability in the SonicWall NetExtender Linux client file extractor component allows an attacker to write arbitrary file as root.	8.8 High	—	0,50%	25 Agt 2026
CVE-2026-65367 apple ipados, apple iphone os A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5. An app may be able...	5.5 Medium	—	0,14%	25 Agt 2026
CVE-2026-64705 apple macos A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26....	5.5 Medium	—	0,17%	25 Agt 2026
CVE-2026-59981 OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions through 3.2.10, 3.3.0 thr...	7.1 High	—	0,32%	25 Agt 2026
CVE-2026-55099 icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 7.1.0 until 7.1.3, the Component equality method in src/icalendar/cal/compone...	7.5 High	—	0,63%	25 Agt 2026
CVE-2026-45019 Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled se...	7.2 High	—	0,43%	25 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.