Katalog CVE (hal. 216)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 259.509 (Critical 35.989 · High 103.743 · KEV 1.747 · sejak 2020) · Pembaruan terakhir: 19 Okt 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 10.751–10.800 dari 259.509 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-96526 The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes, allowing users with t...	2.7 Low	—	0,19%	26 Sep 2026
CVE-2026-96525 The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an ownership or sufficient capability check on its workflow create, update and delete REST ro...	2.7 Low	—	0,17%	26 Sep 2026
CVE-2026-96524 The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests when a condition an a...	8.8 High	—	0,14%	26 Sep 2026
CVE-2026-92411 The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied recipe block data before rendering it on the front...	6.8 Medium	—	0,24%	26 Sep 2026
CVE-2026-89237 The Bluff Post WordPress plugin through 1.1.1 does not sanitise and escape parameters before using them as identifiers in a SQL query, allowing unauthenticated attackers...	6.8 Medium	—	0,22%	26 Sep 2026
CVE-2026-85081 The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate th...	7.5 High	—	0,22%	26 Sep 2026
CVE-2026-84097 The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a capability check, before using i...	6.5 Medium	—	0,22%	26 Sep 2026
CVE-2026-84096 The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on the AJAX handler that saves its review submission forms, and the nonce pro...	8.0 High	—	0,23%	26 Sep 2026
CVE-2026-84095 The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on one of its AJAX handlers, and the nonce protecting it is generated for eve...	8.0 High	—	0,23%	26 Sep 2026
CVE-2026-19708 The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated users from downloading its database backup archives, and in some cases writes them under a...	5.9 Medium	—	0,22%	26 Sep 2026
CVE-2026-18143 The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the `afrfq_submit_quote_vi...	9.8 Critical	—	1,7%	26 Sep 2026
CVE-2026-16591 The WP Directory Kit WordPress plugin before 1.5.8 does not sanitize and escape some of its category and location fields before outputting them in page attributes, allowi...	7.2 High	—	0,30%	26 Sep 2026
CVE-2026-11871 The Team Members WordPress plugin before 9.3 does not perform any authorization or visibility check in an unauthenticated AJAX action that returns full team member record...	5.3 Medium	—	0,21%	26 Sep 2026
CVE-2026-15273 The Automatic.css plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI in all version 4.0.0 due to insufficient input sanitization and output...	6.4 Medium	—	0,22%	26 Sep 2026
CVE-2026-100599 OpenClaw versions 2026.5.1 through 2026.7.0 fail to apply the configured exec approval path to Google Meet node commands. The googlemeet.chrome command accepts caller-sup...	8.8 High	—	0,31%	26 Sep 2026
CVE-2026-100598 OpenClaw (npm package openclaw) before 2026.7.1 incorrectly binds Signal approval reactions. In affected versions, a reaction intended to resolve a structured approval re...	7.1 High	—	0,11%	26 Sep 2026
CVE-2026-100597 OpenClaw (npm package 'openclaw') before 2026.7.1 is vulnerable to a time-of-check time-of-use race condition in OpenShell local mirror filesystem mutation operations. Th...	7.8 High	—	0,08%	26 Sep 2026
CVE-2026-100596 OpenClaw versions before 2026.7.1 fail to properly authorize non-owner users executing MCP configuration changes through /mcp set and /mcp unset commands. Attackers can p...	8.8 High	—	0,25%	26 Sep 2026
CVE-2026-100595 OpenClaw versions before 2026.7.1 contain an authorization bypass vulnerability in the diagnostics export command that allows non-owner channel senders to access owner-on...	6.5 Medium	—	0,24%	26 Sep 2026
CVE-2026-100594 OpenClaw versions before 2026.7.1 contain an authorization bypass vulnerability in the /export-trajectory endpoint that allows non-owner senders to request and receive ow...	6.5 Medium	—	0,24%	26 Sep 2026
CVE-2026-100593 OpenClaw (npm package `openclaw`) before 2026.7.1 does not enforce the documented owner-only requirement for persistent `/activation` policy changes in group channels. An...	5.4 Medium	—	0,14%	26 Sep 2026
CVE-2026-100592 OpenClaw is an agent gateway distributed via npm. In versions >= 2026.4.10 and < 2026.7.1, persistent memory dreaming mutations omit owner permission checks. An authorize...	6.3 Medium	—	0,16%	26 Sep 2026
CVE-2026-100591 OpenClaw is an npm-distributed agent gateway. In versions before 2026.7.1, the global Active Memory toggle mutations could omit owner checks. An authorized non-owner exte...	6.3 Medium	—	0,16%	26 Sep 2026
CVE-2026-100590 OpenClaw before 2026.7.1 contains an authorization bypass vulnerability in the /voice set command that allows non-owner external-channel senders to persist Gateway voice...	4.3 Medium	—	0,18%	26 Sep 2026
CVE-2026-100589 OpenClaw versions before 2026.7.1 contain a sandbox bypass vulnerability in the browser tool that allows sandboxed sessions to access paired node browser actions despite...	8.3 High	—	0,32%	26 Sep 2026
CVE-2026-100588 OpenClaw (npm package 'openclaw') before 2026.7.1 does not enforce the administrator scope requirement on browser control when it is reached through the node.invoke metho...	8.3 High	—	0,30%	26 Sep 2026
