Katalog CVE (hal. 241)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 259.544 (Critical 35.992 · High 103.748 · KEV 1.747 · sejak 2020) · Pembaruan terakhir: 19 Okt 2026, 12:28 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 12.001–12.050 dari 259.544 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-12370 ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager versions 12.8.667 and below were vulnerable to a Server-Side Template Injection vulne...	7.6 High	—	1,5%	23 Sep 2026
CVE-2026-96456 The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in...	6.3 Medium	—	0,16%	23 Sep 2026
CVE-2026-96455 The Reachy Mini daemon exposes an HTTP API for managing the robot. Its app installation endpoint, POST /apps/install in src/reachy_mini/daemon/app/routers/apps.py, has no...	8.8 High	—	0,17%	23 Sep 2026
CVE-2026-96442 A code execution flaw was found in Emacs, affecting versions prior to 31.2. The Flymake mode using language backends other than Lisp would execute arbitrary code from the...	7.8 High	—	0,17%	23 Sep 2026
CVE-2026-90950 The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not verify the reCAPTCHA on its registration handler when a form field is absent from the request, al...	5.3 Medium	—	0,21%	23 Sep 2026
CVE-2026-87978 The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its payment webhook, allowing unauthenticated attackers t...	5.3 Medium	—	0,11%	23 Sep 2026
CVE-2026-87848 The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authorisation or authentication on one of its AJAX actions available to unauthenticated users, no...	3.7 Low	—	0,20%	23 Sep 2026
CVE-2026-87071 The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which metadata keys a form submission may supply, and does not exclude the keys WordPress reserves...	5.3 Medium	—	0,19%	23 Sep 2026
CVE-2026-87070 The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before preferring client-supplied forwarding headers over t...	5.3 Medium	—	0,12%	23 Sep 2026
CVE-2026-86612 The Ninja Tables WordPress plugin before 5.2.17 does not restrict shortcode expansion to administrator-authored table rows which, in a non-default configuration, allows u...	5.6 Medium	—	0,17%	23 Sep 2026
CVE-2026-86604 The GTranslate WordPress plugin before 5.0.1 does not remove shortcodes from the content of outgoing emails before expanding them which, in a non-default configuration, a...	4.8 Medium	—	0,15%	23 Sep 2026
CVE-2026-86601 The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metadata, allowi...	6.5 Medium	—	0,18%	23 Sep 2026
CVE-2026-5696 Reflected Cross-Site Scripting (XSS) in Microweber. The vulnerability lies in the ‘group’ parameter of the ‘/admin/settings’ endpoint in the administration panel. A succe...	5.9 Medium	—	0,31%	23 Sep 2026
CVE-2026-5695 Arbitrary file upload vulnerability due to a lack of proper validation in upload forms. This allows authenticated users to upload files to the server without restrictions...	8.4 High	—	0,30%	23 Sep 2026
CVE-2026-96454 Pake turns a website into a desktop application built on Tauri. Every application it generates inherits two settings from the upstream template, and together they hand na...	8.2 High	—	0,34%	23 Sep 2026
CVE-2026-96443 Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution on the FE.	6.5 Medium	—	0,34%	23 Sep 2026
CVE-2026-95627 When a Tauri application uses the dialog plugin's file or folder picker, an attacker with JavaScript execution (XSS) can force the scope expansion to be recursive, granti...	7.7 High	—	0,20%	23 Sep 2026
CVE-2026-95626 Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob:...	8.3 High	—	0,28%	23 Sep 2026
CVE-2026-94251 apache sling security A vulnerability in Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource This issue affects Apache Sling Security Bu...	6.5 Medium	—	0,40%	23 Sep 2026
CVE-2026-94243 apache sling security A vulnerability in Apache Sling Security Bundle: the ReferrerFilter accepts weaker-than-orgin evidence. This issue affects Apache Sling Security Bundle: before 1.3.2....	7.3 High	—	0,24%	23 Sep 2026
CVE-2026-92001 apache sling xss protection api Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4...	6.1 Medium	—	0,35%	23 Sep 2026
CVE-2026-91999 apache sling xss protection api Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4...	6.1 Medium	—	0,35%	23 Sep 2026
CVE-2026-91928 apache sling xss protection api Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4...	6.1 Medium	—	0,35%	23 Sep 2026
CVE-2026-91852 apache sling xss protection api Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4...	6.1 Medium	—	0,47%	23 Sep 2026
CVE-2026-79616 Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path.	0.6 Low	—	0,11%	23 Sep 2026
CVE-2026-73192 apache sling xss protection api An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability when using the XSSAPI.getValidHref() in Apache Sling XSS ve...	6.1 Medium	—	0,35%	23 Sep 2026
CVE-2026-95625 The Tauri updater plugin verifies update binaries using minisign signatures, but the signature covers only the raw binary bytes. The update manifest -- which contains the...	5.9 Medium	—	0,16%	23 Sep 2026
