Katalog CVE (hal. 101)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 258.834 (Critical 35.935 · High 103.510 · KEV 1.746 · sejak 2020) · Pembaruan terakhir: 16 Okt 2026, 06:27 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 5.001–5.050 dari 258.834 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-62028 Missing Authorization vulnerability in bPlugins Before After Image Comparison – Image comparison for WP before-after-image-compare allows Exploiting Incorrectly Configure...	5.4 Medium	—	0,14%	9 Okt 2026
CVE-2026-106602 Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue affects Jetpack: fro...	4.8 Medium	—	0,18%	9 Okt 2026
CVE-2026-106601 Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue affects Jetpack: fro...	5.4 Medium	—	0,18%	9 Okt 2026
CVE-2026-105883 Missing Authorization vulnerability in ThemeHunk Th Shop Mania th-shop-mania allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Th...	7.1 High	—	0,18%	9 Okt 2026
CVE-2026-105877 Insertion of Sensitive Information Into Sent Data vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Retrieve Embedded Sensitive Data.This issue affects QA...	6.9 Medium	—	0,25%	9 Okt 2026
CVE-2026-105872 Deserialization of Untrusted Data vulnerability in mklacroix Product Configurator for WooCommerce product-configurator-for-woocommerce allows Object Injection.This issue...	7.2 High	—	0,30%	9 Okt 2026
CVE-2026-105870 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Delight Star Inc. WP Associate Post R2 wp-associate-post-r2 allows R...	7.1 High	—	0,15%	9 Okt 2026
CVE-2026-105318 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Datasolution AcyMailing SMTP Newsletter acymailing allows Reflected...	7.1 High	—	0,15%	9 Okt 2026
CVE-2026-104392 Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master:...	8.8 High	—	0,29%	9 Okt 2026
CVE-2026-104079 Envira Gallery Lite before 1.16.2 contains a missing authorization vulnerability in its gallery conversion REST endpoint that allows lower-privileged authenticated users...	4.3 Medium	—	0,19%	9 Okt 2026
CVE-2026-103413 Improper input validation vulnerability in Apache Camel Karavan. When a deployment was started, Karavan unmarshalled a project's `kubernetes.yaml` and applied every re...	8.8 High	—	0,39%	9 Okt 2026
CVE-2026-103412 Improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Apache Camel Karavan. A project file name supplied through the project...	8.8 High	—	0,52%	9 Okt 2026
CVE-2026-103220 The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing raster image data in Affinity document files,...	4.5 Medium	—	0,12%	9 Okt 2026
CVE-2026-101130 The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing arrays of strings in Affinity document files,...	3.6 Low	—	0,12%	9 Okt 2026
CVE-2026-101094 The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle incomplete UTF-8 character sequences when parsing text in Affinity document...	3.6 Low	—	0,12%	9 Okt 2026
CVE-2026-89235 The Testimonials by BestWebSoft WordPress plugin through 1.0.8 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers...	6.8 Medium	—	0,22%	9 Okt 2026
CVE-2026-87846 The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform any authorisation, nonce or ownership checks on one of its AJAX actions available to unauthe...	5.3 Medium	—	0,18%	9 Okt 2026
CVE-2026-86851 The Livees Checkout WordPress plugin through 7.0.2 does not perform any capability, nonce or order-key check before acting on request parameters on the order confirmation...	6.5 Medium	—	0,16%	9 Okt 2026
CVE-2026-85348 The GDPR Data Request Form WordPress plugin through 1.7.1 does not have CSRF protection when updating one of its settings, allowing attackers to change that setting via a...	4.3 Medium	—	0,10%	9 Okt 2026
CVE-2026-62042 Missing Authorization vulnerability in unFocus Projects Scripts n Styles scripts-n-styles allows Exploiting Incorrectly Configured Access Control Security Levels.This iss...	5.3 Medium	—	0,19%	9 Okt 2026
CVE-2026-62041 Missing Authorization vulnerability in Ashok Dudhat WP Event Manager wp-event-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a...	5.4 Medium	—	0,14%	9 Okt 2026
CVE-2026-62040 Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-access allows Exploiting Incorrectly Configured Acc...	5.3 Medium	—	0,19%	9 Okt 2026
CVE-2026-62039 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Html5 Audio Player html5-audio-player allows Stored XSS.Thi...	6.5 Medium	—	0,13%	9 Okt 2026
