Katalog CVE (hal. 963)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 267.603 (Critical 36.783 · High 106.969 · KEV 1.767 · sejak 2020) · Pembaruan terakhir: 4 Nov 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 48.101–48.150 dari 267.603 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-15777 google chrome Use after free in UI in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exp...	7.5 High	—	0,30%	14 Jul 2026
CVE-2026-15776 google chrome Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page....	8.8 High	—	0,50%	14 Jul 2026
CVE-2026-15775 google chrome Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium secu...	6.5 Medium	—	0,24%	14 Jul 2026
CVE-2026-15774 google chrome Use after free in Skia in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape...	8.3 High	—	0,29%	14 Jul 2026
CVE-2026-15773 google chrome Use after free in Core in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chr...	9.6 Critical	—	0,35%	14 Jul 2026
CVE-2026-15772 google chrome Use after free in GPU in Google Chrome on Android prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to potentially perform a sand...	8.3 High	—	0,30%	14 Jul 2026
CVE-2026-15771 google chrome Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process...	5.3 Medium	—	0,30%	14 Jul 2026
CVE-2026-15770 google chrome Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted H...	6.5 Medium	—	0,35%	14 Jul 2026
CVE-2026-15769 google chrome Insufficient validation of untrusted input in Linux Toolkit Theming in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who had compromised the re...	8.3 High	—	0,32%	14 Jul 2026
CVE-2026-15768 google chrome Insufficient policy enforcement in HTML-in-Canvas in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass same origin policy via a crafted HTML page....	6.5 Medium	—	0,24%	14 Jul 2026
CVE-2026-15767 google chrome Heap buffer overflow in libyuv in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted vide...	8.8 High	—	0,42%	14 Jul 2026
CVE-2026-15766 google chrome Uninitialized Use in Skia in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted...	6.5 Medium	—	0,40%	14 Jul 2026
CVE-2026-15765 google chrome Use after free in Ozone in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit h...	7.5 High	—	0,30%	14 Jul 2026
CVE-2026-15764 google chrome Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially...	7.5 High	—	0,30%	14 Jul 2026
CVE-2026-15749 A security flaw has been discovered in mastergo-design mastergo-magic-mcp up to 0.2.0. This issue affects the function execute of the file src/tools/get-c2d.ts of the com...	5.3 Medium	—	0,17%	14 Jul 2026
CVE-2026-15738 Incorrect behavior order in the Gateway API listener-rule generation in Amazon AWS Load Balancer Controller before 3.4.2 might allow an authenticated remote user to inter...	8.5 High	—	0,65%	14 Jul 2026
CVE-2026-15643 AWS HealthLake MCP Server (awslabs.healthlake-mcp-server) is a Model Context Protocol server that enables AI assistants to interact with AWS HealthLake FHIR datastores. A...	7.3 High	—	0,39%	14 Jul 2026
CVE-2026-53633 Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chrome DevTools...	9.8 Critical	—	0,90%	14 Jul 2026
CVE-2026-50659 microsoft .net framework, microsoft .net +2 lainnya Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network.	6.5 Medium	—	0,74%	14 Jul 2026
CVE-2026-50651 microsoft .net, microsoft visual studio 2022 +1 lainnya Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.	7.5 High	—	1,2%	14 Jul 2026
CVE-2026-50650 microsoft .net framework, microsoft .net Improper control of generation of code ('code injection') in .NET Framework allows an unauthorized attacker to elevate privileges locally.	7.8 High	—	0,46%	14 Jul 2026
CVE-2026-50649 microsoft .net framework, microsoft .net +1 lainnya Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.	7.8 High	—	4,0%	14 Jul 2026
CVE-2026-50648 microsoft .net framework, microsoft .net +2 lainnya Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attacker to deny service over a network.	7.5 High	—	1,2%	14 Jul 2026
CVE-2026-50646 microsoft .net framework, microsoft .net +2 lainnya Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally.	7.8 High	—	4,0%	14 Jul 2026
CVE-2026-50528 microsoft .net, microsoft visual studio 2022 +1 lainnya Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network.	8.2 High	—	0,61%	14 Jul 2026
CVE-2026-50527 microsoft .net framework, microsoft .net +2 lainnya Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a network.	7.5 High	—	1,2%	14 Jul 2026
CVE-2026-50526 microsoft .net, microsoft visual studio 2022 +1 lainnya Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tampering locally.	5.5 Medium	—	0,22%	14 Jul 2026
CVE-2026-50525 microsoft .net framework, microsoft .net +2 lainnya Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.	7.5 High	—	1,2%	14 Jul 2026
CVE-2026-50524 microsoft .net, microsoft visual studio 2022 +1 lainnya Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network.	7.5 High	—	1,2%	14 Jul 2026
CVE-2026-48784 sensiolabs symfony Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, UrlGenerator::doGenerate()...	6.1 Medium	—	0,35%	14 Jul 2026
CVE-2026-48761 sensiolabs symfony Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlAttributeSanitizer::getS...	6.1 Medium	—	0,35%	14 Jul 2026
CVE-2026-48760 sensiolabs symfony Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlSanitizer::parse() rejec...	6.1 Medium	—	0,34%	14 Jul 2026
CVE-2026-48747 sensiolabs symfony Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.13 and 8.0.13, MailomatRequestParser::validateSignature() p...	5.3 Medium	—	0,25%	14 Jul 2026
CVE-2026-48736 sensiolabs symfony Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.0 to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, NoPrivateNetworkHttpCl...	8.6 High	—	0,57%	14 Jul 2026
CVE-2026-48489 sensiolabs symfony Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, DefaultAuthenticationFailur...	7.5 High	—	0,60%	14 Jul 2026
CVE-2026-48371 adobe commerce Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnera...	5.4 Medium	—	0,39%	14 Jul 2026
CVE-2026-48359 adobe experience manager Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution in th...	9.6 Critical	—	1,0%	14 Jul 2026
CVE-2026-48358 adobe commerce Adobe Commerce is affected by an Improper Encoding or Escaping of Output vulnerability that could result in arbitrary code execution in the context of the current user. A...	9.1 Critical	—	1,2%	14 Jul 2026
CVE-2026-48356 adobe commerce Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current...	9.3 Critical	KEV	44,6%	14 Jul 2026
CVE-2026-48355 adobe experience manager Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts in...	5.4 Medium	—	0,39%	14 Jul 2026
CVE-2026-48350 adobe animate Animate is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in th...	8.6 High	—	0,33%	14 Jul 2026
CVE-2026-48349 adobe animate Animate is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on condi...	8.1 High	—	0,24%	14 Jul 2026
CVE-2026-48348 adobe animate Animate is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on condi...	7.7 High	—	0,22%	14 Jul 2026
CVE-2026-48347 adobe animate Animate is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code exe...	7.7 High	—	0,72%	14 Jul 2026
CVE-2026-48346 adobe animate Animate is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue...	7.9 High	—	0,26%	14 Jul 2026
CVE-2026-48345 adobe animate Animate is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code exe...	8.2 High	—	0,89%	14 Jul 2026
CVE-2026-48310 adobe experience manager Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file...	8.6 High	—	1,0%	14 Jul 2026
CVE-2026-48263 adobe experience manager Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts in...	5.4 Medium	—	0,39%	14 Jul 2026
CVE-2026-48262 adobe experience manager Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to...	5.4 Medium	—	0,36%	14 Jul 2026
CVE-2026-48261 adobe experience manager Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to...	5.4 Medium	—	0,36%	14 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.