CVE-2026-93368 The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' (Username) Parameter in all versions up to, and incl...	7.5 High	—	0,30%	23 Sep 2026
CVE-2026-42801 NULL pointer dereference vulnerability in ASR Crane，Falcon on Linux (as_rrc module) allows Pointer Manipulation. This vulnerability is associated with program file 3g.m...	7.4 High	—	0,21%	23 Sep 2026
CVE-2026-31377 An Improper Authentication vulnerability in the Apache Doris Frontend (FE) meta service allows an unauthenticated remote attacker to access internal metadata service endp...	7.5 High	—	0,54%	23 Sep 2026
CVE-2026-15027 CGServiSign developed by Changing has a OS Command Injection vulnerability. Unauthenticated remote attackers can induce victims to visit a malicious web page and inject a...	8.8 High	—	3,2%	23 Sep 2026
CVE-2026-92378 A session management vulnerability exists in the Legacy UI Reduced Function Login feature of NT-ware uniFLOW Online. Under specific timing conditions during Service Offli...	4.1 Medium	—	0,12%	23 Sep 2026
CVE-2026-91818 foxit pdf editor, foxit pdf reader A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s JavaScript handling of PDF annotations. Reentrant page-event processing during annotation enumeration m...	5.5 Medium	—	0,11%	23 Sep 2026
CVE-2026-91817 foxit pdf editor, foxit pdf reader A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of wide strings in embedded PDF JavaScript. Insufficient validation of string-d...	6.1 Medium	—	0,11%	23 Sep 2026
CVE-2026-91816 foxit pdf editor, foxit pdf reader A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF annotations. Reentrant annotation deletion triggered by embedded JavaScript can cause t...	7.8 High	—	0,12%	23 Sep 2026
CVE-2026-91815 foxit pdf editor, foxit pdf reader Foxit PDF Editor/Reader does not perform sufficient verification of the JPEG2000 image metadata in the PDF file, which leads to out-of-bounds write in the heap buffer dur...	7.8 High	—	0,13%	23 Sep 2026
CVE-2026-91814 A signature validation vulnerability exists in Foxit PDF Editor/Reader’s handling of incrementally updated PDF documents. Changes to visible document content may not inva...	5.3 Medium	—	0,11%	23 Sep 2026
CVE-2026-91813 Advisory foxit pdf editor, foxit pdf reader A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows an update package to be replaced between download and high-privilege extraction due to insufficient f...	7.8 High	—	0,09%	23 Sep 2026
CVE-2026-91812 foxit pdf editor, foxit pdf reader A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows man-in-the-middle attackers to bypass certificate validation and package integrity checks, potentiall...	8.1 High	—	0,14%	23 Sep 2026
CVE-2026-91811 foxit pdf editor, foxit pdf reader A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s PRC parser due to insufficient validation of vertex indices in triangular fan texture m...	7.8 High	—	0,12%	23 Sep 2026
CVE-2026-91810 foxit pdf editor, foxit pdf reader A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF image masks. Inconsistent image metadata may cause incorrect a...	6.1 Medium	—	0,11%	23 Sep 2026
CVE-2026-91809 foxit pdf editor, foxit pdf reader A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF form fields. Improper validation during field-name traversal may cause the ap...	7.8 High	—	0,12%	23 Sep 2026
CVE-2026-91808 foxit pdf editor, foxit pdf reader A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor Reader’s handling of PDF image objects with inconsistent compression metadata. Insufficient valid...	6.1 Medium	—	0,11%	23 Sep 2026
CVE-2026-91807 foxit pdf editor, foxit pdf reader A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed image soft-mask data. Insufficient validation of the soft-mask dat...	6.1 Medium	—	0,11%	23 Sep 2026
CVE-2026-91806 foxit pdf editor, foxit pdf reader A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF form fields. Embedded JavaScript may access form-field references after the correspondi...	7.8 High	—	0,12%	23 Sep 2026
CVE-2026-91805 foxit pdf editor, foxit pdf reader A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s PDF page-tree handling. A specially crafted PDF can trigger page-structure changes during rendering, ca...	7.8 High	—	0,12%	23 Sep 2026
CVE-2026-91804 foxit pdf editor, foxit pdf reader A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s rendering of Circle annotations with malformed Cloudy appearance streams in specially c...	7.8 High	—	0,12%	23 Sep 2026
CVE-2026-91803 foxit pdf editor, foxit pdf reader A local privilege escalation vulnerability exists in the updater of Foxit PDF Editor/Reader due to unsafe loading of dynamic-link libraries from a user-writable directory...	7.8 High	—	0,12%	23 Sep 2026
CVE-2026-91802 foxit pdf editor, foxit pdf reader A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s WebP image decoding due to improper handling of bitmap stride and target buffer formats...	5.5 Medium	—	0,11%	23 Sep 2026
CVE-2026-91801 foxit pdf editor, foxit pdf reader A path traversal vulnerability exists in Foxit PDF Editor/Reader's handling of embedded PDF resources. Insufficient validation of resource file paths may allow files to b...	7.8 High	—	0,15%	23 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.