Katalog CVE (hal. 783)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.172 (Critical 36.633 · High 106.354 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 1 Nov 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 39.101–39.150 dari 266.172 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-48074 OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, when a TENANT_ADMIN deletes an existin...	2.7 Low	—	0,29%	6 Agt 2026
CVE-2026-48071 OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the PIN-type challenge throttle uses `...	5.8 Medium	—	0,40%	6 Agt 2026
CVE-2026-48054 OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Versions prior to 0.10.9 generate a Ha...	8.8 High	—	0,64%	6 Agt 2026
CVE-2026-47765 Frappe is a full-stack web application framework. Prior to 15.110.0 and 16.20.0, the restore and bulk_restore endpoints do not apply the appropriate document permission c...	7.1 High	—	0,45%	6 Agt 2026
CVE-2026-47194 Frappe is a full-stack web application framework. Prior to 15.108.0 and 16.18.3, temporary magic login link generation can use an attacker-controlled request Host header,...	8.6 High	—	0,26%	6 Agt 2026
CVE-2026-47185 Frappe is a full-stack web application framework. Prior to 16.18.0, the Workspace Save API accepts a controlled workspace identifier from any authenticated user without e...	5.1 Medium	—	0,41%	6 Agt 2026
CVE-2026-45573 Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, when VAPID delivery is enabled, the notif...	6.4 Medium	—	0,26%	6 Agt 2026
CVE-2026-45572 Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, an administrator with landing-page editin...	4.8 Medium	—	0,25%	6 Agt 2026
CVE-2026-45415 Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the /admin/csv_census/census_logs record-...	6.0 Medium	—	0,43%	6 Agt 2026
CVE-2026-45414 Decidim is a participatory democracy framework. Prior to 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, JWT-backed API authentication is not bound to the organization select...	8.5 High	—	0,45%	6 Agt 2026
CVE-2026-45378 Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin...	7.5 High	—	0,42%	6 Agt 2026
CVE-2026-43632 ggml llama.cpp llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in llama-server affecting six tokenization endpoints (/tokenize, /detokenize, /inf...	8.1 High	—	0,48%	6 Agt 2026
CVE-2026-43631 ggml llama.cpp llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in the vocab pointer of llama-server when the --sleep-idle-seconds feature is enab...	8.1 High	—	0,57%	6 Agt 2026
CVE-2026-43630 ggml llama.cpp llama.cpp builds b4882 before b8487 contain an out-of-bounds read vulnerability in the recurrent memory state restore path that allows attackers with write access to the...	6.5 Medium	—	0,50%	6 Agt 2026
CVE-2026-43629 ggml llama.cpp llama.cpp builds b4882 through b9058 contain a heap buffer overflow vulnerability in the KV cache state restore path where the state_read_data() function computes write s...	8.1 High	—	0,70%	6 Agt 2026
CVE-2026-43628 ggml llama.cpp llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauthenticated attackers to trigger...	7.8 High	—	0,23%	6 Agt 2026
CVE-2026-43627 ggml llama.cpp llama.cpp builds b1283 through b9058 contain an integer overflow vulnerability in the llama_batch_init() function where unchecked multiplications in malloc() calls can wr...	7.8 High	—	0,20%	6 Agt 2026
CVE-2026-41861 Path Traversal in BOSH-Ecosystem / BOSH allows an IaaS-metadata attacker to make the agent write a root-owned file with partially attacker-controlled body to any path end...	4.2 Medium	—	0,21%	6 Agt 2026
CVE-2026-3418 The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary...	9.1 Critical	—	0,76%	6 Agt 2026
CVE-2026-3415 The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser...	8.7 High	—	0,49%	6 Agt 2026
CVE-2026-19177 google chrome Insufficient validation of untrusted input in UI in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentiall...	8.3 High	—	0,32%	6 Agt 2026
CVE-2026-19176 google chrome Use after free in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sand...	7.5 High	—	0,53%	6 Agt 2026
CVE-2026-19175 google chrome Use after free in Payments in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium s...	9.6 Critical	—	0,35%	6 Agt 2026
CVE-2026-1289 autodesk revit A maliciously crafted PDF file, when parsed through Autodesk Revit, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a...	7.8 High	—	0,19%	6 Agt 2026
CVE-2026-19174 google chrome Integer overflow in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium se...	8.8 High	—	0,41%	6 Agt 2026
CVE-2026-19173 google chrome Out of bounds write in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox e...	8.3 High	—	0,34%	6 Agt 2026
CVE-2026-19172 google chrome Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escap...	8.3 High	—	0,30%	6 Agt 2026
CVE-2026-19171 google chrome Use after free in Media in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Ch...	9.6 Critical	—	0,35%	6 Agt 2026
CVE-2026-19170 google chrome Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Ch...	9.6 Critical	—	0,35%	6 Agt 2026
CVE-2026-19169 google chrome Insufficient validation of untrusted input in Contextual Tasks in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to perform privilege escalation via a cr...	8.8 High	—	0,35%	6 Agt 2026
CVE-2026-19168 google chrome Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page....	8.8 High	—	0,41%	6 Agt 2026
CVE-2026-19167 google chrome Integer overflow in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafte...	3.1 Low	—	0,23%	6 Agt 2026
CVE-2026-19166 google chrome Use after free in Web Authentication in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (...	9.6 Critical	—	0,39%	6 Agt 2026
CVE-2026-19165 google chrome Use after free in Extensions in Google Chrome prior to 151.0.7922.109 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code...	7.5 High	—	0,27%	6 Agt 2026
CVE-2026-19164 google chrome Insufficient validation of untrusted input in Codecs in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a craf...	9.6 Critical	—	0,35%	6 Agt 2026
CVE-2026-19163 google chrome Use after free in Media in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sa...	8.3 High	—	0,30%	6 Agt 2026
CVE-2026-19162 google chrome Out of bounds write in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium...	8.8 High	—	0,41%	6 Agt 2026
CVE-2026-19161 google chrome Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a craf...	3.1 Low	—	0,34%	6 Agt 2026
CVE-2026-19160 google chrome Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a craf...	3.1 Low	—	0,40%	6 Agt 2026
CVE-2026-19159 google chrome Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit h...	7.5 High	—	0,30%	6 Agt 2026
CVE-2026-19158 google chrome Use after free in Views in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentiall...	7.5 High	—	0,30%	6 Agt 2026
CVE-2026-19157 google chrome Out of bounds write in ANGLE in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page...	9.6 Critical	—	0,38%	6 Agt 2026
CVE-2026-19156 google chrome Heap buffer overflow in Base in Google Chrome prior to 151.0.7922.109 allowed an attacker who convinced a user to install a malicious extension to potentially exploit hea...	7.5 High	—	0,25%	6 Agt 2026
CVE-2026-19155 google chrome Use after free in Payments in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox es...	8.3 High	—	0,30%	6 Agt 2026
CVE-2026-19154 google chrome Use after free in Skia in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a san...	8.3 High	—	0,35%	6 Agt 2026
CVE-2026-19153 google chrome Insufficient validation of untrusted input in Workers in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to bypas...	8.1 High	—	0,33%	6 Agt 2026
CVE-2026-19152 google chrome Insufficient policy enforcement in Navigation in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially p...	8.3 High	—	0,30%	6 Agt 2026
CVE-2026-19151 google chrome Use after free in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium secu...	8.8 High	—	0,41%	6 Agt 2026
CVE-2026-19150 google chrome Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page....	8.8 High	—	0,41%	6 Agt 2026
CVE-2026-19149 google chrome Use after free in Aura in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chrom...	9.6 Critical	—	0,35%	6 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.