Katalog CVE (hal. 673)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 264.859 (Critical 36.491 · High 105.819 · KEV 1.762 · sejak 2020) · Pembaruan terakhir: 29 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 33.601–33.650 dari 264.859 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-74956 mozilla firefox, mozilla thunderbird Same-origin policy bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.	9.1 Critical	—	0,50%	18 Agt 2026
CVE-2026-74955 mozilla firefox, mozilla thunderbird Privilege escalation in the Request Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.	8.8 High	—	0,42%	18 Agt 2026
CVE-2026-74954 mozilla firefox, mozilla thunderbird Information disclosure due to side-channel in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thund...	7.5 High	—	0,44%	18 Agt 2026
CVE-2026-74953 mozilla firefox, mozilla thunderbird Privilege escalation in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbir...	8.8 High	—	0,44%	18 Agt 2026
CVE-2026-74952 mozilla firefox, mozilla thunderbird Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 153.2, and Thunderbird 153.2.	8.8 High	—	0,42%	18 Agt 2026
CVE-2026-74951 mozilla firefox mobile Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154.	6.5 Medium	—	0,28%	18 Agt 2026
CVE-2026-74950 mozilla firefox, mozilla thunderbird Privilege escalation in the Downloads API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.	8.8 High	—	0,42%	18 Agt 2026
CVE-2026-74949 mozilla firefox, mozilla thunderbird Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.1...	8.8 High	—	0,47%	18 Agt 2026
CVE-2026-74948 mozilla firefox, mozilla thunderbird Information disclosure in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154,...	6.5 Medium	—	0,44%	18 Agt 2026
CVE-2026-74947 mozilla firefox, mozilla thunderbird Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 15...	8.8 High	—	0,45%	18 Agt 2026
CVE-2026-74946 mozilla firefox, mozilla thunderbird Information disclosure due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firef...	8.8 High	—	0,49%	18 Agt 2026
CVE-2026-74945 mozilla firefox, mozilla thunderbird Information disclosure in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbir...	6.5 Medium	—	0,44%	18 Agt 2026
CVE-2026-74944 mozilla firefox, mozilla thunderbird Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14,...	9.8 Critical	—	0,59%	18 Agt 2026
CVE-2026-74943 mozilla firefox, mozilla thunderbird Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 15...	9.8 Critical	—	0,61%	18 Agt 2026
CVE-2026-74942 mozilla firefox, mozilla thunderbird Privilege escalation in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thun...	8.8 High	—	0,45%	18 Agt 2026
CVE-2026-74941 mozilla firefox, mozilla thunderbird Privilege escalation in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderb...	8.8 High	—	0,48%	18 Agt 2026
CVE-2026-74940 mozilla firefox, mozilla thunderbird Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, T...	9.8 Critical	—	0,61%	18 Agt 2026
CVE-2026-74939 mozilla firefox, mozilla thunderbird Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird...	8.8 High	—	0,45%	18 Agt 2026
CVE-2026-74938 mozilla firefox, mozilla thunderbird Mitigation bypass in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.	9.1 Critical	—	0,44%	18 Agt 2026
CVE-2026-74937 mozilla firefox, mozilla thunderbird Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.	8.8 High	—	0,44%	18 Agt 2026
CVE-2026-74936 mozilla firefox, mozilla thunderbird Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird...	9.8 Critical	—	0,59%	18 Agt 2026
CVE-2026-74935 mozilla firefox, mozilla thunderbird Privilege escalation in the DOM: Networking component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird...	8.8 High	—	0,45%	18 Agt 2026
CVE-2026-74934 mozilla firefox, mozilla thunderbird Site isolation issue in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thund...	7.5 High	—	0,21%	18 Agt 2026
CVE-2026-59781 zabbix When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions...	7.8 High	—	0,16%	18 Agt 2026