CVE-2026-62036 Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in AREOI All Bootstrap Blocks all-bootstrap-blocks allows Retrieve Embedded Sensi...	4.3 Medium	—	0,18%	9 Okt 2026
CVE-2026-39779 Missing Authorization vulnerability in Asgaros Asgaros Forum asgaros-forum allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Asga...	4.3 Medium	—	0,16%	9 Okt 2026
CVE-2026-107419 Missing Authorization vulnerability in Cool Plugins AI Translation for Polylang automatic-translations-for-polylang allows Exploiting Incorrectly Configured Access Contro...	5.4 Medium	—	0,17%	9 Okt 2026
CVE-2026-103329 The Super Payments WordPress plugin before 1.43.1 does not properly verify the authenticity of incoming payment webhook notifications, as the signing key used to validate...	5.3 Medium	—	0,13%	9 Okt 2026
CVE-2026-97791 In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was stored in one o...	7.5 High	—	0,17%	9 Okt 2026
CVE-2026-97468 Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens under a non-cryptographic 32-bit hash of the token (Java Arrays.hashCode/...	9.1 Critical	—	0,17%	9 Okt 2026
CVE-2026-86463 Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pattern can get stuck trying many combinations when i...	7.5 High	—	0,16%	9 Okt 2026
CVE-2026-79650 Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after successful authentication. The issue occurs because attacker-controlled...	6.1 Medium	—	0,19%	9 Okt 2026
CVE-2026-78384 CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no output-size cap. A small (~KB) crafted payload could expand to gigabytes on the heap. Rea...	7.5 High	—	0,16%	9 Okt 2026
CVE-2026-73179 Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multip...	8.1 High	—	0,22%	9 Okt 2026
CVE-2026-71575 The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity....	9.1 Critical	—	0,23%	9 Okt 2026
CVE-2026-108039 By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large request could therefore use a lot...	7.5 High	—	0,17%	9 Okt 2026
CVE-2026-107938 In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not verify that the hostname in the server’s TLS certificate matched the ho...	9.1 Critical	—	0,11%	9 Okt 2026
CVE-2026-107937 In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size (default 300 characters) and attachme...	7.5 High	—	0,24%	9 Okt 2026
CVE-2026-100227 Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module. The JAX-RS XML Signature interceptors (XmlSigInHandler, XmlSigI...	7.5 High	—	0,17%	9 Okt 2026
CVE-2026-96809 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MultiNet Interactive AB EduAdmin Booking eduadmin-booking allows Bli...	9.3 Critical	—	0,24%	9 Okt 2026
CVE-2026-96761 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Welcart Welcart e-Commerce usc-e-shop allows Reflected XSS.This issu...	7.1 High	—	0,14%	9 Okt 2026
CVE-2026-96671 Cross-Site Request Forgery (CSRF) vulnerability in fifu.app Featured Image from URL featured-image-from-url allows Cross Site Request Forgery.This issue affects Featured...	8.8 High	—	0,13%	9 Okt 2026
CVE-2026-96607 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Reflected X...	7.1 High	—	0,14%	9 Okt 2026
CVE-2026-96553 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Damian Góra FiboSearch ajax-search-for-woocommerce allows Reflected...	7.1 High	—	0,15%	9 Okt 2026
CVE-2026-96539 Incorrect Privilege Assignment vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a t...	5.6 Medium	—	0,15%	9 Okt 2026
CVE-2026-96518 Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec...	5.9 Medium	—	0,18%	9 Okt 2026
CVE-2026-96461 Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/...	7.5 High	—	0,20%	9 Okt 2026
CVE-2026-96337 Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec...	6.5 Medium	—	0,17%	9 Okt 2026
CVE-2026-96336 Authentication Bypass by Spoofing vulnerability in WPMU DEV Forminator forminator allows Identity Spoofing.This issue affects Forminator: from n/a through 1.57.2.	7.5 High	—	0,27%	9 Okt 2026
CVE-2026-96334 Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a...	5.6 Medium	—	0,15%	9 Okt 2026
CVE-2026-96333 Authentication Bypass by Spoofing vulnerability in Liquid Web / StellarWP GiveWP give allows Identity Spoofing.This issue affects GiveWP: from n/a through 4.16.8.1.	7.5 High	—	0,27%	9 Okt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.