CVE-2026-100587 OpenClaw versions before 2026.7.1 fail to properly validate owner authorization in the Codex computer-use installation command. Non-owner channel senders can install arbi...	8.8 High	—	0,25%	26 Sep 2026
CVE-2026-100586 OpenClaw Codex before 2026.7.1 fails to properly enforce owner authorization when creating native conversation bindings. Non-owner channel senders with command access can...	8.8 High	—	0,25%	26 Sep 2026
CVE-2026-100585 OpenClaw (npm package `openclaw`) before 2026.7.1 fails to enforce the owner-only authorization requirement for Claude Code permission prompts delivered through the MCP c...	8.0 High	—	0,19%	26 Sep 2026
CVE-2026-100584 OpenClaw is an npm-distributed agent runtime. In versions >= 2026.2.26 and < 2026.7.1, PowerShell command analysis on Windows hosts running in exec allowlist mode could a...	6.7 Medium	—	0,10%	26 Sep 2026
CVE-2026-100583 OpenClaw Discord versions before 2026.7.1 contain an authorization bypass vulnerability in guild metadata read actions that allows lower-trust senders to retrieve informa...	4.3 Medium	—	0,18%	26 Sep 2026
CVE-2026-100582 OpenClaw channel plugins (@openclaw/msteams, @openclaw/feishu, @openclaw/matrix, and @openclaw/googlechat) before 2026.8.1 do not enforce the configured channel read allo...	6.5 Medium	—	0,21%	26 Sep 2026
CVE-2026-100581 OpenClaw for iOS before 2026.8.11 stores Gateway credentials as cleartext JSON in App Group UserDefaults instead of the device Keychain. Attackers with access to unencryp...	5.5 Medium	—	0,08%	26 Sep 2026
CVE-2026-100580 OpenClaw (npm package 'openclaw') before 2026.7.1 improperly handles case sensitivity in the model-facing cron tool: a mixed-case payload kind can pass the agent-facing s...	8.8 High	—	0,34%	26 Sep 2026
CVE-2026-100579 OpenClaw (npm package 'openclaw') before 2026.7.1 incorrectly trusts requester provenance in message.action. In identity-bearing Gateway deployments (authentication modes...	7.6 High	—	0,23%	26 Sep 2026
CVE-2026-100578 OpenClaw (npm package `openclaw`) before 2026.7.1 fails to restrict owner-only infrastructure tools exposed through the chat.send endpoint. In Gateway deployments using a...	7.6 High	—	0,23%	26 Sep 2026
CVE-2026-100577 OpenClaw versions before 2026.8.1 fail to validate video asset URLs returned by providers, allowing server-side requests to private destinations. A malicious or compromis...	6.3 Medium	—	0,14%	26 Sep 2026
CVE-2026-100576 OpenClaw versions before 2026.8.1 contain a server-side request forgery vulnerability in browser wait predicates that allows attackers to bypass SSRF protections by reach...	5.4 Medium	—	0,21%	26 Sep 2026
CVE-2026-100575 OpenClaw Slack versions before 2026.8.1 fail to properly enforce sender allowlists in multi-person direct messages. Disallowed participants can trigger Slack agents and a...	8.8 High	—	0,26%	26 Sep 2026
CVE-2026-100574 OpenClaw (npm package 'openclaw') before 2026.8.1 contains a server-side request forgery vulnerability in its trusted-host DNS checks. For fetches that use the trusted-ho...	5.9 Medium	—	0,23%	26 Sep 2026
CVE-2026-100573 OpenClaw versions before 2026.8.1 contain a sandbox policy bypass vulnerability in the MCP loopback component that allows sandboxed coding-agent sessions to invoke tools...	3.3 Low	—	0,11%	26 Sep 2026
CVE-2026-100572 OpenClaw versions >= 2026.3.25 and < 2026.8.1 apply invalid-token rate limiting for Synology Chat webhooks before authentication and key the limit on the raw proxy socket...	5.3 Medium	—	0,35%	26 Sep 2026
CVE-2026-100571 OpenClaw (npm package 'openclaw') versions >= 2026.6.6 and < 2026.8.1 apply the SMS webhook invalid-request rate limit before Twilio signature verification and identify c...	5.3 Medium	—	0,35%	26 Sep 2026
CVE-2026-100570 OpenClaw (npm package 'openclaw') versions >= 2026.3.28 and < 2026.8.1 allow an untrusted workspace .env file to set the CLOUDSDK_PYTHON_ARGS environment variable. When a...	7.8 High	—	0,13%	26 Sep 2026
CVE-2026-100569 OpenClaw is an npm-distributed application. In versions >= 2026.4.25 and < 2026.8.1, the workspace environment-variable filter did not block variables ending in `_ENDPOIN...	5.5 Medium	—	0,12%	26 Sep 2026
CVE-2026-100568 OpenClaw versions before 2026.8.1 fail to properly restrict access to operator command cron jobs, allowing model-visible agent callers to read and execute ownerless comma...	8.3 High	—	0,25%	26 Sep 2026
CVE-2026-100567 OpenClaw is an agent gateway distributed as the npm package 'openclaw'. In versions >= 2026.4.5 and < 2026.8.1, the Gateway validated a single DNS resolution result for a...	8.2 High	—	0,25%	26 Sep 2026
CVE-2026-100566 OpenClaw LINE versions before 2026.8.1 contain an access control vulnerability where group allowlist mode silently inherits DM allowFrom values when groupAllowFrom is not...	6.5 Medium	—	0,20%	26 Sep 2026
CVE-2026-100564 OpenClaw versions before 2026.8.1 fail to neutralize spreadsheet formula characters in participant display names within attendance CSV exports. Attackers can inject formu...	5.4 Medium	—	0,19%	26 Sep 2026
CVE-2026-100563 OpenClaw (npm package `openclaw`) before 2026.8.1 does not neutralize leading characters that spreadsheet applications interpret as formulas when the Control UI exports s...	5.4 Medium	—	0,19%	26 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.