CVE-2026-45532 DataEase is an open source data visualization and analysis tool. Versions prior to 2.10.23 have a path traversal vulnerability. The root cause is that on Windows, the `FI...	8.7 High	—	0,52%	18 Agt 2026
CVE-2026-23938 zabbix An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential...	4.9 Medium	—	0,50%	18 Agt 2026
CVE-2026-23937 zabbix The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity.	6.5 Medium	—	0,38%	18 Agt 2026
CVE-2026-23935 zabbix A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (JavaScript) HttpRequest logic, leading to potential confiden...	4.9 Medium	—	0,51%	18 Agt 2026
CVE-2026-23934 zabbix An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend validate.api.exists ac...	6.5 Medium	—	0,56%	18 Agt 2026
CVE-2026-23933 zabbix In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed. Currently the only known exploitation scenario i...	9.1 Critical	—	0,57%	18 Agt 2026
CVE-2026-23931 zabbix The frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user macro values leading to potential loss of confidentiality.	4.3 Medium	—	0,31%	18 Agt 2026
CVE-2026-23930 zabbix An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexp...	7.5 High	—	0,63%	18 Agt 2026
CVE-2026-23929 zabbix Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like _...	5.4 Medium	—	0,26%	18 Agt 2026
CVE-2026-23922 zabbix The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious 'Token endpoint'. Changes were made to reset...	4.9 Medium	—	0,38%	18 Agt 2026
CVE-2026-18751 External control of file name or path vulnerability in Citrix WorkSpace App on MacOS. This issue affects WorkSpace App: 2607.	5.2 Medium	—	0,18%	18 Agt 2026
CVE-2026-16309 Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessing Functionality Not Properly Constrained by ACLs....	5.3 Medium	—	0,31%	18 Agt 2026
CVE-2026-1199 zabbix Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneo...	3.7 Low	—	0,23%	18 Agt 2026
CVE-2026-75855 ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated r...	8.7 High	—	0,55%	18 Agt 2026
CVE-2026-75854 ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and...	9.8 Critical	—	0,89%	18 Agt 2026
CVE-2026-75853 ArcadeDB's Gremlin wire-protocol plugin (com.arcadedb:arcadedb-gremlin) in versions <= 26.7.3 enforces authentication (SASL PLAIN) but performs no authorization: it never...	8.8 High	—	0,59%	18 Agt 2026
CVE-2026-75852 ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find...	9.8 Critical	—	0,66%	18 Agt 2026
CVE-2026-75851 ArcadeDB server (com.arcadedb:arcadedb-server) in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When...	9.9 Critical	—	0,39%	18 Agt 2026
CVE-2026-75850 ArcadeDB before 26.8.1 fails to bind the authenticated principal (setCurrentUser) on its batch and time-series HTTP handlers. Because no principal is bound on the worker...	4.2 Medium	—	0,21%	18 Agt 2026
CVE-2026-75846 ArcadeDB before 26.8.1 (affected versions <= 26.7.3) contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement. DeleteFunctionStatement.executeS...	7.1 High	—	0,35%	18 Agt 2026
CVE-2026-75845 ArcadeDB versions 26.4.2 through 26.7.3 contain an authorization bypass vulnerability in the set_server_setting MCP server-level tool. SetServerSettingTool.execute() gate...	6.3 Medium	—	0,29%	18 Agt 2026
CVE-2026-75844 ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and checks hostna...	7.1 High	—	0,32%	18 Agt 2026
CVE-2026-75843 ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute Ja...	9.9 Critical	—	0,38%	18 Agt 2026
CVE-2026-75842 ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read local files. A...	7.7 High	—	0,46%	18 Agt 2026
CVE-2026-75841 ArcadeDB before 26.8.1 contains a denial of service vulnerability in the Cypher range() function that allows authenticated users to exhaust server heap memory. Attackers...	4.3 Medium	—	0,37%	18 Agt 2026
CVE-2026-75840 ArcadeDB before 26.8.1 contains an arbitrary file read vulnerability in the GraalVM JavaScript sandbox allowlist enforcement, which uses unescaped regular expressions to...	7.5 High	—	0,43%	18 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.